415 items

19minBleepingComputerNorway fines Microsoft ad firm $9.6 million over Grindr data sharing30minZscalerWhat's New in ZDX: Sharper Alerts, Cleaner Data, Faster Troubleshooting32minDark ReadingProminent Ransomware Negotiator Faces Extortion Charges32minCybersecurity DiveAhold Delhaize experiencing cybersecurity issue1hBleepingComputerYandex confirms service outage as users lose access to cloud files1hBleepingComputerAnthropic takes risky AI tests offline after models breach govt sites2hDark ReadingNo Identity, No Recovery: Cyber Resilience Starts With IAM2hZscalerFrom Solutions Engineer to Enterprise Account Executive2hCyberScoopIonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion2hZDNet SecurityClaude sent a false homicide tip to police – and it’s part of a troubling AI pattern3hThe Register SecurityChatbot refuseniks edge out users in the US, and they’re not for turning4hBleepingComputerLedger confirms spy chip implant behind wallet crypto thefts5hCybersecurity DiveCISA calls on Citrix NetScaler customers to patch as new flaws disclosed5hBleepingComputerCyberattack shuts down refrigerators at French supermarkets5hInfosecurityLuna Moth Leaks Shed Light on Ransomware Group's Inner Workings5hSchneier on SecurityFBI Arrests Suspect in FBI-Hacking Case5hCybersecurity DiveGitLab fixes critical vulnerability that exposed software environments to sabotage5hCheck Point Research12th October – Threat Intelligence Report5hCloudflareFilter, reshape, and redact logs before export with Transformers6hSecurityWeekIonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion6hBleepingComputerInside AvisLoader: A Windows Malware Loader Built to Resist Disruption6hThe Register SecurityUkrainian drone strikes on Yandex datacenters knock cloud and payments offline7hSecurityWeekBricksforge WordPress Plugin Vulnerability Exploited in the Wild7hZDNet SecurityGoogle’s new Fitbit Edge solves my biggest gripe with the Pixel Watch7hFederal News CyberCyber Leaders Exchange 2026: SentinelOne’s Ron Ringgold on combating “living off the land’ adversaries7hFederal News CyberCyber Leaders Exchange 2026: Cisco’s Norman St. Laurent on building a future-ready cyber workforce7hFederal News CyberCyber Leaders Exchange 2026: How to build a more skilled cybersecurity workforce7hFederal News CyberCyber Leaders Exchange 2026: Federal, industry cyber experts on critical infrastructure face growing cyber risks as IT and OT converge7hFederal News CyberCyber Leaders Exchange 2026: Revolutional’s Pete Harris on holding AI accountable7hFederal News CyberCyber Leaders Exchange 2026: Federal, industry experts on best defenses against AI attacks8hDark ReadingPassing the Baton: Dark Reading Names New Editor-in-Chief8hCSO OnlineThese ARE the droids you’re looking for8hCSO OnlineResearchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt8hThe RecordUkraine strikes third Yandex data center, disrupting digital services across Russia8hSecurityWeekCanonical Websites Disrupted in Second DDoS Attack This Year8hInfosecurityMajor French Supermarket Chains Hit by Cyber-Attack, Food Stock Impacted8hThe Hacker NewsBring Your Own Agent: Your Employees' Assistants Are Already Logged In9hSecurityWeekMastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US9hSecurityWeekiRhythm Data Breach Impacts at Least 360,000 People10hSecurityWeekRansomware Response Expert Arrested in ShinyHunters FBI Hack Probe10hThe Register SecurityImagine there's no Shiny Hunters – AI could make human hacking crews obsolete10hCyberScoopYour AI agent is only as safe as the packages it downloads10hInfosecurityNet Closes Around ShinyHunters with Another FBI Arrest11hInfosecurityMonths-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups11hCybersecurity DiveAI-driven security: Why agentic AI is changing cybersecurity11hInfosecurityKaraoke Giant Reveals Data Breach Impacting Eight Million12hCSO OnlineThe 7 biggest issues CISOs and security teams face today13hThe Hacker NewsCyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records15hHelp Net SecurityStrands Box: Open-source sandbox for AI agents16harXiv SecurityAn Exploration of Attacks on AI Agent Systems16harXiv SecurityHOMARD: Hammering Off-chip Memory via Aggregate power Rail Disclosure16harXiv SecurityCancerous Backdoor Attack: Gradual Activation via Invisible Tokens and A Stage Controller16harXiv SecurityEnabling Extended SGX Enclaves inside Confidential Virtual Machines16harXiv SecurityPVBRF-ID: Private, Verifiable and Byzantine-Robust Federated Intrusion Detection for Oilfield Enterprise Networks16harXiv SecurityPower, Performance, and Area of HPC-Based Malware Detectors: An FPGA and Open-PDK ASIC Study18hSANS ISCISC Stormcast For Monday, October 12th, 2026 https://isc.sans.edu/podcastdetail/10132, (Mon, Oct 12th)20hTLDR InfoSecTelegram 1Click Account Takeover 💬, Claude unintended actions 🤖, Ledger hardware implant 🔐20hElastic SecurityAuditing the auditor: Unmasking Apex Accelerator21hThe RecordCyberattack disrupts refrigeration at hundreds of French supermarkets1dThe Register SecurityAI systems are fully capable of carrying out nightmare attacks against infrastructure and nobody's ready2dNextgov CyberCybersecurity executive who helped hacking victims arrested on federal extortion charges2d0xdfHTB: DevHub2dCyberScoopCanadian cybersecurity executive arrested in federal extortion case2dThe MarkupWhat it takes for voters to be resilience against AI misinformation2dThe Hacker NewsP7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands2dThe Hacker NewsThe Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't2dThe Register SecurityTwo characters open up a world of typosquatting opportunities in Chromium browsers2dThe Hacker NewsAnthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws2dSANS ISCWhy TLP should not replace your internal information classification, (Sat, Oct 10th)2dZDNet SecurityRing’s new smart lock has a manual fallback that can’t lock you out – how it works2dSimon WillisonQuoting The New York Times2dKrebs on SecurityFBI Arrests Executive at Ransomware Negotiation Firm2dEFF DeeplinksResisting the Menace of Federal Data Consolidation2dDark ReadingASOS Breach Reveals the Risks in Customer-Facing SaaS3dSchneier on SecurityFriday Squid Blogging: I Caught a Squid3dDark ReadingAI Scramble Drives Cybersecurity M&A Boom3dThe Register SecurityAWS AgentCore security undone by prompt requesting credentials3dThe Hacker NewsCredential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories3dZDNet Security4 ways Amazon’s new Alexa tablets eclipse the Fire line – starting with Google Play3dThe RecordJapan confirms arrest of Russian Qilin operative, extradition to Germany3dCloudflareIntroducing Clef-omni with full multimodality, plus a faster Clef and a cheaper Clef-flash3dZDNet Security‘I use AI to do the things that I’m bad at’: Linus Torvalds on why it works for him3dDark ReadingWhat We Missed: FBI Strikes Back at ShinyHunters3dPraetorianHunt, Triage, and Act on Guard Findings in Slack3dNextgov CyberFBI arrests another ShinyHunters suspect after massive breach of employee data3dEFF DeeplinksOrganizing in the Town at Oakland Tech Week3dCSO OnlineLightwell project filters out 400 Java library vulnerabilities3dThe RecordHundreds of thousands impacted by data breach at biosensor firm iRhythm3dThe RecordLeader of vast money mule operation that laundered cybercriminal proceeds pleads guilty3dCSO OnlineRansomware consultant said he would decrypt data, is accused of paying ransoms instead3dCSO OnlineOpenAI reports three new incidents of misalignment3dSimon WillisonQuoting Matthew Green3dInfosecurityWikimedia Says Rogue AI Agents Abused its Platforms3dGraham Cluley$10 million bounty offered for Chinese Hafnium hacker accused of Microsoft Exchange Server mega-attack3dEFF DeeplinksTurkish Crackdown On LGBTQ+ Organizations Threatens Freedom of Expression and Association3dCybersecurity DiveFBI seizes domains linked to China-nexus botnet3dTechCrunch SecuritySurveillance company Flock cuts staff as privacy backlash grows3dCloudflareIntroducing on-demand CPU and memory profiling with flamegraphs for Workers and Durable Objects3dSimon WillisonA new feature for my blog, built using my voice3dCloudflareDeno is joining Cloudflare3dCybersecurity DiveAs frontier models go rogue, colleges beef up AI cybersecurity education3dRapid7Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules3dIndicatorBriefing: US interferes in the name of non-interference3dXBOWMicrosoft integration3dSANS ISCISC Stormcast For Friday, October 9th, 2026 https://isc.sans.edu/podcastdetail/10130, (Fri, Oct 9th)3dSimon Willisonttok 1.03dSpecterOpsWhat the 2026 Microsoft Digital Defense Report reveals about AI, identity, and the future of cybersecurity3dRecorded FutureRecorded Future Introduces AI Infrastructure Indicator Lists, Strengthening AI Governance3dTor ProjectA statement on the Tor Project's relationship with Mullvad3dTLDR InfoSecOracle Health 20M data leak 🏥, Cisco Nexus takeover 🔌, CIA Officer's $194M gold fraud 🪙3dSimon Willisonttok 0.43dZscalerClosing the Endpoint Zero Trust Gap3dZscalerNavigating Security in the Nordics and Baltics: Meet Annika Grönström3dCyberScoopLeader of 764 pleads guilty, faces up to 30 years in prison3dCyberScoopAnthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software3dMicrosoft SecurityPost-quantum authentication: Why organizations should start testing certificate ecosystems now4dCyberScoopDOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub4dEFF DeeplinksWhen No ID Means No Internet: Age Verification and the Right to Access Information4dNextgov CyberWatchdog to examine summertime hack of DHS information network, other incidents4dZscalerSuspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware4dZDNet SecurityGot a Microsoft 365 subscription? Your storage is about to shrink4dNextgov CyberFBI seizes websites supporting Chinese contractor’s hacking operations4dCisco TalosMaking sure the checks get printed4dSANS ISCReconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)4dReversingLabsWhat RL Found Before Anthropic’s Midnight Blizzard Report4dEFF DeeplinksIt's DAF Day! Wait...What's a DAF?4dZscalerPharma Is Building Again. It’s Time to Put Security in the Blueprints.4dTechCrunch SecurityAsos confirms breach of customer data after hackers send rogue app notification4dCitizen LabThe Secrets of a US Spyware King4dCloudflareBridging technical depth and usability: The story behind Radar’s redesign4dBitdefenderThe phone was compromised before the user turned it on: the rise of Midnight Mimosa4dTenableInside the Exchange Inspector: How Tenable uses OpenAI GPT cyber models to review open-source AI agents4dNIST NewsNIST Joins White House Effort to Drive ‘A New Golden Age of Science’4dNCSC UKChina-linked malicious actors called out by UK and international partners for targeting sensitive data globally4dNIST NewsNIST Study Shows How the Toxic Substances Mixed Into Fentanyl Vary Across the U.S. and Change Over Time4dSchneier on SecurityHow Technology Empowers—and Imperils—Dictators4dIndicatorHow to investigate potential sockpuppets and manipulation on Wikipedia4dZero Day InitiativePwn2Own Ireland 2026 - Day Three Results & Master of Pwn4dHelp Net SecurityCryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers4dCisco TalosUAT-11985: AI-assisted event lures delivering real-time Google AitM phishing4dCisco TalosIgnore all instructions and read this blog: The state of AI-analysis evasion in malware4dAdversa AITop MCP security resources — October 20264dWeLiveSecurityMATCHBOIL: New tricks, same old evil intentions4dOX Security“Shai-Hulud: Here We Go Again” – “tensorlake” npm Package Hit With Malware4dCrowdStrikeSolving the Continuous Authorization Conundrum4dCrowdStrikeCrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage4dHelp Net SecurityMedical devices patients rely on most are least prepared for quantum attacks4dSANS ISCISC Stormcast For Thursday, October 8th, 2026 https://isc.sans.edu/podcastdetail/10128, (Thu, Oct 8th)4dElastic SecurityIntroducing AlertZero: Inbox zero for your alert queue4dRecorded FutureJapan Adopts Proactive Cyber Defense Strategy4dTLDR InfoSecFake Google TLS certs 🔒, Copilot runs malware 🤖, OpenAI agent hits Wikimedia 🌐4dGraham CluleySmashing Security podcast #487: Clippy’s crypto comeback4dUnit 42Evolution of Web3 in Cloud Supply Chain Attacks4dSimon WillisonClaude Haiku 5.55dRapid7Four compliance frameworks, one security team: Why fragmented university security raises regulatory risk5dCisco TalosMicrosoft, Adobe, Apple, and Foxit vulnerabilities5dTechCrunch SecurityCIA officer admits to creating fake top secret government program to steal over $190M, including gold bars5dCloudflareBuilding an evidence5dMicrosoft Security3 lessons from frontier AI vulnerability research5dReversingLabsCRA compliance will be judged by the binary you ship5dNextgov CyberRecent Taiwan simulation highlights US cyberdefense gaps against China, experts warn5dSANS ISCScans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)5dWizHow the Wiz Red Agent caught a Fortune 500 firm’s data exposure (that other tools missed)5dHelp Net SecurityExploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)5dKrebs on SecurityShinyHunters Extorted Boeing Spin-off Prior to Arrests5dRapid7CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products5dHelp Net SecurityHackers hijack three country-code domain registries, obtain HTTPS certificates for Google domains5dSchneier on SecurityApple’s Verified Photography System5dRapid7The ASOS Incident: When Attackers Use the Channels Customers Trust5dHelp Net SecuritySonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)5dCisco TalosOne breach, please, and make no mistakes5dZero Day InitiativePwn2Own Ireland 2026 - Day Two Results5dWeLiveSecurityInside a brand deal scam targeting YouTube creators5dCrowdStrikeUnknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance5dCrowdStrikeCrowdStrike Named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises Vendor Assessment5dSnykFrontier models found the vulnerabilities. Only the attacker found the chains.5dFlock SafetyFlock Authorized as a CVE Numbering Authority by CISA5dSophosCISA’s 17 Common Active Directory Compromise Techniques: A Sophos MDR Perspective5dSnykAutonomous Attacks Are Already Here. The Defense Has to Match Their Speed.5dTLDR InfoSecHealthcare 250k breach 🏥, kubectl cp trust flaw 💻, AWS AgentCore JWT leak ☁️5dNextgov CyberThe monsters of Cybersecurity Awareness Month are getting stronger6dCitizen LabToronto-Based VPN Provider Plans to Quit Canada Over Lawful-Access Bill6dFull Disclosure[0day-rubbish] StreamSets Transformer 3.17.0 auth-mode none fallback and un-sandboxed ScalaDTransform execution to container root (8.1 primary)6dFull Disclosure[0day-rubbish] RCDevs WebADM 2.4.14 authenticated log viewer sid command injection to webadm uid 999 code execution (7.2)6dFull Disclosure[0day-rubbish] Maian Cart 3.8 addBanners unrestricted banner upload to PHP webshell and administrator command execution (7.2 primary, PR:H)6dFull Disclosure[0day-rubbish] IPConfigure Orchid VMS 26.3.0 authenticated DNF repository GPG-key property command injection to root (7.2)6dFull Disclosure[0day-rubbish] Circutor LineEds 24.11.14-r0 unauthenticated pwrstudio events.xml shellExecute command injection (9.8)6dPortSwigger ResearchThe model isn't cooperating6dMicrosoft SecurityCISO perspectives on managing vulnerability risks in the age of AI6dOX SecuritySSRF in Harbor Webhooks: Any User Can Reach the Server’s Cloud Credentials6dTechCrunch SecurityLibreOffice says ‘no AI’ is now a software feature6dTenableHow to mitigate the risk from AI-generated apps built by your 'citizen coder' employees6dReversingLabsDependency installation security measure already defeated on npm6dRapid7Securing Agent-to-Agent Communication: The Next Identity Frontier6dWizIntroducing Wiz AI SAST: Application Security that Understands Your Code and Your Infrastructure6dAdversa AIGitHub Copilot CLI vulnerability: Cryptographic Context Injection steals developer secrets6dNCSC UKIncident affecting ASOS customers6dSchneier on SecurityPossible Vulnerability in Apple’s Automatic Reboot6dUnit 42Blinder Tunnel Campaign Targets Iraqi Infrastructure6dZero Day InitiativePwn2Own Ireland 2026 - Day One Results6dWeLiveSecurityThe quest for simplicity: Why SMBs want advanced protection without the complexity6dGoogle Project ZeroHow to fix a bug in a fix6dCrowdStrikeRequest, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers6dTrustedSecLogging is a Discipline, Not a Switch6dDatadog Security LabsBeyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access6dSophosUnderstanding Asymmetric Routing Risks in Modern Firewall Deployments6dTLDR InfoSecBouncy Castle flaw 🏰, Car privacy exposed 🚗, ShinyHunters arrest in Jordan 🕵️7dZero Day InitiativePwn2Own Ireland 2026 - The Full Schedule7dQualysSecure Your Mission7dWizWhat’s New in Wiz Service Catalog: Smarter Discovery, Governance, and Service-Level Context7dPortSwigger ResearchSmashing the token limit with overlapping fragments7dTechCrunch SecurityHackers steal 8 million citizens’ records from Danish government database7dCheck Point Research5th October – Threat Intelligence Report7dCitizen LabFixer, Financier, Spymaster: How the UAE’s Sheikh Tahnoon is Setting His Sights on AI Dominance7dFortinetClingSTUN Linux Backdoor Abuses Public STUN Infrastructure7dNIST NewsPhysicist Jun Ye Wins Wolf Prize in Physics7dSchneier on SecurityAnother Historic Cipher Falls to AI7dIndicatorWorkshop video: Finding hidden connections with digital ad data7dCrowdStrikeFalcon Data Security for SaaS Secures Sensitive Data in Microsoft 3657dDatadog Security LabsGuarding the gates: Assessing dangerous permissions granted to Kubernetes built-in principals7dElastic SecurityBehind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage7dSophosCitrix NetScaler vulnerability (CVE-2026-88779) in active exploitation7dTLDR InfoSecVercel KVM 0-day escape 💻, 543k GitHub keys leaked 🔑, DeepSeek agent hijack 🤖8dTechCrunch SecurityGoogle froze its open source bug bounty program due to a ‘significant rise’ in AI submissions8dAdversa AITop AI agent security resources — October 20268dTroy HuntWeekly Update 524: Live From Copenhagen9d0xdfHTB: Reactor9dGraham CluleyN0n ransomware: what you need to know10dEFF DeeplinksSite-Blocking Will Not Defend IP, No Matter the Bill’s Name10dHackerOneWhat’s New for HackerOne Researchers10dAdversa AITop AI coding agent security resources — October 202610dRapid7SMTP is the key: BPFDoor and AVERAT hitting the network edge10dIndicatorBriefing: Grokipedia is back (kinda)10dSentinelOneThe Good, the Bad and the Ugly in Cybersecurity – Week 39 (2026)10dSophosSophos Named a Leader in the IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises 202610dXBOWTest the Whole Estate. Prove What's Exploitable.11dCisco TalosGive yourself room to be human11dReversingLabsWhy the smartest LLMs are not-so-smart pen testers11dMicrosoft SecurityPreparing governments for an era of interconnected cyber risk11dMicrosoft SecurityInsights from the 2026 Microsoft Digital Defense Report11dIndicatorThe Indicator Lab is live!11dGraham CluleyFBI tells ShinyHunters members to turn themselves in, after arrest of alleged leader11dGraham CluleyShinyHunters suspect arrested, and is now investigated over alleged murder plots11dTrustedSecHashcatRosetta: Reading the Rosetta Stone of Password Cracking11dSnykWhy AI Coding Agents Keep Writing Broken Access Control11dExploit-DB[remote] Teltonika_RutOS 00.07.06.21 - command injection11dTor ProjectArti 2.7.0 released11dExploit-DB[webapps] TigerGraph_Community_Edition 4.2.4 - arbitrary file write11dTor ProjectNew Alpha Release: Tor Browser 16.0a1311dExploit-DB[webapps] WordPress 7.0.2 - Path Travesal11dExploit-DB[webapps] Food-Ordering 1.0 - LFI11dSophosSophos CISO Advantage is now generally available11dExploit-DB[remote] Ecava_ntegraXor IGX_16.0.701.10 - RCE11dEmbrace The RedFrom SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669)12dUnit 42Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)12dMicrosoft Security​​Secure what’s next: Your guide to Microsoft Security at Microsoft Ignite 202612dBlack Hills InfoSecThreat Hunting Home Lab: Your Personal Playground for Learning Adversary Behavior12dWizSecuring the Kubernetes Supply Chain: Introducing WizOS Helm Charts12dReversingLabsRestrospective: How Malicious Updates Poison Your Environment12dMandiantVulnerability Discovery and Exploitation Trends in the AI Era12dIndicatorGoogle promised to label ads for unofficial visa providers. It’s doing a lousy job of it.12dSpecterOpsIntroducing Adversary Intelligence: LLM Tradecraft12dGraham CluleyPentagon personnel database breach exposes personal data of millions12dWeLiveSecurityThis month in security with Tony Anscombe – September 2026 edition12dXBOWFrom One Application to your Entire Portfolio: Autonomous Exposure Management12dSnykWhat Is Agentic AppSec?12dSnykEvo ADS Govern Agent Behavior Goes GA: Bringing MCP Usage Under Control12dRecorded FutureRecorded Future Debuts Autonomous Defense, Built for Machine-Speed Threats12dTor ProjectNew Release: Tails 7.1413dQualysAutonomous Remediation Is Already Running at Enterprise Scale13dReversingLabsCan advanced math make AI systems safer?13dMandiantDefending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances13dWizThe Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub13dUnit 42OperTraitors: How Kubernetes Operators Betray Your Security Posture13dWeLiveSecurityTimeshare exit scams: From fake buyers to recovery fraud13dQualysLessons from Microsoft Patch KB5002907: Two Layers of Patch Control in Qualys TruRisk Eliminate13dOX SecurityCVE-2026-93355: Account Takeover in LiteLLM13dFlock SafetySearch and Rescue Drones: Faster Response When Seconds Count13dSentinelOneBuilding Agents Backwards from Evaluation13dElastic SecurityNo MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current13dRecorded FutureSocial Engineering in the Age of Synthetic Media13dTor ProjectNew Release: Tor Browser 15.0.2414dXBOWAPT Attacks Explained: How Threat Actors Exploit Your Attack Surface14dKrebs on SecurityDutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation14dQualysThe Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches14dCheck Point Research28th September – Threat Intelligence Report14dWizIntroducing the Wiz Partner Alliance Managed Service Provider Program14dOX SecurityPhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels14dNCSC UKExploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway14dNIST NewsNIST Provides Updates on National Construction Safety Team Activities14dWeLiveSecurityThe devil is still in the email – but wears a new mask14dTroy HuntWeekly Update 523: Live From a Norwegian Fjord14dXBOWNo Time to Pwn: CVE-2026-72018 Linux Kernel LPE14dSignalBack to Backups: A Year in Review14dSentinelOneSentinelOne and NVIDIA: Governing AI From Silicon to Runtime14dSentinelOneBring Your Own Vulnerable Device: The EDR Killer Economy14dElastic SecurityQuarantined isn't contained: Agentic phishing response with Elastic and Sublime14dRecorded FutureRecorded Future Launches MCP, the Intelligence Layer for Agentic Security Operations15dTenableFrequently asked questions about reported Citrix NetScaler zero-day vulnerabilities15dXBOWAsset types16d0xdfHTB: SmartHire16dUnit 423 Consulting Myths Debunked by Unit 42 Experts16dKrebs on SecurityU.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions17dMandiantShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft17dHacking ArticlesWindows Privilege Escalation: SeManageVolumePrivilege17dRecorded FutureUsing Threat Intelligence to Stop Ransomware Attacks18dSpecterOpsAI for Offensive Security: What Works, What Does Not, and How to Adopt It18dMandiantProactive Defense: Hardening Code Pipelines and CI/CD Infrastructure18dFortinetUncovering a SectopRAT Variant Embedded in Legitimate Software18dKaspersky SecurelistMacSync under the microscope: new delivery methods and a new payload18dOX SecurityHow MCP Is Bypassing a Decade of Cloud Security Best Practices18dTrustedSecWhat's New in hate_crack Since 2.018dSnykYour Vulnerability Backlog Is No Longer Technical Debt, It’s an Attack Surface18dDatadog Security LabsDiscovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)18dDoyensecOne Tap Too Far: Using Shortcuts to Bypass Chrome for iOS Call Prompts19dBlack Hills InfoSecForensic Data: How to Acquire and Retain Vital Evidence19dZero Day InitiativeCVE-2024-0244 – A heap buffer overflow in the Canon MF753Cdw printer19dPraetorianHannibal Puts Autonomous Penetration Testing Under Your Control19dQualysCISA BOD 26-04 Timelines for Three Linux Kernel CVEs19dPortSwigger ResearchHTTP/3 in Burp Suite - it’s time to find a bigger wordlist19dAdversa AITop 10 attacks on Claude Code and what each one actually broke19dTroy HuntWeekly Update 522: Live From Oslo with Scott Helme20dCitizen LabUN Reports Citing Citizen Lab Submissions Published20dSpecterOpsIntroducing Ghostwriter Skills20dCitizen LabSubmission to the Immigration and Refugee Board of Canada20dHacking ArticlesImpacket for Pentester: tstool20dFlock SafetyFlock Security Testing 2026: What the Bishop Fox Penetration Test Found — Critical and High Findings Fixed and Independently Verified20dTor ProjectNew Alpha Release: Tor Browser 16.0a1220dCheck Point Research21st September – Threat Intelligence Report20dArs Technica SecurityMuse, Meta's extraordinarily privileged AI assistant, has a serious 0-day21dKaspersky SecurelistGroup Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO21dUnit 42From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies21d0xdfHTB: Hercules21dGoogle Project ZeroWindows Exploitation Techniques: Dangling COM Object Registrations21dElastic SecurityCloud Threat Emulation on Autopilot: Context is Everything24dSentinelOneDon’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties24dNIST NewsNIST Awards More Than $1.7 Million to Support Cybersecurity Workforce Development Across 8 States24dDatadog Security LabsAttacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms25dSpecterOpsCiliumHound: Graphing Kubernetes Network Policies25dCheck Point ResearchAI Threat Landscape Digest: July–August 202625dAdversa AIWhy vibe coding security is the next enterprise nightmare25dKaspersky SecurelistThe Odyssey and Trojans again: MovieReaper attacks users in multiple countries through compromised torrents25dTrustedSecUnpacking a laZzzy Donut25dPraetorianCredentials Are Still the Shortest Path In25dDoyensecThe skb that wasn't freed - the Fragnesia primitive via Open vSwitch26dZero Day InitiativeThe Apple Security Update Review for September 202626dKrebs on SecurityData Broker Radaris Loses Domains in Privacy Fight26dBlack Hills InfoSecThreat Hunting on the Endpoint: Hunting Adversaries Where They Live26dSpecterOpsGhostwriter v7.3.0: A Fresh New Look26dThe MarkupWho’s buying your personal data: Disney, GM, your insurer and bank. Here’s what they get26dThe MarkupData brokers have detailed files on you. Here’s what’s in them — and how it impacts you26dOX SecurityHow Do You Build Security for AI Agents That Don’t Exist Yet?26dKaspersky SecurelistNightEagle targets Russian companies26dDatadog Security LabsMapping out your unknown: A threat hunter’s guide to GitHub26dTenableOracle September 2026 Critical Security Patch Update addresses 672 CVEs27dTenableAustralia is replacing the Essential Eight with a new cyber framework. Here’s how exposure management can help you get ahead of it.27dNCSC UKUK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists27dNCSC UKIranian cyber targeting of dissidents, activists and journalists27dNIST NewsNIST Awards More Than $30 Million for MEP Centers in 11 States and Puerto Rico27d0xdfHTB: Ghostlink28dCheck Point Research14th September – Threat Intelligence Report28dThe MarkupHow TikTok and Google ended up with information about doctors’ appointments around the world1mo0xdfHTB: Silentium1moTroy HuntWeekly Update 521: Breach Perception v. Reality1moCitizen LabGroup of Bipartisan Lawmakers Ask US Government to Ban Several Hack-for-Hire Firms1moFortinetCasbaneiro: A Banking Trojan with Distributed Data-Receiving Servers1moTenableThe agentic harness for Tenable Hexa AI: How Tenable prevents AI agents from going off the rails1moDetectify LabsHow to hack APIs in 20261moTrustedSecSo… You Found AWS Access Keys (Part 1)1moDoyensecPreinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability1moBlack Hills InfoSecSoar 101: Security, Orchestration, Automation, and Response1moKrebs on SecurityMicrosoft Plugs Nearly 1,000 Security Holes1moMandiantGTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI1moHackerOneEU CRA Reporting Goes Live This Friday. Are You Ready?1moGoogle Project ZeroTesting race conditions with memory access tracing and stack-based delay injection1moTroy HuntWeekly Update 520: The Unscripted Edition1moFlock SafetyWhat Is Traffic Analytics?1moKaspersky SecurelistAngry Birds: Toy Ghouls’ new toys1moFortinetSomeone Else Is Using Your AI1moThe MarkupDefense tech has unleashed a new weapons boom in Southern California1moBlack Hills InfoSecCalling Reinforcements: Your Incident Response Plan, Before The Fire Starts1moFlock SafetyCalifornia SB34: What Private Organizations Using ALPR Need to Know1moHackerOneProject Glasswing: What We Learned Running a Frontier Model on Our Own Codebase1moFlock SafetyWhat Flock's Privacy and Security Updates Mean for Private Sector Customers1moMDSecWhen it Snows it Pours – Anatomy of a ServiceNow Red Team1moGitHub SecurityOpenClaw went viral. Meet the maintainers building and securing it.1moNCSC UKDisruptive cyber activity highlights risk from internet-exposed systems and edge devices1moExpelThe AI CVE exploitation evidence story: Headlines are scarier than reality1moEmbrace The RedBreaking Claude Code Opus 5 Auto Mode1moPortSwigger ResearchWhat's in a tag name? JavaScript, apparently1moExpelSynkLoader: when you throw in everything but the kitchen sink1moHackerOneCIRCIA Cyber Incident Reporting: HackerOne's Recommendations1moEmbrace The RedRecovering Encrypted LLM Reasoning Traces1moProjectDiscoverySupply Chain Security Analysis of a 9.5M-Install VS Code Extension1moHacking ArticlesImpacket for Pentester: SMBExec1moMDSecARM64 stack internals and obfuscation on Apple Silicon2moFortinetMulti-Functional Linux Botnet “Evooo1Bot”2moSignalIntroducing Automatic Key Verification2moPortSwigger ResearchCSS:the bomb inside your inbox2moHacking ArticlesImpacket for Pentester: reg2moSignalMore linked devices are on the table (and the Android tablet)2moProjectDiscoveryWatching Agents Work: A Behavioral Audit of Offensive-Security LLM Runs2moEmbrace The RedLLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection2moBitdefenderFake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums2moHacking ArticlesImpacket for Pentester: atexec2moArs Technica SecurityClaude published malicious code to the Internet and attacked 3 real companies2moArs Technica SecurityChrome may get faster updates with no restart required2moEmbrace The RedEscaping Linux Sandboxes via PipeWire (CVE-2026-5674)2moGitHub SecurityDisrupting supply chain attacks on npm and GitHub Actions2moThe MarkupBrazil gives parents social media controls for their kids. Should the US?2moArs Technica SecurityMicrosoft unveils AI security tools it says outperform competing platforms2moArs Technica SecurityForgot your Google password? Now you can log in with a selfie.2moProjectDiscoveryOh My Rogue Agent2moGitHub SecurityNext chapter: Restructuring GitHub’s bug bounty program2moProjectDiscoveryIntroducing Internal Network Scanning: see your network the way an attacker inside it would