Stay informed about the latest cybersecurity threats, vulnerabilities, malware campaigns, phishing trends, supply-chain attacks, and security advisories. This section provides timely updates and practical insights to help organizations understand emerging risks and strengthen their security posture.
The investigation into the September breach of the Dutch Institute for Vulnerability Disclosure, or DIVD, has now identified the initial access path: attackers chained two previously unknown vuln…
The discovery of 543,699 still-valid credentials across public GitHub repositories is a sobering demonstration that exposed secrets remain one of the most persistent and avoidable weaknesses in…
Cisco’s disclosure of CVE-2026-76504 is particularly serious because the vulnerability affects the management plane of Cisco Catalyst SD-WAN and is already being exploited in real-world att…
TeamViewer has released security updates addressing five vulnerabilities across its Full Client and Host products on Windows, Linux and macOS, with severity ratings reaching CVSS 8.8 High. The fl…
Cisco Talos has uncovered a sustained espionage campaign attributed with high confidence to a China-nexus threat actor tracked as UAT-11587, targeting government, defense, diplomatic, policy, res…
OpenSSL has released security updates for CVE-2026-84782, a high-severity vulnerability in its Datagram Transport Layer Security implementation that can cause applications to disclose heap memory…
Phishers no longer need their own shady servers. They rent Google's reputation instead, and many email and web filters let them straight through. For years, spotting phishing was fairly simple: look f…
The latest ClickFix campaign analyzed by Huntress demonstrates an important evolution in social engineering: attackers are no longer merely impersonating trusted brands such as ChatGPT. They are placi…
Microsoft’s latest analysis of Star Blizzard shows a Russian state-linked espionage operation becoming both broader and more efficient. Since January 2026, Microsoft has observed at least 1…
The theft of French tax information affecting hundreds of thousands of individuals and businesses is a particularly useful case study because investigators found no need for a zero-day, custom malware…
On 29 September 2026, a domain called epfo[.]online started serving a page titled "Sign in — EPFO Regional Office Portal," complete with a password field. It had nothing to do with EPFO. The rea…
The newly disclosed TONTOU attack demonstrates that some of the mitigations developed to contain Spectre v2 can still be undermined by carefully manipulating what happens after the processor beli…
The data breach disclosed by Eskenazi Health in Indianapolis demonstrates why trusted-contact phishing remains so effective even in organizations with mature security programs. According to Esken…
The cyberattack against the Dutch Institute for Vulnerability Disclosure, or DIVD, may represent one of the clearer real-world examples yet of an AI agent being used autonomously during an intrus…
The rapid adoption of Model Context Protocol is creating an important new security boundary that organisations need to understand: an MCP server should not automatically be treated as a trusted extens…
The ransomware attack on Keio Corporation, one of Japan’s major private railway and transportation groups, demonstrates how an intrusion into corporate IT can disrupt a wide range of custom…
Microsoft’s disclosure of NeedyMantis provides a useful look at the kind of malware attackers deploy after the noisy part of an intrusion is already over. Unlike commodity malware designed …
The confirmed breach affecting approximately 6.6 million Times Car accounts in Japan is significant not simply because of its size, but because of the sensitivity and long-term usefulness of the …
Bitget's latest disclosure about its September 24 security incident significantly changes the technical picture of one of the largest cryptocurrency thefts of 2026. The exchange now says the att…
The latest analysis of RatHat shows that the malware is evolving beyond a conventional Android banking trojan into a much more complete Malware-as-a-Service ecosystem. Cleafy says the command-and…