What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,787 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 4d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 6d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 4d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 6d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 4d ago
-
New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery
Kaspersky GReAT experts describe a new Project CAV3RN C2 module. It uses Outlook calendar for communication via Microsoft Graph and has a backup connection via DNS AAAA responses.
-
Protect Your Privacy with California's DROP Tool
Are you a California resident? Then we've got exciting news for you: there's a tool just for you that lets you take a single, relatively easy step to protect your privacy. It's called a DROP request. (That's Delete Request and Opt…
-
An Explosion of Surveillance Towers is Coming to U.S. Borders, Costing Over $1 Billion
A new report from the Government Accounting Office reveals that the Department of Homeland Security (DHS) plans to nearly triple the number of surveillance towers along U.S. borders, from the current 830 to 2,300 by 2034. DHS expe…
-
A stitch in time saves… 29!
Privyet, droogs! Yes – we ve been stitching time and saving the world a full 29 years already! And last Friday we celebrated those 29 years in typically unrestrained, loud, colorful, and rock rollicking style. Also typical: the ve…
-
The Broken Link In Cybersecurity Nobody Wants To Fix – Is It What You Think?
There s a problem in cybersecurity I haven t been able to let go of these past few weeks. I ve been returning to it and looking at it from different angles. To begin, I asked whether we re solving the wrong problem in cybersecurit…
-
Victory! Flock Ends Rollout of Audio “Distress Detection” of Human Voices
Reversing course, Flock Safety—the surveillance technology vendor most known for its extensive network of automated license plate readers — has announced that it will end a pilot for its acoustic gunshot detection devices to ident…
-
Your Vision. Your Legacy. Your Future.
This month, we celebrate 36 years of EFF and a mission that is bigger than any one of us. Thanks to EFF, communities around the world are demanding that technology protects their freedom, advances justice, and opens doors to oppor…
-
Microsoft VSS: Still Essential, But Not the Whole Story
Microsoft VSS remains a cornerstone of Windows data protection, but its architectural limits matter. Learn when to rely on it and when to go beyond it.
-
Now, even Russia's most elite hackers are using Clickfix to infect devices
The social-engineering technique has primarily been a tool of financially motivated criminals.
-
Begun, the Patch Wars have
Long foretold, the Great Patching has begun and it’s a doozy. Buckle in as Joe takes you through the story.
-
Custom HTML for Custom Phishing: Make the Fake Feel Real
Build personalized, realistic phishing scenarios with Huntress Custom HTML for Custom Phishing, tailored to your organization's unique risks and vendors.
-
HelloNet campaign: new malicious modules launched through the ViPNet update system
We identified targeted infection attempts against large Russian organizations using the ViPNet update system (a software suite for creating secure networks).
-
44 years of Blade Runner.
In the summer of 1982 – 44 years ago – arguably one of the greatest works in the history of Hollywood-kind premiered: Blade Runner. But in Chinese numerology, 44 is a bad number ( four sounds a lot like death in Mandarin), so, sho…
-
GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration
Two-phase attacks with the GoSerpent backdoor, Stowaway RAT, ThumbcacheService and other tools aim to steal data from government entities in Southeast Asia.
-
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.
-
EFF and ARTICLE 19 Submission to the European Commission on the DSA Trusted Flagger Guidelines
EFF and ARTICLE 19 have submitted joint comments to the European Commission on draft guidelines for the Digital Services Act’s trusted flagger mechanism. Having long advocated for a DSA that protects freedom of expression while pr…
-
The Impostor Got Verified. The Founder Couldn't.
On LinkedIn, a scammer impersonating a company can get verified more easily than the company can verify its own staff. The lock works; Microsoft owns the key.
-
The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)
Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more. The post The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) appeared …
-
California Steps Back From Dangerous Expansion of its Age-Gating Law
The California legislature has stepped back from a plan that would have expanded its age-gating law, removing language that could have compounded serious threats to users’ speech, privacy and security just to browse the internet. …
-
Windows 0-day drops the same day Microsoft releases record number of patches
HiveLegacy is a "powerful primitive" that's likely capable of other nefarious actions.
-
Most Smart Watches, Rings, and Bands Lack Basic Transparency Reports and Key Privacy Features
Oura Rings, Garmin GPS fitness watches, Apple Watches, Whoop bands—every year, more and more tech devices are promising to monitor our health and fitness, guide us toward healthier living, and provide useful health metrics to take…
-
🚫 Don't Let Congress Age-Gate the Internet | EFFector 38.13
The effort to age gate the internet is back in Washington—and now it has a new name. Recently passed by the House of Representatives, the KIDS Act is a sprawling package of proposals to control what we can see and say online. Supp…
-
New Onyxia Cyber CISO Survey Report Exposes Wide Gaps in Cyber Resilience Standards Across Critical Infrastructure, Healthcare, Financial Services, Retail, and Technology
Today, we are unveiling our third CISO research report, “Industry Divides: Uncovering the CISO’s Resilience Priorities Across Sectors.” Based on a survey of 300 CISOs across financial services, healthcare, critical infrastructure,…
-
Wishin’ for Switchin’? The Huntress Buyout Program Has You Covered
Stuck riding out a contract with a vendor you no longer want to use? The Huntress Buyout Program covers your remaining term so you can switch today, not later.
-
Weekly Update 512: IoT Lockout Fail
Build a smart home , they said. It ll make life so much better , they said. Well, life wasn t very bloody good at 23:00 the other night after travelling 33 hours from Paris only to find the IoT doorlock batteries dead and the
-
Microsoft’s Secure Boot has been broken for a decade and no one noticed until now
Old and forgotten "shims" Microsoft failed to revoke have made Secure Boot bypasses simple.
-
European Court: Apple Can Not Shirk Off its Interoperability Requirements
One of the best bulwarks against monopoly is interoperability—that is making a new product or service work with an existing product or service. Interoperability allows users, and not the manufacturers of their devices or largest p…
-
Don’t Repeat NY’s 3D Printing Blunder
This year the state of New York had the dubious honor of being the first to pass a controversial provision to mandate all 3D printers come with surveillance and censorship. That means not only is there a ticking clock to protect e…
-
What Happens When Someone Mentions Your Name?
A few years ago, my friend Jim Shields wrote a book called Three Guys Walk Into a Bar. The basic premise is that there are three kinds of people. There is a guy. You need a wall painted, so you find a guy. Any reasonably competent…
-
[Video] Where protection starts: Cisco Talos Intelligence Integrations
Every day, defenders make high-consequence decisions with incomplete information. Learn how Cisco Talos Intelligence Integrations help reduce uncertainty by turning the latest threat intelligence into proactive protections across …
-
Should cyber insurance be part of your business backup plan?
Insurance is all about managing risk. Unlike policies that are legally required for driving a car or taking out a mortgage, cyber insurance is optional. But for small businesses in particular, is cyber cover worth getting? If they…
-
The serpent’s tongue: Luring the Python out of its den
This blog examines the full lifecycle of a Python package, from hosting on repositories such as PyPI or custom web servers, through source and wheel distribution formats, to the final installation into virtual or system-wide Pytho…
-
Sony Nerfs Videogame Ownership
Legal intern Suzanne Castillo co-authored of this post. Playstation’s decision to kill physical game discs is the latest attack on our diminishing rights to access and engage with culture digitally. Rent-seeking corporations and n…
-
A Bridge Not Too Far!
On our Irkutsk–Yakutsk–Magadan–Yakutsk winter road-trip we finally rolled into civilization and were fast approaching Yakutsk Airport, from where we d soon have the good fortune to be heading home. But before the triumphant finale…
-
Threat Actors Achieve Persistence After SQL Injection
See how a threat actor used SQL injection and BadIIS to gain persistence, disable Windows Defender, and quietly install a cryptominer.
-
Minimizing Machine Work Maximizes Human Work
Minimizing machine work maximizes human work header/images/minimizing-machine-work-maximizes-human-work.webp/images/minimizing-machine-work-maximizes-human-work.webp Behavioral geneticists like Robert Plominhttps://en.wikipedia.or…
-
The Good, the Bad and the Ugly in Cybersecurity – Week 28
Authorities launch Operation First Light 2026, attackers deploy Forg365 to hijack Microsoft accounts, and rival cyberspies breach Pakistani police networks.
-
Building Our Future Together
In my first weeks as Executive Director of EFF, I’ve been reminded every day how consequential this moment is in determining what kind of future we will have. We are on the edge. What each one of us steps up to do – with our exper…
-
Automated Moderation Is Here to Stay—Accountability Must Keep Pace
This post is part 2 in a series about automated content moderation. Read the first post here . When whistleblower Frances Haugen leaked a set of documents from Meta in 2020, among the revelations was a jarring statistic: The compa…
-
Guide to System Hardening: Checklist & Best Practices [2026] | Huntress
Threat actors want an easy way in. Use this practical system-hardening checklist to close gaps and learn how to secure your environment today.
-
"We Want Texans to Know Their Rights": Q&A with Mayday Health on the Impact of Surveillance on Abortion Care
Last May, EFF reported that a sheriff’s office in Texas searched data from more than 83,000 automated license plate reader (ALPR) cameras to track down a woman suspected of self-managing an abortion. ALPRs are promoted as tools fo…
-
The House Passed The KIDS Act—The Senate Should Reject It
Last week, the House voted on the KIDS Act , a disjointed package of legislation that seeks to control Americans’ web browsing and private messaging. The package combines a revised version of the Kids Online Safety Act ( KOSA), wi…
-
Patch for Windows Defender 0-day could allow attackers to fill hard disk
The feud between NightmareEclipse and Microsoft shows no signs of resolving soon.
-
Reduce Human Risk | Build a Strong Security Awareness Training Program | Huntress
Build a security awareness training program that actually changes user behavior. Huntress Managed SAT delivers engaging content, phishing sims, and results.
-
European Commission Chooses to Keep EU Users Locked Up Behind Big Tech’s Gates
Users are always seeking more control over their social networking experience to make it better, whether to improve privacy or enhance flexibility. Interoperability between social networking platforms like Facebook and TikTok has …
-
I Wrote a New Book for Corelight
TLDR: I wrote a new book for Corelight called NDR Essentials . It's free at that link. This is the 10th book that I've authored or co-authored. The rest are all posted at taosecurity.com . Why? It was time . That’s what I thought …
-
Conditional Access Misconfigurations Exposed 55 Orgs with MFA On
Two Microsoft 365 attacks got through Conditional Access policies that seemed fully configured. Learn what went wrong and how Huntress Managed ISPM catches these gaps first.
-
Weekly Update 511: Live from my Riad in Marrakech
How s this for a location?! I mean, last week was nice with Scott in Mallorca, but Marrakech is, well, wow Anyway, about those data breaches... This week I m talking about the futility of attempting to remove piss from a pool , ye…
-
LoTL Abuse: How to Spot It vs. Normal Admin Activity | Huntress
LoTL abuse hides in plain sign, using legit tools like PowerShell and RMM software. Learn how to spot the warning signs that separate from routine IT work.
-
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination. The post Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File In…
Last fetch 4m ago · 1 new · 1 source error(s)