access ai android api apple attack authentication backdoor breach business ceo china cisa cisco ciso cloud compliance control credentials crypto cve cyber cyberattack cybercrime cybersecurity data data-breach defense detection email endpoint exploit finance flaw framework fraud google governance government group hacker hacking healthcare identity infrastructure intelligence Internet jobs law leak linux malicious malware microsoft monitoring network open-source password phishing privacy ransomware remote-code-execution resilience risk russia scam service software strategy supply-chain technology theft threat tool unclassified update usa vulnerability windows zero-day
-
Apple parental controls in iOS 27 let kids ask before opening new websites
Apple has overhauled the child-safety tools that ship across iPhone, iPad, and Mac. One idea runs through the redesign. Give a child a device that does very little, then open … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/15/apple-parental-controls-ios-27/ also interesting: Apple expands what parents can block, approve, and limit Cybersecurity Snapshot: Tenable Report Spotlights…
-
AI CEOs Call for Slower Frontier Development as Stocks Fall
Amodei, Altman and Musk Back AI Pacing as Trump Rejects New Guardrails. Discourse about the potential of unchecked AI systems and frontier labs’ ability to control rogue AI agents culminated in several AI executives calling for slower AI development, a move that saw AI-related stocks fall and drew rebuke from the U.S. president. First seen…
-
Cymphony Raises $30M to Turn Access Data Into Remediation
Israeli Startup Focuses on What Compromised Identities Can Do With Existing Access. Israeli startup Cymphony raised $30 million from Sequoia Capital and SMBC Fin Atlas Beyond Fund to continuously map identities, permissions and activity as attackers and AI tools make dormant access-control weaknesses more easy to discover and exploit. First seen on govinfosecurity.com Jump to…
-
Assume Breach Must Now Mean Assume Impersonation
‘Assume breach’ is a useful operating principle for enterprise security: Build as if an attacker will eventually get past the perimeter. That mindset led teams to adopt Zero Trust, stronger endpoint controls, network segmentation, and tighter identity and access management. The premise… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/assume-breach-must-now-mean-assume-impersonation/ also interesting: Cybersecurity Snapshot: NIST Offers Zero…
-
No UK Regulators Can Stop Risky AI Models, Panel Warns
Lawmakers Find AI Security Institute Has No Power to Compel or Block Model Releases. British lawmakers are calling for new legislation to address the threat AI may pose to human rights, including demands that the riskiest systems clear regulatory hurdles before deployment – and warning that no U.K. regulator can currently stop a model from…
-
TIBER-EU and the Future of Cyber Resilience: Why Continuous Security Validation Is No Longer Optional
Sep 14, 2026 TIBER-EU and the Future of Cyber Resilience: Why Continuous Security Validation Is No Longer Optional A point-in-time red team exercise proves resilience once. Here’s what it takes to prove it every day in between. Summary TIBER-EU is… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/tiber-eu-and-the-future-of-cyber-resilience-why-continuous-security-validation-is-no-longer-optional/ also interesting: Response to CISA Advisory (AA24-326A):…
-
Agentic SOC Platforms for Financial Services, Judged on What the Examiner Asks For
Vendor claims below are dated at first sourcing and re-checked periodically; see the Source & Date column in the comparison table. Third-party positions are quoted from each vendor’s public materials, with dates as labeled. We hold D3 Morpheus to the… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/agentic-soc-platforms-for-financial-services-judged-on-what-the-examiner-asks-for/ also interesting: Working in critical infrastructure? Boost…
-
‘Sandworm’ Chains Cisco Vulnerabilities to Deploy Cyclops Blink
The notorious Russian threat group is spreading an upgraded version of the botnet malware, which the FBI disrupted in 2022. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/sandworm-chains-cisco-vulnerabilities-cyclops-blink also interesting: The 2024 cyberwar playbook: Tricks used by nation-state actors International effort erases PlugX malware from thousands of Windows computers Russian hackers exploit old Cisco flaw…
-
UK lawmakers call for new law to protect human rights from AI systems
MPs and peers call for the UK to create a statutory AI oversight body with powers to test and evaluate high-risk uses of AI and to prevent the deployment of AI that poses risks to human rights First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366649608/UK-lawmakers-call-for-new-law-to-protect-human-rights-from-AI-systems also interesting: Why identity security is your best companion for…
-
UK Panel Calls for Fresh Approach to Regulating Medical AI
Commission Says Premarket Reviews Alone Fall Short for Evolving AI Technologies. AI-enabled medical devices and healthcare software in the United Kingdom should be regulated with a life-cycle risk approach, especially as the technologies evolve, rather than the one-time premarket approval model that’s predominate today, according to a new government commission report. First seen on govinfosecurity.com…
-
ENISA: Frontier AI Is Changing the Speed of Cyberattacks. Europe Needs to Catch Up
Frontier AI is compressing the attack lifecycle from vulnerability discovery to exploitation, forcing defenders to detect, patch and respond at machine speed. Cybersecurity has always been a race between attackers and defenders. ENISA’s latest assessment suggests that frontier AI is changing the speed of that race, and the gap between discovering a vulnerability and exploiting…
-
AI SOC vs. SOAR: Augmentation or Replacement?
For SOC leaders approaching a SOAR renewal or weighing another automation investment, the question isn’t whether AI SOC replaces SOAR, it’s which parts of the workflow still need static playbooks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/ai-soc-vs-soar-augmentation-or-replacement/ also interesting: Agentic AI in SOCs: A Solution to SOAR’s Unfulfilled Promises What is SIEM? Improving security…
-
Maximum Severity GitLab Flaw Puts Supply Chains at Risk
CVE-2026-85706 is a path traversal vulnerability with a 10 out of 10 CVSS score, affecting both GitLab Community Edition and Enterprise Edition instances. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/maximum-severity-gitlab-flaw-supply-chains-risk also interesting: ‘Dangerous’ vulnerability in GitLab Ultimate Enterprise Edition Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign Operation Epic Fury:…
-
Japan’s Digital Agency says VPN flaw exposed 246,000 personnel records
Japan’s Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government employees. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-digital-agency-says-vpn-flaw-exposed-246-000-personnel-records/ also interesting: Top 7 zero-day exploitation trends of 2024 AI development pipeline attacks expand CISOs’ software supply chain risk Operation Epic Fury: Why exposure data…
-
Japan’s Digital Agency says VPN flaw exposed 246,000 personnel records
Japan’s Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government employees. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-digital-agency-says-vpn-flaw-exposed-246-000-personnel-records/ also interesting: Top 7 zero-day exploitation trends of 2024 AI development pipeline attacks expand CISOs’ software supply chain risk Operation Epic Fury: Why exposure data…
-
Microsoft releases emergency Windows updates to fix RDS failures
Microsoft has released emergency out-of-band Windows updates to fix Remote Desktop Services failures caused by this month’s security updates, along with Hyper-V and USB audio problems on some Windows versions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-windows-updates-to-fix-rds-failures/ also interesting: The SQL Server Crypto Detour Microsoft’s May 2025 Patch Tuesday Addresses 71 CVEs (CVE-2025-32701, CVE-2025-32706,…
-
Microsoft 365 Passkey Phishing Turns Login Into a Cloud Breach
Microsoft warns that passkey-themed phishing is hijacking Microsoft 365 accounts, adding rogue MFA methods, and slowly stealing business cloud data. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-passkey-phishing-microsoft-365-cloud-data/ also interesting: Cybersecurity Snapshot: CISA’s Best Cyber Advice on Securing Cloud, OT, Apps and More Will AI agent-fueled attacks force CISOs to fast-track passwordless projects? Cybersecurity Snapshot:…
-
Finnish Police Alert Europe Over Fugitive Vastaamo Hacker
Tags: hackerAleksanteri Tomminpoika Kivimäki Has Eluded Finnish Authorities for Months. Finnish authorities issued a European Arrest Warrant for convicted Vastaamo hacker Aleksanteri Kivimäki after he failed to return to prison, widening the search for the man who stole 33,000 psychotherapy records and extorted patients. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/finnish-police-alert-europe-over-fugitive-vastaamo-hacker-a-32813 also interesting: OpenAI Says…
-
Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
Tags: flawA flaw in Telegram Desktop let a bot’s message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12.In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a web…
-
3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials
An attacker was operating inside the network of 3BB, one of Thailand’s largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, threat intelligence firm Hunt.io said.The company uncovered the intrusion by examining a server the attacker had left open on the internet, which held the attacker’s own…
-
Twitch extension with 30K installs exposes users’ OAuth tokens
A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users’ Twitch OAuth session tokens to a commercial bot service. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/twitch-extension-with-30k-installs-exposes-users-oauth-tokens/ also interesting: Google settles Chrome privacy suit with massive personal data purge Google Cuts Off uBlock Origin on Chrome…
-
Twitch extension with 30K installs exposes users’ OAuth tokens
A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users’ Twitch OAuth session tokens to a commercial bot service. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/twitch-extension-with-30k-installs-exposes-users-oauth-tokens/ also interesting: Google settles Chrome privacy suit with massive personal data purge Google Cuts Off uBlock Origin on Chrome…
-
Homebrew 7.0.0 gets built-in GUI, better security controls
Homebrew package manager version 7.0.0 has been released with a built-in vulnerability scanner, stronger security controls, and the full release of its native BrewUI graphical interface. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/homebrew-700-gets-built-in-gui-better-security-controls/ also interesting: Researchers Uncover 46 Critical Flaws in Solar Power Systems From Sungrow, Growatt, and SMA Aviation sector faces heightened cyber…
-
China Calls Amodei’s AI Proposal a New Cold War Playbook
China rejects Amodei’s AI slowdown proposal, calling it fearmongering and a US attempt to contain China’s technology sector. The debate over whether the world should slow down the development of advanced AI has quickly turned into something bigger than a technology argument. Dario Amodei, CEO of Anthropic, has called for a slower pace of development,…
-
China Calls Amodei’s AI Proposal a New Cold War Playbook
China rejects Amodei’s AI slowdown proposal, calling it fearmongering and a US attempt to contain China’s technology sector. The debate over whether the world should slow down the development of advanced AI has quickly turned into something bigger than a technology argument. Dario Amodei, CEO of Anthropic, has called for a slower pace of development,…
-
Members of ‘Black Axe’ cybercriminal group extradited from South Africa
Prosecutors unsealed a 2021 indictment accusing the five men of conducting lucrative romance scams that stole thousands of dollars from more than 100 people. First seen on therecord.media Jump to article: therecord.media/members-of-black-axe-cybercrime-group-extradited-south-africa also interesting: 7 biggest cybersecurity stories of 2024 Cybercrime ring GXC Team dismantled in Spain, 25-year-old leader detained Our APWG eCrimes Paper on…
-
Iran, Yemeni Cell Used Claude in Developing Weapons, Threats: Anthropic
An Iranian-sponsored threat group and a likely Houthi engineering cell used Anthropic’s Claude and other AI tools to gather information on U.S. naval operations and to develop software for missile systems. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/iran-yemeni-cell-used-claude-in-developing-weapons-threats-anthropic/ also interesting: The 2024 cyberwar playbook: Tricks used by nation-state actors Cybersecurity Snapshot: U.S. Gov’t Urges…
-
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads
Hackers compromised HBO Max’s official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/ also interesting: Weaponized pen testers are becoming a new hacker staple Cybersecurity Snapshot: AI Will Take Center Stage in Cyber…
-
InWild Attacks Hit Popular DevSecOps Platform GitLab
Recently Patched Flaw Is Being Actively Exploited to Steal Files and Credentials. Attackers are actively targeting a recently patched vulnerability in the popular DevSecOps platform GitLab that they can exploit to steal data and credentials from public-facing, self-hosted GitLab servers. The software developer is urging all self-hosted users to update immediately. First seen on govinfosecurity.com…
-
ClickFix attacks are tricking Mac and Windows users into hacking themselves
If you clicked on a fake HBO Max ad on Reddit in the past week, you might have fallen victim to a rising “ClickFix” security threat. First seen on techcrunch.com Jump to article: techcrunch.com/2026/09/14/clickfix-attacks-are-tricking-mac-and-windows-users-into-hacking-themselves/ also interesting: Hackers exploited Windows WebDav zero-day to drop malware New Hacking Campaign Exploits Microsoft Windows WinRAR Vulnerability Google Details Turla’s…
-
Five alleged leaders of Black Axe’s operations in South Africa extradited to US
Tags: scamOfficials said the five individuals concocted various long-running romance scams to trick U.S.-based victims into sending them money. First seen on cyberscoop.com Jump to article: cyberscoop.com/black-axe-south-africa-leaders-extradited/ also interesting: DOJ Charges 324 in Sprawling $14.6 Billion Healthcare Fraud Scams WhatsApp Screen-Sharing Scam: How Attackers Are Deceiving Users to Expose Sensitive Information Fake Gemini AI Chatbot Promotes…
-
Five alleged leaders of Black Axe’s operations in South Africa extradited to US
Tags: scamOfficials said the five individuals concocted various long-running romance scams to trick U.S.-based victims into sending them money. First seen on cyberscoop.com Jump to article: cyberscoop.com/black-axe-south-africa-leaders-extradited/ also interesting: DOJ Charges 324 in Sprawling $14.6 Billion Healthcare Fraud Scams WhatsApp Screen-Sharing Scam: How Attackers Are Deceiving Users to Expose Sensitive Information Fake Gemini AI Chatbot Promotes…
-
AI Agent Security Readiness: The Federal Standard You Should Get Ahead Of
Tags: aiHere’s the uncomfortable part first: in August 2026, researchers found AI agents connected to Hugging Face running loose inside enterprise networks. No owner, no audit trail, nobody who could tell you they existed until something broke. If that sentence made… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/ai-agent-security-readiness-the-federal-standard-you-should-get-ahead-of/ also interesting: AI supply chain threats loom,…
-
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
A Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign.”Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems,” Acronis Threat Research Unit (TRU)…
-
New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing
Researchers have disclosed a new hardware attack, called DDRop, that breaks the memory protection in Intel and AMD confidential computing by silently dropping writes to a server’s memory, so the processor keeps reading old encrypted data as if it were current.The attack requires an attacker who already controls the server’s software and can briefly access…
-
Anthropic CEO: Time to Shift From Improving to Controlling AI
Dario Amodei says it’s time to slow the pace of frontier AI improvements so that security and risk prevention efforts can catch up. What does this mean for enterprises? First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/anthropic-ceo-shift-from-improving-to-controlling-ai also interesting: CISOs embrace rise in prominence, with broader business authority New OneTrust CEO on Why AI Governance…
-
Is Your Organization Mature Enough for AI?
CyberEdBoard Webinar to Explore CMU SEI AI Adoption Maturity Model. The CyberEdBoard will host a virtual webinar Sept. 24 to explore a new framework developed by the Carnegie Mellon Software Engineering Institute and Accenture to help organizations assess their AI adoption maturity and build a road map for achieving predictable, repeatable and scalable results. First…
-
Machine-Speed Attacks Are an Architecture Problem
Kunjal Trivedi and I spent the other week in Las Vegas at CrowdStrike Fal.Con, alongside more than 10,000 practitioners from 71 countries. A couple of weeks on, one impression has outlasted the rest. The keynote was about AI. The hallway… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/machine-speed-attacks-are-an-architecture-problem/ also interesting: 7 biggest cybersecurity stories of…
-
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
WordPress has announced it’s launching an automated security review for every release of a plugin before it’s distributed through the WordPress.org update API so as to analyze it for potential security issues and ensure there are no risks involved.”New plugins are reviewed before they enter the directory, but updates ship continuously after that,” David Perez,…
-
Hackers target exposed Vite dev servers to steal AWS, Azure secrets
A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-target-exposed-vite-dev-servers-to-steal-aws-azure-secrets/ also interesting: Cybersecurity Snapshot: Study Raises Open Source Security Red Flags, as Cyber Agencies Offer Prevention Tips Against Telecom Spying Attacks Getting the Most Value Out…
-
New York Seizes a Dozen Celebrity Deepfake Websites
In the biggest-ever legal action against harmful deepfake websites, the Manhattan District Attorney’s Office has seized 12 sites that collectively targeted around 1,200 victims. First seen on wired.com Jump to article: www.wired.com/story/new-york-seizes-a-dozen-celebrity-deepfake-websites/ also interesting: 7 biggest cybersecurity stories of 2024 Phishing click rates tripled in 2024 despite user training Patch Tuesday for May: Five zero…
-
Mantax Otax Targets Android Phones With Spyware and Ransomware
Mantax Otax Android malware steals messages, PINs, and files, monitors screens, and uses ransomware and harassment to pressure victims into paying. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/cybersecurity/news-mantax-otax-android-malware-apac-indonesia/ also interesting: Russian cyberespionage groups target Signal users with fake group invites Man jailed for teaching criminals how to use malware Google Warns Over 1 Billion…
-
Revolut Reveals Data Breach Tied to Faked Official Request
Financial Platform Was Socially Engineered Into Disclosing Sensitive Customer Data. Digital financial platform Revolut is notifying customers that it suffered a data breach exposing their personal details after it fell for an official-looking impersonation scam involving a request for customer information sent using a legitimate government agency domain email. First seen on govinfosecurity.com Jump to…
-
Revolut Reveals Data Breach Tied to Faked Official Request
Financial Platform Was Socially Engineered Into Disclosing Sensitive Customer Data. Digital financial platform Revolut is notifying customers that it suffered a data breach exposing their personal details after it fell for an official-looking impersonation scam involving a request for customer information sent using a legitimate government agency domain email. First seen on govinfosecurity.com Jump to…
-
Weshalb guter Ransomware-Schutz für Backups nicht nur Daten schützt, sondern auch das Repository prüft
Unveränderliche Backups gelten als letzte Verteidigungslinie gegen Ransomware. Doch was passiert, wenn Angreifer nicht die Produktivsysteme, sondern das Backup-Repository selbst ins Visier nehmen? Kai Hambrecht von Grau Data geht dieser Frage auf den Grund. Übermäßige Admin-Rechte, Active-Directory-Anbindung, unzureichende Netzwerksegmentierung oder manipulierte Restore-Punkte können dazu führen, dass Backups im Ernstfall nicht mehr verfügbar oder wiederherstellbar sind.…
-
Hundreds of fake government websites target users in Central Asia
The sites are designed to collect victims’ contact details, which scammers then use to target them through phone or email to steal money, personal information or gain access to their devices. First seen on therecord.media Jump to article: therecord.media/hundreds-of-fake-gov-websites-central-asia-scam also interesting: 7 biggest cybersecurity stories of 2024 TDL001 – Cybersecurity Explained: Privacy, Threats, and the…
-
Pro-Ukraine Hacking Cat group deploying new malware against Russian targets
The pro-Ukraine hacktivist group Hacking Cat has evolved from carrying out website defacements and data leaks to more sophisticated and destructive attacks on Russian targets, researchers said. First seen on therecord.media Jump to article: therecord.media/ukraine-malware-russia-ransomware also interesting: The most notorious and damaging ransomware of all time UK blames Russia’s infamous ‘Fancy Bear’ group for Microsoft…
-
Bigger AI Security Budgets Should Be Coming In 2027: GuidePoint CISO
CISOs looking for a boost in budget to help secure the surging adoption of AI around their organizations could begin to see a much-needed spending increase starting next year, according to GuidePoint Security’s Gary Brickhouse. First seen on crn.com Jump to article: www.crn.com/news/security/2026/bigger-ai-security-budgets-should-be-coming-in-2027-guidepoint-ciso also interesting: How CISOs Can Lead the Responsible AI Charge AI Integration,…
-
Sonar Supports OpenAI’s Call for Collective Action on Cyber Defense
The window to strengthen cyber defense is narrowing, as advanced AI models compress the time between vulnerability disclosure and exploitation from months to minutes. It’s the responsibility of the defenders to match that pace. That is why we’ve signed OpenAI’s… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/sonar-supports-openais-call-for-collective-action-on-cyber-defense/ also interesting: 9 top bug bounty programs…
-
Common web application security risks every SME should understand
For many UK SMEs, a web application is not just a website. It is the place customers log in, place orders, book services, submit forms, or access account information. That means a weakness in the application can quickly become a… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/common-web-application-security-risks-every-sme-should-understand/ also interesting: The 7 most in-demand cybersecurity…