Aggregated from vendor advisories, security research, and industry publications.
Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck's CVE Numbering Authority (CNA) record. The CNA record says the command can run as a local subprocess when the notebook is opened in edit mode. The vulnerability, tracked
When Android users get a call from a non-contact, they will see more information about the caller, including their country. The post WhatsApp Adds Multiple Passkeys and Stronger 2S…
WhatsApp has started rolling out several new account security features, including support for multiple passkeys and stronger two-step verification. [...]
Hands-on Cyber Attack Methods course returns to SecurityWeek’s ICS Cybersecurity Conference, October 6–8 at the W Nashville. The post Hands-On Cyber-Physical Systems Training Retur…
Rack-mount system intended for software porting, workload optimization, to bring open standard to the bitbarn
Threat actors have already compromised over 270 Zimbra instances in remote code execution attacks targeting a high-severity Zimbra Collaboration Suite (ZCS) vulnerability. [...]
Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legiti…
Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAP…
Cybersecurity researchers are calling attention to a new campaign that employs FTP banners as dead drop resolvers (DDRs) to deliver two previously unreported remote access trojans …
Summer in Redmond, Winter for everyone else
Kaspersky researchers have linked the malware to the BadBox botnet, which has ensnared millions of devices. The post First Malware Built Specifically for Car Head Units Fuels Botne…
Vulnerability management has been a staple of security programs since the dawn of the cybersecurity discipline. The symbiotic relationship between vulnerability and patch managemen…
Andy Ellis has a roundup of the security vendors at Black Hat this year. Key Takeaways: We have entered into an AI world. While nearly half of booths didn’t directly mention AI or…
Law enforcement agencies from 22 countries helped identify 263 suspects and arrested 58 individuals linked to cybercrime networks coordinated by African crime groups. [...]
Disclosed in January and honeypots buzzed soon after, CISA says it’s finally time for the USG to plug the gap
Fast and lightweight unmanned aircraft is designed for easy deployment and fits in a pickup truck
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. The post Silent Patches Don’t Stop Attackers – T…
Sponsored search results lead developers straight into a ClickFix malware trap
Building a business case for moving enterprise workloads to the cloud or even switching cloud providers can itself be a lengthy exercise, requiring enterprises to first understand …
Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attac…
Taxman wants to drag creaky NPS into agile era
AI infrastructure, including advanced semiconductors mostly made in Taiwan, has become a key point of competition between the U.S. and China. The post Taiwan Charges 9 Over Illegal…
SPONSORED EXPLAINER: Why you should take a long-term approach to rethinking your virtualization portfolio
The vulnerability is tracked as CVE-2026-21962 and it has been widely exploited by threat actors against WebLogic servers. The post CISA Warns of Exploited Oracle WebLogic Vulnerab…
This is basically a riff on ‘You wouldn’t steal a car’ and means only the human league can have a hit
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Kno…
And fly ‘significant scale’ in 2028 – a claim that isn’t entirely bonkers, but needs a solid grain of salt
The semiconductor industry is becoming a trillion-dollar growth engine as AI gobbles up more and more resources. Gartner has slightly increased its forecast for worldwide semico…
Cunning plan to expand the amount of software that runs on mainframes is also an admission ISVs are focusing their energies elsewhere
Privacy? Not if you use hosted AI services