Scammers impersonate FBI on social media, prey on crime victims
IC3 says any account claiming to represent it is fake
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
AWS customer learns the hard way how even the smallest oversight can be mission-critical
An expired card, overzealous spam filter, and broken authenticator create havoc with a very clear moral
25 Years After Code Red: What the Worm Era Can Teach Us About AI Security
Marc Maiffret reflects on Code Red's legacy and the security lessons helping organizations navigate AI risk today.
Malicious cloud customers can bring down the power grid
Datacenters tax utilities normally, so just imagine what they could do if workloads were designed to destroy
CISOs Feel the Heat Over AI Risk
Job pressures have increased as companies run headlong into AI adoption, causing 26% of top security executives to consider leaving their position.
Frontier LLMs couldn't help Hugging Face fight off evil agents
Chinese open-weight model GLM 5.2 happily obliged
Sheetz replaces VMware at more than 830 stores
Convenience store and gas station chain Sheetz announced it is replacing VMware across its network of more than 830 retail locations with StorMagic’s SvHCI hyperconverged infrastru…
Attackers Combo Up Evasion Tactics for BEC Phishing
"The TFF Trap" uses fileless techniques and loaders with low detection rates to deploy various RATs and stealers, including Agent Tesla, Remcos, XWorm, and Best Private Logger.
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protoc…
New HollowGraph malware uses Microsoft Graph for stealthy C2 comms
A malicious component dubbed HollowGraph uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and exfiltra…
NB583: TSMC Chips In Another $100 Billion for US Fabs; Can Data Centers Make It In New York?
Take a Network Break! In this week’s episode our red alert highlights two critical vulnerabilities in RabbitMQ, and we dig into listener follow-up about data centers in space. This…
Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments…
The Document Foundation says Microsoft's file formats keep users on a short leash
OOXML may carry an ISO certificate, but only Office can be trusted to render it properly
Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign
Malware hides commands in appointments set for 2050 and uses Redmond's own cloud to phone home
Neo Emerges From Stealth With $100M to Control and Secure Enterprise AI Software
Neo raised money across seed and Series A funding rounds from Andreessen Horowitz, Bessemer Venture Partners, and others. The post Neo Emerges From Stealth With $100M to Control an…
HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attac…
Windows Server Update Services buckle under Microsoft's metadata mountain
Redmond has stabilized new installations, but existing deployments remain stuck in sync purgatory
SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch
The zero-days CVE-2026-15409 and CVE-2026-15410 were exploited by a threat actor tracked by Volexity as UTA0533. The post SonicWall Zero-Days Exploited to Deliver Custom Malware fo…
An AI SOC Evaluation Guide for Security Leaders
Choosing an AI SOC platform requires understanding how it will perform in your own environment, not just during an evaluation. Prophet Security shares a practical framework for ass…
Cybersecurity Keeps Events 'Uneventful'
From the World Cup to the United States' 250th celebration, this year's event calendar has been packed with high-profile gatherings that drew global audiences, intense scrutiny, an…
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools. The paths were often…
EU's AI labeling rules take effect next month
Chatbots and agents will have to come clean about who – or what – users are talking to
Watching the world burn as all the money flows into a multitrillion-dollar Magic 8 Ball
On this week's episode of The Kettle, we welcome a special guest to discuss how the AI datacenter buildout is setting the world on fire – literally
OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability
Attackers could send waves of malicious payloads to trigger buffer pre-allocations that are not freed, exhausting server memory. The post OpenSSL Silently Fixes ‘HollowByte’ DoS Vu…
Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine
At least one Russian intelligence service is systematically hijacking internet-connected security cameras across Europe and Ukraine, using the feeds to watch military transport rou…
Infosec expert: Paidwork users' data pwned after 23M-record database dumped online
HIBP claims leaked info includes bank account numbers, payout histories, and personal details
Hugging Face warns an autonomous AI agent hacked its network
The Hugging Face artificial intelligence repository disclosed that attackers gained access to internal datasets and credentials after breaching its production infrastructure using …
New Index Tracks Material Breaches — And Refuses to Add Up the Losses
Longtime cybersecurity executive Richard Bird built the resource for security experts, journalists, policymakers, and everyday citizens. The post New Index Tracks Material Breaches…
Mythos Didn't Break Your Security Program. Your Exposure Window Could.
The industry spent the initial months after Anthropic's April 7 Mythos reveal focused on volume. How many new CVEs would Mythos add to an already overloaded pipeline? How quickly w…
Ernst & Young Data Breach Affects Personal, Financial Information
Hackers stole names, addresses, Social Security numbers, credit/debit card numbers, and other information from a third-party management platform. The post Ernst & Young Data Breach…