SectopRAT Returns, Hiding Inside a Legitimate Application
The latest activity from the remote access Trojan (RAT) shows why organizations should monitor the behavior of applications rather than blindly trusting them, experts say.
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
New Carbonato malware uses AI agents to hijack exposed Docker hosts
A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. [...]
Docker's new sandboxes aim to contain AI agents for real
With Cloud Sandboxes, devs can keep agents at arm's length
Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing
'SalesBleed' security flaws 'lead to very unexpected consequences'
Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions
A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two fl…
IP Fabric 8.1 adds application-aware mapping and cloud-native data model
Application inventories and network data typically live apart in enterprise IT. Application details sit in application performance management (APM) platforms and configuration mana…
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before. …
Exposed GitLab project email addresses let attackers push code
Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to …
Meta's new AI fidget is a ... Tamagotchi?
We hope Zuck's Muse Charm doesn't die if you neglect it
LIU023: Wendell Odom – The Man Who Wrote THE Book
Renowned Cisco Press author Wendell Odom shares how he began writing the definitive guide for the CCNA exam. Alexis, Kevin, and Wendell discuss the balance between practical, on-th…
Decades-old file security flaws found in Android, Linux, macOS, and Windows
Security researchers report that Microsoft considers the side-channel leak of file events to be by design
iPhone 18 Pro benchmark boosted by giving it a cold drink
3x the vapor-chamber surface area can only do so much; luckily the fridge helped with sustained performance
CVE flood pushes Ubuntu onto weekly kernel release cycle
AI-assisted bug hunting is helping pile up vulnerabilities faster than defenders can patch them, so Canonical is picking up the pace
AI boom could wipe 230 million budget phones a year from the market
Sub-$200 shipments forecast to shrink 40% by 2030 as component costs climb
Kontext Security Emerges With $4 Million for AI Agent Runtime Controls
The startup’s runtime enforcement platform evaluates AI agents in real time to provide visibility and control over their actions. The post Kontext Security Emerges With $4 Million …
Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content
The "third-party[.]com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to oth…
Someone went shopping in ASUS's eShop – for customer data
Contact details and order records accessed, but PC maker is keeping schtum on how many customers are affected
Ask HPE and NVIDIA the AI data question you cannot ask in public
Matt Rosoff chairs a Register roundtable with HPE and NVIDIA on data sovereignty in the AI era, off the record, in Washington
3 Cyber Threats That Defined the Summer of 2026
This installment of the Reporters' Notebook video series discusses the impact of AI agents breaching Hugging Face, Fairlife's ransomware attack, and Iranian-linked threat actors co…
OpenAI Agents Probed Websites for Vulnerabilities While Fetching Public Data
Australia disclosed that an OpenAI agent gained unauthorized access to non-public government information. The post OpenAI Agents Probed Websites for Vulnerabilities While Fetching …
Talk of AI in KDE sets the community ablaze
A desktop pitch and an attempt to curb LLM slop descended into very human mayhem
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a…
How to Build a SASE Framework for Modern Cybersecurity
Securing edge computing requires organizations to fundamentally rethink security governance. This step-by-step guide to building a SASE framework provides the path forward. (Third …
FedRAMP VDR & VER: Daily Scans Are Only the Beginning
FedRAMP's new VDR and VER requirements make vulnerability management more continuous, with faster scanning, tighter remediation deadlines, and stronger evidence requirements. Anecd…
DoJ: Uncle Sam bought forensics software from same Russian operation supplying FSB
Russian devs alleged to have built tools for US agencies as software from same op was sold to Moscow's security services
On-prem VeloCloud Orchestrator under attack, only some versions patched
A flaw in VeloCloud Orchestrator enables attackers to access the platform organizations use to manage their VeloCloud SD-WAN subscriptions and the edge devices it controls. Aris…
Ghost Service Accounts Enable M365 Data Theft in Chile
Even if the organization locks down employee accounts, forgotten and lost service accounts can still undo the organization's entire M365 environment.
Hackers now exploit critical Roundcube flaw in code injection attacks
A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security. [...]
Google to critical infra orgs: Our AI scanners won't be evil, promise
Gemini 3.8 Flash Cyber and Wiz's Red Agent team up to protect hospitals, public transit, and tech
Prompt-Injection Bug Hits $4B Agentic AI App 'Manus'
AI apps that interpret external data (read: most AI apps) need exceptionally rigorous security filters, or attackers can take advantage.