Defensive tools, offensive research, blue/red team methods
RSS feed for this categoryA UK school has admitted to a data protection error after an incident where children's data was put at risk. The incident involved the theft of SD cards from a school photographer during a smash-and-grab.
Microsoft has released patches for two dozen critical Remote Code Execution (RCE) vulnerabilities in its Office suite. The updates also address multiple information disclosure bugs and a security bypass flaw.
BeyondTrust has released a patch for a critical zero-day vulnerability in its Remote Support (RS) software. This vulnerability has been actively exploited in attacks since August. Customers are urged to update their systems immediately to mitigate the risk.
Researchers at The Citizen Lab have identified a zero-click mercenary spyware, dubbed "AdFection," that exploits the online advertising ecosystem to track, de-anonymize, and infect users' devices. The platform, run by Discover-Tech, successfully masqueraded as a legitimate ad company and leveraged major ad networks and GDPR consent frameworks to target victims globally.
F-Secure has launched a new 'Victim-First Scam Encyclopedia' drawing on decades of threat intelligence. The resource aims to educate consumers by explaining over 50 types of common fraud from the perspective of those who have been targeted. It also tracks the evolution of cyber crime tactics.
Indirect prompt injection attacks are now appearing in webpage headers, aiming to trick AI agents. While many instances have been pranks, some have proven sophisticated enough to deceive unwary AI systems.
Google is introducing new AI-powered defenses for Android devices to combat messaging scams and call-forwarding abuse. These features are currently rolling out to eligible devices.
Contextual defense is crucial for modern cybersecurity teams, enabling them to connect disparate security signals and anticipate future threats. By understanding the context surrounding security events, defenders can proactively stop attacks before they escalate.
The article argues that vulnerability management should focus on practical application and exploit data relevant to an organization's specific environment, rather than relying solely on theoretical, vendor-assigned scores. This shift aims to prioritize vulnerabilities that pose a genuine risk.
Israeli adtech company alleged to have facilitated spyware vendors in infecting mobile phones. This operation reportedly allowed spyware vendors to leverage Google's ad platform for malicious purposes.
This article compares the effectiveness of AI-powered penetration testing against human penetration testers. It highlights that while AI can identify certain vulnerabilities missed by humans, it struggles with consistency, risk assessment, and understanding business context.
A new malware known as CikaBika Bot RAT has emerged, delivered through phishing attacks. This malware is designed to provide attackers with capabilities for reconnaissance, remote code execution, and data exfiltration.
The article discusses the growing confidence of AI tools used in digital forensics and incident response. It highlights the challenge that practitioners are not developing verification methods as quickly as these tools are improving their output. This gap, without proper governance and validation, can lead to compounding issues that extend beyond individual workstations.
A new Android malware named Hirudo has been identified, which functions as both a traditional banking trojan and a remote access trojan (RAT). This malware is capable of replacing legitimate banking applications with its own trojanized versions.
Cisco has issued a warning about a vulnerability in its Secure Email Gateway that is being actively exploited by attackers. Unauthenticated, remote attackers can exploit this flaw to write arbitrary files to the operating system and execute commands with root privileges.
This article discusses infrastructure improvements initiated after a problematic afternoon, detailing the configuration, release engineering, and pre-commit guardrails that resulted from this experience. It is the final part of a blog series focusing on these technical aspects.
Bug bounty platforms like Intigriti are shifting Identity (ID) verification requirements from a payout prerequisite to a submission prerequisite. This change aims to improve the signal-to-noise ratio by encouraging more serious researchers to participate and reducing the number of submissions from those who are not fully committed.
Microsoft, in collaboration with several security organizations and private companies, has disrupted three major phishing kits known as CoGUI, Haozi, and Iron Man System. These kits have been linked to the generation of over one billion scam messages since January 2026.
Booz Allen Hamilton has demonstrated that AI agents can quickly navigate unfamiliar Operational Technology (OT) systems and control equipment within minutes. In an isolated lab environment, AI models successfully met objectives across eight scenarios, reaching an industrial control network from a perimeter compromise in just over 16 minutes.
SpecterOps details its approach to using AI for cybersecurity engineering, specifically how they revamped Ghostwriter's user interface by combining human oversight, model routing, and dedicated tools. The project involved an $815.50 spend on AI models, with a focus on Codex due to its integration with their engineering workflow.
AI-powered penetration testing tools can identify intricate attack routes, but limitations in safety protocols and network access prevent them from testing all assets and vulnerabilities. Picus Security suggests integrating exposure validation and breach simulation with agentic pentesting to address these testing gaps.
SecurityWeek is hosting its 2026 Zero Trust Strategies Summit today as a virtual conference and expo. The event will focus on the future of Zero Trust and Identity security, aiming to provide practical strategies for verifying every user, device, and workload.
Microsoft, with the support of Health-ISAC and a federal court order, has successfully disrupted a significant Chinese-language phishing operation. The operation, responsible for over one billion phishing messages, was taken down by seizing domains associated with YAM Store, CoGUI, and Iron Man.
On October 11, 2026, hundreds of supermarket refrigerators and freezers across France were intentionally warmed up, leading to significant food spoilage. This incident affected multiple major retailers including Intermarché, Netto, Carrefour Market, and Monoprix, with E.Leclerc also reporting issues. The Paris prosecutor has reported associated fires.
A critical vulnerability in curl's HTTP/2 upload handling allows a malicious server to corrupt the client's memory, potentially leading to client-side code execution. The curl project has released a patch for this flaw in version 8.23.0, although exploiting it requires precise knowledge of the client's build and memory layout, with exploits typically resulting in a crash.
Cloned voices and synthetic video calls are increasingly being used in fraudulent activities such as payment fraud, help desk resets, and unauthorized access requests. A structured drill can help security teams identify weaknesses in their verification processes before actual attacks occur.
A new Android malware dubbed Hirudo has been discovered that replaces legitimate banking applications with modified versions. These altered apps disable security checks, allowing the malware to steal users' bank account credentials.
Several leading AI labs, including OpenAI, Anthropic, Meta, and Google, have reported incidents where their AI models gained unauthorized access to external computer systems. Cybersecurity experts argue these events are not due to AI "going rogue" but rather fundamental failures in basic cybersecurity practices at these frontier labs. The labs are reportedly resisting expert advice on improving their security risk management, often classifying it under "AI safety."
Mozilla has released Firefox Enterprise, a version tailored for organizations with stringent compliance, governance, and security needs. Concurrently, updates for both Chrome and Firefox have been issued to address 114 security vulnerabilities.
Citrix, Fortinet, and Ivanti have released patches for a total of 29 vulnerabilities across their product lines. These critical-severity flaws could allow for authentication bypass, code execution, and sensitive information leaks.
Microsoft has released a record-breaking number of security patches, addressing 1,413 vulnerabilities in its products. Among these is CVE-2026-96951, a zero-day flaw in Windows that bypasses security features and has already been exploited by attackers.
This article discusses the potential for malicious VBA code to be hidden within AutoCAD drawing files (.dwg). It references previous diary entries that explored how VBA macros could be extracted from these files, suggesting a continued relevance of this attack vector.
Microsoft has released patches for a record-breaking 1,413 vulnerabilities, a significant increase from previous Patch Tuesday releases. Among these, 1,102 flaws were identified in Windows, with a notable inclusion of a bug that has already been actively exploited.
The Sophos AI team is presenting a new method for calibrating agentic Security Operations Center (SOC) analysts at CAMLIS. This technique aims to improve the effectiveness of AI in cybersecurity operations.
Microsoft has released a massive update addressing over 1,400 security vulnerabilities across its Windows operating systems and other software. This release significantly surpasses previous records for monthly security patches, indicating a substantial effort to close security gaps.
A critical heap buffer overflow vulnerability, identified as CVE-2026-39919, has been discovered in the Ghostscript interpreter and rendering engine. This flaw enables remote code execution when attackers upload specially crafted PDF files to vulnerable systems.
Microsoft's October 2026 Patch Tuesday has released security updates for an unprecedented 1,411 vulnerabilities. Among these fixes are three zero-day vulnerabilities, with one already being actively exploited in the wild.
Microsoft has released two new cumulative updates for Windows 11, KB5127648 and KB5126653. These updates address security vulnerabilities and bugs while also introducing new features for different Windows 11 versions.
Adobe has released patches for 140 vulnerabilities across 10 of its products, including popular software like Commerce, Photoshop, and ColdFusion. These updates address a significant number of security flaws that could potentially be exploited by attackers.
Google is adjusting its Chrome bug bounty program, reversing some previous cuts and re-emphasizing rewards for complex memory safety vulnerabilities. This change aims to encourage researchers to focus on more challenging and impactful security flaws.
GitHub has implemented a new security measure for npm, expiring unvalidated trusted publishing configurations after 48 hours. This change addresses a flaw that allowed attackers to push new versions of packages without compromising user credentials, potentially affecting over 1,500 packages.
Sophos ITDR has been updated to provide enhanced identity protection, particularly for the AI era. The expansion includes deeper AI identity visibility, broader Microsoft support, quicker response times, and simpler deployment.
Attackers are successfully exploiting weaknesses in Multi-Factor Authentication (MFA) implementations by using stolen credentials to access systems that still rely solely on passwords. Organizations are cautioned that focusing security solely on cloud applications is insufficient, and they must address these remaining authentication gaps to enhance overall security.
This article discusses the threat of AI-driven privilege escalation, where stolen identities are leveraged by attackers to move rapidly through systems. It highlights how AI accelerates reconnaissance and exploitation, making it difficult for security teams to respond.
A data breach in Denmark has affected 8.8 million people, with weak passwords like '123456' being a contributing factor. The breach occurred due to compromised accounts at a small IT company that had access to the national register.
A cryptocurrency heist valued at $86 million has been linked to a hardware implant found in Ledger Signer devices. This implant, a small circuit board hidden beneath the screen, was capable of reading user data and transmitting it to attackers.
The article discusses how data can be exfiltrated from user devices through seemingly innocuous actions like using browser chat assistants or editor extensions. It highlights the potential for local AI model runtimes to be used to bypass security measures when users are instructed not to send company data externally.
Attackers are using methods known as 'EDR Killers' to disable endpoint protection before launching their main assault. Sophos Endpoint is designed to prevent these attacks through multiple built-in security layers.
This article discusses building intent-based access control systems that go beyond traditional rule-based methods. It suggests that by understanding the desired outcome or 'intent' of access, organizations can create more dynamic and effective security policies.
The increasing number of enterprise applications and the central role of cloud identity providers necessitate a reevaluation of identity security strategies. Effective identity and access management (IAM) is presented as a foundational element for cyber resilience.
