Good news for defenders — patches, takedowns, arrests, and security improvements.
RSS feed for this viewThe White House has launched the Gold Eagle Clearinghouse initiative to improve the coordination of vulnerability responses within the rapidly evolving AI landscape. However, significant questions remain regarding the specific implementation details and operational effectiveness of this new program.
Google Cloud is implementing an "agentic defense" strategy, integrating capabilities from Wiz into its platform to automate threat detection and response. This approach aims to proactively counter AI-driven cyberattacks.
Beacon Security, a startup focused on security data platforms, has successfully raised $13 million in funding. Their platform is designed to help organizations detect, hunt, and protect their assets at machine speed across various environments.
The Pentagon's suspension of CMMC Phase 2 audits has been met with broad agreement from industry professionals that the legal obligation to protect CUI remains. While audits are paused, companies must still adhere to the underlying security requirements.
A recent auction revealed a cache of papers detailing Alan Turing's "Delilah" project, a portable voice encryption system developed during World War II. These papers, handwritten by Turing and annotated by his colleague Donald Bayley, shed light on his work in cryptographic history.
Risk Ledger, a British company, has successfully raised $32 million in Series B funding. The company's platform focuses on assisting organizations in managing and mitigating supply chain security risks.
South Korea is developing its own security-focused artificial intelligence model, adapting a local large language model project for security and sovereignty. The initiative aims to create an AI that can compete with advanced models like Mythos.
Professor Messer is offering a pop quiz focused on the SY0-701 CompTIA Security+ certification exam. This quiz aims to help individuals test their knowledge and familiarity with the exam's objectives. It's presented as a learning tool for those preparing for the certification.
Daniel Solove argues that individual control over personal data is insufficient for regulating privacy in the AI era. He proposes holding companies accountable through measures like data minimization, fiduciary duties, and liability for harmful technological design and algorithms.
This article presents a pop quiz for the CompTIA A+ certification, specifically focusing on the 220-1202 exam objectives. The quiz is designed to test a candidate's knowledge on a particular topic, presented as a challenge to ensure understanding.
Cybersecurity startup Oak has announced it has emerged from stealth mode after securing $60 million in funding. The company has developed an AI-powered Identity Operating System designed to manage all identities within an organization's environment.
CISA, alongside international cybersecurity agencies, has released guidance urging software vendors and online service providers to establish formal Coordinated Vulnerability Disclosure (CVD) programs. These programs aim to improve vulnerability management and product security by structuring how organizations receive, assess, and respond to reports from security researchers.
AI tools are significantly enhancing offensive security by rapidly analyzing code, generating payloads, and automating testing. However, human expertise remains crucial for validating AI-generated findings and ensuring their practical applicability in security.
OpenAI has developed an internal automated red-teaming model called GPT-Red to identify and fix prompt injection vulnerabilities in their AI models. This model has proven effective in finding weaknesses, prompting OpenAI to use it for adversarial training to improve the security of their AI systems.
Dark Reading has launched a new 'DR Global' section to provide region-specific cybersecurity intelligence outside of North America. This expansion aims to offer tailored insights for European cyber defenders, acknowledging the diverse threat landscape and unique challenges faced globally.
This article provides a cheatsheet for KAPE (Kroll Artifact Parser and Extractor), a tool used for efficiently locating, extracting, and parsing Windows forensic artifacts. These artifacts can be crucial for identifying adversary activity within the operating system.
A virtual Cloud & Data Security Summit is taking place today, offering attendees the chance to interact with solution providers and peers. The event focuses on the challenges of securing various cloud deployments.
The White House has launched the Gold Eagle initiative, an AI-driven vulnerability clearinghouse designed to accelerate the identification, prioritization, and remediation of software vulnerabilities for government agencies and critical infrastructure operators. This program aims to coordinate vulnerability reporting and remediation efforts across federal agencies, open-source communities, and the private sector, leveraging advanced AI capabilities.
Professor Messer is offering a free CompTIA A+ 220-1201 pop quiz focusing on the 'Clap On' topic. This quiz is part of his ongoing free training resources for IT certification.
CISA, NSA, and international partners have released guidance on establishing Coordinated Vulnerability Disclosure (CVD) programs. The guidance offers best practices for software manufacturers and online service providers to work with security researchers, including clear policies for reporting, triaging, and remediating vulnerabilities. It also suggests using third-party intermediaries to support these programs.
This article announces an on-demand webinar that addresses the security risks associated with marketing tags in ad tech. It explains how a single approved tag can introduce unseen fourth-party code, potentially granting access to sensitive customer data and checkout pages.
The White House has launched the 'Gold Eagle' initiative, an AI-driven program focused on coordinating vulnerability management. This initiative is a direct result of an AI-focused Executive Order signed by President Trump on June 2nd.
The article outlines seven key skills and traits that define elite security engineers, emphasizing the growing importance of AI in both defense and attack landscapes. It highlights the need for engineers to understand and leverage AI-powered tools for predictive threat detection, as well as to comprehend the emerging threats posed by AI.
Microsoft will transition its Entra ID service to use passkeys as the default authentication method starting September 1, 2026, with SMS and voice authentication ending in February 2027. This move aims to bolster security against increasingly sophisticated AI-powered attacks that target traditional credentials.
The DShield SIEM has received an update, its first since September 2025. This new version incorporates ELK stack version 8.19.15, introducing additional dashboards and new log capabilities.
Cribl has acquired CardinalOps, a company specializing in detection engineering. This integration aims to enhance Cribl's platform by enabling customers to map detection rules and security controls to the MITRE ATT&CK framework, thereby identifying coverage gaps and operationalizing threat intelligence for SecOps teams.
Sophos has launched Sophos Fusion, an AI-native cybersecurity defense system designed to replace traditional security stacks. This new system leverages artificial intelligence to provide comprehensive protection.
The General Court of the European Union has ruled against Apple, upholding its obligations under the Digital Markets Act (DMA) regarding interoperability. This decision ensures greater choice for developers and users in Europe by allowing applications from outside Apple's ecosystem and potentially facilitating research into Apple's operating systems.
Microsoft has released the Windows 10 KB5099539 extended security update, which includes the July 2026 Patch Tuesday security updates addressing 570 vulnerabilities. This update also contains additional security fixes to enhance the overall security posture of Windows 10 systems.
Managing vendor risk is a complex but achievable task with disciplined governance. Key steps include defining risk tolerance, ensuring visibility into exposure, and maintaining board oversight. Implementing precise governance is crucial for effective third-party risk management.
Microsoft has released Windows 11 cumulative updates KB5101650 and KB5099414 for different versions. These updates aim to address security vulnerabilities, resolve bugs, and introduce new features to the operating system.
Bruce Schneier has announced a list of his upcoming speaking engagements at various cybersecurity and privacy-focused events. These include the Policy-Relevant Privacy Research Workshop, Boston Leadership Exchange, Cognitive Security Conference, and DEF CON 34. The events are scheduled for July and August 2026 in different locations.
This article presents a pop quiz for the CompTIA Network+ N10-009 certification exam, focusing on a specific topic that will be addressed on screen. It appears to be a learning aid for individuals preparing for the certification.
This article discusses the challenge of validating vulnerabilities without running live exploits, which is often impossible due to the lack of public exploits or the critical nature of affected systems. It introduces the concept of TTP chaining, a method to assess exploitability by validating the underlying attack techniques an exploit relies on, thus allowing for security posture validation without direct exploitation.
Microsoft will make passkeys the default authentication method for Microsoft Entra ID starting in September 2026. This shift aims to enhance security by moving away from password-based authentication, which is susceptible to phishing and other credential-based attacks.
Professor Messer has released a new pop quiz for the CompTIA A+ 220-1202 certification, focusing on the topic of 'Recreating from scratch'. This quiz is part of their free IT certification training resources.
Pentera is developing AI security agents that can influence real security decisions by summarizing findings, prioritizing remediation, and recommending next steps. These agents currently leverage fragmented risk signals from various sources like scanners and threat intelligence.
UK-based cybersecurity firm Valarian has secured $50 million in funding, bringing its total funding to $70 million. This capital will be used to further develop and deploy its ACRA technology, which focuses on sovereign infrastructure control.
The Pentagon has temporarily halted Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program. A new task force has been established to conduct a comprehensive review and reform of the contractor cybersecurity rules.
Sophos has released a browser extension that adds policy enforcement, data protection, GenAI visibility, and web security controls to existing Chromium-based browsers on Windows and Mac. This extension aims to provide enhanced protection and visibility without requiring users to switch browsers.
EPIC has submitted testimony to the D.C. Council, advocating for stronger provisions in the proposed DC Government Data Privacy and Protection Act of 2026. The organization aims to enhance data privacy and protection measures within the D.C. government.
Defenders are adapting 'prompt injection' techniques, originally a tool for attackers, to a defensive strategy known as 'context bombing.' This method aims to confuse or disable malicious AI agents before they can execute harmful actions.
Jesse McGraw, formerly known as GhostExodus, details his transition from a blackhat hacker involved in high school hacking and facing prison time to becoming a cybersecurity advocate. The article highlights his personal journey of redemption and his current role in promoting cybersecurity awareness.
Varonis has launched a free, hands-on Capture the Flag (CTF) event called 'Breach at the Beach' designed to educate defenders on how attackers exploit Microsoft Entra ID. Participants will learn to investigate these attack techniques through realistic scenarios.
This article introduces the AI Governance Stack, a five-layer operating model designed to ensure security and governance for enterprise AI systems. It spans data, models, system integration, control and monitoring, and audit and evidence, aiming to create a single source of truth for compliance and defensibility.
Digital rights organizations EPIC, the Consumer Federation of America, and Fairplay have submitted recommendations to the Colorado Department of Law. These recommendations are in response to the state's request for stakeholder input on upcoming rulemaking for new laws concerning chatbot safety and the use of automated decision-making technology (ADMT) in consequential decisions.
A new open-source, AI-driven system called 'ScamBuster' has been developed to combat email scammers. It engages with phishing attackers by adopting victim personas, enabling organizations and law enforcement to collect valuable data on cybercriminal activities.
Cybersecurity mergers and acquisitions saw a significant increase in June 2026, with 37 deals announced. Notable transactions involved major players such as 1Password, Accenture, Cisco, F5, Rubrik, and SailPoint.
This article presents a pop quiz focused on the CompTIA A+ 220-1201 certification exam. It is part of a series of free training resources offered by Professor Messer to help individuals prepare for IT certifications.
This article discusses the integration of AI agents, specifically mentioning Claude, into Security Operations Centers (SOCs) to aid in investigations. It highlights the value seen in specific use cases but also raises questions about broader architectural design and the potential for combining autonomous AI with human analyst copilots.
