Cloudflare, Inc. NYSE: NET, the leading connectivity cloud company, today announced it will launch Cloudflare OS, an open source AI workspace that runs on Cloudflare’s global…

Read more →

IDeaS, a SAS company and a provider of AI-powered hospitality revenue management software, today announced that Sofitel Bangkok Sukhumvit has achieved an 18% increase in…

Read more →

Transforms the writing journey from one-time evaluation to continuous, formative growth

Read more →

Vukovits breaks down why verifying access at connection time is no longer enough.

Read more →

Wallis dives into the nuances of AI-enabled security and how these offerings will impact midmarket security teams.

Read more →

Novee’s Geffen breaks down what it means to own the full AI pentesting stack.

Read more →

In this post, I will show you the best rotating proxies for web scraping in 2026. As businesses continue to rely on data-driven decisions, web scraping has become an essential technique for gathering publicly available information from websites. Whether you’re monitoring competitors, tracking product prices, conducting market research, or collecting SEO data, the quality of…

Read more →

Farassat discusses how security teams can put controls on the agent attack surface without blocking agentic AI outright.

Read more →

Generative AI is steamrollering the once booming industry known as software-as-a-service. “You have to burn the ships and start from the ground up.”

Read more →

Traditional operating systems (OS) were built to manage hardware, files, apps, and users on a device, but Cloudflare says the agentic AI era requires a whole new format. The company this week announced Cloudflare OS, which connects AI agents, enterprise data and context, internal systems, and workflows together in one secure workspace. It is open…

Read more →

A New Mexico judge ordered the social-media giant to create a new $567 million fund in addition to paying $375 million in previously determined civil penalties.

Read more →

OpenAI is rolling out a more reliable version of ChatGPT GPT-5.6 Sol for Plus and Pro users, while Free users are getting unlimited text chats with GPT-5.6 Luna. […]

Read more →

A Go-based malware delivered in ClickFix attacks targeting macOS users is stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. […]

Read more →

Customers tell us that managing TLS certificates at scale is one of their biggest operational concerns. The Certification Authority Browser Forum (CA/Browser Forum) has mandated a phased reduction in maximum certificate validity for public certificates. By March 2027, the maximum validity drops to 100 days. By March 2029, it lasts for 47 days. For an…

Read more →

Vulnerability management isn’t failing because security teams lack visibility. Most organizations already have more findings than they can reasonably address. Yet despite all those findings, many CISOs still struggle to answer a deceptively simple question: Are we actually becoming harder to attack? That question sits at the center of a growing problem. Security programs have…

Read more →

The Hacker News reports that North Korean threat actors have developed a new command-and-control (C2) technique called NullReceiver, an evolution of the EtherHiding method.

Read more →

As reported by Security Affairs, a 13-year-old Linux kernel flaw named OVSwrap was disclosed, enabling local users to gain root privileges on many default-configured distributions utilizing Open vSwitch.

Read more →

Samsung is starting August with a security sweep that patches dozens of flaws across Galaxy phones and tablets. The company has published details of its August 2026 Security Maintenance Release (SMR), which addresses 56 security vulnerabilities affecting eligible Galaxy smartphones and tablets running Android 14, Android 15, and Android 16. The update includes 38 Android…

Read more →

Vectra AI has launched Vectra AI Pro, a new offering designed to provide what the company calls “trusted signal intelligence” for security operations centers (SOCs) adopting AI-powered workflows. Announced at Black Hat USA 2026, the platform continuously correlates network, identity, cloud, SaaS, SASE, and endpoint telemetry into a unified view of attacker behavior.  Behavioral intelligence…

Read more →

Samsung wants to shrink one of AI infrastructure’s biggest bottlenecks: the distance between processors and memory. At FMS 2026 in Santa Clara, California, the company previewed zHBM and zNAND-O concept architectures, introduced its 400-plus-layer V10 BV-NAND design and outlined a roadmap spanning HBM4E, HBM5 and enterprise storage. Samsung says the technologies could increase bandwidth, capacity…

Read more →

A researcher demonstrated a proof-of-concept attack chain that provided C2-style influence over ChatGPT’s isolated sandbox during a session at Black Hat USA 2026.

Read more →

Mimecast’s Nielsen argues that treating agentic AI as a new security category is the wrong instinct.

Read more →

The AI industry is securing the ecosystem through open collaboration. NVIDIA and the Open Secure AI Alliance have drafted the Shared AI Findings Exchange (SAFE) framework and introduced several open-source tools to champion AI security. The SAFE RFC document proposes a framework for reporting, collaboratively analyzing and recommending operational guidance after breaches. Additionally, the alliance…

Read more →

Senators from both parties Thursday probed Trump administration officials about whether federal agencies and foreign governments are coordinated enough in the battle against scammers, something witnesses told the Foreign Relations Committee they were working to remedy. At least 13 federal agencies have authorities to counter scams, raising questions about whether someone needs to be in…

Read more →

The agency had turned down two earlier applications over clinical data-quality concerns.

Read more →

A recent wave of cyberattacks targeting hedge funds, private-equity firms, and other financial organizations has been linked to UNC6671, an extortion group reportedly associated with the BlackFile campaign extortion group. […]

Read more →

Security researchers Talal Haj Bakry and Tommy Mysk have identified three request paths involving Apple’s browser and authentication technologies that can bypass proxy protections and expose a user’s real network information. The flaws affect Apple’s iCloud Private Relay, a paid iCloud+ feature designed to hide users’ IP addresses and DNS information while browsing in Safari.…

Read more →

John Hurley discusses Optiv’s ability to advise, deploy and operate complete cybersecurity programs.

Read more →

Critical Paperclip flaws let attackers seize AI agent platforms, escalate privileges, and execute code.

Read more →

Meta is entering the AI coding race with a familiar weapon: lower prices. Released in beta, Muse Code is a terminal-based coding agent powered by Muse Spark 1.2. Meta says it can plan and write code, then test changes across large repositories. Muse Code gives MSPs and systems integrators another option aside from Claude Code…

Read more →

John Hultquist discusses Google’s approach to combating today’s threats.

Read more →

Security teams investigating AI-related incidents need guardrail intervention data alongside their existing security telemetry. Routing Amazon Bedrock Guardrails violations to Amazon Security Lake makes this possible. With this integration, you can query guardrail events alongside identity, network, and application security data in a single layer. When a guardrail blocks a prompt injection attempt or redacts…

Read more →

For decades, Network Address Translation (NAT) has been the default way IP addresses are provided inside larger networks, as a means to deal with the challenges of IPv4 address availability. The basic premise behind NAT is that private addresses stay private, but that assumption might not be entirely accurate anymore (if it ever really was).…

Read more →

More than 250 ClickFix domains are using browser fingerprinting to hide macOS malware lures from security scanners. Microsoft Threat Intelligence said the campaign checks visitors for signs of a genuine Mac before serving malicious instructions that can lead to the download of Atomic Stealer or MacSync.  Crawlers, sandboxes, and researchers may instead receive blank pages…

Read more →

Apiiro’s Idan Plotnik makes the case for a prevention-first model.

Read more →

Switzerland’s federal IT office says hackers exploited vulnerabilities to breach its Microsoft SharePoint servers and compromised approximately 200 accounts. […]

Read more →

A longtime cybercriminal was sentenced to 16 years in prison for creating and running Ransom Cartel, a ransomware strain linked to attacks on at least 18 companies between 2021 and 2023, the Justice Department said Wednesday.  Maksim Silnikau, a Belarusian national, actively participated in Russian-speaking cybercrime forums since at least 2005, and was a member…

Read more →

Researchers found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks and developed an exploit to leak secrets from Linux machines. […]

Read more →

Welcome to this week’s edition of the Threat Source newsletter.  Metaphor is a powerful tool for understanding emerging issues in cybersecurity. Framing the unfamiliar in terms of the well understood helps us remove the burden of extraneous detail to draw focus to the real issues.   Recent reports of offensive AI agents “escaping” their sandbox environments…

Read more →

Zapscape, a new Linux kernel vulnerability, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host. The risk applies when nested virtualization is exposed to untrusted guests. The flaw is tracked as CVE-2026-64561 and affects KVM/x86’s shadow memory management unit (MMU), which manages…

Read more →

We asked several experts in the travel industry to share their top picks for gadgets that help them on the go.

Read more →

Cisco has rolled out updates to address multiple critical security vulnerabilities impacting Catalyst SD-WAN and IOS XE Software as part of a comprehensive internal security review. The security issues affect Cisco Catalyst SD-WAN Software, regardless of device configuration, and Cisco IOS XE Software when it is running in autonomous or controller mode. “These vulnerabilities were…

Read more →

A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud data storage provider Snowflake. Connor Riley Moucka, of Kitchener, Ontario, also admitted to stealing call and text history…

Read more →

Kai’s Galina Antova discusses why the industry is moving toward machine-led security.

Read more →

An exposed SISVISA database leaked 102,215 Brazilian health records, exposing IDs, tax data, and regulatory documents without authentication. Researcher Jeremiah Fowler found a publicly accessible database that turned out to belong to SISVISA, Brazil’s Health Surveillance Information System, and alerted ExpressVPN, which later shared the findings with Hackread. The exposed instance held exactly 102,215 files,…

Read more →

Apple increased prices in its official store, but Amazon has the lowest prices on the new 13-inch M5 MacBook Air right now.

Read more →

Meta has become the latest AI company to confirm that one of its models hacked a real organization during cybersecurity testing, as similar incidents continue to emerge following OpenAI’sOpenAI’s initial disclosure that its agents breached Hugging Face. […]

Read more →

Cloudflare is opening up the AI workspace it built for its own employees. Now, partners can use the same foundation to create enterprise agents, automate workflows, and build small internal apps.  The platform connects AI tools with an organization’s internal knowledge, applications, and security controls.  Employees can use the browser-based workspace to research information, create…

Read more →

The rumors turned out to be true. Anthropic says it’s building an in-house team to design custom AI chips for Claude, giving the company more control over the hardware behind its AI models. It’s also not blowing up its existing infrastructure. Anthropic says chips from AWS, Google, Nvidia and AMD will remain part of the…

Read more →

A new study from 1Password’s Off-by-1 Labs suggests that organizations should be cautious about relying on large language models (LLMs) to autonomously remediate software vulnerabilities.  After evaluating more than 6,000 AI-generated security patches across six recently disclosed, high-impact vulnerabilities, researchers found that fully successful patches were the exception rather than the rule. Key takeaways of…

Read more →

Attackers used SQL injection to compile a post-exploitation toolkit inside an Oracle database

Read more →

A U.S. court sentenced Ransom Cartel founder Maksim Silnikau to 16 years for running a ransomware-as-a-service operation. Maksim Silnikau (aka “J.P. Morgan,” “lansky,” and “xxx,”) built a ransomware business the way a franchise owner builds a chain: he never had to touch most of the crime scenes himself. This week, a federal judge in Virginia…

Read more →

AI note-taking app maker Granola is accused of violating privacy laws by developing software that can record conversations without all participants’ consent, according to a lawsuit filed July 30 in a California federal court. It follows a similar ongoing case in the same district, filed last year, that involves another note-taking and transcription software vendor,…

Read more →

Prompt injection attacks continue to present the most dangerous threat from large language models (LLMs), despite the relatively low number of recorded incidents relating to this vector, according to an updated analysis from the Open Worldwide Application Security Project (OWASP).

Read more →

Beacon CRM confirmed it was the target of a cyberattack that resulted in the exposure of data belonging to a significant number of UK charities.

Read more →

The Trump administration is reportedly drafting import rules that would bar optical transceivers from China, a move that could significantly impact U.S. data center operators and AI infrastructure buildouts, as first reported by SDx Central.

Read more →

As outlined in HackRead, over 102,000 private records from Brazil’s health surveillance system were left accessible online without any security measures, exposing sensitive personal and government information.

Read more →

Google locked hundreds of legitimate Blogger websites, with some even being deleted, due to a false positive flagging them for violating the “Malware and Similar Malicious Content” policy, based on information published by Bleeping Computer.

Read more →

Apple’s Private Relay, an opt-in feature designed to hide a user’s IP address when browsing the internet with Safari, was found to have flaws that can reveal the supposedly hidden IP address.

Read more →

Western Union is one of the most used means of international money transfer. Find out how to get money back from a scammer on Western Union in this post.  Scams take various forms, but the most popular scam often joked about is the “Nigerian Prince” email scam, which still rakes in over $700,000 in illegal…

Read more →

In this post, I will discuss common dating website scams and how to avoid them. The image of a dating scam as a clumsy stranger with a broken keyboard is out of date. The people running these schemes now build profiles with deliberate small flaws, match a target’s tone, and wait weeks before asking for…

Read more →

Three WebKit mechanisms have been discovered to bypass Apple’s iCloud Private Relay. In fact, the mechanisms can bypass any browser‑level proxy configuration, including Psylo’s proxy, Tor-on-iOS proxy setups, and so on. Private Relay is a VPN-like system for Safari on iOS which is meant to prevent websites from viewing the visitor’s IP address and location.…

Read more →

Oligo Security has linked TeamPCP to ShadowRay 2.0 and to cryptojacking infrastructure dating back to 2020

Read more →

A new mobile ad fraud scheme, dubbed Papyrus, is using a cluster of novel-reading apps to generate hidden browser traffic, according to IAS Threat Lab. Sample novel-reading apps associated with Papyrus (Source: IAS Threat Lab) While a person taps through chapters of a romance or fantasy story, the app is quietly loading websites in a…

Read more →

AI did not create a new browser security problem. It exposed one that enterprises have long been able to ignore. Skyhigh Security explains why browsers have become a critical control point for governing data movement, AI interactions, and modern work. […]

Read more →

A healthcare software provider believed its segmented environment was reasonably secure. The company had invested heavily in layered controls across a distributed workforce, separating developer environments, segmenting cloud infrastructure, and tightly managing administrative access. Multifactor authentication (MFA) was enforced broadly, vulnerability scanning was routine, and annual penetration tests were part of the organization’s broader security…

Read more →

One of Meta’s AI models hacked into another company’s systems during a cybersecurity evaluation after a testing misconfiguration gave it internet access. Facebook’s parent company told the BBC it is investigating and plans to publish more information once it has established the facts. Recent incidents involving OpenAI and Anthropic have intensified scrutiny of whether cyber-capable…

Read more →

Most security teams don’t suffer from a lack of data. They suffer from a lack of certainty. Vulnerability scanners, annual penetration tests, and compliance assessments can generate thousands of findings. Yet they often fail to answer a simple question: Which risks actually matter? For a global investment firm operating across 18 locations, that question became…

Read more →

One of Meta’s AI models exploited a third-party security flaw during an evaluation, the latest in a series of similar incidents involving advanced AI systems

Read more →

Meta has become the third frontier AI developer in recent weeks to disclose a security incident involving one of its advanced AI models during cyber capability testing conducted by AI safety startup, Irregular, placing the independent evaluator at the center of a series of disclosures involving the industry’s leading AI labs. During a “capture-the-flag” test…

Read more →

The updated Cybersecurity Maturity Model Certification (CMMC) represents a critical evolution in the Department of War (DoW) strategy to secure the Defense Industrial Base (DIB). It is more than a regulatory hurdle. It is a direct response to a rapidly changing and increasingly hostile threat landscape faced by the DIB. Updated CMMC guidance issued in…

Read more →