A threat actor used the open-source Hermes AI agent in unattended “YOLO” mode to automate post-exploitation activity during an alleged breach of Thailand’s Ministry of Finance. […]
Samsung just launched its latest lineup of phones, and Amazon has free gift card offers on every single one.
The White House is monitoring developments after OpenAI revealed earlier this week that one of the company’s AI systems went beyond its intended parameters during a security test and managed to hack into the infrastructure of the AI platform Hugging Face. According to Reuters, presidential technology advisor Michael Kratsios has been briefed on the incident.…
In this post, I will discuss luxury ORM Los Angeles and show you a realistic timeline for suppressing negative search results. In the high-stakes world of high-end commerce, your brand’s digital footprint is your most valuable asset. One disparaging article or a series of coordinated negative reviews can do more damage to your bottom line…
Dependency mapping focuses on what breaks, not what exists
Hackers are changing the DNS settings on Wi-Fi devices at hotels and conference centers to redirect users to fake Microsoft 365 login pages. […]
SSO failure modes create cascading authentication outages across connected services
House Armed Services Committee member urges faster cyber investments as China, Russia threats grow.
Anthropic’s latest Claude upgrade targets developers and enterprises with stronger coding, better reasoning efficiency, prompt-cache-friendly tool changes, and near-Fable performance at Opus pricing.
Recovery is only as fast as your understanding of what depends on what.
A recent uptick in lag and disconnects led me to reevaluate my home office setup. Here’s how I validated my solution.
Microsoft says a bug in its automated network maintenance request system caused Thursday’s massive outage by mistakenly removing IP routes from more devices than intended, disrupting Azure and Microsoft 365 services. […]
Attribute- and policy-based controls are makes minimum-necessary tractable without strangling care
Microsoft, along with more than two dozen tech companies, are pressing policymakers to support open-source AI systems and code across society, arguing that it will be a safer approach than attempting to restrict access or relying on a handful of closed, proprietary models. The open letter, posted Friday, draws parallels to the software industry of…
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware. “BlueNoroff has operationalised trust abuse by combining compromised industry contacts, social engineering, wallet
Achieve digital autonomy in critical infra with a ‘logically air-gapped’ model using eBPF, Cilium, and Cisco for secure, compliant cloud-native operations.
Cybersecurity vendor Coro has appointed three executives to lead EMEA sales, product strategy, and research and development as the company pursues international and channel growth. New executives take charge of EMEA, product, and R&D Among the hires are: Ingo Schaefer as Vice President of Sales, EMEA Dor Avrahami as Vice President of Product Itzik Schacher…
Resin art has become a popular corner of TikTok, with some videos attracting millions of views. But not every glossy, colorful post is what it claims to be. Scammers are using the look of handmade resin art to trick buyers, collectors, and even fellow artists into sending money for work that either doesn’t exist or…
Call of Duty Mobile players should watch out for a phishing campaign disguised as a free Call of Duty Points giveaway. Victims are asked to log in with their email address and password to claim free Call of Duty Points (CP), the game’s premium currency. They’re then redirected to a second page asking for their…
During an internal OpenAI security evaluation, a chain of AI models escaped its sandbox, reached the internet, and then accessed Hugging Face infrastructure to complete the test objective. OpenAI is a leading artificial intelligence (AI) research and deployment company. Its best-known product is undoubtedly ChatGPT. Hugging Face is a website where developers and researchers share…
Following insights from Bleeping Computer, Australian energy provider Origin Energy has confirmed a significant data breach affecting potentially millions of its customers, exposing a range of personally identifiable information.
As detailed in The Register, security researchers uncovered a vulnerability in Apple’s macOS Gatekeeper security feature that could allow malicious actors to replace legitimate applications with harmful versions.
The autonomous business of the future is being built. Certain skills are in high demand – and can help you stand out.
In a battle of the top Android watches, one does it a little better.
Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine. They codenamed the flaw Certighost. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync.
Chick-fil-A has confirmed that over 13,000 customers had their accounts breached in a wave of credential stuffing attacks targeting its website and mobile app between June 17 and June 19. […]
Slopsquatting, phantom squatting, and HalluSquatting all exploit the same late-binding attack pattern, where AI coding agents trust hallucinated package, repo, or domain names. ActiveState explains how pre-fetch verification and governed dependency management can help stop these attacks before malicious code enters the pipeline. […]
Understanding which party can take which API actions — and which party is accountable for the resulting configuration state — determines where security controls must be implemented
Dell’s 14S pairs a sleek design with excellent battery life, making it one of the best midrange PC I’ve tested in 2026.
Google has started rolling out a new way to recover access to your account if you’ve lost your phone or forgotten your password: a “selfie video” verification option. After recording a short video of your face during setup, you can later submit another video during account recovery to prove you are who you claim to…
AM/FM, NOAA weather band, solar and hand-crank charging, and a power bank – this tech is what actually works when the grid doesn’t.
Meta has introduced Facebook Verified, a free badge meant to show that a person behind a profile has completed identity verification through a selfie check. (Source: Meta) The company says the goal is to give users a signal that they are dealing with a person, not a bot or an AI-generated account, when browsing Marketplace…
A porous API endpoint exposes, names, email addresses, location, and site status, all of which can be easily gleaned by anyone with a browser.
Europol has flagged 4,340 URLs for removal during a multi-week operation targeting online content linked to “The Com,” a loosely organized network of nihilistic violent extremist groups. […]
If you’re only using Google Calendar to track events, you’re missing some of its most useful features.
Hunt.io uncovered a cyber-espionage attack on Thailand’s Finance Ministry using Hermes AI agent and Hades malware for reconnaissance and persistence. Researchers at Hunt.io have uncovered an intrusion targeting Thailand’s Ministry of Finance that offers a rare look inside a live cyber-espionage operation. Instead of recovering malware after the fact, the team found exposed staging servers…
Russian state-backed hacker group Laundry Bear has been breaking into government and commercial networks for at least a year by exploiting a vulnerability in the Zimbra Collaboration Suite (ZCS) webmail platform. Laundry Bear (also known as Void Blizzard, CL-STA-1114, and TA488) has been running the campaign since July 2025, according to a joint advisory from…
Chips, servers, cables, and more could compound an already massive problem – here’s who it affects and what’s being done about it.
You probably think of your phone’s security the way you think of your front door: as long as you’re downloading apps from the Play Store, you’re safe. And for the most part, that’s true. Google reviews apps before they’re published. But some apps reach your phone without ever passing through the Play Store. Take Albiriox,…
Researchers at ReliaQuest warned of widespread DNS poisoning attacks targeting the hospitality sector as part of a cyber espionage campaign
Cybersecurity researchers have disclosed a critical vulnerability in OpenAI’s ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim’s organization. The vulnerability has been codenamed AgentForger by Zenity Labs. The issue has since been addressed by OpenAI as of…
A crafted SVG submitted to Bing’s image search ran commands as NT AUTHORITYSYSTEM on Microsoft’s production image-processing workers, and as root on the Linux machines in the same fleet. XBOW’s testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing’s image tier, not on one bad…
AI agent security is moving through a familiar maturity curve: adoption, then visibility, and finally, control. But what we’ve collectively discovered is that enforcing least privilege for AI agents is harder than we ever imagined. This is why there are so many approaches, from prompt filtering to identity-layer access controls. Where we’ve collectively landed is…
An Illinois man was sentenced on Tuesday to 76 months in prison and three years of supervised release for hacking the Snapchat accounts of over 750 women to steal nude photos. […]
Tel Aviv, Israel, 24th July 2026, CyberNewswire
OpenAI’s chatbot tool ChatGPT ranked among the top 10 most impersonated brands in phishing attacks for the first time
Russian hackers from the TA488 group exploited a Zimbra webmail flaw triggered when emails were opened or previewed, stealing credentials and up to 90 days of messages from victims.
AI can help us sharpen our policy decisions – but we still have to know what to look for.
Agentic AI cuts alert noise by prioritizing and fixing real risks, not creating more work.
A court has dismissed Google’s case against SerpApi over that company’s scraping of search results to train AI models. The US District Court for the Northern District of California found that there was no indication that any copyright had been breached. Google announced in December that it was suing SerpApI for its alleged web scraping,…
Microsoft cloud and Azure services hosted on the West Coast of the US went down for hours on Thursday when network connectivity failed. Although services running entirely within Microsoft’s West US cloud region were unaffected, any traffic entering or leaving the facilities was affected. Microsoft has now published a Preliminary Post Incident Review (PIR) of…
Enterprise software developers continue to be in danger of falling victim to slopsquatting, where AI coding tools hallucinate the existence of nonexistent libraries and hackers create malicious packages in response. The top AI coding tools are remarkably consistent in their hallucinations: Researcher Aleksandr Churilov found the same 127 fake package names generated by five different…
Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”. “Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March…
Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”. “Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March…
Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand’s Ministry of Finance, which runs the country’s treasury and tax collection. The agent then worked through the ministry’s network on its own, checking hosts for ways to…
The European Commission provisionally found TikTok’s rules for minors’ accounts didn’t meet its bloc’s safety standards.
Dolphin X malware targets more than 300 apps and includes an AI Profiler that scores infected Windows PCs to help criminals identify high-value victims quickly.
The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings. The malware families in question are: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and a modified web browser credential
From tiny box cutters to bug-bite healers, these handy gadgets totally earn their place in your home for their form and function.
UAC-0099 delivers malware via a fake Notepad++ plugin after phishing, using a loader that sabotages itself if run without the correct arguments to hinder analysis. CERT-UA published a new advisory attributing a phishing campaign to UAC-0099, a Russia-aligned threat actor active since at least mid-2022 and previously known for exploiting WinRAR vulnerabilities and using phishing…
Microsoft is making Trusted Platform Module (TPM)-backed attestation a requirement for Windows Key Management Service (KMS), the on-premises service used for Windows volume activation, replacing the software-only trust model with hardware-backed verification to strengthen enterprise activation security. Attestation will become mandatory with the next Windows Server Long-Term Servicing Channel (LTSC) release. How TPM-backed KMS attestation…
The European Commission has fined Google a total of €890 million ($1 billion) for its breaches of the Digital Market Act (DMA). Just over half the fine — €460 million — was because Google illegally gave preference to its own services in Google Search results. The remainder was because in the Google Play store for…
AMD used its Advancing AI 2026 event in San Francisco this week to do something it has never quite managed before: stand in front of the whole AI industry and look like the…
Samsung’s Galaxy Watch 9 is light and comfortable, with helpful nudges to hydrate as you exercise.
Comparitech’s analysis of incidents in the first half of 2026 finds that the emergence of The Gentlemen ransomware has resulted in surge in attacks against higher education
Google has launched a preview of CodeMender, an AI agent built to scan code for security flaws, confirm they are exploitable, and generate fixes for developers to review. (Source: Google) The company describes it as a response to attackers who are already using AI to speed up their work, arguing that defenders need automation that…
Artificial intelligence adoption is soaring, but consumer trust lags. Transparency, human oversight, and clear AI use cases are key to closing the trust gap. Businesses are rapidly adopting AI, with 93% planning deployment, but consumer trust lags far behind: only 23% trust companies to use AI with their data, revealing a major “AI trust gap.”…
Google’s selfie video sign-in option verifies that an account owner is a real person and that the account wasn’t created or used by computer programs or bots for the purpose of abuse, such as spamming. It is not available for all regions, accounts, or devices. Source: Google A selfie video is recorded and securely stored…
US agencies warn Russian group Laundry Bear is exploiting a patched Zimbra flaw to steal email accounts from organizations running unpatched servers. The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI) and other U.S. government and international partners published a joint advisory to warn that the Russia-linked APT…
Channel partners accustomed to competing for customers, talent, and market share are increasingly turning to one another for help navigating technology shifts and improving their operations. At Ingram Micro’s recent Unplugged event, partners described exchanging technology strategies, leadership lessons, and even stories of failed business decisions with companies that might otherwise be considered competitors. Those…
Kiteworks and A-LIGN have formed a strategic partnership to help Defense Industrial Base (DIB) organizations strengthen sensitive-data controls and prepare for CMMC Level 2 assessments, creating a new compliance-services opportunity for MSPs and MSSPs serving federal contractors. CMMC review creates uncertainty, not a compliance pause The announcement comes as the federal government conducts a 60-day…
As enterprises race to adopt generative AI, Forcepoint is introducing a new platform aimed at helping organizations—and the partners supporting them—govern how sensitive data is accessed, shared, and protected. AI Data Security combines AI governance with data security controls to monitor sanctioned AI applications, shadow AI, and autonomous agents from a single platform. Forcepoint connects…
Keyfactor, a trust infrastructure for AI and machines organization, has announced the expansion of its Global Partner Program. The partner program enhancement enables partners to build new advisory, implementation, and managed services for helping customers modernize digital trust as organizations prepare for the transition to post-quantum cryptography (PQC). It will equip partners to deliver crypto-agility…
Artificial intelligence is accelerating cloud adoption, infrastructure demand, and spending, forcing enterprises to replace periodic optimization reviews with continuous management. In this Q&A with Channel Insider, Joaquim Alfaro Camps, global director of cloud advisory and FinOps services at Syntax, explains how the shift is also changing the role of cloud consultants—giving them new tools to…
Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and says its AI pentest agents found them in a six-hour review of the forum software’s source code. Every version before 4.14.0 is affected. NodeBB has fixed them all, and administrators…
The Clop ransomware gang (also tracked as Cl0p) is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign. […]
Cybercriminals are actively exploiting a recently discovered vulnerability in Palo Alto Networks firewall and VPN appliances to deploy the Qilin ransomware strain. A critical authentication bypass flaw (CVE-2026-0257) in Palo Alto GlobalProtect portal and gateway was the common link in a series of intrusions in June, Arctic Wolf Labs warns. Exploitation of the vulnerability came…
The AI security layer and guardrails for many AI products don’t evenly protect against jailbreaking and unsafe actions in every single language.
Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL and the bundled RedisBloom module. Redis says the underlying memory flaws may lead to remote…
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new campaign that involves the use of a malicious program that’s dressed up as a Notepad++ plugin to compromise Windows systems. The activity has been attributed by the agency to a threat cluster it tracks as UAC-0099, a Russia-aligned group that has previously…
Pop the hood on a new car and you won’t find much you can fix with a wrench. What you’ll find is software, and a lot of it. The screen in the dash probably runs Android or a flavor of Linux. The system watching the road for you might run QNX or VxWorks, the same…
Enterprise AI leaders from ZoomInfo, Docusign and AppViewX share what it took to build AI Centers of Excellence and govern agent identities inside two companies operating at scale. What you’ll take away: What an AI Center of Excellence looks like day to day at ZoomInfo and Docusign How to govern agent identities without standing up…
A ransomware attack against a hospital makes headlines, while attacks on the rest of the ecosystem around it tend to stay quiet despite doing damage that can be just as bad. Flare researcher Assaf Morag analyzed ransomware leak-site activity tied to healthcare organizations in the EMEA region between 2024 and 2026, and found that ransomware…
An employee gets an email dressed as a password reset. She clicks the link, types her credentials into a page built to copy her company’s login screen, and moves on with her morning. She tells no one. That silence is the exposure. Across 13.9 million simulated phishing messages, one in ten recipients flagged the attempt…
Ransomware activity followed a recognizable pattern during the previous four years. Each year was defined by a dominant actor, its collapse, or a major supply chain incident. Black Kite’s 2026 Ransomware Report documents a more fragmented market, with multiple ransomware playbooks scaling at the same time. Monthly victim count by threat actor (Source: Black Kite)…
Here’s a look at the most interesting products from the past week, featuring releases from Astelia, Druva, Swimlane, and ThreatDown. Druva brings backup, recovery and governance to AI workloads Druva has announced Druva AI Resilience, a new approach that helps organizations recover, govern, and defend the systems, activity, and context behind AI-powered work. The launch…
As Australians grapple with rising living costs and mounting environmental concerns, Cricut and Salvos Stores are asking a simple question: what if the next beautiful piece in…
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
New multi-year agreement enables NiCE to resell RingCentral’s industry-leading UCaaS solution; companies also extend their long-standing agreement to market and sell…
Xi confidant leads fevered effort for domestic alternatives to win AI race. Chinese AI companies get warned that anyone who resisted using local chips was a traitor.
New digital portal already supporting 210,000+ workers with more than $100 million in levy payments processed
A monthly security-only, stability-first cadence delivers speed without the regression risk
