News
Plain-English guides on web security, compliance, and keeping your clients protected.
Researchers at the Hong Kong University of Science and Technology say malicious add-on “skills” for AI coding agents can be modified to bypass static security scanners without breaking their behavior....
Read article →The source code for KSOS, an early security-focused Unix-like operating system funded by the U.S. Department of Defense in the late 1970s and 1980s, has been made publicly available through The Unix H...
Read article →Financial institutions continue to allow some customers to log in without multi-factor authentication, a gap that can make account takeovers easier for criminals, according to a recent account of a re...
Read article →A U.S. government organization appears to have paid roughly $1 million after attackers threatened to publish stolen data, according to a new case study from Ransom-ISAC researcher Rakesh Krishnan. The...
Read article →Researchers say a North Korean-linked threat group tied to the long-running Contagious Interview campaign has released 108 distinct malicious packages and browser extensions across several software ec...
Read article →New academic research is casting doubt on a core trust mechanism used in confidential computing, a technology that vendors and policymakers have promoted as a foundation for sovereign cloud services a...
Read article →Security researchers at runZero have disclosed seven vulnerabilities in FatFs, a compact filesystem library widely embedded in firmware for devices that read and write FAT and exFAT media. The softwar...
Read article →A newly disclosed Linux kernel vulnerability dubbed Bad Epoll could allow a local, unprivileged user to gain root access on affected systems, according to a public research write-up. The flaw is track...
Read article →Security researchers have identified a previously undocumented modular malware framework called Avalon that appears designed to support a full intrusion lifecycle, from initial access and credential t...
Read article →Researchers have uncovered a new software supply chain operation involving malicious npm packages that imitate legitimate Rollup polyfill tooling and appear to be tied to North Korean threat actors. T...
Read article →Researchers have linked a previously unreported threat group, known as Armored Likho, to cyberattacks against government agencies and electric power organizations in Russia, Brazil, and Kazakhstan. Se...
Read article →The Citizen Lab has reported that Stelios Kouloglou, a former member of the European Parliament, was repeatedly targeted with Pegasus spyware while he was serving on a committee examining the misuse o...
Read article →