Reporting is aggregated and cross-verified across multiple authoritative sources. Stories are clustered, de-duplicated, and tagged by category, vendor, and threat actor. Filter to your role, pin your stack, subscribe or point your reader at a feed. No account required.
Browse latest storiesSkip to latest storiesRanked by distinct source count; recency breaks ties.
Grouped because: shared entities: ENVIRONMENTAL PROTECTION AGENCY, INFRASTRUCTURE SECURITY AGENCY, INTERNET-EXPOSED PLCS
Grouped because: title similarity 60
Grouped because: title similarity 59
Grouped because: title similarity 74
Grouped because: title similarity 59
Grouped because: title similarity 61
Alation, a data search and AI platform provider, confirmed unauthorized access to its systems following an incident on Tuesday. The company is actively investigating the breach and its scope.
Why it matters: Organizations using Alation for data governance and AI features need to contact the company immediately to understand what customer data or credentials may have been exposed and what remediation steps are required.
This technical article demonstrates how to use Microsoft Graph API and PowerShell to enumerate Microsoft 365 and Entra user accounts, licenses, and sign-in activity. The author provides code examples to identify stale accounts, unused licenses, disabled users, and last authentication timestamps, then export findings to CSV or GridView for operational review and cost optimization.
Why it matters: Microsoft 365 administrators and security teams can use these queries to discover inactive accounts that may pose a credential or licensing risk, and to audit unused license spending across their organization.
Hackers are actively targeting internet-connected Siemens controllers deployed in water facilities across the United States. The attackers are leveraging artificial intelligence (AI) tools to enhance their targeting capabilities against these critical infrastructure assets.
Why it matters: Water utility operators and critical infrastructure defenders must immediately audit exposed Siemens controllers and restrict internet connectivity to these devices; water supply disruption poses direct public health risk.
Atlassian and Splunk have released patches for dozens of critical and high-severity vulnerabilities that could allow attackers to execute arbitrary code, access sensitive data, and escalate privileges. The specific vulnerabilities and affected versions were not detailed in the available source material.
Why it matters: Organizations running Atlassian and Splunk products should prioritize patch deployment immediately to close remote code execution and privilege escalation exposures affecting their collaboration and security monitoring infrastructure.
Citrix has disclosed two vulnerabilities in NetScaler Gateway and NetScaler ADC products and is urging customers to apply patches immediately. The company has issued guidance for admins to secure affected systems against these flaws.
Why it matters: NetScaler administrators and organizations running Gateway or ADC appliances need to prioritize patching to prevent exploitation of these newly disclosed vulnerabilities in remote access and load balancing infrastructure.
Organizations deploying autonomous AI systems should implement safeguards, sandboxing, and active oversight to realize their benefits while limiting unintended activity. The approach balances operational gains against the cyber risks introduced by agentic AI.
Why it matters: Practitioners deploying or securing autonomous AI systems need guardrails to prevent unauthorized or harmful actions that agents might take independently.
Cisco released patches for critical vulnerabilities in Crosswork and Secure Workload products that could allow remote code execution, authentication bypasses, and path traversal attacks.
Why it matters: Organizations running Crosswork or Secure Workload must prioritize patching to prevent unauthorized code execution and access control circumvention.
Corero Network Security announced AI-Augmented Cloud-Assist for SmartWall ONE, a feature that combines cloud-delivered AI analysis with threat intelligence to improve DDoS protection. The system identifies emerging attack patterns and generates protective policies that can be deployed manually or automatically within seconds.
Why it matters: Organizations running Corero DDoS solutions gain faster threat identification and policy updates, helping them respond to AI-driven attacks with reduced latency.
AWS has implemented an approach to propagate user authorization context through AI agents, enabling infrastructure and downstream services to enforce access controls instead of relying on the agent itself. This prevents agents from returning sensitive information to unauthorized users, even if the agent is manipulated during a request. Customers using Amazon Bedrock AgentCore can now build agents that safely pull data from DynamoDB, document repositories, SaaS platforms, and knowledge bases while maintaining user-level permission boundaries.
Why it matters: Organizations deploying AI agents on AWS need to understand this authorization mechanism to prevent data leakage and ensure agents respect user access controls across integrated services and repositories.
Atalanta's Argo product has been deployed to demonstrate the resilience of Viasat's satellite communications network following a 2022 Russian hacking incident. The tool provides AI-assisted security verification for the network infrastructure.
Why it matters: Satellite operators and critical infrastructure defenders should understand how AI-assisted assessment tools can validate network recovery and strengthen defenses against nation-state adversaries targeting communications systems.
The Cybersecurity and Infrastructure Security Agency (CISA) has warned federal agencies that threat actors are actively exploiting a critical vulnerability in MLflow, an open-source AI engineering platform. This ongoing exploitation prompted CISA to issue guidance to federal stakeholders on remediation and defense measures.
Why it matters: Federal agencies and organizations using MLflow in production must prioritize patching this critical vulnerability immediately, as active exploitation by threat actors presents immediate compromise risk.
Grouped because: title similarity 69
Researchers at Cycode disclosed a vulnerability chain (CVSS 9.4) in AIT-GUI, NASA/JPL's browser-based operator console for the AMMOS Instrument Toolkit, that permits unauthenticated attackers to send arbitrary commands to spacecraft and instrument command systems. The flaw affects the open-source software used for mission operations.
Why it matters: Space agencies and organizations operating JPL's AMMOS toolkit face immediate risk of unauthorized spacecraft command injection; practitioners should assess exposure and apply patches or network controls to restrict access to AIT-GUI immediately.
A malicious executable disguised as a Google Gemini installer was deployed to deliver the Vidar infostealer on an EMEA company network. The attack leveraged Google Colab, a legitimate cloud-based platform for code execution, as a distribution vector to host and serve the malware payload.
Why it matters: Security teams managing enterprise networks must monitor for trojanized downloads of popular tools and recognize that legitimate platforms like Google Colab can be abused for malware delivery, requiring controls beyond traditional file reputation checks.
Cybersecurity researchers identified an updated version of ToxicPanda (TgToxic), an Android malware that now supports 167 remote commands and targets over 140 banking and cryptocurrency applications. The new variant expands the malware's global reach and includes a PIN harvesting workflow for on-device fraud.
Why it matters: Mobile banking users and financial institutions face increased risk from enhanced Android malware that can execute numerous remote commands and steal authentication credentials from legitimate finance and crypto apps.
OpenAI has implemented new security measures for its models, including sandboxing, 30-minute alert thresholds, and training pauses, in response to recent incidents like the Hugging Face compromise and discovery of advanced capabilities in the Astra model.
Why it matters: AI platform operators and enterprises deploying OpenAI models should understand these new safeguards and their implications for model safety, incident response timelines, and operational procedures.
Manic is a newly identified Android malware affecting users across multiple European countries that includes a fallback mechanism to exfiltrate data through nearby infected devices when direct communication is unavailable.
Why it matters: Android users in Europe should be aware of this malware's novel peer-to-peer data exfiltration capability, which could allow attackers to steal information even when direct network access is blocked.
Cisco Talos identified UAT-10147, a Chinese-speaking threat actor operating a sophisticated multi-platform intrusion toolkit targeting IIS and Linux servers for SEO fraud monetization and persistent access. The actor's SPECTRE backdoor features cross-platform command-and-control, process injection, credential theft, and Bring Your Own Virtual Driver (BYOVD) based EDR bypass via vulnerable kernel drivers. The Specter Linux rootkit component demonstrates AI-assisted code generation in its development, providing kernel-level persistence through ftrace-based syscall hooking and signal-based inter-process communication that survives reboots and user-level security controls.
Why it matters: Organizations operating internet-facing IIS and Linux servers are at immediate risk of compromise by this operationally mature actor; defenders should hunt for BYOVD driver abuse (CVE-2019-16098, CVE-2021-21551), ASHX web handlers, BadIIS malware, and registry modifications from named-pipe impersonation attacks, and consider blocking the actor's known vulnerable drivers at the kernel level.
Unit 42 reports on attackers leveraging enterprise collaboration tools to conduct identity phishing and steal credentials. The research identifies how trusted communication channels become vectors for credential compromise and outlines mitigation strategies.
Why it matters: Security teams managing enterprise collaboration platforms must review access controls and user awareness training, as these tools are now primary targets for credential theft that bypasses traditional email filtering.
Researchers found that Peer2Profit, a bandwidth-sharing app installed legitimately by users, feeds proxy nodes into Astroproxy, a commercial proxy service, with a markup of up to 27 times the user payment. Over 72 hours, the enumeration detected 117,224 unique IPs across Astroproxy's pools, with the residential pool adding over 1,000 new IPs per hour, making traditional reputation-based detection ineffective. The infrastructure poses a concrete risk: any employee can install Peer2Profit on a corporate device undetected by antivirus, turning the organization's IP space into a proxy exit node, and researchers demonstrated that Astroproxy's internal IP filter can be bypassed using DNS to access corporate routers and internal resources.
Why it matters: Security teams must audit for Peer2Profit and similar bandwidth-sharing apps installed by employees on corporate devices or personal devices on the network, since they are not flagged as malware and expose internal resources to proxy subscribers; defenders should implement proactive enumeration of proxy networks rather than relying solely on reactive IP reputation signals.
Police departments in Wapello County, Iowa are using Flock automated license plate reader (ALPR) cameras while operating under a usage policy that explicitly prohibits disclosing the surveillance tool to suspects or documenting its use in arrest reports and complaints. The secrecy directive mirrors historical law enforcement practices with earlier surveillance technologies like IMSI-catchers, where agencies sought to conceal investigative methods from public scrutiny.
Why it matters: Security practitioners and compliance officers should monitor law enforcement surveillance practices and their integration into security infrastructure, as undisclosed ALPR usage raises questions about transparency, due process, and the evidentiary standards applied in criminal cases.
No stories match your current filters. Reset search and filters to show all stories.
See the daily change brief for what changed since the previous snapshot. Looking further back? Browse the daily archive, this feed's own history.