Cybersecurity Veteran Offers Career Advice for Downturn Anxiety
A seasoned security professional shares a pep talk on managing self-doubt and building connections during tough tech times.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
OpenAI Engineers Reconstruct Hugging Face Incident at Black Hat USA
OpenAI's Black Hat USA session reconstructs the Hugging Face incident to draw lessons on AI safeguards and cyber resilience.
BambooToken Malware Hijacks MQTT for Cross-Platform Command
Researchers reveal a new malware family that abuses a common IoT messaging protocol to control Windows and Linux systems.
SANS ISC Maps Expected First-Boot Traffic for macOS 27
A SANS ISC diary gives defenders a baseline for macOS 27 network behavior before login.
Why Testing Single Attack Techniques Fails to Catch Real Threats
Security teams must shift from evaluating isolated techniques to simulating full attack chains to uncover true vulnerabilities.
Mass-Scanning Attack on Vite Dev Servers Steals Cloud Credentials
Automated scans are exploiting exposed Vite development servers to harvest cloud credentials and configuration data.
Human Attacker Reaches SSH Bastion in 8 Seconds After Marimo RCE
Sysdig findings show a skilled human operator moved from initial access to an SSH bastion in eight seconds, underscoring that speed is no longer AI's exclusive advantage.
AI-Driven Credential Theft Demands Stronger Identity Checks
AI is scaling credential theft, so identity security must verify both user and device, not just successful logins.
Malicious npm Package 'imgdecode' Hides Shellcode Loader in Windows Addon
The newly discovered npm package extends a long-running MALFEX supply chain campaign that targets Windows developers with stealthy shellcode loaders.
Compromised ConnectWise Backup Credential Breached 173 Microsoft 365 Tenants
Researchers say attackers used a stolen vendor credential to reach dozens of Microsoft 365 tenants, and they warn that disabling the app alone may not be enough.
Schneier's Squid Post Doubles as Security News Thread
A paleontology note on prehistoric squid becomes an open thread for security stories Schneier hasn't covered.
SAP Patches Critical NetWeaver and S/4HANA Flaws
SAP addresses critical vulnerabilities that could allow full system compromise.
F5, Juniper Networks Release Critical Security Patches
New patches address critical vulnerabilities that could let attackers execute code and take over devices.
Cybersecurity job postings hit four-year low as GRC roles grow
US cybersecurity job postings fell to a four-year low in 2026, with growth shifting toward governance, risk, and compliance roles.
AOMEI Backupper Update Servers Tampered With for Minutes to Plant Backdoor
Attackers exploited AOMEI Backupper's unsigned update metadata in short windows to deliver a backdoor to machines that happened to check for updates.
Windows SmartScreen Enclave Broken by Four-Byte Write and Timing Bug
Researchers ran code inside a protected Windows enclave, prompting a critical September patch.
AI exposure grows fast while legacy systems lag, Censys finds
New research from Censys shows the internet's attack surface is uneven: AI services are expanding rapidly with weak security, while older systems remain exposed for years.
Unpatched Fridge Firmware Costs EU Grocers Millions
A report shows that outsourcing OT management left hundreds of grocery stores exposed to costly cooling-system failures.