Corey Thuen hires hackers for what he calls ‘the evil bit’ — an adversarial streak he believes is either there or it isn’t.
Two critical RCEs in PHP core
Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain…
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-114625…
New Serious PHP Vulnerabilities Released and Patched
PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can…
AI Guardrails Aren’t Stopping Criminal Hackers
Hackers around the world are all-in on using agentic AI to wage attacks—and manipulating tools like Anthropic’s Claude to help them carry out their crimes.
OpenAI’s coding agents talked themselves out of being monitored
Two AI coding agents running inside OpenAI silently weakened the systems built to catch AI misbehavior, and one of them then told its human operator it…
CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors
This post has no text preview — click the link below to read the original article. This article has been indexed from CISA News Read the original article: CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple…
FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
The group has been linked to a 2025 attack targeting technology firm Ingram Micro.
Russia-Linked Hackers Target NATO Defense Contractors in European Espionage Campaign
Cybersecurity researchers have uncovered an espionage operation targeting defense-related organizations in Europe, including a naval shipbuilder, a…
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in…
PHP devs publish critical bug fix as site owners warned: Pull ’em offline if you’re unpatched
Websites down as precaution as exploits have already been published
PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches
PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned…
Machine speed attacks require machine speed detection and response
Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks…
DOQEX Achieves Cyber Essentials Certification to Strengthen Security Standards
UK-based secure data exchange specialist DOQEX has achieved Cyber Essentials certification, adding another recognised security standard to its existing…
Decades-Old Windows Utility Powers Modern ClickFix Attack
The attack uses malicious Google search results related to Amazon and leverages the “finger” utility to launch a CAPTCHA that installs malware, including…
Operation Serengeti III: Three Years of Collaboration Against Cybercrime
Fortinet examines Operation Serengeti III and three years of collaboration with INTERPOL and the World Economic Forum Cybercrime Atlas to disrupt…
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Cisco Talos observed abuse of more than 25 legitimate…
Agentic AI helps hackers level up, even without detailed instructions
Low-skilled hackers are likely to become a lot more dangerous over the next 12 months, CrowdStrike warned.
OVHcloud CLI Packages on GitHub Were Replaced With Secret-Stealing Malware
Attackers replaced the binary releases of OVHcloud’s open-source CLI tool on GitHub with malicious builds designed to harvest secrets from developer…
Microsoft shares how to fix broken Exchange Online EWS apps
Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. […]
FCC bans two devices with surveillance chips linked to Huawei
The banned items — a wireless video transmitter and dashboard camera — are made with chips manufactured by Huawei subsidiary HiSilicon, which markets its…
What Is Scareware? How to Spot and Remove Fake Alerts
Scareware uses fake virus alerts to scare you into paying or downloading malware. Learn how to spot these pop-ups, remove them and keep your devices safe.
“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration.
European and Ecuadorian cooperation leads to 20 arrests in major hit against drug trafficking
The operation, codenamed Operation CANTABRIA, underscores the success of strong cooperation between European and Ecuadorian law enforcement agencies,…