Behind TikTok’s booming growth industry are fake engagements, stolen accounts, and a fast track to getting flagged.
Java Spring Boot “heapdump” scans, (Mon, Jul 27th)
Spring Boot exposes the endpoint “/actuator/heapdump” to collect debug information. By default, the endpoint will return a file heapdump.hprof, which…
Measuring the Tendency of AI Agents to Go Rogue
This essay was written with Barath Raghavan, and originally appeared in The Guardian . In July, Hugging Face, a company that hosts much of the world’s AI…
Ransomware Groups Increasingly Deploy EDR Kill Techniques
Halcyon’s latest quarterly ransomware report showed that while ransomware attacks are declining, obfuscation techniques are getting harder to fight against
GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a…
Revolut Alleged Data Breach – Hackers Claiming to Access Over 75 Million Users’ Records
Revolut is currently under scrutiny after hackers claimed to be selling a database containing records of more than 75 million users. However, the company…
NVIDIA Launches Open Secure AI Alliance to Strengthen AI Security with 36 Industry Partners
iNVIDIA has joined forces with 36 technology organizations to establish the Open Secure AI Alliance (OSAA), an industry-wide initiative focused on…
What the Trojan horse gets right (and wrong) about AI security
Agentic AI didn’t invent new risk. It removed the friction that used to keep environments in check.
CrowdStrike Joins the Open Secure AI Alliance to Advance AI Safety and Security
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: CrowdStrike Joins the Open Secure AI Alliance to Advance AI Safety and Security
EXCLUSIVE: Working Chat Dorking Exposes AI Conversations, Claude, ChatGPT, Grok
A growing privacy crisis is unfolding in the artificial intelligence sector as simple search engine “dorks” are revealing…
Better security starts with better questions
Learn how better questions, trusted AI, and human judgment help security leaders make confident decisions and build resilient systems.
Word worm crawls into Copilot, spreads chaos
Researcher says months of coordination with Microsoft have yet to produce a robust mitigation
TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments
Cybersecurity researchers have flagged fresh malicious cyber activity by a threat actor with ties to East Asia targeting government entities in the Middle…
CrashStealer Malware Targets macOS Users by Posing as Apple Crash Reporter
A newly identified malware strain named CrashStealer is targeting macOS users by disguising itself as Apple’s legitimate crash reporting utility. Designed…
Hackers Can Hijack Tor Browser Users Through a Single Malicious Web Page
A single malicious webpage is enough to compromise Tor Browser users running an unpatched build, following newly disclosed research into CVE-2026-10702.…
US Sanctions on VPN Service Briefly Disrupt Telegram’s t.me Link Shortener Due to Compliance Action
iTelegram’s t.me link-shortening domain briefly went offline earlier this week after a compliance action linked to US sanctions inadvertently affected the…
In the Mythos era, security belongs at runtime
Frontier AI cut time-to-exploit from years to hours. Why defense now has to happen at runtime.
Google to Patch Gemini Flaw That Lets Locked Android 16 Phones Send SMS and WhatsApp Messages Without PIN
Google is preparing to roll out a fix for a newly identified security vulnerability in its Gemini AI assistant that could allow unauthorized users with…
A week in security (July 20 – July 26)
A list of topics we covered in the week of July 20 to July 26 of 2026
Russian Intelligence Hackers Phish Signal Backup Keys to Hijack Accounts and Messages
Russian intelligence-linked hackers are trying to seize Signal accounts by posing as support staff and asking targets for backup recovery keys. The…
WP2Shell WordPress Exploit Technical Analysis and Real Attack Data
On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by…
macOS ClickFix Attack Deploys Atomic Stealer to Steal Passwords and Crypto Wallets
Mac users are being targeted by a ClickFix campaign that turns a fake verification prompt into a path for malware installation. Victims are persuaded to…
Microsoft Threat Intelligence Portal Retires August 1: 4 Checks Before the Cutoff
Microsoft is retiring its legacy Threat Intelligence portal on August 1. Security teams should verify licenses, permissions, investigation projects, APIs,…
Critical Ruflo MCP Bridge Flaw Lets Attackers Execute Commands and Hijack AI Agents
A critical security flaw in the open-source AI orchestration platform Ruflo has been disclosed, allowing unauthenticated attackers to execute arbitrary…