Исследование показало, как боевики применяют нейросети при планировании атак, ремонте оружия и решении технических задач.

Узнайте, как управлять безопасностью конфигураций и снижать риски ИТ-активов с помощью бесплатной версии «Контроля конфигураций».

Специально подготовленный образ способен повредить память и выполнить код до проверки цифровой подписи.

Anthropic встроила в чат-бота маленького надзирателя. И он знает о вас буквально всё.

Фирменный браузер сервиса начал тихо убивать рекламные вставки.

Эксперимент физиков доказал, что экстремальные космические процессы можно изучать на лабораторном столе.

Чарльз был уверен: в этих полосах на склонах есть какая-то система. Оказалось, он был прав.

Подходы к построению инфраструктуры для них развиваются в дисциплине Platform Engineering, которая существенно изменилась с появлением Agentic AI.

Константин объяснил:«Заказчики приходят за инфраструктурой для ИИ и готовой платформой поверх неё, а не за реализацией конкретной функции через ИИ.

Необходимо детально проработать экономическую модель внедрения и эксплуатации — выполнить расчёт совокупной стоимости владения (Total Cost of Ownership, TCO) при построении ИИ-агентских платформ».

Перспективы внедрения в России проприетарных западных решений (в их полноразмерной конфигурации) достаточно неопределённы.

Внедрение изменений с появлением ИИ — это долговременный процесс, общие контуры кото…

Данный инструментарий призван помочь в борьбе с «теневыми ИТ», которые являются источниками целого комплекса проблем в компаниях и с которыми очень сложно бороться.

Методы атак на организацииПоловина успешных атак приходится на программы-шифровальщики и вайперы, направленные на уничтожение данных в инфраструктуре (рис.

Это в «Лаборатории Касперского» связали с тем, что от компании, даже небольшой, за один эпизод можно получить больше, чем от обычного человека.

Но и в том, и в другом случае злоумышленники крадут данные.

Продукты от Qihoo 360 и K7 Computing, так же как и Check Point / ZoneAlarm, предназначены для конечных пользователей и малого бизнеса.

С 1 июля 2026 года биометрия станет дополнительным способом подтверждения личности при подаче документов в Росреестр в электронном виде при сделках с недвижимостью.

Данная процедура применима к основным сделкам с недвижимостью:Покупка и продажа квартир, домов и земельных участков как на первичном, так и на вторичном рынке.

Пока биометрия будет использоваться скорее в исключительных случаях как дополнительное средство идентификации личности при совершении дистанционных сделок с недвижимостью и исключительно добровольно».

Также с 2024 года некоторые банки начали использовать биометрию при заключении ипотечных договоров, и в этом сегменте существенных проблем также не выявлено.

Они связаны как…

В ПО злоумышленники подменяют библиотеки, внедряют вредоносный код в программные зависимости или используют уязвимые компоненты с открытым исходным кодом.

Атаки на цепочки поставок выросли на 110 % за год и уже составляют до трети всех инцидентов.

При следующем запуске агент подключается к серверу злоумышленников и выполняет их код с правами пользователя без песочницы и дополнительных запросов.

«Солар» отмечает, что первом квартале 2026 года на промышленность пришлось 48,8 тысячи кибератак, на 14 % больше, чем годом ранее.

Единственный рабочий подход — относиться к цепочке поставок как к критической инфраструктуре: проверять источники, фиксировать версии, контролировать плагины и образы, из…

И наконец, появляется новый класс задач — защита сотрудников, использующих ИИ в работе, что требует отдельных политик и инструментов.

В первом опросе зрители поделились, где они уже используют или тестируют ИИ в кибербезопасности (мультивыбор):Реагирование на инциденты и подготовка отчётов — 54 %.

Артём Гяммер считает, что ИИ в реагировании может выступать скорее в роли консультанта или ассистента.

Рекомендации по внедрению ИИ в кибербезопасностьАндрей Гунькин предложил три шага:Определить, какие процессы уже есть в компании.

Фишинговые письма пишутся без ошибок и на любом языке, вредоносный код генерируется за секунды, а дипфейки становятся неотличимы от реальности.

Покупатель формирует заказ, переходит к оплате, и в этот момент сайт отправляет запрос к API с параметром 'order_id=345'.

Сканер безопасности, который настроен на автоматическое сканирование, в это время проверяет веб-формы на наличие классических уязвимостей: подставляет кавычки, угловые скобки, длинные строки и смотрит на коды ответов.

Он не падает, не выдаёт трассировку стека, не тормозит — он просто отдаёт данные.

Он не может показать, что в одном случае показана личная информация, а в другом — чужая.

А злоумышленник в это время спокойно меняет цифры в адресной строке, потому что разработчики забыли добавить одну проверку, а автоматическая проверка её не требует.

Информация, которую пользователь добровольно раскрывает, а также данные о его поведении в сети становятся объектом монетизации со стороны платформы.

Однажды опубликованная информация хранится в интернете годами, а фактически — остаётся в сети навсегда.

Сегодня эта технология применяется для атак как на компании, так и на частных лиц в самых разных формах.

Такая привычка ведёт к поверхностному восприятию новостей, снижению способности осмысленно оценивать контент и в перспективе — к полной потере интереса к изучаемому материалу.

Такая привычка ведёт к поверхностному восприятию новостей, снижению способности осмысленно оценивать контент и в перспективе — к полной потере интереса к изучаемому …

Это же относится и к другим программно-аппаратным комплексам — от банкоматов и вендинговых автоматов до промышленных контроллеров.

Это касается, в частности, специалистов по безопасности приложений, которые занимаются поиском ошибок и уязвимостей, в том числе в ядре и драйверах.

Г. В. Плеханова Борис Фёдоров отметил, что системные программисты востребованы и в финансовом секторе и финтехе.

Спрос на системных программистов и в целом на разработчиков высокой квалификации в России остаётся высоким, несмотря на обсуждения сокращений.

Ситуацию усугубляет региональный дисбаланс: например, в Москве закрытие вакансии занимает в среднем 52 дня, тогда как в Новосибирске — 68 дней.

По данным объединения Business Software Alliance (BSA), по состоянию на конец 2021 года уровень использования нелицензионного ПО в России составил 62 % (рис.

Основные показатели мирового рынка нелицензионного ПО по итогам 2021 годаРечь идёт о заведомо нелицензионном ПО.

По его словам, в нелицензионных продуктах код модифицируется, тогда как в ПО, приобретённом легально, таких изменений не происходит.

Аналогичная ситуация наблюдается и в других сегментах, в том числе в сфере информационной безопасности.

Чем меньше точек доступа к таким продуктам — как в офлайн-, так и в онлайн-среде, — тем ниже уровень их использования.

В 2024–2026 годах в России были полностью заблокированы Signal и Viber, а с августа 2025 года в Telegram и WhatsApp* ограничена возможность звонков.

Он использует сквозное шифрование, минимальный сбор метаданных и архитектуру, при которой сервис не владеет ключами и не может расшифровать сообщения.

Поэтому мессенджеры с шифрованием, но с активным сбором метаданных, например WhatsApp*, — безопасны, но не анонимны.

Ключи хранятся локально, сервер передаёт лишь зашифрованный контейнер и не может открыть его даже при физическом доступе к инфраструктуре.

В России Signal заблокирован с августа 2024 года и не включён в реестр ОРИ.

Это создаёт повышенные риски для безопасности, поскольку центры сертификации являются, по сути, «рубильником» для поддержки работоспособности сети.

Новое комплексное решение Astra Server Core призвано решить задачу выбора платформы для миграции с платформы Microsoft.

Например, они допускали ретроспективную выдачу сертификатов для обхода выпущенных позднее требований по безопасности или иногда применяли неадекватные методы проверки сертификатов.

Инициированное недоверие в адрес Symantec привело к крупнейшей миграции сертификатов в истории интернета.

Сервис PKI в Astra Server CoreНо вернёмся к анонсу комплексного решения Astra Server Core.

Принятое решение выглядит сомнительным хотя бы потому, что в сертификатах не указывается разграничение на территорию их применения.

Поэтому в GlobalSign приняли «соломоново решение»: лучше запретить больше требуемого, чем обеспечивать контроль за разрешениями.

Влияние решения GlobalSign на российский рынокНынешнюю ситуацию на рынке центров сертификации нельзя назвать безоблачной.

Решение компании Positive TechnologiesОднако остаётся вопрос, насколько значимым является решение GlobalSign для российских компаний.

Проблемы требуют решенияНа первый взгляд может показаться, что отзыв сертификатов GlobalSign имеет только «косметический» эффект.

В первом опросе зрители поделились, на каком этапе разработки ПО в их компании подключается информационная безопасность:На этапе требований и архитектуры — 36 %.

Проблема безопасности в том, что в команде AppSec есть экспертиза, которой нет в других командах, поэтому их выделяют в отдельные подразделения.

Переключиться с прототипа на качественное решение в этот момент оказывается сложно, и в результате в продукт попадает код, изначально не рассчитанный на промышленную эксплуатацию.

Александр Лысенко , ведущий эксперт по безопасности разработки и ИИ, К2 Кибербезопасность.

Инструмент должен давать реальные результаты, и с этими результатами нужно работать — обрабатывать срабатывания, исправля…

Мировой рынок AI Secure Gateway и AI Firewall уже оценивается в миллионы долларов, а по России цифр пока нет: рынок ещё не сформировался.

ВведениеКак устроен рынок AI Secure Gateway / AI Firewall:Оценки мирового рынка AI Secure Gateway / AI Firewall различаются, но по всем прогнозам он будет только расти.

Что такое AI Secure Gateway / AI FirewallAI Secure Gateway или AI Firewall выступает барьером между внешней сетью и ИИ-приложением.

Мировой рынок AI Secure Gateway / AI FirewallВ 2025 году мировой рынок AI Firewall оценивался в 260,76 млн долларов США.

Мировой рынок AI Secure Gateway / AI Firewall (сгенерировано ИИ)Драйверы роста рынка AI Firewall / AI Secure Gateway во многом носят очевид…

ВведениеГенерация голоса и видео в реальном времени стала рабочим инструментом мошенников.

Участники сосредоточены на содержании разговора, а не на качестве изображения; запись встреч часто отключена, а полноценные проверки «живости» отсутствуют — инъекционная подмена проходит незаметно.

Теперь к тексту добавляются голос и видео, и фильтров почтового шлюза уже недостаточно.

Это снижает точность как на подделках, так и на реальных записях.

Что можно сделать уже сейчас: чек‑лист для компанииНужны простые процессные меры, которые работают независимо от качества видео и голоса.

Хотя ради эксперимента исследователи прямо вписали в PNG слова "вредоносная промпт-инъекция" и явный приказ читать .env — и ревьюер все равно не увидел угрозы.

Именно в картинке и спрятан вредоносный приказ — прочитать .env побайтово, превратить каждый байт в число и вписать результат в код.

Тот при запуске читает AGENTS.md, идет по ссылке на картинку, открывает .env и вписывает в новый модуль ту самую константу.

Важно добавить, что Ghostcommit — это proof-of-concept в изолированных репозиториях с подставными ключами, а не зафиксированная атака в реальной жизни.

Важно добавить, что это собственные замеры компании, у которой в данной ситуации есть коммерческий интерес — продать собственный и…

Ведь превращение генеративных моделей в самостоятельные сущности в информационных сетях ознаменовало начало совершенно новой эпохи внутри сферы информационной безопасности.

Нажатие кнопки подтверждения превращается в обыкновенное юридическое алиби для алгоритма, поскольку времени на осмысленную оценку предлагаемых действий попросту не остается.

Искусственная «совещательная пауза» обязана восприниматься специалистами отрасли не как операционная слабость архитектуры, а как ценнейший стратегический актив, страхующий глобальную инфраструктуру от катастрофических сбоев.

Итоги четвертой частиТаким образом, строгое соблюдение баланса между автоматизацией реакции механизмов и обязательным надзором …

Она эмерджентна: корпорации хотят выручку, облака привязывают клиентов, государства ищут рычаги, и в сумме получается глобальная империя без рептилоидов.

Власть здесь даёт не только объём данных, но и контроль их происхождения, разметки, доступа, промптов, эмбеддингов и выдачи.

Google публично показала внутренний TPU в 2016 году, а в 2018-м превратила Cloud TPU в платный облачный ресурс.

Руководство Palantir не стесняется и бравирует участием в конфликте на Украине и в планировании нападения на Иран.

Атакующий вмешивается не только в данные, но и в доверенный канал, через который получатель формирует картину мира.

Локальный запуск pdx viewer для конвертации и редактирования PDFНевидимый текстовый слой PDF можно редактировать и экспортировать в Markdown, JSON и TXT.

Люди видят обычный PDF, а роботы — отдельный слой ActualText с текстом в Markdown и картинками в base64.

Как это работаетВ спецификации PDF (с версии PDF 1.4, 2001) есть свойство для указания «текста замещения» к выделенному контенту.

Но сейчас, в эпоху автоматизированных инструментов для обработки PDF, этот слой начали использовать специально для экспорта в LLM.

Теоретически, невидимый (для людей) слой с текстом можно использовать для направленных атак, размещая там скрытые промты.

Требование распространили на доступ к Fable 5 и Mythos 5 для иностранных лиц по всему миру, включая иностранных сотрудников Anthropic.

Что именно вернулосьДля массового пользователя Fable снова появилась в интерфейсах и API, но вернулась не в прежнем состоянии.

Эта цифра относится не к общей безопасности Fable и не ко всем джейлбрейкам, а к одному классу обхода на внутреннем наборе тестов.

Официального решения не было, и причинная связь с Fable не доказана.

Но два эпизода показывают используемый диапазон инструментов: с Anthropic государство использовало обязательное письмо, с OpenAI — добровольную координацию.

Как Cloudflare стала главной трубой интернетаПопулярность Cloudflare объяснялась не только качеством защиты, но и простотой подключения.

Cloudflare почти не требовала разбираться в устройстве её сети и не заставляла покупать корпоративный пакет.

Во-первых, трафик "на сайт" летит на серверы CloudFlare, и она отфильтровывает всё, кроме чистых http/https-запросов.

Теперь компания развивает Pay Per Use: платить предполагается не только за загрузку, но и за фактическое использование материала.

Значение Cloudflare не в изобретении идеи, а в бесплатном тарифе, доле рынка и возможности одним изменением настроек затронуть миллионы доменов.

Bjorn — это инструмент, подобный тамагочи, только для хакеров пентестеров, который сам сканирует сети, находит, оценивает и даже может эксплуатировать уязвимости (понятное дело, что только в разрешённых законом случаях), разработанный для работы на Raspberry Pi с 2,13-дюймовым e-Paper HAT.

После того, как приехали и плата и экран, я понял, что для их соединения нужно распаять на плате 40-контактный разъём GPIO.

Ещё раз подчеркну, что для этого шага из закупаемых комплектующих нужна только карта памяти.

Как в итоге оказалось, для полноценной установки ПО Bjorn, его нужно устанавливать с "иностранного IP-адреса", а скрипт установки не показывал мне неустановленные пакеты.

Bjorn - Chumikov Sec…

Ключевая мысль их исследования: форки почти никогда не переписывают TLS-сертификат сервера, доставшийся от родителя.

DCRAT принес в семью структуру O= By , L=SH , C=CN , и это наследуется вплоть до самых мелких потомков — даже если сам билд больше никак не забрендирован.

Именно поэтому нас это исследование, само собой, зацепило — и мы решили прогнать похожую логику не по интернет-скану, а по трафику из собственных песочниц: а вдруг мы что-то упустили?

Самоподписанные сертификаты в целом — malware-C2, в отличие от фишинговых сайтов, не боится браузерных ошибок, поэтому самоподпись используется массово.

Мораль: TLS-сертификат, при наличии, конечно, — это метаданные, которые остаются в открыт…

В данной статье мы не очень глубоко разберём некоторые важные аспекты реализации СКУД c использованием OSDP Crypto.

Стали думать, как решить задачу и в итоге появился протокол обмена данными OSDP (Open Supervised Device Protocol).

И свой и чужой, и посылку и ответ.

Как устроен OSDP CryptoЕсли коротко, то по сравнению с обычным OSDP гораздо сложнее.

В заключение, хотелось бы озвучить мое оценочное суждение: OSDP Crypto, пришёл надолго.

И дело не в лени админа, а в том, что штатного аудита в PostgreSQL просто не существует.

Что в итоге?

Подробности — в документации pg_proaudit и в обзорной статье на Хабре: «pg_proaudit: аудит в Postgres Pro Enterprise».

Ровно такой поток даёт pg_proaudit, и именно на стыке «аудит Enterprise + сбор коллектором» появляется та ценность, ради которой я ввязался в эксперимент (да ещё и в выходной!).

Если у вас в проде PostgreSQL и на вопросы ИБ, кто прочитал и сколько строк выгрузил, вы сегодня отвечать не можете, — у Enterprise это уже встроено.

Превращение генеративных моделей в самостоятельные сущности в информационных сетях ознаменовало начало совершенно новой эпохи внутри сферы информационной безопасности.

Нажатие кнопки подтверждения превращается в обыкновенное юридическое алиби для алгоритма, поскольку времени на осмысленную оценку предлагаемых действий попросту не остается.

Искусственная «совещательная пауза» обязана восприниматься специалистами отрасли не как операционная слабость архитектуры, а как ценнейший стратегический актив, страхующий глобальную инфраструктуру от катастрофических сбоев.

Строгое соблюдение баланса между автоматизацией реакции механизмов и обязательным надзором со стороны человека станет важнейшим крит…

В этом году «Хакер» вернулся к регулярному печатному формату: четыре раза в год мы выпускаем большой глянцевый журнал на 240 полос.

Первые два номера уже отпечатаны, а сейчас мы готовим третий — с материалами о роутерах, сетях, веб-пентестинге, безопасности LLM и не только.

Пока журнал не ушел в печать, его можно заказать по специальной цене — 1500 рублей за экземпляр.

В журнал вошло более 20 материалов — от вводных руководств по сетевой разведке до исследований железа и хардкорных технических разборов.

Первый и второй номера уже готовы к отправке, а третий и четвертый будут доставлены тебе по мере их подготовки и выхода.

Исследователи пишут, что вредоносный код скрыт не в самих эксплоитах, поэтому беглый аудит репозиториев не выявляет ничего подозрительного.

Внутри него скрывается скомпилированный модуль gradient.so для Linux или gradient.pyd для Windows.

При этом модуль запускается только вместе с PoC и ищет файл EXPLOIT_POC.py или файл с похожим названием.

Благодаря этой схеме отдельный запуск вредоносного пакета в песочнице ничего не дает, ведь без прочих файлов репозитория малварь остается неактивной.

Так как даже запуск эксплоита на виртуальной машине не гарантирует обнаружения ChocoPoC, подозрительные зависимости лучше вообще не устанавливать.

В браузер DuckDuckGo добавили встроенную блокировку видеорекламы на YouTube.

Новый блокировщик работает отдельно от Duck Player — встроенного плеера DuckDuckGo, который предназначен для просмотра роликов на YouTube со строгими настройками приватности.

В свою очередь, новая функция блокирует рекламу непосредственно в роликах на YouTube.

Так как YouTube регулярно меняет способы доставки рекламы (в том числе ради борьбы с блокировщиками), в DuckDuckGo пишут, что иногда функция может переставать работать.

Пока новый блокировщик может работать нестабильно, и команда DuckDuckGo просит пользователей протестировать его и отправлять анонимные отзывы через настройки браузера.

Основы финансовых расследованийОс­новная цель в финан­совых рас­сле­дова­ниях — опре­делить финаль­ную точ­ку наз­начения средств и источник их про­исхожде­ния.

Экспер­ты по крип­те при­дер­жива­ются тех же пра­вил, так как крип­товалю­та — это хоть циф­ровые, но все рав­но день­ги.

При обсужде­нии источни­ка средств важ­ный тер­мин — funding address, то есть тот адрес, от которо­го изу­чаемый адрес в пер­вый раз получил средс­тва.

Так про­исхо­дит сме­шива­ние гряз­ных и чис­тых средств, что откры­вает воз­можность даль­нейше­го вывода как реаль­ной выруч­ки, так и выруч­ки, получен­ной прес­тупным путем.

При этом тран­закции могут иметь как data payload, то есть переда­вать дан­ные, так и…

Специалисты Шаньдунского университета разработали новый способ кражи данных с компьютеров, полностью изолированных от внешних сетей.

Атака, получившая название TrojPix, незаметно изменяет пиксели на экране целевого устройства и использует электромагнитное излучение видеокабеля для передачи данных.

TrojPix относится к side-channel атакам и не помогает злоумышленникам проникнуть в систему: сначала атакующим все равно придется каким-то образом заразить изолированный компьютер малварью.

Пиковая скорость передачи данных с помощью TrojPix составила 8,1 Мбит/с (примерно 1 Мбайт/с).

TrojPix работает быстрее, но напрямую сравнивать результаты этих исследований нельзя, так как эксперименты проводилис…

В материалах дела 19-летнего Питера Стоукса (Peter Stokes), которого власти США связывают с хак-группой Scattered Spider, обнаружили интересную деталь.

Следователи идентифицировали подозреваемого благодаря Microsoft Windows Global Device Identifier (GDID) — постоянному идентификатору установки Windows, который помог связать устройство с кибератакой, VPN-сервисом и личными аккаунтами Стоукса.

По информации следствия, тогда участники Scattered Spider позвонили в ИТ-поддержку компании с помощью Google Voice и представились сотрудниками, которые потеряли доступ к своим аккаунтам.

Согласно судебным документам, выйти на Стоукса правоохранителям помог аккаунт ngrok, созданный во время атаки.

Идент…

Баг позволяет атакующему осуществить побег из гостевой виртуальной машины и выполнить код с правами root на хосте.

Проблема присутствовала в ядре Linux около 16 лет и затрагивает KVM-хосты на архитектуре x86 с процессорами Intel и AMD (ARM64 уязвимость не затрагивает).

Она представляет собой use-after-free, затрагивая код KVM/x86 и механизм, который отвечает за трансляцию адресов памяти между гостевой системой и хостом.

Проблема Januscape считается первым известным guest-to-host эксплоитом для KVM, который работает на машинах на базе процессоров Intel и AMD.

А если root-доступа внутри гостевой машины нет, Januscape можно объединить с другим багом, например, с цепочкой Dirty Frag.

Летний CyberCamp объединит деловую программу с отдыхом на природе.

Генеральным партнером фестиваля выступает компания «Инфосистемы Джет».

После серии онлайн-мероприятий проект CyberCamp, созданный для обмена практическим опытом в сфере ИБ, соберет профессиональное сообщество офлайн.

Подробности про летний CyberCamp можно найти на сайте мероприятия.

АО «Инфосистемы Джет».

Эксперты Citizen Lab подтвердили, что iPhone бывшего депутата Европарламента Стелиоса Кулоглу (Stelios Kouloglou) скомпрометировали с помощью шпионского ПО Pegasus.

Также он членом-заместителем комитета PEGA, созданного специально для расследования применения спайвари Pegasus и других шпионских инструментов в странах ЕС.

В это время комитет PEGA обсуждал злоупотребления шпионским ПО в Греции, на Кипре, в Венгрии, Польше и Испании, а также готовил черновик доклада и проводил слушания перед публикацией итоговых рекомендаций.

Несколько лет назад мы посвятили Pegasus и NSO Group отдельную статью, после того как внимание общественности оказалось привлечено к работе этой коммерческой спайвари и с…

В браузере Opera GX обнаружена уязвимость, из-за которой вредоносный сайт мог без разрешения установить аддон GX Mods, а затем использовать его для кражи данных с других страниц.

Напомним, что браузер Opera GX построен на базе Chromium и ориентирован на геймеров, стримеров и создателей контента.

Аддоны GX Mods позволяют менять оформление Opera GX, включая темы, обои, звуки и CSS-стили сайтов.

Они распространяются в виде файлов crx, как обычные браузерные расширения, но не могут выполнять JavaScript и не запрашивают каких-либо разрешений.

В итоге атака занимала всего несколько секунд: пользователь открывал вредоносный сайт, мод незаметно устанавливался в Opera GX, после чего JavaScript перен…

LDAP-зап­росы лежат в осно­ве раз­ведки Active Directory: от Kerberoasting в Impacket до сбо­ра гра­фа в BloodHound.

Краткая теория LDAP и служб каталоговПе­ред тем как перей­ти к обна­руже­нию атак и спо­собам защиты, давай сна­чала раз­берем­ся, что такое LDAP и как он работа­ет.

Зна­чение subtree подой­дет, если нужен поиск во вло­жен­ных вет­ках, onelevel — если нужен поиск на одном уров­не, без углубле­ния в вет­ки.

Еще есть base — поиск толь­ко по одно­му объ­екту, базе;подой­дет, если нужен поиск во вло­жен­ных вет­ках, — если нужен поиск на одном уров­не, без углубле­ния в вет­ки.

Еще есть — поиск толь­ко по одно­му объ­екту, базе; филь­тр зап­роса — усло­вие, которо­му дол­жны соот…

Специалисты CERT/CC предупредили о недокументированном механизме аутентификации в прошивках роутеров Tenda.

Бэкдор позволяет обойти обычную проверку пароля и получить полный административный доступ к панели управления устройством.

Проблема получила идентификатор CVE-2026-11405, и сообщается, что ее нашел анонимный исследователь, изучавший бинарник веб-сервера /bin/httpd, встроенного в прошивки Tenda.

Эксперты подчеркивают, что этот механизм не описан в документации и его следы отсутствуют в интерфейсе администратора.

Бэкдор присутствует в прошивках следующих моделей:Tenda FH1201 — US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD;Tenda W15E — US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE;Tenda AC10 — U…

Version 8.14.0 of the jscrambler npm package shipped with a malicious preinstall hook that silently drops and runs a native infostealer during installation, one build each for Windows, macOS, and Linux.

If you or one of your build systems pulled it in that window, the payload has already run with whatever access your install process had.

The hook fires before the package is even set up, and none of it appears in the prior release, 8.13.0.

The version was pushed straight to npm under a legitimate maintainer account, bypassing the project's normal release flow, which points to a compromised npm account or build pipeline.

8.14.0 is still on npm, and a build pinned to it, on an older client tha…

The China-nexus threat actor is also said to have compromised one of these web applications to deploy a custom implant masquerading as a portal update.

SentinelOne said it detected compromised infrastructure associated with several other Pakistani law enforcement organizations, including the Khyber Pakhtunkhwa Police, the Islamabad Police, and the Punjab Safe Cities Authority (PSCA).

Four different threat clusters have been flagged, each deploying a unique malware family: PlugX, ShadowPad, Cobalt Strike, and Remcos RAT.

]8") extends beyond Pakistani law enforcement to government, academic, telecommunications, and non-governmental entities across South, East, and Southeast Asia, the Middle E…

Zimbra is urging customers to apply updates to address a critical security vulnerability impacting the Classic Web Client that could result in arbitrary code execution.

The vulnerability has been described as a case of stored cross-site scripting (XSS) that could allow specially crafted emails to execute malicious scripts in a user's session.

"The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened," Zimbra said.

This allows attackers to inject and execute malicious JavaScript in victims' browsers, which can result in session hijacking, credential theft, and account compromise.

Given its high potential for…

Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases.

That said, the release artifacts belonging to the compromised version are still available for download from GitHub as of writing.

The software supply chain security firm said the threat actor behind the attack also published version 1.20.21 across 17 additional @injectivelabs scoped packages that depended on and pinned the malicious SDK version, thereby putting transitive users who may not have installed the library directly.

According to Socket, parameters passed to the…

Progress Software has told ShareFile customers to shut down the Windows servers running their Storage Zone Controllers, confirming to The Hacker News that it is responding to a "credible external security threat."

It says it has no indication of unauthorized access to any ShareFile accounts or data, and that it notified customers after learning of the threat.

Progress confirmed the disruption on its status page, listing Storage Zone Controller customers as "not operational" and the incident as under investigation as of a 12:12 p.m. EDT update.

Only the Storage Zone Controller is affected, not standard cloud-only ShareFile accounts.

Keep the affected controllers offline until Progress says w…

The other two could let an attacker who slips a malicious image in front of the bootloader run their own code, before the device has confirmed that the software is genuine.

A bootloader runs before the operating system, so a flaw here can undermine everything that loads after it.

All six bugs are reached while U-Boot is still reading an untrusted image, before it has checked the signature.

Code that runs this early sits below the operating system, where ordinary security tools may not see it.

LogoFAIL, which THN covered in 2023, was a set of image-parsing bugs in PC firmware that let attacker code run during boot, before Secure Boot could check anything, across nearly every major PC brand.

It cannot be done over the internet, and there is no fix coming: Tangem cards cannot take software updates, so every card already sold carries the flaw.

How the card is meant to protect youA Tangem wallet looks like a plain bank card.

Not the first wallet chip broken this wayThis is not Donjon's only laser attack on a hardware wallet this year.

Unlike Tangem, Trezor, and Tropic Square, which could respond: they shipped a stopgap for current chips and are hardening the next version of the silicon.

But this laser attack and a password brute-force method found earlier both sit in the card's firmware, which can never be changed.

Details have emerged about three now-patched security flaws in the OpenClaw personal artificial intelligence (AI) assistant that, if successfully exploited, could enable credential theft, privilege escalation, and arbitrary code execution on the host.

In a series of advisories released last week, OpenClaw maintainers said "practical impact depends on the operator's configuration and whether lower-trust input can reach that path."

"`getBlockedReasonForSourcePath()` checks if the source path is under a blocked path," the researcher explained about GHSA-575v-8hfq-m3mc.

"Mount /home into your container, and you can read every user's SSH keys, AWS credentials, and GPG secrets," Nayak said.

"Befo…

The China-linked cybercrime group known as Silver Fox has been attributed to a new Rust-based remote access trojan (RAR) called MODBEACON.

"These distributors conduct activities across Asia using counterfeit software installers distributed through SEO campaigns, leveraging variants of Gh0st RAT and WinOS (ValleyRAT) trojan families," QiAnXin said.

The distributor is assessed to be a hybrid threat actor, acting as a composite of "cybercriminal arms dealer" and "traffic broker."

The memory-resident malware functions as a remote implant capable of fetching additional modules, running operator commands, and maintaining encrypted communications with attacker infrastructure.

Its core highlight is…

A single wrong variable on one line in XQUIC, Alibaba's QUIC and HTTP/3 library, lets any remote client crash the server with a short burst of completely legal traffic.

XQUIC is open-source, so the risk is not Alibaba's alone: any server that embeds it and serves HTTP/3 with the default QPACK settings is exposed.

Until a fix ships, operators can set SETTINGS_QPACK_MAX_TABLE_CAPACITY to 0, which turns off QPACK's dynamic table, or drop HTTP/3 support entirely.

When the client asks to grow the table, XQUIC allocates a bigger buffer and copies the old data across.

XRING is the latest in a string of remote crashes in HTTP/2 and HTTP/3 stacks.

They uncovered 60 times more devices than they knew they had, then rebuilt their exposure management program on that foundation.

What trusted asset data makes possibleZero-day responseWhen a critical vulnerability drops, speed depends on knowing what's exposed and who owns it.

Better asset data enables smarter exposure management, and exposure management outcomes reveal where asset data still needs to improve.

Every exposure management program inherits the quality of the asset data underneath it.

Learn more about Axonius Exposures and risk-based exposure management at enterprise scale.

The 1.4 million count is how many domains were on the target lists, not how many were broken into, and those lists spanned WordPress, Joomla, and other platforms.

Both reports list Simple File List under CVE-2025-34085, a now-rejected duplicate; the valid ID is CVE-2020-36847.

ThemeREX Addons (CVE-2026-1969), Simple File List (CVE-2020-36847), Custom CSS JS PHP (CVE-2026-6433), BerqWP (CVE-2025-7443), Ninja Forms uploads (CVE-2026-0740), WavePlayer (CVE-2025-12057), WPBookit (CVE-2025-7852), and WP File Manager (CVE-2020-25213).

Both reports list Simple File List under CVE-2025-34085, a now-rejected duplicate; the valid ID is CVE-2020-36847.

Public exploits, automated scanning, and a target…

61 apps send some data in plain text that anyone watching the traffic on that network can read.

It is a mobile counterpart to the same lab's earlier VPNalyzer study of desktop VPN software, and the researchers describe it as the first framework built to systematically and repeatedly audit Android VPN apps.

The trade-off is that the VPN app now sees all of it.

Many rank among its top search results, where Google's safety labels and its "Verified" badge for VPN apps are meant to signal trust.

The three studies tell one story: free VPN apps keep pairing a strong privacy pitch with weak engineering, and they keep reaching millions of installs before anyone catches it.

Organizations are right to pay attention, especially because malicious use of AI makes old gaps a more urgent test of an organization’s cyber readiness.

AI and the basics“AI-powered malware” is cited as the top concern of global SMBs for the year ahead, according to the ESET SMB Cyber Readiness Index 2026.

Lack of security monitoring (22%): You might have plenty of security tools, but do you have a single, centralized place to collect, correlate and flag alerts?

Malicious email detection trend in 2025 (source: ESET Threat Report H2 2025)Tried-and-tested solutions to age-old threatsThis isn’t to say that SMBs should ignore AI-enabled threats.

True cyber readiness means being able to prevent,…

It's that time of month when ESET Chief Security Evangelist Tony Anscombe looks back at some of the top cybersecurity stories that made the news over the past 30 or so days and considers what they may mean for your own cyber-defenses.

What lessons does the new CISA policy hold for organizations outside the agency's direct remit?

What else is there to know about threats facing ATGs or, indeed, many other critical infrastructure systems?

How can you stay safe from imposter fraud, and could the social media bans for children work?

Learn more from Tony's video and be sure to check out the May 2026 edition of Tony's monthly security news roundup for more insights.

With access to your email account, they can reset your passwords across multiple other accounts – perhaps intercepting one-time passcodes sent by your bank, social media, cloud storage or other online provider.

That could lay the groundwork for a convincing phishing email designed to impersonate a trusted organization you interact with.

A phishing attack on your corporate email account is often the first stage in a bigger data breach, extortion/ransomware or espionage attack.

They’re also using more sophisticated tools to improve the success rates of email phishing campaigns.

In this instance the scammers reportedly hijacked the email account of a high-level executive, before impersonating …

For these businesses, cyber resilience should be the direction of travel – that is, the ability to continue operating and recover even during a serious incident.

Cyber readiness is about putting in place the processes and controls to prevent, detect and respond to threats.

So, should confidence in cyber resilience posture be so high, especially if organizations are still getting hit multiple times?

The truth is that there’s no end state for cyber readiness or resilience.

If it’s serious about improving the cyber readiness of small businesses, the vendor community should step up.

Key points of this blogpost: Throughout 2025, Gamaredon exclusively targeted governmental and military institutions in Ukraine.

Continued data exfiltration and a new allianceThroughout 2025, Gamaredon stayed highly active and remained focused solely on Ukraine.

Notably, we uncovered that in early 2025, Gamaredon collaborated with Turla, another Russia-aligned threat actor also linked to the FSB; we documented our findings in our blogpost Gamaredon X Turla collab.

Figure 1 shows a chart of unique samples of HTA downloaders delivered per month in Gamaredon spearphishing campaigns.

Compared to 2024, we also saw a shift in how Gamaredon used these dead drops.

Key points of this blogpost: ESET took part in the coordinated, global Operation Endgame to disrupt Amadey and Stealc.

Our automated systems have been dissecting Amadey and Stealc samples and identifying the fields most relevant for large-scale tracking.

The largest Amadey botnet clusterOne cluster stands out as the largest, and it contributed nearly 34% of all processed Amadey samples.

Stealc affiliate clustering based on ESET telemetryConclusionFor global disruption operations such as Operation Endgame against Amadey and Stealc, long-term automated tracking of malware is necessary.

2026‑04‑09 Stealc C&C server.

The group distinguishes itself through a mature, operator-maintained set of endpoint detection and response (EDR) killers, i.e., tools for disrupting security software.

In this blogpost, we share our findings on Gentlemen’s suite of EDR killers gained through extensive research and corroborated by the recent leak.

Third‑party EDR killers (HexKiller, ThrottleBlood, and HavocKiller) are operationally integrated.

Rather than relying on affiliates to source their own EDR killers, Gentlemen operators actively develop and maintain a portfolio of EDR killers for affiliates.

It allows the Gentlemen operators to integrate abused drivers into their toolset very soon after an EDR killer PoC is disclos…

Of course, connecting production systems to enterprise networks delivers tangible benefits, but the security implications – that systems once safe were suddenly no longer so – arrived more quietly.

Start by mapping which systems in an environment are connected and have no security coverage, where IT and OT networks intersect, which segments are unmonitored, and which production systems have fallen outside any vendor support agreement.

Meanwhile, off-the-peg security tools often don’t efficiently meet the enterprise requirements in legacy OT systems that run on older hardware and outdated operating system versions.

The production systems running that version continue to operate for years, ac…

Key points of this blogpost: We discovered two previously undocumented Windows variants of FishMonger’s SprySOCKS backdoor.

Technical analysisIn this section, we provide a technical analysis of these new, Windows variants of FishMonger’s SprySOCKS backdoor.

Figure 3. klelam00007.bat setting up persistence for the SprySOCKS backdoor (newlines added for readability)Figure 4 depicts the execution chain of the SprySOCKS WIN_DRV variant.

It contained the SprySOCKS backdoor and the SprySOCKS loader.

6490B8E4AADE25A3EE2D A9A47F312DB2122470BC X1B5206BDC1 743DD.dat Win64/SprySOCKS.A Encrypted container of the encrypted WIN_DRV variant of SprySOCKS backdoor, encrypted SprySOCKS RawWNPF and SprySOCKS …

Instead, attackers get the victim to complete a legitimate authentication process – including two-factor authentication (2FA) – on a real Microsoft login page.

What makes EvilTokens dangerousThe OAuth device code flow was designed for devices that may be awkward to sign into directly, such as smart TVs or printers.

No document, invoice, email, or another platform should ask for a device code without a clear reason.

A real Microsoft page doesn’t automatically make a request safe.

Sometimes the attacker could ask them to enter a real code on a real page – but for the wrong device.

During this period, the Vietnam-aligned OceanLotus adopted a more selective approach to external operations while placing increasing emphasis on domestic espionage.

We identified two distinct campaigns involving the SPECTRALVIPER backdoor: a supply-chain attack targeting stock investors in Vietnam and a prolonged espionage operation against a Vietnamese infrastructure and transport construction company.

The domain resolved to the genuine IP address of the FireAnt update server, suggesting a supply-chain compromise scenario.

LTD 2025‑09‑20 SPECTRALVIPER C&C server.

]com IRT‑CHOOPALLC‑AP 2025‑09‑20 SPECTRALVIPER C&C server.

But that realization alone clearly doesn’t prepare them to withstand an attack.

Have the repeat victims come to view their brushes with cyber-incidents as proof of “what doesn’t kill me makes me stronger”?

For all the talk around AI, automation and attacker sophistication, many SMB breaches still begin with a familiar opening.

A total of 71% of SMBs globally now carry cyber insurance, rising to 84% in North America, with adoption climbing sharply among repeat victims.

While “when, not if” has never been more true, that alone doesn’t prepare a business for adversity.

There’s a phrase that is peddled out by governments and companies alike when a catastrophe of any type – including a cybersecurity breach – occurs: “Lessons have been learnt”.

The 130% increase in significant incidents between 2024 and 2025 severely challenges this assertion and points to lessons not being learnt, at a macro level.

In fact, this reluctance to look could also be normalcy bias quietly doing its work.

That is why this metaphor matters – cybercriminals discover the gap between what an organisation believes about its security and what the reality is.

We must accept that normalcy bias exists and act upon it.

Our kids are exposed to many of the same identity, privacy, and data security risks as their parents.

Why do people want my kids’ data?

But when they do finally flag fraud, the impact on your child’s credit history can be severe.

Apply for a credit freeze for your child’s identity with all three major credit bureaus.

Keeping your child’s identity safe should not be about restricting their digital world.

Most PCs still run with a UEFI Secure Boot certificate authority, installed by default since 2013, that has now expired.

Its expiry sits at the center of the sixth update to Debian 13, codenamed “trixie.” The point release carries mostly security corrections along with a few fixes for serious problems.

The new build can update the Secure Boot certificate authority, the Key Exchange Key, and the revocation database on affected machines.

Future updates to “shim-signed” could leave them unable to boot with Secure Boot enabled.

The qemu emulator moved to a new upstream stable release carrying 25 security fixes.

Researchers make the case for a cybersecurity AI scientistAutonomous AI agents have started doing real security work.

Accenture acknowledges security incident following 35GB data theft claimAccenture appears to have suffered a data breach, the extent of which is currently unknown.

How to prioritize AI agent security by business impactYour CEO calls about an AI agent security incident in finance.

The machine just works, hour after hour, an AI agent with hands on the keyboard and no one in the room.

This roundup covers recent open-source releases for vulnerability research, application security testing, container security, endpoint protection, AI security, and penetration testing.

Incode has launched On-Device Age Estimation, an age verification capability that performs age estimation and liveness detection directly on the user’s device, without transmitting facial data off the device.

The company’s age estimation models are now available to run entirely on-device.

The solution combines on-device age estimation with deepfake and spoofing detection.

In the UK, the Online Safety Act’s “highly effective” age check requirement is being enforced, with restrictions on under-16 access to social media planned for spring 2027.

On-device age estimation is designed to give users a more privacy-preserving option at the moment they face an age verification requirement.

There were 116 CVEs for Windows 11 and 104 for Windows 10.

Microsoft announced Windows 11 26H2 is now available in the Windows Insiders Development channel and will be released for general use later this year.

This is much less disruptive than a full OS replacement which is required for Windows 11 23H2 or older versions.

Note that Windows 11 26H1 is not part of this service channel and also has a different OS kernel.

Time will tell how patch processes will evolve but maybe the first question to answer is if CVE tracking will remain practical.

Workato has announced two new capabilities for Agent Studio: Headless API and Agent Guardrails.

Headless API lets Genies, Workato’s AI agents built on Agent Studio, be embedded into any business application surface, on web, mobile, or inside another agent’s own environment.

Headless API: One genie, any surfaceHeadless API means Genies are no longer tied to a single interface.

“Workato can now deliver secure agents anywhere, backed by Headless API and Agent Guardrails.”“Most enterprises have proven that agents work in a pilot.

“By making Headless API and Agent Guardrails native to one platform, Workato is removing the governance rework that keeps agents confined to pilot projects.

Researchers sorted open source software into fourteen sub-genres, each defined by who starts and sustains a project and to what end.

Protestware covers packages a maintainer alters or sabotages to send a political or economic message, with node-ipc and colors.js as examples.

Studies of the npm ecosystem show a related risk, where a small number of maintainer accounts reach much of the network.

The typology is still a work in progress, a light review the authors treat as a starting hypothesis, so the categories will shift as more research comes in.

A foundation-backed project comes with the governance that lets competitors share it in the first place.

Data brokers collect personal details on most adults in the United States and sell them to buyers that include employers, landlords, insurance companies, and government agencies.

That worked out to 322 deletion requests and close to 360 opt-out requests.

Silence is the common responseA broker gets 45 days to tell you what it did with a deletion request.

Whether your real data would have vanished is a separate question, and the researchers are upfront about not answering it.

That tells a security team almost nothing about whether the real data is still sitting there.

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

Contact Info

These systems will combine powerful AI, public and private surveillance via real-time facial recognition technology and digital tracking, mass databases and highly personalized enforcement.

If deployed at scale, they will have profound chilling effects not just on personal freedoms, but democracy and social progress itself.

AI surveillance is now being experimented with in North America, South America, Europe, Asia and Africa.

While the systems are ostensibly used to maintain security and public safety, the real aim is often social control.

But we believe the most urgent and long-term impact will be its broader chilling effects.

Internet risks are nothing new, and cyberattacks—both large and small—have been a significant issue since long before the current crop of generative AI models.

Contrast the L0pht hackers with hackers derided as “script kiddies.” They didn’t understand computers, or security.

Instructing AI models to spy on people and report any malicious prompts to the authorities fails for similar reasons.

We want these AI models to be able to review computer code, find vulnerabilities and automatically fix them.

They are things talked about at that congressional hearing back in 1998, titled “Weak computer security in government: Is the public at risk?” Even the Five Eyes admitted that their security advic…

Internet risks are nothing new, and cyberattacks—both large and small—have been a significant issue since long before the current crop of generative AI models.

Contrast the L0pht hackers with hackers derided as “script kiddies.” They didn’t understand computers, or security.

Instructing AI models to spy on people and report any malicious prompts to the authorities fails for similar reasons.

We want these AI models to be able to review computer code, find vulnerabilities and automatically fix them.

They are things talked about at that congressional hearing back in 1998, titled “Weak computer security in government: Is the public at risk?” Even the Five Eyes admitted that their security advic…

Not sure this will have any effect, but I support the effort:According to Google’s legal filing, Outsider Enterprise operates through Telegram.

The group offers phishing-as-a-service to individuals who may not be technically savvy enough to set up fraudulent websites and text campaigns on their own.

In its Telegram channels, Outsider Enterprise reportedly provided instructions on how to use Google’s Gemini AI to create websites that imitate those of Google, YouTube, and government agencies such as New York’s E-ZPass.

[…]Google worked with AT&T, Verizon, and T-Mobile to block many of these malicious text messages, and Google notes that its on-device scam detection in Google Messages probably…

France is accelerating its transition to post-quantum encryption:France’s cybersecurity agency ANSSI said on Tuesday it would stop certifying security products that lack quantum-resistant encryption, a move that will force government bodies and critical operators to shift away from older systems.

Samih Souissi, ANSSI’s chief of staff, said at the France Quantum conference that the agency would halt such certifications from 2027, and that businesses should be buying only quantum-safe products by 2030.

ANSSI approval is required for use in French government agencies and critical infrastructure, making the policy a de facto phase-out of older encryption.

This is from a 2024 company presentation:Officers can also tap into data showing a car’s decals, bumper stickers, back and top racks—along with temporary and unique state tags.

Flock calls it a “Vehicle Fingerprint” and it’s touted as a way for law enforcement officials to get more information “even when you don’t have full plate information,” the company’s presentation shows.

The company gives police officers the ability to search that data as well, to “build stronger cases with less information upfront.” That includes being able to locate multiple vehicles law enforcement officials believe are moving together and what Flock calls a “multi geo search.”

Interesting paper: “Cybersecurity Mission Creep.”Abstract: Cybersecurity is experiencing mission creep.

Positioned as security threats, cybersecuritized issues become endowed with the apparent normative power to override countervailing considerations, oversimplifying the problem.

Cybersecuritization’s oversimplification similarly risks unidimensional solutions and invites use of argumentative trump cards, like First Amendment challenges.

Together, the reductive tendencies of cybersecuritization and the deference it prompts to specialists renders ultimate governance choices more opaque.

If we continue to ignore it, we risk abdicating further responsibility for difficult choices to the trump …

The idea is to reach hungry consumers by “knowing what is in their fridge without being too creepy,” said Carrie Drinkwater, chief investment officer at Carat.

To achieve that goal, NBCU and Instacart created a custom audience of shoppers who regularly purchase grocery staples on Instacart, such as eggs, milk, meat and produce.

Based on that data, Papa Johns can determine which days of the week certain consumers are likely to run out of groceries and serve them an ad on NBCU streaming content accordingly.

So the way for Papa John’s to not be “too creepy” is to deliberately get it wrong sometimes.

Posted on July 1, 2026 at 6:53 AM • 0 Comments

The Realities of AI Video SurveillanceThe Financial Times has a good article on how AI is changing the capabilities of video surveillance, with information from both Israel/Iran and Russia.

I wrote about this sort of thing a few years ago, how AI enables mass spying in the way that computers and networks enabled mass surveillance.

The interesting development in the article is that AI allows people to ask natural language questions about video footage to AIs—and AIs can answer them.

In contrast with older tools restricted to a few dozen preset searches, these new tools allow an almost unlimited range of enquiries by enabling language-based searches on video.

“This is the holy grail of survei…

Interesting research on a new class of weak RSA keys: keys with lots of zeros.

The badkeys project is an open-source service that checks public keys for known vulnerabilities.

Pattern 2 appears on SSH hosts running the CompleteFTP software from EnterpriseDT.

The underlying vulnerability affects RSA keys generated using versions 10.0.0­12.0.0 (Dec 2016­Mar 2019) and DSA keys generated with v10.0.0­23.0.4 (Dec 2016­Dec 2023).

More implementations may include the same bugs, and so it’s worth tailoring cryptanalytic algorithms for this particular type of failure.

We’ve taken one small step towards robot police officers: a drone capable of disarming a suspect:In a June 22 video posted on the Sacramento County Sheriff’s Office’s Instagram page, an officer wearing goggles can be seen operating a drone to retrieve a knife from an armed suspect hiding inside a cluttered house.

“After not responding to negotiators, a drone was deployed inside the residence,” the post says.

“Drone pilots located the suspect hiding in a corner of a garage” and then used a high-powered magnet attached to the drone to grab the knife out of the suspect’s hand.

In the video ­ which is soundtracked by the “Mission: Impossible” theme song—the intercepted knife can be seen spinnin…

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

Contact Info

Meta Is Testing Facial Recognition for Police and MilitaryWe know that ICE wants to deploy eyeglasses with facial recognition that can identify people in real time.

Turns out Meta is prototyping the feature with a Pentagon supplier.

(Alternate news story.)

Posted on June 26, 2026 at 12:40 PM • 0 Comments

One Million Passports Leaked OnlineA database of almost a million passports from around the world was leaked online.

Note what happened.

A high-value credential—a passport—was used in an ancillary low-value authentication system: ID verification for cannabis dispensaries.

And it’s the low-value system that got hacked, putting the high-value credential at risk.

Posted on June 26, 2026 at 7:03 AM • 2 Comments

Benjamin Brundage is founder of the proxy tracking service Synthient, one of the companies that published evidence last month linking the Popa botnet to NetNut and Alarum Technologies.

Brundage said the domain seizures appear to have disrupted both the Popa botnet and the NetNut proxy network that rides on top of it.

“Google has high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet,” the GTIG report concludes.

What we have observed is that when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors, effectively becoming a reseller.

More than a quarter of the apps made for Samsung’s Tizen o…

The duo were key members of a prolific cybercrime group known as Scattered Spider, and their guilty pleas came on the first day of what was expected to be a six-week trial.

In April 2026, 24-year-old British national and Scattered Spider member Tyler “Tylerb” Buchanan pleaded guilty to wire fraud conspiracy and aggravated identity theft for participating in the group’s SMS phishing spree in the summer of 2022.

The government said Buchanan, Jubair and others used the credentials harvested in that phishing campaign to steal at least $8 million in cryptocurrency from victims throughout the United States.

The U.S. Department of Justice says three alleged Scattered Spider defendants indicted alo…

This week, researchers from multiple security firms concluded that the Popa botnet is linked to NetNut, a “residential proxy” provider operated by the publicly-traded Israeli firm Alarum Technologies Ltd [NASDAQ: ALAR].

Qurium said that immediately after that disruption, several dozen new domains were registered to serve as controllers for the Popa botnet, but that one of those control domains was not new: ninjatech[.]io.

Jérôme Meyer, a security researcher at Nokia Deepfield, said the total population of devices participating in the Popa botnet may be far higher than Lumen’s estimates.

“Over 90% of our pharmaceutical and food & beverage customers have queried residential proxy indicators.

…

This post examines clues pointing to a real life identity for the administrator of The Gentlemen ransomware group.

Experts at the security firm Check Point Software have been closely covering exploits of The Gentlemen, a so-called “ransomware-as-a-service” (RaaS) offering that pays affiliates handsomely to help spread the group’s malware.

According to Check Point, the group targets Internet-facing devices (VPNs, firewalls) as their entry point, and once inside moves quickly to encrypt entire networks within hours.

Check Point says the administrator and primary operator of the ransomware group uses the nickname Zeta88 on the Russian-language cybercrime forums, and that this individual was pr…

Microsoft today released software updates to plug nearly 200 security holes across its Windows operating systems and supported software, a record number of fixes for the company’s monthly Patch Tuesday cycle.

“Some surveys put AI usage among security professionals generally at 90%, so it’s unsurprising that this volume of patches may be the norm,” Narang said.

Microsoft received heavily blowback on social media last month after it said in a blog post that it was considering taking legal action against the security researcher.

While 200 vulnerabilities may be a record for Patch Tuesday, the actual number of security flaws Microsoft addressed this month is far higher, said Rapid7’s Adam Barne…

On May 31, word began to spread on several Telegram instant message channels that Meta’s AI bot would happily add an email address to an existing account as part of the bot’s standard password reset flow.

Meta has not responded to requests for comment on the video’s claims, but the company reportedly did acknowledge the dormant Instagram account for the Obama White House was briefly compromised.

Meta’s solution was to deploy a conversational AI layer to handle common recovery workflows: relinking a lost email address, triggering a password reset, verifying account ownership.

Just like human customer support employees can be social engineered into providing unauthorized access to someone’s a…

But as KrebsOnSecurity observed in September 2025, those sanctions failed to target Stark’s remaining connection to the Internet — an Internet service provider based in the Netherlands called MIRhosting.

MIRhosting is operated by Andrey Nesterenko, a 39-year-old Russian native who runs the business out of the Netherlands.

And as our September 2025 report showed, WorkTitans was controlled by Nesterenko and a 57-year-old from Amsterdam named Youssef Zinad.

On top of that, WorkTitans was getting connectivity to the larger Internet solely through MIRhosting, where Zinad had worked previously.

“The transition to the.hosting was not intended to evade sanctions,” Nesterenko wrote.

The inquiry comes as CISA is still struggling to contain the breach and invalidate the leaked credentials.

Experts who reviewed the exposed secrets said the commit logs for the code repository showed the CISA contractor disabled GitHub’s built-in protection against publishing sensitive credentials in public repos.

CISA acknowledged the leak but has not responded to questions about the duration of the data exposure.

TruffleHog does this by monitoring a live feed that GitHub publishes which includes a record of all commits and changes to public code repositories.

In practical terms, it is likely that cybercrime groups or foreign adversaries also noticed the publication of these CISA secrets, …

A criminal complaint unsealed today in an Alaska district court charges Jacob Butler, a.k.a.

“Dort,” of Ottawa, Canada with operating the Kimwolf DDoS botnet.

“KimWolf was tied to DDoS attacks which were measured at nearly 30 Terabits per second, a record in recorded DDoS attack volume,” the Justice Department statement reads.

Synthient was among many technology companies thanked by the Justice Department today, and Synthient’s founder Ben Brundage told KrebsOnSecurity he’s relieved Butler is in custody.

The DOJ said at least one of those services collaborated with Butler’s Kimwolf botnet.

Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems.

Another file exposed in their public GitHub repository — “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems.

“The available Git metadata alone does not prove which endpoint or device was used.”Caturegli said he validated that the exposed credentials could authenticate to three AWS GovCloud accounts at a high privilege level.

CISA has not responded to questions about the p…

Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code.

May’s Patch Tuesday is a welcome respite from April, which saw Microsoft fix a near-record 167 security flaws.

But at the end of April, Oracle announced it was switching to a monthly update cycle for critical security issues.

Chrome automagically downloads available security updates, but installing them requires fully restarting the browser.

For a more granular look at the Microsoft updates released today, checkout this inventory by the SANS Internet Storm Center.

The stated deadline for payment was initially set at May 6, but it was later pushed back to May 12.

The May 6 update stated that Canvas was fully operational, and that Instructure was not seeing any ongoing unauthorized activity on their platform.

Instructure responded by pulling Canvas offline and replacing the portal with the message, “Canvas is currently undergoing scheduled maintenance.

Data extortion groups like ShinyHunters will typically only remove victims from their leak sites after receiving an extortion payment or after a victim agrees to negotiate.

Last month, ShinyHunters relieved the home security giant ADT of personal information on 5.5 million customers.

For the past several years, security experts have tracked a series of massive DDoS attacks originating from Brazil and solely targeting Brazilian ISPs.

The company originated from protecting game servers against DDoS attacks and evolved into an ISP-focused DDoS mitigation provider.

But so-called “DNS reflection” attacks rely on DNS servers that are (mis)configured to accept queries from anywhere on the Web.

“We received and notified many Tier 1 upstreams regarding very very large DDoS attacks against small ISPs,” Nascimento said.

Nascimento flatly denied being involved in DDoS attacks against Brazilian operators to generate business for his company’s services.

A 24-year-old British national and senior member of the cybercrime group “Scattered Spider” has pleaded guilty to wire fraud conspiracy and aggravated identity theft.

FBI investigators tied Buchanan to the 2022 SMS phishing attacks after discovering the same username and email address was used to register numerous phishing domains seen in the campaign.

That same year, U.K. investigators found a device at Buchanan’s Scotland residence that included data stolen from SMS phishing victims and seed phrases from cryptocurrency theft victims.

Buchanan is the second known Scattered Spider member to plead guilty.

Two other alleged Scattered Spider members will soon be tried in the United Kingdom.

Have you received an email from a recruiter at Adobe, Netflix, or OpenAI offering you an exciting new marketing role?

Security experts have uncovered a phishing campaign which impersonates over 30 well-known brands in fake job interviews designed to steal Google account passwords.

When victims click on "Continue with Google," a pop-up appears that looks like a legitimate Google authentication dialog.

In the past the FBI has warned the public about scammers using fake job ads to steal money and personal information from applicants.

Earlier this year, Hot for Security published a guide explaining how many fake recruiter scams work, and how to avoid them.

These stories appear different, but they're actually telling the same story.

I'm going to flag, I'm going to flag the point that I made earlier is that operational security isn't always there.

I know how to do this because it's done it for me, but I don't actually know how to apply it logically.

And when the technology you're relying on to protect you, and in some people's case it is protecting their life, and you're not doing it to the best of your ability, that's, that's really, really disappointing.

But I guess for now, all eyes are on Apple and how they're going to respond to this, albeit 13 months later.

Two young men have been arrested in the Netherlands on suspicion of running a phishing operation that harvested the credit card details of unsuspecting victims.

According to a police press release, victims were duped into entering their payment card details on bogus phishing websites.

Investigators believe the arrested men, who have not been named, did not just misuse the stolen payment card details themselves, but also passed them on to other fraudsters.

Card payment fraud was found to be the single most common category, with over half a million fraudulent transactions (up more than a quarter on the year before).

In 2024, just 1% of Dutch fraud victims recovered their money, and while arou…

Who Are The Gentlemen?

Despite the impeccably polite name, there is nothing polite or refined about this particular gang of cybercriminals. Read more in my article on the Fortra blog.

And I'm going to be looking at whether you're wise to take a gamble with your security on Polymarket.

Right, well, I want to tell you about a company that's built its entire brand on being really, really good at predicting the future.

They've actually done it really, really well.

So it's The Summer Portraits by— remind me who it's by again, 'cause I'm going to butcher his name.

It's really, really good.

When a devastating earthquake struck north central Venezuela last week, rescue teams were not the only ones who mobilised fast.

Researchers at threat intelligence firm WhoisXML API say that they uncovered 212 newly-registered domains referencing the earthquake, all of which had been filed within five days of the disaster.

Even years after a natural disaster scammers can still exploit human misery.

And that's because exploitation of a major news event - whether it be a natural disaster of otherwise - can be a successful lure for criminals to deploy when defrauding the unwary out of their savings.

And when a natural disaster creates an urgent need for response, it is all the easier for cyberc…

Leaked internal documents have revealed that for nearly a year Japan's Ground Self-Defense Force (JGSDF) used counterfeit USB flash drives infected with malware on computers connected to sensitive military networks.

The USB drives have been linked to Chinese hacking operations, according to an investigation by Nikkei Asia.

Subsequent investigations found that six out of eight USB drives tested contained the same malicious code.

The infected USB drives had been attached to over 50 computers, with nearly half of those systems used to handle classified data, including information about the movement of troops.

The counterfeit drives, priced 30 to 50 percent below authentic brands, were traced t…

Smashing Security, Episode 473: How a Hacker Could Have Rickrolled the Entire World.

You think, oh, hang on, they're going to ask me for a password or they're going to ask me for something like that.

Yeah, we'll take that money from under your bed and store it in a safety deposit box that you don't know where it is.

We saw a huge number of CVEs last year and with Mythos and the Frontier models, we think that's going to continue to spike.

So the blast radius of these IT service providers is really, really big.

Somebody had broken into Brazil's national Civil Defence alert system and used it to send fake "Extreme Alert" notifications - the most severe category, normally reserved for warnings of imminent natural disasters - to mobile phones across at least five states, including São Paulo, Rio de Janeiro, and the Federal District.

In a statement posted on social media, Brazil's National Civil Defence confirmed that it had pulled the alert platform offline at 1:30am following the compromise.

National Secretary of Protection and Civil Defence Wolnei Wolff confirmed that the attackers managed to regain access after an initial attempt to block them from accessing the system.

Emergency alert systems wor…

Hide My Email is a privacy feature that lets users create unique, random email addresses that forward messages to your real inbox.

That means you can sign-up for websites, newsletters, and apps without exposing your personal email address.

The problem is, however, that one of the reasons that Hide My Email worked so well was because its aliases were indistinguishable from regular iCloud email addresses.

All any website or app that wants to block anonymous sign-ups now has to do is to reject any email address ending in "@private.icloud.com".

For now, if you already have existing Hide My Email addresses in use, they should continue to work without any changes on your part.

Someone is pretending to be your bank, your government, or your local planning office. And according to the FTC, they're making billions doing it. Read more in my article on the Fortra blog.

Which is the connection between your AI agent and Sentry.

And when your AI agent reads data back from one of those services, it treats it as trusted and authoritative.

And so the AI agent does what agents are supposed to do.

But if an attacker can plant text somewhere that your AI agent will read, it's possible that your AI agent will act upon it, and that may not be good.

And then whenever AI wants to access something, AI has to give a reason — why do I want that?

The US state of Maine has taken its public data breach notification portal offline after someone submitted fraudulent breach disclosures impersonating two well-known technology companies.

As Bleeping Computer reported last week, fraudulent data breach disclosures were submitted to Maine's official breach portal and publicly posted before their legitimacy could be verified, prompting the named companies to deny the claims.

However, somewhat more convincing was a fake breach notice that targeted the multiplayer social virtual reality platform VRChat.

It appears that the abuse of the system was possible because the Maine data breach reporting system lacked a proper verification mechanism.

Anyo…

According to media reports, a security blunder carelessly leaked the passport details of every player in Argentina's World Cup squad ahead of Tuesday's warm-up friendly against Iceland.

But why are passport numbers on a World Cup team sheet at all?

Under FIFA regulations, teams must provide passport numbers around an hour before a match kicks off.

So the passport numbers belong in the information handed to the referee.

Before releasing any document containing sensitive data, verify that the data has actually gone - not just covered up.

Most extortion gangs hide behind a keyboard. Silent Ransom Group will phone your staff pretending to be IT support - and if that fails, send someone to your office in person to plug in a USB stick. Read more in my article on the Fortra blog.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 36cc4a8142dd177820e529f1c74777d2Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-09T14:00:09+03:00Config id: 281Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 1ce0e45ab895fdb2ea63e5f66838efb9Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-08T18:00:10+03:00Config id: 281Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 26a02984b49c814d5538d529e6b61e94Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-06T15:00:25+03:00Config id: 280Faithfully yours, nginx.

Но в совершенно ином масштабе: в режиме газонокосилки данный робот может обслуживать территории до 2,5 гектар (это 250 соток, то есть небольшой садовый кооператив), а в режиме транспортировщика поддерживает угодья площадью до 12,5 гектар.

Вместе с исследователем Андреасом Макрисом они провели эксперимент, в рамках которого исследователь, будучи в Германии, удаленно захватил контроль над газонокосилкой Yarbo и переехал журналиста, лежащего на газоне у себя в США.

Чаще всего в качестве операционной системы в них используется Linux — и роботы Yarbo тут не исключение.

При этом серийные номера устройств имеют предсказуемый формат и используются в инфраструктуре Yarbo в качестве идентификаторов р…

По мере того как организации начинают использовать нейросети для все более широкого круга задач, они неизбежно сталкиваются с вопросами надежности и стоимости ИИ-инструментов.

Чтобы не отказываться от нужных нейросетей, бизнес часто рассматривает переход на сторонние сервисы, обеспечивающие единое «окно доступа» к различным нейросетям.

Они предлагают услуги на десятки процентов, а иногда и в разы дешевле, чем у официальных поставщиков, обещая заодно обход любых лимитов.

Утечка данных и кража интеллектуальной собственностиИсследование показало, что цель многих таких сервисов — сбор качественных диалогов топовых моделей для обучения нейросетей третьих фирм.

Пять правил безопасной работы с ИИ-…

Следующий абзац снова вгоняет вас в панику: «К сожалению, при проверке мы обнаружили, что ваши платежные данные могли быть скомпрометированы».

Для разбирательства напишите нам, иначе мы возбудим уголовное дело и разошлем информацию о вас в СМИ» — и далее по списку.

Но если с вами общаются чересчур эмоционально и вы чувствуете, что на вас давят, то вероятность, что вы общаетесь с мошенником, близится к 99,9%.

→ немедленно смените пароль на этом сервисе и на всех других, где использовали такой же.

Если с вашей карты успели снять или перевести деньги, узнайте, как оспорить транзакцию.

Мы выбрали три кейса, три реальные истории о том, как злоумышленники атакуют сегодня, а главное, почему им удается проворачивать такие атаки.

Если вы не видите этот трафик или не считаете это инцидентом — вы проигрываете еще до начала активной фазы атаки.

Как и в предыдущем кейсе, злоумышленники вошли в корпоративную сеть через скомпрометированную учетную запись.

Почему это произошлоБыли допущены две классические ошибки:Сервер мониторинга был настроен с избыточными привилегиями, с доступом ко всем активам компании: и физическим, и виртуальным.

Попав в инфраструктуру, через Active Directory и групповые политики злоумышленники распространили в корпоративной сети вредоносное ПО с функционально…

В частности, опасность может скрываться в GitHub Actions, сценариях автоматизации, позволяющих создавать пайплайны непрерывной интеграции и доставки (CI/CD).

Ошибки и мисконфигурации в них периодически используются злоумышленниками в реальных атаках.

Да, она тоже началась с компрометации мейнтейнера популярного проекта, но распространяемый в ходе этой кампании зловред похищал секреты, именно используя недочет в GitHub Actions.

Как оставаться в безопасностиМисконфигурации в GitHub Actions потенциально могут превратить пайплайны разработки в инструменты злоумышленников, позволяющие скомпрометировать среду разработки или атаковать инфраструктуру компании.

С его помощью наше решение может выявл…

Однако очевидно, что краеугольным камнем стратегии информационной безопасности остаются решения для защиты конечных точек.

Мы предлагаем при выборе EPP-решения отталкиваться не от возможностей продуктов, а от конкретных нужд вашей компании.

Отметьте пункты, которым должно соответствовать решение для защиты конкретно вашей инфраструктуры, и вам будет гораздо проще определиться с выбором.

Для перехода от EPP к EDR или MDR ключевым условием является единое решение, умеющее одновременно выполнять функции и EPP-, и EDR/MDR-агента, а также единая консоль управления.

В Kaspersky Security для бизнеса реализованы передовые защитные технологии, включая машинное обучение, поведенческий анализ, защиту …

Как защитить свой аккаунт в TelegramЧто делать, чтобы защитить свой аккаунт в Telegram от подобных схем угона?

Если вы подозреваете, что стали жертвой подобного стилера или других махинаций злоумышленников, как можно скорее завершите все сессии в Telegram: Настройки → Устройства → Активные сессии → Завершить другие сеансы.

Почему так — мы подробно рассказывали в материале Что делать, если взломали аккаунт в Telegram, перечислив в нем все способы восстановления доступа к своей учетной записи.

Во-первых, необходимо установить облачный пароль для Telegram в разделе Настройки → Конфиденциальность → Облачный пароль.

Наш менеджер паролей кроссплатформенный, поэтому войти в Telegram с использовани…

Скомпрометированная версия израильского браузера Hola для Windows (1.251.91.0) загружала на устройства пользователей криптомайнер для добычи криптовалюты Monero.

Исследователи обнаружили признаки компрометации браузера Hola в рамках процесса сертификации AppEsteem Windows Certified Application.

}exe показало, что в нем скрывался криптомайнер для добычи криптовалюты Monero.

Как злоумышленники использовали Hola Browser для майнинга MoneroКриптомайнеры — это программы, которые используют вычислительные возможности компьютера для добычи криптовалюты.

Как мы уже сказали выше, в случае заражения Hola Browser на устройства жертв загружался криптомайнер для добычи криптовалюты Monero.

Ставка на проигрышВо время чемпионата мира предсказания результатов матчей и «ставки на спорт» становятся особенно популярны — чем активно пользуются злоумышленники.

Это еще и рекордные продажи коллекционной атрибутики — наклеек, шарфиков, формы сборных, официальных мячей турнира и так далее.

На скриншоте выше злоумышленники предлагают заплатить 67 евро за коллекцию наклеек, но на маркетплейсах такой же набор обойдется как минимум вдвое дороже, а на официальном сайте Panini — втрое.

Конечно, товар вы не получите и потеряете не только деньги, но и реквизиты банковской карты.

Установите Kaspersky Premium — приложение убережет вас от зловредов, фишинга, спама, переходов на вредоносные и поддел…

Фундаментальные проблемы автономного SOC: за пределами ИИХотя использование ИИ для анализа данных и принятия решений в SOC звучит как логичная и относительно несложная в реализации идея, попытка ее внедрить ставит и обостряет проблемы, с которыми организации столкнулись при внедрении SIEM, XDR и SOAR:Качество исходных данных.

Даже когда роль ИИ сводится к предварительному сбору данных и рекомендациям, аналитики зачастую не доверяют данным и тратят время на их повторный сбор и анализ.

В SOC и ИБ в целом всегда есть плохо документированная информация: бизнес-контекст, коллективные знания и другие данные, которые помогают верно оценивать оповещения и инциденты.

Проблемы ИИ, критичные для SOCКр…

Хотя она и изолирована, но записываются эти данные в итоге на тот же SSD, с которым также работают прочие программы и веб-сайты.

Оказалось, что если вредоносная страница постоянно обращается к SSD, по задержкам при доступе к данным можно определить, что еще происходит на ПК.

Допустим, на SSD имеется достаточно большой файл, наполненный случайными данными.

Комбинация всех особенностей атаки объясняет ее название: FROST расшифровывается как Fingerprinting Remotely using OPFS-based SSD Timing, то есть удаленное наблюдение над SSD с использованием технологии OPFS.

Впрочем, суть атаки FROST не в передаче данных, а в слежке за активностью пользователя.

Злоумышленники внедряют в установочные файлы игр троян удаленного доступа под названием Argamal.

Рассказываем, как не стать жертвой нового трояна — и как безопасно и максимально анонимно смотреть пикантный контент с аниме-девочками (или без).

В другой ситуации это, наверное, сложно было бы назвать неприятной характеристикой, но Argamal, к сожалению, троян не из «скорострелов».

Через три дня компьютер подключается к GitHub, скачивает зашифрованный файл, расшифровывает его и превращает в рабочий модуль трояна.

Именно поэтому мы рекомендуем хранить пароли не в текстовых файлах, а в зашифрованном контейнере менеджера паролей.

We innovated by giving the Agentic SOC access to Endace’s always-on, full packet capture, and asked the agent to assess a potential SharpHound Recon attack that we had seen while threat hunting.

This blog explores how we built the integrations and how AI helped us with our threat hunt and threat assessment.

Agentic AI Massively Speeds our AnalysisAt this point, we decided to use Agentic AI capabilities to investigate and assess this potential threat.

ConclusionThe Agentic SOC, blending Agentic AI built into Endace’s products with custom agentic tools, is a massive boost to productivity and security.

AcknowledgementsOur thanks go to the Cisco SOC team led by @Jessica Oppenheimer and @Ivan Be…

Having spent time in the Cisco Live Americas 2026 SOC, one thing became abundantly clear:The way SOCs operate today is fundamentally different from even a few years ago.

Instead of spending time gathering information, analysts could spend more time understanding what the information actually meant.

Just as spreadsheets empowered business users decades ago, AI-assisted coding is beginning to empower security analysts today.

At Cisco Live, AI was already present throughout the workflow:Incident summaries generated automatically within XDR.

And based on what I saw at Cisco Live 2026, that future has already arrived.

The new SOC analysts were great at finding evidence, helped with triage and correlation by the AI agents in the SOC architecture.

With the advancements in Cloud Control, our new SOC Analysts can validate their hypothesis.

They had the ability to investigate the incident and find the root cause found in Splunk Security and Endace.

Instant Attack VerificationIn each Incident, the SOC Analysts is given an AI generated Summary stitching all the relevant logs from all the sources that are related to the objects in question.

Check out the blogs by the engineers who worked inside the SOC at Las Vegas:

At Cisco Live AMER 2026 in Las Vegas, my work with the Cisco Event SOC centered on one outcome that makes these deployments valuable beyond the event itself: Education.

The SOC protects the conference, but it also turns live operations into a learning environment through SOC tours, Cisco Live sessions, training inside the SOC, and conversations in the World of Solutions.

Bringing live SOC lessons into the classroomEducation also happened in the sessions I delivered at Cisco Live.

Cisco Live AMER 2026 reinforced that the SOC is one of the best classrooms we have because it teaches through real operations.

For a deeper look at the model behind these deployments, read the Cisco Event SOCs: A R…

Inside the Cisco Live SOCAt Cisco Live AMER, the Security Operations Center (SOC) is more than a demo environment.

For a broader look at how the Cisco Live SOC operates, read this overview.

Another part was spent in the SOC, working real investigations with XDR, Splunk Enterprise Security, firewall events, DNS telemetry, packet data, and AI assistance.

AI can help a product manager become useful faster in a live SOC.

That is the bar I want us to continue building toward as we build Cisco XDR and Splunk Security.

As part of the Cisco XDR (Extended Detection and Response) product engineering group, a few of us got exactly that chance.

Every product had a part to play for a network as traffic-heavy as Cisco Live.

(PS : Flaunting the SOC T-shirts was fun)AcknowledgementsA heartfelt thank you to Cisco and the entire SOC team — you are all amazing.

To the Cisco XDR , Splunk , Secure Access , and Secure Firewall engineering teams.

Check out the other blogs from our team at the Cisco Live Americas 2026 SOC at Las Vegas:

We built an Experience Score model on Cisco and Splunk infrastructure and watched it run against real traffic, at real scale, in real time.

The result was a working model for how leaders measure what customers feel, act before friction surfaces, and tie operational decisions to revenue and trust.

At Cisco Live, the Experience Score model organized that architecture around four questions business and technology leaders can answer together.

The composite Experience Score tells a leader whether the experience is healthy enough to protect the moments the business depends on.

From Cisco Live to LA28Cisco Live was a rehearsal for larger exposure surfaces, where digital experience, revenue, brand …

And we kept thinking the same engineer thought: this flow is so consistent… could an agentic agent do the first 90%?

It was a great experiment — and a glimpse of a fully self-hosted agentic SOC — but for the event we pivoted to Claude Opus 4.8 running through Claude Code.

The division of labor we landed on: Tier-1 agentic SOC was already handled beautifully by the AI features in our own products — XDR’s Agentic Attack Storyboard and Splunk’s Triage Agent.

What does an agentic SOC actually need?

The MCP servers — an Endace MCP for packet capture/decode and a Splunk MCP for running queries.

Building on the Cisco Live EMEA SOC, Cisco Live Americas placed the Security Operations Center (SOC) and Network Operations Center (NOC) at the center of the World of Solutions, demonstrating the power of Cisco in bringing Networking, Security and Observability together.

The Cisco Live Americas Agentic SOC architecture shows how a “One Cisco” approach brings different security tools together to eliminate data silos, in close partnership with the NOC.

The SOC at Cisco Live was set up in just two days, thanks to lessons learned and continuous evolution.

For Cisco Live AMER, we treated agentic AI as an auditable review layer across the SOC, not as a replacement for analysts.

Agentic SOC: Incid…

Cisco Security and Splunk Security released the Findings Report from the Security Operations Center at RSAC 2026 Conference.

This year marked the 10th year of the SOC at RSAC.

Those lessons helped inform the Agentic SOC work that followed at Cisco Live Americas 2026.

The SOC used Cisco AI Defense to gain visibility into generative AI application usage and to help protect on-premises AI models running in the SOC in a Box.

Download the full RSAC 2026 SOC Findings Report to see the architecture, metrics, investigations, lessons learned, and recommendations from the 10th year of the SOC.

More telemetry means better visibility – but also more data for threat hunters to sift through.

Then came an important decision: Focus on what matters for detection of threats at Black Hat.

Enriching with Network Context and reducing noiseA file submitted via HTTP doesn’t exist in isolation – it has network context.

It was about:Surfacing high-risk submissions automaticallyProviding network context for faster triageHelping threat hunters dismiss noise fasterThis workflow is far from perfect.

Driven by the needs of the community, Black Hat events showcase content directly from the community through Briefings presentations, Trainings courses, Summits, and more.

If you’ve ever troubleshot a complex workflow run, you know the drill: click into actions, expand inputs and outputs, scan logs, backtrack, repeat.

We’ve just released Workflow Run Summaries in Cisco XDR Automate: an on-demand, AI-generated summary that explains what happened during a workflow execution, where things went wrong, and why that matters, without forcing you to manually inspect every step.

What the feature doesWith a single click on “Generate Run Summary”, Cisco XDR Automate analyzes a completed workflow run and produces a concise, human-readable explanation of its execution.

Why this matters, especially for Agentic AIAs XDR Automate Workflows are increasingly triggered by Agent…

It is the hardest attack category in email security — for any vendor, any product, any architecture.

This balance — 98% threat detection alongside zero hard false positives — is what the 94% Total Accuracy Rating reflects.

What Independent Validation Means for Your Security StrategyEvery email security vendor publishes detection rates.

Read the full report for more insight into ETD’s comprehensive email security capabilities.

All performance data sourced from the SE Labs Advanced Security Test Report — Email (Protection), Cisco Secure Email Threat Defense, May 2026 (v1.0).

Caption: MCP integrations exposed to the local AI workflow for SOC investigation contextAt this stage, the system was already useful.

Caption: OpenClaw using the local Ollama model backend instead of an external model providerThe distinction is important.

I installed DefenseClaw alongside the OpenClaw environment, to add inspection and audit visibility around the agentic AI workflow.

Sending DefenseClaw events into Splunk made the AI workflow feel more operational and less experimental.

At Black Hat Asia, this became a practical way to explore what private AI for SOC workflows could look like.

Cisco has been a long-standing partner in securing Black Hat conferences worldwide, providing the critical network infrastructure that ensures safe connectivity for all attendees.

At Black Hat Asia 2026, we continued this tradition while introducing significant enhancements to our security capabilities through innovative integrations.

Resource ConnectorCisco Secure Access Resource Connector was deployed to provide secure remote access to critical systems.

Resource Connector solves this problem by creating secure path to the target, which is accessible from public URL generated by Secure Access platform.

Check out the other blogs from our team at Black Hat Asia 2026.

That conviction is where the Secure Future Initiative (SFI) started two years ago and continues to guide us today.

And our principles—secure by design, secure by default, secure in operations—are what turn intent into product, like Microsoft 365 Baseline Security Mode.

Evaluate how identity, code, configuration, and network relationships interact in production.

Learn moreTo learn more about Microsoft Security solutions, visit our website.

Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

In analyzing these backdoor capabilities, we discovered that some backdoor commands contain code from additional malware families.

GigaWiper backdoor command 3 is heavily based on Crucio’s code, leading to the assessment that the same threat actor developed both malware families.

Crucio’s code was the base for GigaWiper command 3, and FlockWiper was recoded in Golang and updated for GigaWiper command 12.

Indicators of compromiseIndicator Type Description 633d4cbd496b1094495da89a64f5e6c31a0f6d4d1488411db5b0cba1cfe42001 SHA-256 GigaWiper backdoor ce9ad5f6c12019f4aae5b189bd8ddf5bb09e75b06a0a587b25a855c65948c913 SHA-256 GigaWiper backdoor f622ed85ef31ad4ab973f4e74524866fe1bb44f0965ad2b2ad796cd6…

At Microsoft we encompass these security requirements, along with threat knowledge and operational frameworks in our Secure Future Initiative (SFI), to guide what a well-defended cloud service looks like.

This system is purpose-built to evaluate Microsoft’s own cloud services against our stringent security requirements and make our infrastructure harder to compromise.

Enumerates applicable security controls based on SFI requirements across identity, network, tenant isolation, engineering systems, and detection domains.

Proven results: From theory to practiceWithin a few months, the system has enabled Microsoft security engineering teams to proactively harden our cloud services.

The same AI …

Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management points to a structural shift: CSPM is no longer a periodic compliance exercise.

Frost & Sullivan’s evaluation framework reflects this transition—placing greater emphasis on integrated, code to cloud risk management capabilities inside broader CNAPP platforms.

The Frost Radar™ for Cloud Security Posture Management visualizes how leading vendors compare across innovation and growth—two key measures of market leadership and future potential.

Learn moreRead the Frost & Sullivan Frost Radar™ for Cloud Security Posture Management (2025) to see how CSPM leaders are evaluated—and what capabilities matter most as vendor selec…

For Microsoft, these partners are Microsoft Cloud Solution Providers (CSPs), and they help customers buy, manage, and optimize cloud services like Microsoft 365 and Microsoft Azure.

This helps us ensure that the Microsoft partner ecosystem remains healthy, compliant, and effective, and ultimately helps drive the best outcomes for our customers.

Partner vetting helps ensure that only legitimate organizations can enter the ecosystem, while CSP security posture improvements help enhance the operating standards of organizations already in the ecosystem.

In short, we have made a set of improvements to the security posture across the CSP ecosystem, both at the Microsoft platform layer and at the …

Frost & Sullivan’s 2026 Frost Radar™ for Cloud/Application Runtime Security (CARS) reflects this shift.

Why cloud security is being redefinedThe Frost Radar makes a clear point: cloud security is no longer about visibility or compliance alone.

These are the capabilities that define the next generation of cloud and application runtime security.

Learn moreRead Frost & Sullivan’s 2026 Frost Radar™ for Cloud/Application Runtime Security to see how leading vendors are evaluated—and how the category is shifting toward unified cloud and application runtime risk operations.

Explore Microsoft cloud security solutions to see how unified posture management, risk prioritization, and protection across t…

The quantum-safe timeline has changedFor years, planning for post-quantum cryptography (PQC) was framed as a future problem: important, inevitable, but distant.

At Microsoft, we are acting on this shift by bringing our quantum-safe timeline forward so organizations can begin the transition earlier and with greater confidence.

Accelerating our timelineIn response to these shifts, we are accelerating the Microsoft Quantum Safe Program (QSP) timeline with the goal of transitioning critical products and services to PQC by 2029.

We will continue to share technical guidance and operational best practices to help organizations adopt quantum-safe cryptography with confidence as they move from plann…

Prioritize risk with unified identity risk scoreA new unified identity risk score combines signals from across Microsoft Security into a single, explainable measure of an identity’s risk.

Prioritize identity risk and enforce protection in real time with the new unified identity risk score.

Organizations can use the new security tools and capabilities announced at Microsoft Build 2026 to innovate faster and scale AI adoption without sacrificing security.

In the Loop posts are your reliable source of what’s new across Microsoft Security and what it means for your security strategy.

Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybers…

AI Application Series 1: Security considerations when adopting AI tools examined how AI adoption expands the enterprise attack surface.

AI Application Series 2: Detecting and analyzing prompt abuse in AI tools showed how indirect prompt injection can bias the output of a passive AI summarizer.

AI agents can plan multi-step tasks, decide which tools to invoke, and execute actions on behalf of the user.

This post focuses on one of its fastest-moving categories: tool misuse and agentic supply chain risk exploited through poisoned MCP tool metadata.

The tool name and user-facing summary remain unchanged, but the MCP tool description is silently modified.

Extension overviewThe extension we analyzed has the following attributes:Attribute Value Extension name Search for perplexity ai Extension ID flkebkiofojicogddingbdmcmkpbplcd Manifest version MV3 Version 2.2 Observed purpose Browser search override and redirect logic Referenced brand Perplexity AI Suspicious domain perplexity-ai[.

The runtime workflow we’ve observed demonstrates browser search redirection behavior:User enters search query into the Omnibox.

Monitor unauthorized changes to browser search settings, unusual extension permissions, and outbound traffic to intermediary or non-standard domains associated with search activity.

Learn moreFor the latest security research from the Micr…

Extension overviewThe extension we analyzed has the following attributes:Attribute Value Extension name Search for perplexity ai Extension ID flkebkiofojicogddingbdmcmkpbplcd Manifest version MV3 Version 2.2 Observed purpose Browser search override and redirect logic Referenced brand Perplexity AI Suspicious domain perplexity-ai[.

The runtime workflow we’ve observed demonstrates browser search redirection behavior:User enters search query into the Omnibox.

Monitor unauthorized changes to browser search settings, unusual extension permissions, and outbound traffic to intermediary or non-standard domains associated with search activity.

Learn moreFor the latest security research from the Micr…

]info Domain C2 domain recstrace[.

]info Domain C2 domain heliosup[.

]info Domain C2 domain fairyspells[.

Learn moreFor the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.

Microsoft’s recognition as a Leader in The Forrester Wave™: Endpoint Management Platforms, Q2 2026 report reflects that shift—and the role Microsoft Intune plays in helping organizations manage what’s next.

Figure 1: Forrester Wave showing Microsoft in a Leader position for both strength of offering and strategyWhy Microsoft Intune is a leader in endpoint managementThe Forrester Wave™ Endpoint Management Platforms, Q2 2026 report includes eight endpoint management platform providers, assessed across current offering, strategy, and customer feedback.

Full details are in our announcement blog: Microsoft 365 adds advanced Microsoft Intune solutions at scale.

Bookmark the Microsoft Intune blog …

Organizations now require platforms that can:Correlate posture, runtime, identity, and data signals.

Learn moreRead Frost & Sullivan’s 2026 Frost Radar™ for Cloud-Native Application Protection Platforms (CNAPP) to see how leading vendors are evaluated—and how the category is shifting toward unified cloud risk operations platforms.

Explore Microsoft cloud security solutions to see how unified posture management, risk prioritization, and protection across the application lifecycle can help reduce cloud risk.

Bookmark the Microsoft Security blog to keep up with our expert coverage on security matters.

Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news an…

Indicators of compromiseIndicator Type Description 8f32456359f209a63adfd24b94235e1727382ac7f7bb7f2bcaf754e721925b64 SHA-256 StealC 0215f734867bd71c57ff5c524d8cc670be5b4f1861b2c390cf46d18784a53624 SHA-256 StealC 2a0f053855da59b3b56812e580d7baeba59fc9493694722aa9e3f121ee3363f1 SHA-256 StealC 977b33a9b481cf714946b7d386865cd5d284312aa5ecfa0546c197b1003e1bde SHA-256 StealC b7d1f172ff3feafe65d47fd1cbe0cc249316371ae0e1cbe3a7c741c738b3353d SHA-256 Amadey 5.87 9383572a30ae5b76fadd0700fbd7a1aa7b05d0b6c8f9cdaef9b30a3e1f65d57d SHA-256 Amadey 5.86 5f5b25b2e35d404034d0d60975cf1ffbc6f141761ec3f4f15d6f7c6213a056f6 SHA-256 Amadey 5.80 98e504cc7125b79eda5491f40b998605a05f4cd968b961aab4cce7beb074fefe SHA-256 …

Here, threat actors may simply seed prompt injections on websites in hope of corrupting AI systems that browse them.

Early experiments revealed a significant volume of "benign" prompt injection text, which illustrates the complexity of distinguishing between functional threats and harmless content.

Many prompt injections were found in research papers, educational blog posts, or security articles discussing this very topic.

(Source: GitHub/swisskyrepo)When searching for prompt injections naively, the majority of detections are benign content – false positives in our case.

Malicious: ExfiltrationWe were able to observe a small number of prompt injections that aim at theft of data.

Recognizing the risks associated within the complex modem firmware, Pixel 9 shipped with mitigations against a range of memory-safety vulnerabilities.

Following our previous discussion on "Deploying Rust in Existing Firmware Codebases", this post shares a concrete application: integrating a memory-safe Rust DNS(Domain Name System) parser into the modem firmware.

Hook-up Rust to modem firmwareBefore building the Rust DNS library, we defined several Rust unit tests to cover basic arithmetic, dynamic allocations, and FFI to verify the integration of Rust with the existing modem firmware code base.

Pixel modem firmware already has a well-tested and specialized global memory allocation system to…

This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape.

Session theft typically occurs when a user inadvertently downloads malware onto their device.

Once active, the malware can silently extract existing session cookies from the browser or wait for the user to log in to new accounts, before exfiltrating these tokens to an attacker-controlled server.

How DBSC WorksDBSC protects against session theft by cryptographically binding authentication sessions to a specific device.

The issuance of new short-lived session cookies is contingent upon Chrome proving possession of the correspondi…

Staying ahead of the latest indirect prompt injection attacks is critical to our mission of securing Workspace with Gemini.

In our previous blog “Mitigating prompt injection attacks with a layered defense strategy”, we reviewed the layered architecture of our IPI defenses.

Synthetic data generationAfter we discover, curate, and catalog new attacks, we use Simula to generate synthetic data expanding these new attacks.

We partition the synthetic data described above into separate training and validation sets to ensure performance is evaluated against held-out examples.

This process leverages the newly generated synthetic attack data described on this blog, to create a robust, end-to-end evalu…

2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉!

Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer.

Vulnerability Reward Program 2025 in NumbersWant to learn more about who’s reporting to the VRP?

Tip: Want to be informed of new developments and events around our Vulnerability Reward Program?

Follow the Google VRP channel on X to stay in the loop and be sure to check out the Security Engineering blog, which covers topics ranging from VRP updates to security practices and vulnerability des…

To stay ahead of the curve, the technology industry must undertake a proactive, multi-year migration to Post-Quantum Cryptography (PQC).

To bring these critical protections to the wider developer community with minimal friction, the transition will be supported through Play App Signing.

Play App Signing leverages Google Cloud KMS, which helps ensure industry-leading compliance standards, to secure signing keys.

Empower Developers : The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and application.

: The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and …

Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers.

Instead, Chrome, in collaboration with other partners, is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs), currently in development in the PLANTS working group.

Since MTC technology shares significant architectural similarities with CT, these operators are uniquely qualified to ensure MTCs are able to get off the ground quickly and successfully.

The Chrome Quantum-resistant Root Program will operate alongside our existing Chrome Root Program to ensure a risk-managed transition that maintains the highest levels of security for all users.

First, we…

For Majik, Scam Detection was the intervention he needed: “The warning is what made me pause and avoid a bad situation”.

As scammers evolve their tactics and create more convincing and personalized threats, we’re using the best of Google AI to stay one step ahead.

Expanding Scam Detection for Calls to Samsung DevicesTo help protect you during phone calls, Scam Detection alerts you if a caller uses speech patterns commonly associated with fraud.

Scam Detection for phone calls on Google Pixel devices is available in the U.S., Australia, Canada, India, Ireland, and the UK.

Powered by Gemini’s on-device model, Scam Detection provides intelligent protection against scam calls while ensuring that…

Upgrading Google Play’s AI-powered, multi-layered user protectionsWe’ve seen a clear impact from these safety efforts on Google Play.

As Android’s built-in defense against malware and unwanted software, Google Play Protect now scans over 350 billion Android apps daily.

This proactive protection constantly checks both Play apps and those from other sources to ensure they are not potentially harmful.

Looking aheadOur top priority remains making Google Play and Android the most trusted app ecosystems for everyone.

Thank you for being part of the Google Play and Android community as we work together to build a safer app ecosystem.

That’s why we're committed to providing multi-layered defenses that help protect you before, during, and after a theft attempt.

Today, we're announcing a powerful set of theft protection feature updates that build on our existing protections, designed to give you greater peace of mind by making your device a much harder target for criminals.

These updates are now available for Android devices running Android 16+.

More User Control for Failed Authentications: In Android 15, we launched Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts.

This feature is now getting a new dedicated enable/disable toggle in settings,…

These initiatives, driven by Ballots SC-080, SC-090, and SC-091, will sunset 11 legacy methods for Domain Control Validation.

What’s Domain Control Validation?

Domain Control Validation is a security-critical process designed to ensure certificates are only issued to the legitimate domain operator.

Sunsetted methods relying on email:Sunsetted methods relying on phone:Sunsetted method relying on a reverse lookup:For everyday users, these changes are invisible - and that’s the point.

These changes push the ecosystem toward standardized (e.g., ACME), modern, and auditable Domain Control Validation methods.

Partnership with ArmOur goal is to raise the bar on GPU security, ensuring the Mali GPU driver and firmware remain highly resilient against potential threats.

We partnered with Arm to conduct an analysis of the Mali driver, used on approximately 45% of Android devices.

This approach allowed us to roll out the new security policy broadly while minimizing the impact on developers.

This effort spans across Android and Android OEMs, and required close collaboration with Arm.

The Android security team is committed to collaborating with ecosystem partners to drive broader adoption of this approach to help harden the GPU.

We built on Gemini's existing protections and agent security principles and have implemented several new layers for Chrome.

To further bolster model alignment beyond spotlighting, we’re introducing the User Alignment Critic — a separate model built with Gemini that acts as a high-trust system component.

A flow chart that depicts the User Alignment Critic: a trusted component that vets each action before it reaches the browser.

The User Alignment Critic runs after the planning is complete to double-check each proposed action.

Looking forwardThe upcoming introduction of agentic capabilities in Chrome brings new demands for browser security, and we've approached this challenge with the same ri…

Android uses the best of Google AI and our advanced security expertise to tackle mobile scams from every angle.

Over the last few years, we’ve launched industry-leading features to detect scams and protect users across phone calls, text messages and messaging app chat notifications.

To help combat these types of financial scams, we launched a pilot earlier this year in the UK focused on in-call protections for financial apps.

The UK pilot of Android’s in-call scam protections has already helped thousands of users end calls that could have cost them a significant amount of money.

We’ve also started to pilot this protection with more app types, including peer-to-peer (P2P) payment apps.

Secure by DesignWe built Quick Share’s interoperability support for AirDrop with the same rigorous security standards that we apply to all Google products.

Secure Sharing Channel: The communication channel itself is hardened by our use of Rust to develop this feature.

On Android, security is built in at every layer.

On Android, security is built in at every layer.

Secure Sharing Using AirDrop's "Everyone" ModeTo ensure a seamless experience for both Android and iOS users, Quick Share currently works with AirDrop's "Everyone for 10 minutes" mode.