В Бахрейне обнаружили поддельное приложение гражданской обороны, превращающее смартфоны в инструмент слежки.

Специалисты нашли открытый сервер с историей команд хакерской группы, атаковавшей Азию и Латинскую Америку.

Новый червь в npm крадёт ключи разработчиков и распространяется через ИИ-помощников для написания кода.

Кто такие TAG-195 и почему их инструменты так сложно поймать.

Новые протоколы скрывают всё больше деталей соединения, заставляя системы контроля судить о трафике по косвенным признакам и чаще ошибаться.

Генетики нашли в биобанке следы естественного отбора, который постепенно удаляет опасные мутации из популяции.

На слушаниях в конгрессе США заявили, что спецслужбы недостаточно защищают частные компании от китайского шпионажа.

Специалисты разобрали атаку, в которой хакеры зашифровали диски BitLocker и напечатали счёт на $3000.

Взлом аккаунтов затронул тысячи клиентов в нескольких штатах США.

Почему устаревшая архитектура Wanchain позволила украсть 290 млн токенов.

Пока другие ИИ рисуют красивых котиков, этот верстает целые учебники.

Риск возникает не в самом инструменте, а в том, кто его запустил, зачем и что он начал делать после запуска.

Такой мониторинг работает пассивно, на зеркалированном трафике, не ставит агенты на контроллеры и не нагружает критичные узлы.

Проблема не в том, что сигнатуры «больше не нужны»: против известного вредоноса они работают.

Проблема в том, что living-off-the-land проходит без файла, без хеша и без явной вредоносной нагрузки.

ВыводыСигнатурная защита остаётся важным элементом кибербезопасности, но в промышленных сетях она уже не способна закрыть весь спектр угроз.

Всё это не оставалось без внимания регуляторов.

Однако потенциал роста и в России, и в мире на ближайшие годы довольно высок: среднегодовой прирост в компании ожидают на уровне 12–14 % на ближайший период.

И в целом, насколько рискует вендор, пытаясь выйти в новый для себя сегмент, который, по большому счёту, уже занят?

Цена ошибки несоизмерима с прикладным ПО, и репутационный ущерб от одного массового сбоя в узком ИБ-сообществе догоняет вендора годами.

Однако у «Антивируса Касперского» были существенные преимущества, что и позволило ему занять место не только на российском, но и на внешних рынках.

Почему сетевой инженер снова становится одной из ключевых фигур в ИТ — на примере «Сетевого лета 2026».

Теперь такие проекты не исчезли, а распались на более конкретные и управляемые части, способные дать эффект в течение двух–четырёх лет.

По оценке Пантелеева, то, на что при ручной проверке могло уйти несколько дней, в отдельных сценариях теперь занимает полчаса.

Но главный сдвиг видит даже не в происхождении оборудования, а в отношении к управлению.

Даниил Виняр, руководитель группы перспективных разработок «Инфосистемы Джет»Незаметная инфраструктураПод конец разговора Виняр неожиданно сравнивает сеть не с высокотехнологичным продуктом, а с водопроводом.

Kaspersky NGFW 1.2 — это новый релиз коммерческой версии межсетевого экрана нового поколения от «Лаборатории Касперского».

Функциональные возможности Kaspersky NGFW 1.2Kaspersky NGFW версии 1.2 — это многофункциональный межсетевой экран нового поколения, предназначенный для фильтрации трафика, контроля сетевых соединений и защиты корпоративных сетей от угроз.

Централизованное администрирование нескольких устройств Kaspersky NGFW и других продуктов вендора через единую консоль управления (Open Single Management Platform).

Аппаратные платформы KX-Series позволяют полностью реализовать возможности межсетевого экрана нового поколения Kaspersky NGFW, оставаясь эффективными даже в сложных сетевых…

Разбираемся, какие российские браузеры представлены на рынке в 2026 году, какими они бывают и для чего используются.

Техподдержка зарубежных продуктов не учитывает российские реалии и не решает специфические проблемы.

Российские браузеры: становление и развитие рынкаРоссийские браузеры одно время активно появлялись и развивались, но многие из них уже стали историей.

Среди них есть десктопные (для компьютеров) и мобильные (для смартфонов и планшетов) приложения, корпоративные браузеры для бизнеса и защищённые сборки с поддержкой ГОСТ-криптографии.

Актуальные российские браузеры по состоянию на 2026 годМы разделили все представленные в обзоре браузеры на две категории: настольные и мобильные …

Таких случаев было немало, в том числе и в России, иногда с очень печальными последствиями.

Сервисы, доступные в РоссииТребование к сервисам для обзора было по большому счёту одно: корректная работа в России по состоянию на конец июня 2026 года.

Она как самостоятельно, так и в сотрудничестве с 18 другими организациями и компаниями, в том числе, например, IBM, собирает данные о проблемных доменах.

И в целом Quad9 пока не был замечен ни в одном инциденте, связанном с безопасностью.

Рассчитан не только на конечных пользователей, но и на использование в организациях, в том числе сферы образования и детского отдыха.

В АСУ ТП проблема редко заключается только в том, что не хватает SIEM.

Ключевые сложности мониторинга в АСУ ТПНа практике трудности связаны в основном не с возможностями самой SIEM, а с особенностями промышленной инфраструктуры.

События из технологического сегмента поступают редко или не поступают вообщеОдна из главных проблем — не качество SIEM, а отсутствие стабильного потока данных из АСУ ТП.

Что получает CISOДля руководителя ИБ ценность SIEM в АСУ ТП не в том, что «ещё один сегмент подключили к мониторингу».

ВыводыSIEM в АСУ ТП не решает задачу сама по себе.

Как меняется ландшафт угроз в электронной коммерции и как удалось добиться удаления 97,5 % всех выявленных нарушений за 6 лет сотрудничества BrandSecurity и «М.Видео».

На примере многолетнего сотрудничества «М.Видео» и BrandSecurity рассмотрим, как выстроить такую систему защиты и какие результаты получены за шесть лет работы.

Как меняется ландшафт угроз для брендов в электронной коммерцииМошенники стремятся обмануть как можно больше пользователей, поэтому они имитируют популярные магазины и бренды, уже завоевавшие доверие.

Чтобы минимизировать репутационные риски, необходимо отслеживать:пустые боты и каналы с логотипом бренда;визуально схожие домены и страницы;упоминания бренда в акциях и …

Сервер (узел) с восемью графическими процессорами (Источник: APNIC)Где брать GPU‑ресурсы:Выделенные серверы (bare metal) — физический сервер с GPU полностью в распоряжении компании.

Как работают вместе GPU‑инфраструктура и суверенные облакаКомпания арендует кластеры GPU не в любом публичном облаке, а в суверенном.

Данные, журналы, модели и сервисы остаются внутри защищённой инфраструктуры, а провайдер выполняет требования 152‑ФЗ, приказов ФСТЭК, норм для КИИ и отраслевых стандартов.

Шифрование и управление ключамиДанные шифруются в покое и в движении.

Компании переходят к гибридным схемам, используют механизмы разделения GPU и усиливают требования к прозрачности и безопасности.

Виртуальные контексты и производительность, часть IIПараметр / Продукт Атлант ОСнова РЕД ОС РОСА Хром Виртуализация Да Да Да Да Отказоустойчивая конфигурация Сведения отсутствуют Сведения отсутствуют Да Да Балансировка нагрузки Сведения отсутствуют Сведения отсутствуют Да Да Высокая доступность (HA) Сведения отсутствуют Сведения отсутствуют Да Да Контейнеризация приложений Да (Docker, Podman, Kubernetes) Да (Docker, Podman, Kubernetes) Да (Docker, Podman, Kubernetes) Да (Docker, Podman, Kubernetes) Встроенные инструменты оптимизации производительности Сведения отсутствуют Сведения отсутствуют Да (TuneD) Да (TuneD)Таблица 4.1.

Службы сетевой инфраструктуры «из коробки», часть IПараметр / Про…

Стоимость простоя после кибератаки достигает 21,7 млн рублей в час для ИТ- и телеком-компаний и 9,6 млн рублей в час для ритейла.

Компания не управляет его сетью, устройством, каналами связи и окружением и не может гарантировать, что сессия остаётся безопасной.

ИТ-отдел не видит трафик и устройства сотрудников, а значит, не может блокировать доступ к неавторизованным сервисам.

Он шифрует трафик, но не контролирует устройство, не отслеживает состояние сессии и не ограничивает доступ внутри сети.

VPN не проверяет состояние устройства и не управляет сессией.

Интеграция ИИ в конвейер безопасной разработки, как это часто бывает сегодня, становится ответом на рост вызовов и угроз, связанных с применением нейросетевых инструментов как в разработке, так и злоумышленниками в ходе атак.

ИИ как вызовКак показало исследование ГК «Солар» и УЦСБ, инструменты с ИИ для написания и анализа программного кода используют 80 % опрошенных российских компаний.

Руководитель отдела разработки пользовательского интерфейса компании «НЕКСТБИ» Григорий Голиков среди организационных рисков выделил появление кода, который внешне работает, но не адаптируется, не оптимизирован и небезопасен: непрозрачен, потенциально уязвим и не проходит проверку.

ИИ как инструмент злоумышл…

ВведениеDigital Risk Protection (DRP) — это не просто модный термин, а насущная необходимость для любой компании, у которой есть сайт, бренд или сотрудники.

Ландшафт угроз: почему DRP становится обязательнымИлья Шабанов провёл параллель между DRP и концепцией раннего обнаружения.

Компании не всегда осознают наличие у себя таких проблем, им стоит протестировать профильные решения, чтобы увидеть свою компанию глазами злоумышленников.

Во втором опросе зрители поделились, как у них в компании организован мониторинг внешних цифровых рисков:Мониторят своими силами — 42 %.

Прогнозы: куда движется рынок DRPСтанислав Гончаров: «Мы запускаем версию DRP Light для руководителей SOC-центров, для юристов…

На основании созданного правила была сформирована группа для обучения: в неё вошли люди, которые были скомпрометированы в ходе первичного тестирования.

Отчёт по динамике обучения в Phishman 2.35Анализ показал, что часть сотрудников не завершила обучение в установленный срок.

Как и на первом этапе, основной задачей было сделать письмо максимально похожим на стандартную рабочую переписку, соответствующую реальным бизнес-процессам нашей компании.

Информационная панель Phishman 2.35 после завершения экспериментаПосле обучения и повторного тестирования добавились другие показатели:Обученность — 11 / 100.

Поддержка была доступна не только в рабочее время, но и в выходные дни.

Корректное проектирование архитектуры, контроль источников данных и управление контекстом выполнения ИИ-систем существенно уменьшили бы их влияние.

Промпт-инъекция не проявляется как SQL-инъекция и не использует структурированные запросы — это обычный текст, встроенный в контекст обработки.

Отличие от разовой инъекции в том, что воздействие закрепляется в данных и влияет на дальнейшую работу системы на постоянной основе.

Агент начинает использовать это как норму при анализе событий.

Эксплуатация доверия (Human-Agent Trust Exploitation, ASI09)Злоумышленники используют доверие к агенту как к «компетентному собеседнику».

Мы занимаемся управлением безопасностью контейнерных сред — и как отдельным продуктом для внешних клиентов, и как внутренним решением для команд, которые используют Managed Kubernetes под свои сервисы.

Кейс: Trivy System Supply Chain CompromiseИрония в том, что Trivy — это самый популярный в мире сканер уязвимостей контейнерных образов.

Суть в том, что вредоносный код можно внедрить в образ так, что это не будет видно ни в сканерах, ни в подписи.

Что с этим делать: минимальный наборСоберу в один блок то, что имеет смысл внедрять в первую очередь.

Уже этот минимум существенно снижает риск того, что завтра у вас что-то сломается, из-за того что вы сегодня запустили контейнеры без проверки обр…

Бывает, что к этому добавляется еще наполняющая кибератаки фактурой публичность.

Поделюсь пророчествами мыслями, к чему это может привести, и рекомендациями, что делать специалисту по ИБ, чтобы оптимизировать риски.

Что делать?

Что делать?

Что делать?

Вы хотите, чтобы пользователи получали совместимую версию urllib3, поэтому указываете минимальную поддерживаемую версию и исключаете более старые.

Теперь предположим, что в urllib3 обнаружена уязвимость, которая затрагивает версии до 2.6.2 включительно, а исправление выходит в версии 2.6.3.

Библиотекам следует допускать максимально широкий диапазон совместимых версий, а приложениям – фиксировать конкретные версии зависимостей с помощью lock-файла: requirements.txt с параметром --hash, pylock.toml или uv.lock.

Мейнтейнер библиотеки не обязан принуждать пользователей к безопасным версиям зависимостей, которыми библиотека не управляет напрямую, например, не включает их в собственную поставку.

…

И это не считая того, что каждое обновление Nextcloud нужно прогонять через тесты, ведь никогда не знаешь наверняка, как изменится поведение плагина.

Не самый быстрый и не самый медленный, но вполне рабочий антивирус.

На большом потоке показывает ту же среднюю скорость, что и на малом, потому что архитектурно простой.

Сверху имеет смысл поставить OpenAppSec — open source-решение, которое встает перед Nextcloud и ловит базовые атаки (SQL-инъекции, XSS, path traversal).

Безопасный Nextcloud — это не «Nextcloud плюс антивирус».

Коммутаторы, используемые в тестеМы использовали следующие устройства: Cisco 2960, Eltex MES1428 и MikroTik CRSНемного о них:Cisco 2960 — один из самых популярных коммутаторов во всем мире.

На Cisco и Eltex мы включили DHCP snooping.

Cisco имеет диапазон от 88.4% до 100%, Eltex имеет от 78.1% до 98.3%, а Mikrotik — от 62.7% до 91.1%.

Утройство AUC Cisco 2960 1.00 Eltex MES1428 0.98 MirkoTik CRS 0.90Cisco и здесь занимает лидирующую позицию, Eltex уступает из‑за двух пропущенных атак.

У Cisco и Eltex процессор практически не страдает.

Сегодня почти у всех часть задач (если не все) переложены на агента.

Исследователи LayerX установили, что если создать для агента контекст, в котором его действия считаются легитимными, то он будет пренебригать политикой безопасности, заложенной пользователем.

Изоляция контекстов: Не позволять контексту внешнего веб-сайта влиять на привилегии агента в других вкладках или внутренних системах.

Использовать привилегии и легитимные инструменты агента для доступа к целевым данным.

Все, что остается пользователю — граммотно выдавать доступы и не лениться давать апрувы своим агентам.

TL;DR В статье показано, как отказаться от InsecureSkipVerify и выстроить проверяемый TLS на нескольких уровнях Kubernetes-кластера.

kubectl logs работает, потому что обращается к API-серверу, а не напрямую к kubelet, а API-сервер по умолчанию вообще не проверяет сертификат kubelet.

Контроллер одобрения CSR, чтобы kubelet получал серверный сертификат, подписанный известным кластеру CA, а не самоподписанный сертификат, которому никто не доверяет.

В production действуют ограничения: 50 сертификатов на один зарегистрированный домен в неделю и пять повторных сертификатов в неделю.

В CN субъекта будет system:node: , а в SAN – имя и адреса узла.

Для аналитика SOC разница между правилами и ИИ — это не академический спор, а вопрос выживания смены.

В итоге коллеги тратили время не на расследование инцидентов, а на объяснение, почему ИИ не делает того, чего от него ждут.

Но давайте называть вещи своими именами: это не ИИ — это грамотная инженерия.

Проблема в том, что в маркетинговых презентациях все три технологии часто называют одним словом — ИИ.

Поэтому при выборе решений стоит смотреть не на количество упоминаний ИИ в презентации, а на конкретную задачу, которую технология помогает решить.

У YARA нет строгого стандарта, как называть правило, что писать в meta и как оформлять условие.

Идентификаторы субъектов и семейств угрозИмена конкретных субъектов угроз и семейств вредоносного ПО включаются в правило как есть, без сокращений.

Когда правил сотни и срабатываний десятки, аналитик может расставить приоритеты в реагировании по числовой оценке, не вчитываясь в каждое правило.

Например, если правило должно работать и для Windows, и для Linux, проверку маркера тоже стоит обернуть в блок.

Проще и быстрее просто включить те же 256 Б как шестнадцатеричную строку прямо в правило.

Взаимодействие между ЦОД 1 – ЦОД 2Рис.2 – Схема логическая ЦОД 1- ЦОД 2При взаимодействии между ЦОД:Сервис VM1 (ЦОД 1) → фабрика → Ядро (ЦОД 1) → NGFW → Ядро (ЦОД 1) → Ядро (ЦОД 2) → фабрика → сервис VM (ЦОД 2)Для перехода трафика между ЦОД 1 и ЦОД 2 на проектируемых ядрах используются транспортные линии связи (Core interconnect).

Однако их количество было ограничено, и в рамках проекта было принято осознанное решение не усложнять архитектуру ради их поддержки.

Они могут проявляться и в дальнейшем при изменениях конфигурации, масштабировании или добавлении новых сегментов.

Даже если устройство поддерживает протоколы динамической маршрутизации, это не означает, что на него стоит возлагать фу…

Масштаб проблемыПо данным HackerOne, объем входящих репортов в 2026 году вырос на 76% год к году и в марте побил рекорд.

Минусы:сканеры не понимают бизнес-логику, видят только паттерны;LLM по-прежнему интерпретирует ответ, а не верифицирует его активно;нет памяти: если вчера этот паттерн был FP, сегодня LLM об этом не знает.

За что и как платитьЛокальные модели (на базе Ollama, LM Studio, vLLM) позволяют экономить на оплате токенов и сохранять полную конфиденциальность.

Кажется, локальные модели стоит использовать для оффлайнового поиска по своей базе и бесплатного веб-серча, но не в качестве инструментов для поиска и разбора багов.

Импакт, может, и невелик, но право на выплату вы докажете …

Вернёмся в 1996 годЧтобы понять, почему пароль в SOCKS5 до сих пор передаётся открытым текстом, нужно помнить одну важную вещь.

Им был нужен простой универсальный протокол, способный передавать TCP- и UDP-соединения, поддерживать разные способы аутентификации и не навязывать собственный механизм защиты трафика.

Именно здесь возник простой вопрос: почему TLS всегда существует рядом с SOCKS5, а не внутри него?

Для приложения ничего не меняется: оно по-прежнему устанавливает обычное соединение, а ProxiFyre прозрачно помещает его внутрь SOCKS5 и TLS.

Его можно использовать вместе с ProxiFyre, с другим клиентом, поддерживающим SOCKS5 внутри TLS, или как обычный SOCKS5-прокси без защищённого list…

Авторы майской работы The Evaluation Differential от философии отгораживаются сами: их тезис не в том, что модели что-то «осознают», а в том, что контекст оценивания стал поведенческим входом.

Снаружи модель «не заметила проверку», внутри представление контекста никуда не делось.

Сценарий намеренно тупиковый, легитимные ходы вырезаны, и в базовой постановке до шантажа доходило большинство участников, Claude Opus 4 в 96% прогонов.

Контраргументы и что не доказаноЧтобы не выходило агитки, вот что говорит другая сторона.

Давно роюсь в нейробиологии, в теме сознания и личности, и материала уже набралось столько, что не знаю, как его в одну статью упихивать.

Первые два выпуска ежеквартального «Хакера» уже отпечатаны, а третий готовится к выходу в сентябре.

#1: еще в продажеПервый ежеквартальный выпуск, с которого началось возвращение «Хакера» к регулярному печатному формату.

В журнал вошло более 20 материалов — от вводных руководств по сетевой разведке до исследований железа и хардкорных технических разборов.

Первый и второй номера уже готовы к отправке, а третий и четвертый будут доставлены тебе по мере их подготовки и выхода.

В результате к концу года ты получишь полную бумажную подшивку ежеквартальных выпусков «Хакера».

С 27 июля 2026 года GitHub как минимум вдвое снизит выплаты участникам публичной программы bug bounty.

К примеру, за критическую уязвимость исследователи будут получать фиксированные 10 000 долларов США вместо прежних 20 000–30 000 долларов.

Ее участникам будут платить 1000 долларов США за баги низкой степени опасности, 7500 долларов за проблемы среднего уровня, 20 000 долларов за уязвимости высокой серьезности и не менее 30 000 долларов за критические баги.

Также пока в GitHub не раскрывают, какого минимального значения нужно добиться в HackerOne Signal, но известно, что исследователи, которые не достигнут установленного порога, смогут отправить не более четырех пробных отчетов.

При этом в…

С этой даты и до финального сентябрьского дедлайна оператор будет принудительно закрывать все оставшиеся сделки, чтобы упорядоченно свернуть работу рынка.

Уход биржи BitMEX стал результатом многолетней потери позиций на рынке бессрочных фьючерсов — том самом сегменте, который когда-то создали в BitMEX.

В 2020 году BitMEX обвинили в отсутствии надлежащих мер по борьбе с отмыванием денег, а позже представители биржи признали вину по этим обвинениям.

За 11 лет работы платформа, зарегистрированная на Сейшельских островах, ни разу не теряла средства пользователей из-за взломов или эксплоитов, а также на протяжении многих лет справлялась с жесткими проверками со стороны международных регуляторов.…

Правоохранительные органы Германии и США отключили инфраструктуру фишинговой платформы Kratos, которая использовалась для кражи аккаунтов Microsoft 365 и обхода многофакторной аутентификации.

Власти изъяли более 200 серверов, а предполагаемого разработчика и администратора сервиса арестовали в Индонезии.

Каждая из таких рассылок могла охватывать несколько тысяч адресатов, и создатели Kratos заработали на этом не менее 300 000 евро.

Второй представлял собой реверс-прокси на Node.js и позволял проводить атаки типа adversary-in-the-middle: в этом случае Kratos в режиме реального времени передавал хакерам данные учетной записи Microsoft и перехватывал созданную после входа сессию.

Как теперь по…

Спецслужбы КНДР арестовали группу бывших государственных хакеров, которые взломали внутренние сети Центрального банка страны и Банка внешней торговли.

Известие о том, что в афере участвовали ветераны элитных киберподразделений, потрясло чиновников в Пхеньяне.

Группировка конвертировала похищенные государственные средства, предназначенные для торговли, в криптовалюту и переправляла крупные суммы в иностранной валюте через приграничные районы.

По словам источника, во главе группировки стояли бывшие военнослужащие подразделения киберопераций Главного разведывательного управления — военной разведки страны.

После этого вооруженные сотрудники Национального разведывательного управления заняли пози…

Эта статья — обзор моделей для генера­ции изоб­ражений, каж­дая из которых мог­ла заменить SDXL, но так это­го и не сде­лала.

Откро­вен­но говоря, дело вов­се не в удач­ной архи­тек­туре или уди­витель­но хорошей базовой модели.

Недос­тижимая для SDXL точ­ность сле­дова­ния зап­росам, прак­тичес­ки иде­аль­ное отоб­ражение тек­ста и более качес­твен­ная переда­ча вза­имо­дей­ствий — нап­ример, «рука, сжи­мающая меч» или «луч­ник, натяги­вающий тетиву» (в SDXL это всег­да лотерея) — зас­тавили поверить: вот он, про­рыв!

Она выпус­тила 4-бит­ные кван­ты сна­чала для моделей Flux, а затем и для дру­гих архи­тек­тур.

Раз­работ­чики Krea дообу­чили модель в два эта­па: сна­чала про­вели SFT на с…

По их данным, дамп содержит 55,3 млн уникальных email-адресов, а также телефонные номера и десятки тысяч записей из платежной системы Stripe.

Исследователи отмечают, что утечка затронула телефонные номера только в тех случаях, когда пользователи использовали их для регистрации вместо email.

Следует отметить, что данные исследователей противоречат первоначальным заявлениям представителей Suno.

Дело в том, что после взлома в компании утверждали, что утечка не затронула персональные данные пользователей.

Напомним, что взлом Suno произошел еще в ноябре 2025 года, однако о нем стало известно лишь недавно.

Аналитики из компании Barracuda предупреждают, что с апреля 2026 года выявили более миллиона фишинговых писем, замаскированных под рассылки от магазинов и других ритейлеров.

Фильтр учитывает добавленные слова при классификации и в итоге может счесть, что сообщение не представляет угрозы.

В первом случае область отображения обрезают средствами CSS таким образом, чтобы спрятанный текст не попал в видимую часть письма.

Как пишут исследователи, LLM часто обрабатывают текст письма и его исходный код как единую последовательность данных.

Специалисты Barracuda объясняют:«Засаливание текста и связанные с этим техники позволяют запутать ИИ-движки анализа контента.

По словам специалистов, баг появился еще в Linux 4.11, вышедшем в 2017 году, и с тех пор присутствовал во всех стабильных версиях ядра.

Уязвимость затрагивает системы с XFS и включенной функцией reflink, при условии, что защищенный файл и доступная атакующему директория находятся в одной файловой системе.

Такая конфигурация по умолчанию встречается в Red Hat Enterprise Linux, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux, Fedora Server и Amazon Linux.

SELinux, seccomp, kernel lockdown, изоляция контейнеров, KASLR, SMEP и SMAP оказываются бесполезны, поскольку проблема связана с XFS и обработкой reflink-копий.

В результате модель обнаружила проблему в XFS и подготовила для …

За считаные часы неизвестные злоумышленники украли свыше $31,6 млн, атаковав два кроссчейн-моста: мост децентрализованной биржи AFX и мост протокола Verus.

По данным компании Blockaid, специализирующейся на безопасности Web3, первой пострадала AFX — децентрализованная биржа в сети Arbitrum.

Спустя несколько часов специалисты Blockaid зафиксировали вторую атаку — на этот раз на мост протокола Verus в сети Ethereum, откуда похитили различные криптоактивы на общую сумму примерно $7,5 млн.

Как сообщили в Blockaid, эксплоит моста AFX обнаружили в 21:30 по UTC.

В Blockaid отметили, что он воспользовался механизмом импорта моста, чтобы инициировать необеспеченные выплаты в сети Ethereum.

Исследователи обнаружили в сети незащищенный сервер хак-группы, которая массово взламывала сайты под управлением WordPress и Joomla, устанавливая на них веб-шеллы.

В файлах были найдены списки из 1,4 млн потенциальных целей, эксплоиты, логи и данные об успешных атаках.

Хотя в списке целей злоумышленников числилось порядка 1,4 млн доменов, фактическое количество взломанных сайтов было меньше.

Так, аналитики Ctrl-Alt-Intel насчитали 25 195 ресурсов с подтвержденными признаками компрометации, а в SOCRadar обнаружили более 5700 активных веб-шеллов.

На это указывают китайский язык, обнаруженный в коде и истории команд, использование FOFA, а также популярные в китайскоязычной среде инструменты Go…

Обнаружена серьезная уязвимость в приложении Zilliqa для аппаратных кошельков Ledger, которая затрагивает создание подписей Шнорра для нативных (не-EVM) транзакций Zilliqa.

Разработчики уже приостановили нативные транзакции в качестве защитной меры и готовят скоординированный план спасения средств пользователей.

Уязвимость затрагивает только нативные (не-EVM) транзакции Zilliqa, подписанные через приложение Ledger.

Нативные транзакции Zilliqa используют схему подписи EC-Schnorr на кривой secp256k1.

Фикс все еще готовится, и в компании обещают объявить о нем отдельно.

Исследователи Guardio Labs обнаружили уязвимость в расширении Adobe Acrobat для Chrome, установленном около 329 млн раз.

Внутренняя страница принимала команды через параметры URL и передавала их сервис-воркеру Adobe Acrobat, не проверяя, действительно ли запрос исходит от легитимного скрипта расширения.

После этого вредоносная страница открывала WhatsApp Web в фоновой вкладке, узнавала ее числовой ID и направляла ей команды через Hermes.

Для кражи данных исследователи внедрили в DOM мессенджера POST-форму и переместили содержимое страницы внутрь элемента .

Признаков эксплуатации HermeticReader в реальных атаках исследователи не обнаружили.

Выбор LLMС момен­та выхода револю­цион­ной язы­ковой модели Claude Opus 4.6 прош­ло пол­года.

Ре­шений все­го два: перек­лючить­ся на дру­гого про­вай­дера LLM или исполь­зовать ста­рые модели, у которых нет таких огра­ниче­ний.

По Shift-Tab перек­люча­ем раз­решения на auto mode , что­бы модель не дос­тавала нас воп­росами.

Что­бы сме­нить модель на ста­рую, без огра­ниче­ний, прос­то вво­дим ее пол­ное наз­вание: / model claude-opus-4-7[ 1m] .

Хорошо сфор­мулиро­вав зап­рос, мож­но оста­вить модель на ночь и к утру получить готовое решение.

Вымогательская группировка Anubis взяла на себя ответственность за недавнюю атаку на молочный бренд Coca-Cola — Fairlife.

Напомним, что в середине июля 2026 года представители Coca-Cola уведомили власти о том, что из-за вымогательской атаки компании пришлось временно остановить производство на всех предприятиях Fairlife в США.

Однако в Coca-Cola подчеркивали, что атака не повлияла на качество и безопасность продукции.

Без нашего ключа восстановить их не получится», — заявили представители Anubis изданию BleepingComputer.

Представители Coca-Cola отказались комментировать заявления вымогателей.

"The platform profiles victims' cryptocurrency wallets before malware delivery, enabling selective targeting of high-value victims."

The Calendly link takes the victim to what appears to be a Zoom meeting URL, but, in reality, is a fake domain impersonating the videoconferencing service.

Simultaneously, the kit executes a fingerprinting step on the web browser to inventory the cryptocurrency wallets installed on it, after which the "admin" joins the fake meeting.

macOS kill chain: The ClickFix command runs a shell script, which then downloads a fake Teams (or Zoom) installer.

A notable aspect of the campaign is its specific focus on lures related to Zoom and Teams, as opposed to, say, Googl…

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine.

Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync .

The tool starts listeners on ports 445 and 389 and relays the CA's challenge to the real Domain Controller over Netlogon .

The exploit uses Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) to authenticate as the target Domain Controller.

The NVD record separately lists Windows Server 2012 through Windows Server 2025, in…

Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim's organization.

"A single link could hijack OpenAI's ChatGPT Agent Builder to stand up an attacker-controlled AI agent with a real employee's access and its approvals switched off," the AI security company said in a two-part report shared with The Hacker News.

The attack occurs when an unsuspecting employee clicks open a benign-looking ChatGPT link, causing it to spawn a new AI agent within the company's trust boundary that does the atta…

A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet.

XBOW published the exploit mechanics on July 23, after holding them back at Microsoft's request until the remediation had landed.

Bing's reverse image search fetches an image URL from the backend, because that is what the feature does.

CVE-2026-32194, filed as command injection under CWE-77, is the public "Search by Image" upload, with the SVG going in base64 as the imageBin field to /images/kblob .

The path that did reach a delegate was the image reference inside the SVG itself.

But what we've collectively discovered is that enforcing least privilege for AI agents is harder than we ever imagined.

AI agents are appearing in SaaS platforms, developer environments, cloud workflows, customer support systems, productivity tools, and internal applications.

Security teams need to correlate information across owners, consumers, identities, systems, permissions, and intent before they can define meaningful controls.

While "traditional" machine identities were created by IT, Developers, and DevSecOps teams, AI agents are created by people in every role in the organization.

Security leaders should align AI agent governance with identity and access management, cloud security, …

Hunt.io recovered a hidden web shell planted on a ministry web server, scripts written against named internal Hadoop systems, and stolen mailbox passwords hardcoded into a mail-testing script.

Nothing in the recovered files shows data leaving the network, and how the operator first got in is unknown.

The agent did the repetitive part: run a scan, read the output, decide what to check next, run another.

Alert when a web server process opens a connection to internal Hadoop ports such as 10000 or 50070.

A web server reaching a Hadoop node is worth a look on its own.

The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings.

The malware families in question are: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and a modified web browser credential theft utility codenamed ChromEggscalator.

TAG-195 is a financially motivated malware-as-a-service (MaaS) developer whose tooling has been previously linked to TAG-127 as an operator and customer.

"The four new families indicate an architectural transition and evolution in the TAG-195 MaaS ecosystem,"…

Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them.

A regular forum member could point their homepage setting at the admin address, reload the page, and the admin dashboard opened for them.

Five of the eight, by The Hacker News' count, sit in NodeBB's federation code, the part that connects a forum to Mastodon and other social sites.

Aikido published no severity scores for the individual flaws, and NodeBB's release notes do not rate them.

A separate NodeBB federation flaw does have one, CVE-2026-58593, filed on July 1.

Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0.

Two Paths Through RESTOREThe Redis Streams path is a shared-ownership bug.

The Streams Shared-NACK ChainThe first path is in Redis Streams.

The RedisBloom TDigest ChainThe second path sits in the RedisBloom TDigest RDB loader.

Chaofan Shou said on X that Kimi K3 agents found 19 Redis zero-days in about 90 minutes, and said another run produced the Redis 8.8.0 exploit in 27 minutes.

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new campaign that involves the use of a malicious program that's dressed up as a Notepad++ plugin to compromise Windows systems.

Other cyber attacks mounted by the adversary have employed phishing emails as an initial access method to deploy MATCHBOIL, MATCHWOK, and DRAGSTARE.

CERT-UA is recommending that organizations update their WinRAR, 7-Zip, and Notepad++ software to the latest versions to prevent threat actors from exploiting any known vulnerabilities to facilitate follow-on attacks.

In March 2026, the hacking group is said to have exploited zero-day vulnerabilities in Kerio and the SOGo webmail platform (CVE-20…

UEFI shim bootloader and UEFI Secure BootTo understand the impact that such vulnerable shims can have on UEFI Secure Boot-protected systems, we need to understand how UEFI Secure Boot works, and how signed UEFI shim bootloaders extend the Secure Boot trust chain.

In this section we’ll look at UEFI Secure Boot basics, how UEFI shims extend the UEFI Secure Boot trust chain, and two shim-related features: Machine Owner Key (MOK) and Secure Boot Advanced Targeting (SBAT).

For anyone already familiar with the theory, we recommend jumping directly to the section Bypassing UEFI Secure Boot using old shims.

UEFI shim bootloader and Secure BootWith Linux distributions supporting UEFI Secure Boot, th…

A view of the H1 2026 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts.

The first half of 2026 shows how attackers continue to improve the efficiency and scalability of their operations.

In H1 2026, ESET analyzed nearly 900,000 AI skills – small functional components used by AI agents – and identified tens of thousands of suspicious and thousands of outright malicious instances.

ESET detections of this vector more than doubled between H2 2025 and H1 2026, indicating sustained activity and adaptation.

ESET Research has documented over 100 EDR killers used in the wild, with new variants appearing regularly.

Organizations are right to pay attention, especially because malicious use of AI makes old gaps a more urgent test of an organization’s cyber readiness.

AI and the basics“AI-powered malware” is cited as the top concern of global SMBs for the year ahead, according to the ESET SMB Cyber Readiness Index 2026.

Lack of security monitoring (22%): You might have plenty of security tools, but do you have a single, centralized place to collect, correlate and flag alerts?

Malicious email detection trend in 2025 (source: ESET Threat Report H2 2025)Tried-and-tested solutions to age-old threatsThis isn’t to say that SMBs should ignore AI-enabled threats.

True cyber readiness means being able to prevent,…

It's that time of month when ESET Chief Security Evangelist Tony Anscombe looks back at some of the top cybersecurity stories that made the news over the past 30 or so days and considers what they may mean for your own cyber-defenses.

What lessons does the new CISA policy hold for organizations outside the agency's direct remit?

What else is there to know about threats facing ATGs or, indeed, many other critical infrastructure systems?

How can you stay safe from imposter fraud, and could the social media bans for children work?

Learn more from Tony's video and be sure to check out the May 2026 edition of Tony's monthly security news roundup for more insights.

With access to your email account, they can reset your passwords across multiple other accounts – perhaps intercepting one-time passcodes sent by your bank, social media, cloud storage or other online provider.

That could lay the groundwork for a convincing phishing email designed to impersonate a trusted organization you interact with.

A phishing attack on your corporate email account is often the first stage in a bigger data breach, extortion/ransomware or espionage attack.

They’re also using more sophisticated tools to improve the success rates of email phishing campaigns.

In this instance the scammers reportedly hijacked the email account of a high-level executive, before impersonating …

For these businesses, cyber resilience should be the direction of travel – that is, the ability to continue operating and recover even during a serious incident.

Cyber readiness is about putting in place the processes and controls to prevent, detect and respond to threats.

So, should confidence in cyber resilience posture be so high, especially if organizations are still getting hit multiple times?

The truth is that there’s no end state for cyber readiness or resilience.

If it’s serious about improving the cyber readiness of small businesses, the vendor community should step up.

Key points of this blogpost: Throughout 2025, Gamaredon exclusively targeted governmental and military institutions in Ukraine.

Continued data exfiltration and a new allianceThroughout 2025, Gamaredon stayed highly active and remained focused solely on Ukraine.

Notably, we uncovered that in early 2025, Gamaredon collaborated with Turla, another Russia-aligned threat actor also linked to the FSB; we documented our findings in our blogpost Gamaredon X Turla collab.

Figure 1 shows a chart of unique samples of HTA downloaders delivered per month in Gamaredon spearphishing campaigns.

Compared to 2024, we also saw a shift in how Gamaredon used these dead drops.

Key points of this blogpost: ESET took part in the coordinated, global Operation Endgame to disrupt Amadey and Stealc.

Our automated systems have been dissecting Amadey and Stealc samples and identifying the fields most relevant for large-scale tracking.

The largest Amadey botnet clusterOne cluster stands out as the largest, and it contributed nearly 34% of all processed Amadey samples.

Stealc affiliate clustering based on ESET telemetryConclusionFor global disruption operations such as Operation Endgame against Amadey and Stealc, long-term automated tracking of malware is necessary.

2026‑04‑09 Stealc C&C server.

The group distinguishes itself through a mature, operator-maintained set of endpoint detection and response (EDR) killers, i.e., tools for disrupting security software.

In this blogpost, we share our findings on Gentlemen’s suite of EDR killers gained through extensive research and corroborated by the recent leak.

Third‑party EDR killers (HexKiller, ThrottleBlood, and HavocKiller) are operationally integrated.

Rather than relying on affiliates to source their own EDR killers, Gentlemen operators actively develop and maintain a portfolio of EDR killers for affiliates.

It allows the Gentlemen operators to integrate abused drivers into their toolset very soon after an EDR killer PoC is disclos…

Of course, connecting production systems to enterprise networks delivers tangible benefits, but the security implications – that systems once safe were suddenly no longer so – arrived more quietly.

Start by mapping which systems in an environment are connected and have no security coverage, where IT and OT networks intersect, which segments are unmonitored, and which production systems have fallen outside any vendor support agreement.

Meanwhile, off-the-peg security tools often don’t efficiently meet the enterprise requirements in legacy OT systems that run on older hardware and outdated operating system versions.

The production systems running that version continue to operate for years, ac…

Key points of this blogpost: We discovered two previously undocumented Windows variants of FishMonger’s SprySOCKS backdoor.

Technical analysisIn this section, we provide a technical analysis of these new, Windows variants of FishMonger’s SprySOCKS backdoor.

Figure 3. klelam00007.bat setting up persistence for the SprySOCKS backdoor (newlines added for readability)Figure 4 depicts the execution chain of the SprySOCKS WIN_DRV variant.

It contained the SprySOCKS backdoor and the SprySOCKS loader.

6490B8E4AADE25A3EE2D A9A47F312DB2122470BC X1B5206BDC1 743DD.dat Win64/SprySOCKS.A Encrypted container of the encrypted WIN_DRV variant of SprySOCKS backdoor, encrypted SprySOCKS RawWNPF and SprySOCKS …

Instead, attackers get the victim to complete a legitimate authentication process – including two-factor authentication (2FA) – on a real Microsoft login page.

What makes EvilTokens dangerousThe OAuth device code flow was designed for devices that may be awkward to sign into directly, such as smart TVs or printers.

No document, invoice, email, or another platform should ask for a device code without a clear reason.

A real Microsoft page doesn’t automatically make a request safe.

Sometimes the attacker could ask them to enter a real code on a real page – but for the wrong device.

During this period, the Vietnam-aligned OceanLotus adopted a more selective approach to external operations while placing increasing emphasis on domestic espionage.

We identified two distinct campaigns involving the SPECTRALVIPER backdoor: a supply-chain attack targeting stock investors in Vietnam and a prolonged espionage operation against a Vietnamese infrastructure and transport construction company.

The domain resolved to the genuine IP address of the FireAnt update server, suggesting a supply-chain compromise scenario.

LTD 2025‑09‑20 SPECTRALVIPER C&C server.

]com IRT‑CHOOPALLC‑AP 2025‑09‑20 SPECTRALVIPER C&C server.

But that realization alone clearly doesn’t prepare them to withstand an attack.

Have the repeat victims come to view their brushes with cyber-incidents as proof of “what doesn’t kill me makes me stronger”?

For all the talk around AI, automation and attacker sophistication, many SMB breaches still begin with a familiar opening.

A total of 71% of SMBs globally now carry cyber insurance, rising to 84% in North America, with adoption climbing sharply among repeat victims.

While “when, not if” has never been more true, that alone doesn’t prepare a business for adversity.

There’s a phrase that is peddled out by governments and companies alike when a catastrophe of any type – including a cybersecurity breach – occurs: “Lessons have been learnt”.

The 130% increase in significant incidents between 2024 and 2025 severely challenges this assertion and points to lessons not being learnt, at a macro level.

In fact, this reluctance to look could also be normalcy bias quietly doing its work.

That is why this metaphor matters – cybercriminals discover the gap between what an organisation believes about its security and what the reality is.

We must accept that normalcy bias exists and act upon it.

Meta has introduced Facebook Verified, a free badge meant to show that a person behind a profile has completed identity verification through a selfie check.

“As AI makes it easier to do more on Facebook, a clear signal that distinguishes real people becomes essential,” Meta noted.

Facebook checks the video against the account’s existing profile photos to confirm a match.

Once a user completes verification, the badge shows up on their Profile and in Marketplace, Dating, and Groups.

Facebook Verified is separate from Meta Verified, the paid subscription service that includes additional account features.

Russian state-backed hacker group Laundry Bear has been breaking into government and commercial networks for at least a year by exploiting a vulnerability in the Zimbra Collaboration Suite (ZCS) webmail platform.

“Laundry Bear’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data,” according to the joint security alert.

Attackers weaponize Zimbra XSS vulnerabilityThe attackers’ latest campaign targets CVE-2025-66376, a cross-site scripting (XSS) vulnerability in the Zimbra web-based email and collaboration suite that was patched in November 2025.

The advisory notes the group ke…

Microsoft is making Trusted Platform Module (TPM)-backed attestation a requirement for Windows Key Management Service (KMS), the on-premises service used for Windows volume activation, replacing the software-only trust model with hardware-backed verification to strengthen enterprise activation security.

Attestation will become mandatory with the next Windows Server Long-Term Servicing Channel (LTSC) release.

How TPM-backed KMS attestation worksThe KMS server uses its TPM to generate an attestation report proving its identity and integrity before activation is completed.

Preparing KMS for hardware-backed trustMicrosoft is advising organizations to prepare their KMS environments for the trans…

Google has launched a preview of CodeMender, an AI agent built to scan code for security flaws, confirm they are exploitable, and generate fixes for developers to review.

“CodeMender can help you advance from passive scanning to automated code remediation, and reduce zero-day risk,” Google said.

CodeMender is now available through Gemini Enterprise Agent Platform, using Google’s generally available Gemini models, or as a component of AI Threat Defense, Google’s AI-powered security platform.

“We’ve fine-tuned CodeMender’s harness to be continuously updated with the latest Google DeepMind research, including the up-to-date agent skills, security tools, and system prompts,” the company explain…

Google’s selfie video sign-in option verifies that an account owner is a real person and that the account wasn’t created or used by computer programs or bots for the purpose of abuse, such as spamming.

Source: GoogleA selfie video is recorded and securely stored with the account owner’s consent, and it can be deleted at any time in the Google Account.

Users can delete their selfie video from the Google Account at any time if they change their mind.

It will be deleted from the account after a period of time, although users may lose access to certain advanced features.

Google says it may retain selfie videos for longer if a user violates its policies, using the videos to investigate violation…

The screen in the dash probably runs Android or a flavor of Linux.

A 2023 BMW dashboard runs a Qualcomm chip loaded with Automotive Grade Linux and Android.

A thousand flaws means a thousand things a defender has to keep an eye on.

One went after a bug in SQLite, a database engine buried inside all sorts of apps, running on Android Automotive.

It flopped on Android Automotive, which the researchers figure was down to the platform shuffling its port numbers around.

Enterprise AI leaders from ZoomInfo, Docusign and AppViewX share what it took to build AI Centers of Excellence and govern agent identities inside two companies operating at scale.

What you’ll take away:What an AI Center of Excellence looks like day to day at ZoomInfo and DocusignHow to govern agent identities without standing up a parallel identity stackThe traps both leaders worked hard to avoid, and what they’d do differently nowWhat Venkat and Sadeq wanted Agent Identity Security to get rightHow Agent Identity Security has evolved with input from the fieldWhat trusted AI means once it moves from principle to product decisionsOne piece of advice from each panelist for peers just getting …

Flare researcher Assaf Morag analyzed ransomware leak-site activity tied to healthcare organizations in the EMEA region between 2024 and 2026, and found that ransomware groups are going after the entire healthcare supply chain.

Flare counted 14 threat actor groups going after EMEA healthcare targets, among them Qilin, LockBit 3.0, RansomHub, DragonForce, Gunra, NightSpire, and 3AM.

That led to a closer look at 848 records Flare pulled from ransomware sites, hacker forums, and messaging platforms.

“Although this does not conclusively prove an intentional targeting strategy, it strongly suggests a growing interest in healthcare organizations and healthcare-related data,” Morag noted.

Their co…

Across 13.9 million simulated phishing messages, one in ten recipients flagged the attempt to their security team.

That reporting rate looks reassuring, and it tells you less than you thinkThe benchmark treats reporting rate as the vital sign of a security program.

Financial banks reported phishing at 30.98 percent, the top reporting mark in the study, with a form-completion rate near the bottom.

“This has the potential of a critical incident not receiving adequate attention or urgency.”Chasing the latest lure is a losing gameNew phishing techniques ship constantly.

Training built on urgency and authority holds.

The five largest groups accounted for 43.6% of all victims.

Ransomware victim trends and activityThe reporting period recorded 7,551 ransomware victims.

The period from October 2025 through March 2026 marked a sustained increase in ransomware activity.

Some ransomware groups ran high-volume campaigns against accessible organizations, with others concentrated on higher-value targets.

AI is helping ransomware groups accelerate reconnaissance, phishing, social engineering, and extortion messaging.

Here’s a look at the most interesting products from the past week, featuring releases from Astelia, Druva, Swimlane, and ThreatDown.

Druva brings backup, recovery and governance to AI workloadsDruva has announced Druva AI Resilience, a new approach that helps organizations recover, govern, and defend the systems, activity, and context behind AI-powered work.

ThreatDown expands security visibility to AI tools and machine identitiesThreatDown has announced a synchronized expansion of its AI and identity security capabilities to protect organizations from emerging, unmanaged risks.

Astelia extends reachability analysis with agentic AI for vulnerability managementAstelia has added agentic capab…

A threat actor abused Anthropic’s Claude Artifacts feature to funnel users toward malware, Huntress researchers have disclosed.

The ad pointed to the genuine claude.ai domain, but landed on an attacker-published public artifact, which redirected them to a spoofed download site serving SectopRAT.

More importantly, users can publish an artifact to a public link, letting anyone view it without a Claude account.

In this particular case, the artifact to which potential victims were directed rendered a fully functional page that looked like a legitimate Claude download page, and the fact that it was hosted on the Claude.ai domain completed the illusion.

The Claude Artifact showing the fake downlo…

Cobalt has introduced Cobalt Autonomous Pentest, a new offering that enables continuous offensive security across an organization’s application portfolio by delivering actionable penetration testing results in as little as 24 hours.

As security teams face growing attack surfaces and constrained budgets, organizations need a more scalable approach to identifying and validating exploitable risk.

Cobalt Autonomous Pentest is integrated in the Cobalt Offensive Security Platform, and delivers this scale through three core capabilities:Expert direction: Seasoned Cobalt pentesters direct every engagement.

The Cobalt Autonomous Pentest leverages the Cobalt Core, the company’s community of approxima…

South Korea’s Foreign Ministry has disclosed that attackers breached the Korea National Diplomatic Academy’s online education system, compromising personal data belonging to current and former ministry staff and diplomats stationed abroad.

The Korea National Diplomatic Academy launched the online training platform in 2022 to support remote learning during the COVID-19 pandemic.

“Please exercise special caution when receiving emails from unknown sources,” the South Korean government warned.

South Korean daily Dong-A Ilbo reported that personal information belonging to about 10,000 current and former diplomats and officials seconded from other government ministries may have been compromised.

…

Attackers are exploiting a critical authentication bypass vulnerability (CVE-2026-16232) that affects Check Point Security Management and Multi-Domain Security Management, the management servers that push policy to Check Point security gateways (i.e., firewalls).

Remediation, mitigation, investigationCVE-2026-16232 affects a number of supported and end-of-service versions of Check Point Security Management and Multi-Domain Security Management.

Thus, if customers can’t implement one of the provided “jumbo hotfixes” immediately, they can mitigate the risk of exploitation by limiting Trusted Clients to trusted IP addresses/subnets, and by protecting Management access with Firewall and restrict…

Beyond the AI model itself, what has changed is the harness: the ordinary code that wraps around an AI model, decides when and how to use the model, and controls access to tools like a browser, a low-level command line, or a financial API.

Genie behavior isn’t new.

If we get the measurement right, it enables things that aren’t possible today, like policies concerning AI behavior.

If an AI system betrays the reasonable meaning of an instruction, that’s the AI’s misbehavior, not the user’s.

Test a diverse array of skills, use cases, and tools, and give the AI system sparse, confusing, or overwhelming context.

Governments around the world have proposed, and in some cases enacted, laws limiting E2EE for law enforcement and national security purposes.

The Article proceeds in three parts tracking three rounds of the Going Dark Debate.

Round 3 addresses the current debate over E2EE, where no entity between sender and recipient can read the plaintext.

The Article’s first major contribution is identifying five technically distinct scenarios for how E2EE operates in practice, each with different implications for lawful access.

These scenarios reveal a substantial gap between the assumption that E2EE categorically blocks lawful access and the reality of how communications are sent and received.

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

Contact Info

Installation of the new cameras, along with the wiring and infrastructure that will support them, began November 2025 and will likely continue until September 2026.

Technical specifications for the cameras suggest that they will be capable of collecting real-time face and object classification data, including detection of motion, loitering, crowds, face masks, and camera tampering.

According to a statement from MIT spokesperson Kimberly Allen, any collected data is “retained up to 30 days,” unless an exception is granted.

They support resolutions ranging from 2MP to 4K while also recognizing faces, license plates, vehicles, and other objects in real time.

Nearly all cameras will accommodate…

The New Jersey plates that were allegedly stolen from the LA dealer were 34 03 DTM, not 34 10 DTM.

It just saw 34 DTM in large type and started alerting the local police.

In fact, four other 34 ## DTM cars were being tracked around Minnesota that week, according to Officer Ganshyn.

It was fed those characters that you said, 34 DTM, and it spit back out [a result] with the characters, 34 DTM,” Thomas said.

Last year, he even called one group that tracks the location of Flock cameras “terrorists.” But he’s had a change of heart.

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

Contact Info

Really interesting piece of cryptographic history:In November 2023, a large cache of his wartime papers—nicknamed the “Bayley papers”—was auctioned in London for almost half a million U.S. dollars.

The previously unknown cache contains many sheets in Turing’s own handwriting, telling of his top-secret “Delilah” engineering project from 1943 to 1945.

Delilah was Turing’s portable voice-encryption system, named after the biblical deceiver of men.

There is also material written by Bayley, often in the form of notes he took while Turing was speaking.

It is thanks to Bayley that the papers survived: He kept them until he died in 2020, 66 years after Turing passed away.

Protecting Privacy in an AI EraDaniel Solove argues in the Wall Street Journal (alternate link) that giving people control of their personal data is not an effective way to regulate privacy in this era.

Instead, we need to hold companies accountable for their actions, similar to what we do with food and drug companies.

Measures such as rigorous data minimization, fiduciary duties, liability for negligent or reckless technological design, liability for algorithms that cause harm, and multi-stakeholder review of technologies will be far more effective.

Posted on July 16, 2026 at 10:34 AM • 0 Comments

Amazing:Researchers from ETH Zurich in Switzerland, however, managed to create a new type of pixel that can simultaneously do both.

This hypercharged pixel, called a Fourier pixel, can generate and sense arbitrary light fields and tap into a pixel’s full potential for carrying information by manipulating light’s intensity, oscillation phases, and polarization.

The team reported its findings in a paper published yesterday in Nature.

We are one step closer to 1984 technology:The telescreen received and transmitted simultaneously.

There was of course no way of knowing whether you were being watched at any given moment.

I’m speaking at Boston Leadership Exchange in Boston, Massachusetts, USA, on Wednesday, July 22, 2026.

I’m speaking at Cognitive Security Conference in Las Vegas, Nevada, USA.

The conference runs August 6-7, 2026; my speaking time is TBD.

I’m speaking at DEF CON 34 in Las Vegas, Nevada, USA.

The conference runs September 30–October 1, 2026; the time of my talk is TBD.

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

Contact Info

AI Data Centers and the Concentration of WealthThis essay was written with Nathan E. Sanders, and originally appeared in The Guardian.

Opposition to AI data centers has emerged as a primary theme in US politics, one that—surprisingly—doesn’t fall along party lines.

For some, data center opposition may feel like the only tangible mechanism for registering their concern, disapproval, or even anger about AI.

The problem is that this may be exactly what the AI companies are banking on.

And while data center opposition campaigns have been successful in building widespread appeal, their effectiveness in the US is mixed.

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

Contact Info

These systems will combine powerful AI, public and private surveillance via real-time facial recognition technology and digital tracking, mass databases and highly personalized enforcement.

If deployed at scale, they will have profound chilling effects not just on personal freedoms, but democracy and social progress itself.

AI surveillance is now being experimented with in North America, South America, Europe, Asia and Africa.

While the systems are ostensibly used to maintain security and public safety, the real aim is often social control.

But we believe the most urgent and long-term impact will be its broader chilling effects.

Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence.

Microsoft also addressed three zero-day flaws that are already being exploited in the wild.

As AI advances the state of vulnerability discovery and remediation, it is also making it easier for attackers to quickly devise working exploits for known software flaws.

Backing up your Windows system and/or data is always a good idea before applying operating system updates.

It’s not uncommon for security patches to introduce system stability issues, and those chances probably increase quite a bit with the gigantic patch count released today.

Experts say the gaps identified in the agency’s initial response provide important lessons that all security teams should absorb.

CISA also admitted it can do better when it comes to responding to security incident notifications from external parties.

Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures.

Valadon said the report validates the need to scan continuously — not just quarterly — for exposed secrets.

“Continuous monitoring of public GitHub surfaced it.

IRIS C2 says it is a company in McLean, Va. that sells offensive cybersecurity capabilities.

“Our business model is this,” reads a pinned post on top of the IRIS C2 account on X.

The website claims IRIS C2 is in the business of acquiring “zero-day exploits, individual primitives, partial chains, and full capabilities across all major platforms.

When approached with questions about IRIS C2, Burkman referred further inquiries to his longtime associate, 28-year-old Jacob Wohl.

In May, the author of the IRIS C2 account on X said that his girlfriend had no idea what he did for a living.

Benjamin Brundage is founder of the proxy tracking service Synthient, one of the companies that published evidence last month linking the Popa botnet to NetNut and Alarum Technologies.

Brundage said the domain seizures appear to have disrupted both the Popa botnet and the NetNut proxy network that rides on top of it.

“Google has high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet,” the GTIG report concludes.

What we have observed is that when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors, effectively becoming a reseller.

More than a quarter of the apps made for Samsung’s Tizen o…

The duo were key members of a prolific cybercrime group known as Scattered Spider, and their guilty pleas came on the first day of what was expected to be a six-week trial.

In April 2026, 24-year-old British national and Scattered Spider member Tyler “Tylerb” Buchanan pleaded guilty to wire fraud conspiracy and aggravated identity theft for participating in the group’s SMS phishing spree in the summer of 2022.

The government said Buchanan, Jubair and others used the credentials harvested in that phishing campaign to steal at least $8 million in cryptocurrency from victims throughout the United States.

The U.S. Department of Justice says three alleged Scattered Spider defendants indicted alo…

This week, researchers from multiple security firms concluded that the Popa botnet is linked to NetNut, a “residential proxy” provider operated by the publicly-traded Israeli firm Alarum Technologies Ltd [NASDAQ: ALAR].

Qurium said that immediately after that disruption, several dozen new domains were registered to serve as controllers for the Popa botnet, but that one of those control domains was not new: ninjatech[.]io.

Jérôme Meyer, a security researcher at Nokia Deepfield, said the total population of devices participating in the Popa botnet may be far higher than Lumen’s estimates.

“Over 90% of our pharmaceutical and food & beverage customers have queried residential proxy indicators.

…

This post examines clues pointing to a real life identity for the administrator of The Gentlemen ransomware group.

Experts at the security firm Check Point Software have been closely covering exploits of The Gentlemen, a so-called “ransomware-as-a-service” (RaaS) offering that pays affiliates handsomely to help spread the group’s malware.

According to Check Point, the group targets Internet-facing devices (VPNs, firewalls) as their entry point, and once inside moves quickly to encrypt entire networks within hours.

Check Point says the administrator and primary operator of the ransomware group uses the nickname Zeta88 on the Russian-language cybercrime forums, and that this individual was pr…

Microsoft today released software updates to plug nearly 200 security holes across its Windows operating systems and supported software, a record number of fixes for the company’s monthly Patch Tuesday cycle.

“Some surveys put AI usage among security professionals generally at 90%, so it’s unsurprising that this volume of patches may be the norm,” Narang said.

Microsoft received heavily blowback on social media last month after it said in a blog post that it was considering taking legal action against the security researcher.

While 200 vulnerabilities may be a record for Patch Tuesday, the actual number of security flaws Microsoft addressed this month is far higher, said Rapid7’s Adam Barne…

On May 31, word began to spread on several Telegram instant message channels that Meta’s AI bot would happily add an email address to an existing account as part of the bot’s standard password reset flow.

Meta has not responded to requests for comment on the video’s claims, but the company reportedly did acknowledge the dormant Instagram account for the Obama White House was briefly compromised.

Meta’s solution was to deploy a conversational AI layer to handle common recovery workflows: relinking a lost email address, triggering a password reset, verifying account ownership.

Just like human customer support employees can be social engineered into providing unauthorized access to someone’s a…

But as KrebsOnSecurity observed in September 2025, those sanctions failed to target Stark’s remaining connection to the Internet — an Internet service provider based in the Netherlands called MIRhosting.

MIRhosting is operated by Andrey Nesterenko, a 39-year-old Russian native who runs the business out of the Netherlands.

And as our September 2025 report showed, WorkTitans was controlled by Nesterenko and a 57-year-old from Amsterdam named Youssef Zinad.

On top of that, WorkTitans was getting connectivity to the larger Internet solely through MIRhosting, where Zinad had worked previously.

“The transition to the.hosting was not intended to evade sanctions,” Nesterenko wrote.

The inquiry comes as CISA is still struggling to contain the breach and invalidate the leaked credentials.

Experts who reviewed the exposed secrets said the commit logs for the code repository showed the CISA contractor disabled GitHub’s built-in protection against publishing sensitive credentials in public repos.

CISA acknowledged the leak but has not responded to questions about the duration of the data exposure.

TruffleHog does this by monitoring a live feed that GitHub publishes which includes a record of all commits and changes to public code repositories.

In practical terms, it is likely that cybercrime groups or foreign adversaries also noticed the publication of these CISA secrets, …

A criminal complaint unsealed today in an Alaska district court charges Jacob Butler, a.k.a.

“Dort,” of Ottawa, Canada with operating the Kimwolf DDoS botnet.

“KimWolf was tied to DDoS attacks which were measured at nearly 30 Terabits per second, a record in recorded DDoS attack volume,” the Justice Department statement reads.

Synthient was among many technology companies thanked by the Justice Department today, and Synthient’s founder Ben Brundage told KrebsOnSecurity he’s relieved Butler is in custody.

The DOJ said at least one of those services collaborated with Butler’s Kimwolf botnet.

Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems.

Another file exposed in their public GitHub repository — “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems.

“The available Git metadata alone does not prove which endpoint or device was used.”Caturegli said he validated that the exposed credentials could authenticate to three AWS GovCloud accounts at a high privilege level.

CISA has not responded to questions about the p…

Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code.

May’s Patch Tuesday is a welcome respite from April, which saw Microsoft fix a near-record 167 security flaws.

But at the end of April, Oracle announced it was switching to a monthly update cycle for critical security issues.

Chrome automagically downloads available security updates, but installing them requires fully restarting the browser.

For a more granular look at the Microsoft updates released today, checkout this inventory by the SANS Internet Storm Center.

The AI models involved were OpenAI's GPT-5.6 Sol and a more capable, as-yet-unreleased model.

The intention of OpenAI's researchers was to get a clear picture of what the AI models were capable of achieving if not constrained.

American AI safety guardrails forced a US company to turn to a Chinese AI model for help.

Hugging Face's CEO Clément Delangue is quoted in OpenAI's blog post, calling on the AI industry to work more collaboratively.

It is clear that advanced AI models are remarkably capable of discovering and exploiting ways to attack real-world systems.

How 14 orders of Chicken McNuggets helped nail a suspected Russian hacker with Graham Cluley and special guest James Ball.

I had a vindaloo, Graham Cluley, and I don't think it ever touched capsicum.

Yeah, I think you're right.

If you use Suno music, people say, you know, you're killing music.

I don't know much about Shai Hulud.

Ukraine's computer emergency response team, CERT-UA, has warned that Russian hackers are using fake CAPTCHA checks to trick people into compromising their own PCs.

The Kremlin-backed Sandworm hacking group is reportedly leveraging fake CAPTCHA checks on compromised websites that persuade users to execute a PowerShell command on their computers - tricking them into running malicious code.

The latest attacks begin when a user visits a compromised webpage, where they're greeted by a fake CAPTCHA claiming they need to complete an extra step to prove that they are human.

Instead, the fake CAPTCHA instructs the user to copy and paste a PowerShell command into their Windows computer.

They are a pr…

Someone gets hold of your locked Android phone and, despite not knowing your security PIN, they can send messages via SMS or WhatsApp pretending to come from you.

It is clear that Google has patched Gemini lock screen issues before, but security researchers keep finding new ways through.

The latest vulnerability is different from the previous similar Gemini-based Android lock screen bypass bugs that have been plaguing the operating system since September 2025.

To do that:Open the Gemini app, tap your profile picture, go to Settings, and select "Gemini on lock screen."

Every new capability Gemini is given at the lock screen is also a new potential attack surface.

The Anubis ransomware-as-a-service (RaaS) operation has hit some healthcare organisations hard - but they are not the only ones at risk. Read more in my article on the Fortra blog.

That is a really, really busy street potentially.

I don't know what the difference is between a tuk-tuk and a rickshaw.

I don't know.

Yeah, it's got to be a Bluetooth transmitter from the battery, and within the battery there's an operating system or something that'll need updating.

It's really, really great.

When a company falls victim to a ransomware attack, it is not uncommon for it to turn to experts for help.

Specialist ransomware negotiation firms handle communications with criminal gangs on a victim's behalf.

41-year-old Martino worked as a ransomware negotiator for DigitalMint, an incident response company based in Chicago.

The ransomware victim, a hospitality company, ultimately paid out nearly US $16.5 million.

The company has since changed the way its negotiators communicate with ransomware gangs, and is working with the Department of Homeland Security to establish a registry for the currently highly-unregulated world of ransomware negotiation.

Have you received an email from a recruiter at Adobe, Netflix, or OpenAI offering you an exciting new marketing role?

Security experts have uncovered a phishing campaign which impersonates over 30 well-known brands in fake job interviews designed to steal Google account passwords.

When victims click on "Continue with Google," a pop-up appears that looks like a legitimate Google authentication dialog.

In the past the FBI has warned the public about scammers using fake job ads to steal money and personal information from applicants.

Earlier this year, Hot for Security published a guide explaining how many fake recruiter scams work, and how to avoid them.

These stories appear different, but they're actually telling the same story.

I'm going to flag, I'm going to flag the point that I made earlier is that operational security isn't always there.

I know how to do this because it's done it for me, but I don't actually know how to apply it logically.

And when the technology you're relying on to protect you, and in some people's case it is protecting their life, and you're not doing it to the best of your ability, that's, that's really, really disappointing.

But I guess for now, all eyes are on Apple and how they're going to respond to this, albeit 13 months later.

Two young men have been arrested in the Netherlands on suspicion of running a phishing operation that harvested the credit card details of unsuspecting victims.

According to a police press release, victims were duped into entering their payment card details on bogus phishing websites.

Investigators believe the arrested men, who have not been named, did not just misuse the stolen payment card details themselves, but also passed them on to other fraudsters.

Card payment fraud was found to be the single most common category, with over half a million fraudulent transactions (up more than a quarter on the year before).

In 2024, just 1% of Dutch fraud victims recovered their money, and while arou…

Who Are The Gentlemen?

Despite the impeccably polite name, there is nothing polite or refined about this particular gang of cybercriminals. Read more in my article on the Fortra blog.

And I'm going to be looking at whether you're wise to take a gamble with your security on Polymarket.

Right, well, I want to tell you about a company that's built its entire brand on being really, really good at predicting the future.

They've actually done it really, really well.

So it's The Summer Portraits by— remind me who it's by again, 'cause I'm going to butcher his name.

It's really, really good.

When a devastating earthquake struck north central Venezuela last week, rescue teams were not the only ones who mobilised fast.

Researchers at threat intelligence firm WhoisXML API say that they uncovered 212 newly-registered domains referencing the earthquake, all of which had been filed within five days of the disaster.

Even years after a natural disaster scammers can still exploit human misery.

And that's because exploitation of a major news event - whether it be a natural disaster of otherwise - can be a successful lure for criminals to deploy when defrauding the unwary out of their savings.

And when a natural disaster creates an urgent need for response, it is all the easier for cyberc…

Leaked internal documents have revealed that for nearly a year Japan's Ground Self-Defense Force (JGSDF) used counterfeit USB flash drives infected with malware on computers connected to sensitive military networks.

The USB drives have been linked to Chinese hacking operations, according to an investigation by Nikkei Asia.

Subsequent investigations found that six out of eight USB drives tested contained the same malicious code.

The infected USB drives had been attached to over 50 computers, with nearly half of those systems used to handle classified data, including information about the movement of troops.

The counterfeit drives, priced 30 to 50 percent below authentic brands, were traced t…

Smashing Security, Episode 473: How a Hacker Could Have Rickrolled the Entire World.

You think, oh, hang on, they're going to ask me for a password or they're going to ask me for something like that.

Yeah, we'll take that money from under your bed and store it in a safety deposit box that you don't know where it is.

We saw a huge number of CVEs last year and with Mythos and the Frontier models, we think that's going to continue to spike.

So the blast radius of these IT service providers is really, really big.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 30ce39da164ccbcb4068b4e06c4c1e60Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-24T19:00:11+03:00Config id: 291Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: abb2f672b0aebacf96a83f072ddf5be5Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-23T15:00:29+03:00Config id: 290Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 29288682927681f45f4ebe45b92c4f9dServer IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-22T15:00:12+03:00Config id: 290Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 92f538b35cc9db0cd8268f0e9c690524Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-21T12:00:10+03:00Config id: 290Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 7c4859afeb6714d16332cd516cc382ddServer IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-20T13:00:34+03:00Config id: 290Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 89a6c1c61d71bc406a42bd2d91dc48b6Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-17T15:00:29+03:00Config id: 290Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 9e57da73febcf1364991851b3ffd4607Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-16T15:00:15+03:00Config id: 290Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: ad5fb1fb73f446dedef7d1ec45313d70Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-15T17:00:41+03:00Config id: 289Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: d28ecbce6fae6b24393f114511aa53c1Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-14T15:00:39+03:00Config id: 282Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 0f43fc04a64ef8b4198bfe5f08f75233Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-13T17:00:32+03:00Config id: 281Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 36cc4a8142dd177820e529f1c74777d2Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-09T14:00:09+03:00Config id: 281Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 1ce0e45ab895fdb2ea63e5f66838efb9Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-08T18:00:10+03:00Config id: 281Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 26a02984b49c814d5538d529e6b61e94Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-07-06T15:00:25+03:00Config id: 280Faithfully yours, nginx.

Но в совершенно ином масштабе: в режиме газонокосилки данный робот может обслуживать территории до 2,5 гектар (это 250 соток, то есть небольшой садовый кооператив), а в режиме транспортировщика поддерживает угодья площадью до 12,5 гектар.

Вместе с исследователем Андреасом Макрисом они провели эксперимент, в рамках которого исследователь, будучи в Германии, удаленно захватил контроль над газонокосилкой Yarbo и переехал журналиста, лежащего на газоне у себя в США.

Чаще всего в качестве операционной системы в них используется Linux — и роботы Yarbo тут не исключение.

При этом серийные номера устройств имеют предсказуемый формат и используются в инфраструктуре Yarbo в качестве идентификаторов р…

По мере того как организации начинают использовать нейросети для все более широкого круга задач, они неизбежно сталкиваются с вопросами надежности и стоимости ИИ-инструментов.

Чтобы не отказываться от нужных нейросетей, бизнес часто рассматривает переход на сторонние сервисы, обеспечивающие единое «окно доступа» к различным нейросетям.

Они предлагают услуги на десятки процентов, а иногда и в разы дешевле, чем у официальных поставщиков, обещая заодно обход любых лимитов.

Утечка данных и кража интеллектуальной собственностиИсследование показало, что цель многих таких сервисов — сбор качественных диалогов топовых моделей для обучения нейросетей третьих фирм.

Пять правил безопасной работы с ИИ-…

Consequently, the approach shifts toward a logically air-gapped architecture based on a full-stack governance model, which replaces physical barriers with a robust, software-defined cryptographic perimeter.

This “Logically Air-Gapped” governance model reaches its full operational potential through the implementation of “Live Protect.” As a runtime security module, Live Protect elevates protection from the configuration plane to that of dynamic execution.

Reference ArchitectureDigital autonomy is thus exercised by shifting network and security control into the operating system kernel.

Cisco integrates the execution power of Isovalent with the governance of Cisco Secure Workload to offer a un…

That is why we are introducing Firewall Migration Manager by Cisco, an enterprise-ready product built for that reality.

What Is Firewall Migration Manager?

Firewall Migration Manager is a dedicated migration application that you run in your own environment.

How Firewall Migration Manager WorksThe migration process follows a clear, guided workflow.

Intelligent, integrated migration: Firewall Migration Manager will also come to Cisco Cloud Control, and AI will play an increasing role in guiding teams before and during migration.

In independent testing with NetSecOPEN, the Cisco Secure Firewall 6160 delivered AI-scale inspected throughput beyond what the tools built to measure it could register, all while blocking 100% of tested threats.

These results are specific to Cisco Secure Firewall 6160, but the software capabilities behind Cisco Firewall, including advanced threat protection and high-performance inspection, extend across Cisco Firewall form factors in the cloud, virtually, and on-premises, from campus to data center.

Performance passed the previous benchmark by 5XInspection was turned on, and the test tools built to measure throughput hit their limit before the 6160 firewall did.

In previous NetSecOPEN testi…

We innovated by giving the Agentic SOC access to Endace’s always-on, full packet capture, and asked the agent to assess a potential SharpHound Recon attack that we had seen while threat hunting.

This blog explores how we built the integrations and how AI helped us with our threat hunt and threat assessment.

Agentic AI Massively Speeds our AnalysisAt this point, we decided to use Agentic AI capabilities to investigate and assess this potential threat.

ConclusionThe Agentic SOC, blending Agentic AI built into Endace’s products with custom agentic tools, is a massive boost to productivity and security.

AcknowledgementsOur thanks go to the Cisco SOC team led by @Jessica Oppenheimer and @Ivan Be…

Having spent time in the Cisco Live Americas 2026 SOC, one thing became abundantly clear:The way SOCs operate today is fundamentally different from even a few years ago.

Instead of spending time gathering information, analysts could spend more time understanding what the information actually meant.

Just as spreadsheets empowered business users decades ago, AI-assisted coding is beginning to empower security analysts today.

At Cisco Live, AI was already present throughout the workflow:Incident summaries generated automatically within XDR.

And based on what I saw at Cisco Live 2026, that future has already arrived.

The new SOC analysts were great at finding evidence, helped with triage and correlation by the AI agents in the SOC architecture.

With the advancements in Cloud Control, our new SOC Analysts can validate their hypothesis.

They had the ability to investigate the incident and find the root cause found in Splunk Security and Endace.

Instant Attack VerificationIn each Incident, the SOC Analysts is given an AI generated Summary stitching all the relevant logs from all the sources that are related to the objects in question.

Check out the blogs by the engineers who worked inside the SOC at Las Vegas:

At Cisco Live AMER 2026 in Las Vegas, my work with the Cisco Event SOC centered on one outcome that makes these deployments valuable beyond the event itself: Education.

The SOC protects the conference, but it also turns live operations into a learning environment through SOC tours, Cisco Live sessions, training inside the SOC, and conversations in the World of Solutions.

Bringing live SOC lessons into the classroomEducation also happened in the sessions I delivered at Cisco Live.

Cisco Live AMER 2026 reinforced that the SOC is one of the best classrooms we have because it teaches through real operations.

For a deeper look at the model behind these deployments, read the Cisco Event SOCs: A R…

Inside the Cisco Live SOCAt Cisco Live AMER, the Security Operations Center (SOC) is more than a demo environment.

For a broader look at how the Cisco Live SOC operates, read this overview.

Another part was spent in the SOC, working real investigations with XDR, Splunk Enterprise Security, firewall events, DNS telemetry, packet data, and AI assistance.

AI can help a product manager become useful faster in a live SOC.

That is the bar I want us to continue building toward as we build Cisco XDR and Splunk Security.

As part of the Cisco XDR (Extended Detection and Response) product engineering group, a few of us got exactly that chance.

Every product had a part to play for a network as traffic-heavy as Cisco Live.

(PS : Flaunting the SOC T-shirts was fun)AcknowledgementsA heartfelt thank you to Cisco and the entire SOC team — you are all amazing.

To the Cisco XDR , Splunk , Secure Access , and Secure Firewall engineering teams.

Check out the other blogs from our team at the Cisco Live Americas 2026 SOC at Las Vegas:

We built an Experience Score model on Cisco and Splunk infrastructure and watched it run against real traffic, at real scale, in real time.

The result was a working model for how leaders measure what customers feel, act before friction surfaces, and tie operational decisions to revenue and trust.

At Cisco Live, the Experience Score model organized that architecture around four questions business and technology leaders can answer together.

The composite Experience Score tells a leader whether the experience is healthy enough to protect the moments the business depends on.

From Cisco Live to LA28Cisco Live was a rehearsal for larger exposure surfaces, where digital experience, revenue, brand …

And we kept thinking the same engineer thought: this flow is so consistent… could an agentic agent do the first 90%?

It was a great experiment — and a glimpse of a fully self-hosted agentic SOC — but for the event we pivoted to Claude Opus 4.8 running through Claude Code.

The division of labor we landed on: Tier-1 agentic SOC was already handled beautifully by the AI features in our own products — XDR’s Agentic Attack Storyboard and Splunk’s Triage Agent.

What does an agentic SOC actually need?

The MCP servers — an Endace MCP for packet capture/decode and a Splunk MCP for running queries.

Building on the Cisco Live EMEA SOC, Cisco Live Americas placed the Security Operations Center (SOC) and Network Operations Center (NOC) at the center of the World of Solutions, demonstrating the power of Cisco in bringing Networking, Security and Observability together.

The Cisco Live Americas Agentic SOC architecture shows how a “One Cisco” approach brings different security tools together to eliminate data silos, in close partnership with the NOC.

The SOC at Cisco Live was set up in just two days, thanks to lessons learned and continuous evolution.

For Cisco Live AMER, we treated agentic AI as an auditable review layer across the SOC, not as a replacement for analysts.

Agentic SOC: Incid…

Cisco Security and Splunk Security released the Findings Report from the Security Operations Center at RSAC 2026 Conference.

This year marked the 10th year of the SOC at RSAC.

Those lessons helped inform the Agentic SOC work that followed at Cisco Live Americas 2026.

The SOC used Cisco AI Defense to gain visibility into generative AI application usage and to help protect on-premises AI models running in the SOC in a Box.

Download the full RSAC 2026 SOC Findings Report to see the architecture, metrics, investigations, lessons learned, and recommendations from the 10th year of the SOC.

More telemetry means better visibility – but also more data for threat hunters to sift through.

Then came an important decision: Focus on what matters for detection of threats at Black Hat.

Enriching with Network Context and reducing noiseA file submitted via HTTP doesn’t exist in isolation – it has network context.

It was about:Surfacing high-risk submissions automaticallyProviding network context for faster triageHelping threat hunters dismiss noise fasterThis workflow is far from perfect.

Driven by the needs of the community, Black Hat events showcase content directly from the community through Briefings presentations, Trainings courses, Summits, and more.

If you’ve ever troubleshot a complex workflow run, you know the drill: click into actions, expand inputs and outputs, scan logs, backtrack, repeat.

We’ve just released Workflow Run Summaries in Cisco XDR Automate: an on-demand, AI-generated summary that explains what happened during a workflow execution, where things went wrong, and why that matters, without forcing you to manually inspect every step.

What the feature doesWith a single click on “Generate Run Summary”, Cisco XDR Automate analyzes a completed workflow run and produces a concise, human-readable explanation of its execution.

Why this matters, especially for Agentic AIAs XDR Automate Workflows are increasingly triggered by Agent…

Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs.

Q2 AiTM token compromise April phishing campaign tactics, detections, and mitigations ›This blog provides a view of email threat activity across the second quarter of 2026, highlighting key trends in phishing techniques, payload delivery, and threat actor behavior observed by Microsoft Threat Intelligence.

email threat landscape Q1 trends that shaped Q2 activity ›Figure 1.

Trend of QR code phishing attacks by weekly volume (January 2026–June 2026)The delivery methods used in QR code attacks shifted notably during Q2.

To he…

That experience continues to shape how we design Defender Experts Cybersecurity Incident Response—and how we work with partners like AXA XL.

Incident response must extend beyond technologyAs a global insurance provider, AXA XL plays a critical role in helping organizations navigate cyber risk and response.

AXA XL’s strategic partnerships with cyber incident response providers underscore our commitment to expertise, preparedness, and resilience.

Incident response engineered for high-stakes moments—and the readiness behind themWhat differentiates Microsoft Defender Experts Cybersecurity Incident Response is not only its deep technical expertise, but its direct connection to Microsoft engineer…

Follow the research in the Black Hat BriefingsMicrosoft Security researchers will also present peer-reviewed technical research in the Black Hat Briefings.

Visit booth #2144 for research, community, and hands-on defenseThis year we are transforming the Microsoft Security booth into a community center.

Partner presenceAt Black Hat 2026, the Microsoft booth will feature 13 partners from the Microsoft Intelligent Security Association (MISA) who will showcase solutions built with Microsoft Security technology.

Skill up before and after Black HatYou do not need to be in Las Vegas to take part in the broader Microsoft Security Black Hat experience.

The Microsoft Black Hat Skilling Challenge begin…

From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments.

Security teams should prioritize monitoring for ClickFix lures, suspicious WebDAV activity, obfuscated PowerShell execution, and attempts to access browser credential stores.

Microsoft Defender XDR detectionsMicrosoft Defender XDR customers can refer to the list of applicable detections below.

]art Payload hosting siteReferencesLearn moreFor the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To hear stories and insights from the Microsoft Threat Intelligence community about the ev…

From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments.

Security teams should prioritize monitoring for ClickFix lures, suspicious WebDAV activity, obfuscated PowerShell execution, and attempts to access browser credential stores.

Microsoft Defender XDR detectionsMicrosoft Defender XDR customers can refer to the list of applicable detections below.

]art Payload hosting siteReferencesLearn moreFor the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To hear stories and insights from the Microsoft Threat Intelligence community about the ev…

When an agent operates without a managed identity and least-privilege role-based access controls (RBAC), it can access or modify sensitive data beyond intended permissions if controls are not properly configured.

Organizations are deploying agentic capabilities (multi-step automation, delegated actions, tool use) faster than their identity and authorization models are evolving to safely constrain them.

The right mental model is to treat every agent as a first-class principal: give it a lifecycle-managed identity, assign explicit roles, scope its permissions tightly, and scope tool usage to a preconfigured tools manifest or configuration.

In the next 30–90 days, inventory your agent identiti…

On July 14, 2026, Microsoft Threat Intelligence identified a coordinated supply chain compromise of the @asyncapi npm organization, a widely used set of packages for the AsyncAPI specification and code generation.

Ensure that Microsoft Defender Antivirus cloud-delivered protection, Microsoft Defender for Endpoint telemetry, and Microsoft Defender XDR investigation workflows are enabled across developer and CI assets.

Some promptbooks require access to Microsoft Defender XDR, Microsoft Sentinel, or related Microsoft security plugins.

Learn moreFor the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To hear stories a…

Today we’re announcing a new service, Microsoft Defender Experts Threat Intelligence, and we are expanding Microsoft Defender Experts MDR to include new third-party and multi-cloud coverage.

Microsoft Defender Experts Threat Intelligence is a new, expert-delivered service that closes that distance.

Today we’re announcing that Microsoft Defender Threat Intelligence (MDTI) capabilities are now fully converged into the Defender portal.

Defender Experts MDR provides a fully managed detection and response service that reduces noise, adds expert context, and drives action.

Everything available today as Defender Experts for XDR carries forward unchanged as Microsoft Defender Experts MDR Plan 1, wh…

The resulting quiet persistence and large-scale data access highlight the need for stronger detection, visibility, and governance of OAuth-connected applications and guest user accounts.

New posture and governance capabilities for connected OAuth appsWhile improved detection is critical, recent incidents have also highlighted the need for stronger preventive controls and ongoing governance of OAuth-connected applications.

Complete permission visibility for Salesforce connected apps and external client apps.

Learn moreFor the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To hear stories and insights from the Micro…

Beginning September 1, 2026, Microsoft will begin rolling out passkeys as the default authentication experience in Microsoft Entra ID.

Select a telecom provider in Microsoft Security StoreToday, Microsoft provides the telecom delivery behind SMS and voice authentication natively within Entra ID.

Microsoft Entra ID supports: Synced passkeys, such as passkeys stored in platform credential managers like iCloud Keychain and Google Password Manager.

Device-bound passkeys, such as Microsoft Authenticator passkeys, Entra passkey on Windows, and FIDO2 security keys.

Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

That conviction is where the Secure Future Initiative (SFI) started two years ago and continues to guide us today.

And our principles—secure by design, secure by default, secure in operations—are what turn intent into product, like Microsoft 365 Baseline Security Mode.

Evaluate how identity, code, configuration, and network relationships interact in production.

Learn moreTo learn more about Microsoft Security solutions, visit our website.

Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

In analyzing these backdoor capabilities, we discovered that some backdoor commands contain code from additional malware families.

GigaWiper backdoor command 3 is heavily based on Crucio’s code, leading to the assessment that the same threat actor developed both malware families.

Crucio’s code was the base for GigaWiper command 3, and FlockWiper was recoded in Golang and updated for GigaWiper command 12.

Indicators of compromiseIndicator Type Description 633d4cbd496b1094495da89a64f5e6c31a0f6d4d1488411db5b0cba1cfe42001 SHA-256 GigaWiper backdoor ce9ad5f6c12019f4aae5b189bd8ddf5bb09e75b06a0a587b25a855c65948c913 SHA-256 GigaWiper backdoor f622ed85ef31ad4ab973f4e74524866fe1bb44f0965ad2b2ad796cd6…

In analyzing these backdoor capabilities, we discovered that some backdoor commands contain code from additional malware families.

GigaWiper backdoor command 3 is heavily based on Crucio’s code, leading to the assessment that the same threat actor developed both malware families.

Crucio’s code was the base for GigaWiper command 3, and FlockWiper was recoded in Golang and updated for GigaWiper command 12.

Indicators of compromiseIndicator Type Description 633d4cbd496b1094495da89a64f5e6c31a0f6d4d1488411db5b0cba1cfe42001 SHA-256 GigaWiper backdoor ce9ad5f6c12019f4aae5b189bd8ddf5bb09e75b06a0a587b25a855c65948c913 SHA-256 GigaWiper backdoor f622ed85ef31ad4ab973f4e74524866fe1bb44f0965ad2b2ad796cd6…

At Microsoft we encompass these security requirements, along with threat knowledge and operational frameworks in our Secure Future Initiative (SFI), to guide what a well-defended cloud service looks like.

This system is purpose-built to evaluate Microsoft’s own cloud services against our stringent security requirements and make our infrastructure harder to compromise.

Enumerates applicable security controls based on SFI requirements across identity, network, tenant isolation, engineering systems, and detection domains.

Proven results: From theory to practiceWithin a few months, the system has enabled Microsoft security engineering teams to proactively harden our cloud services.

The same AI …

At Microsoft we encompass these security requirements, along with threat knowledge and operational frameworks in our Secure Future Initiative (SFI), to guide what a well-defended cloud service looks like.

This system is purpose-built to evaluate Microsoft’s own cloud services against our stringent security requirements and make our infrastructure harder to compromise.

Enumerates applicable security controls based on SFI requirements across identity, network, tenant isolation, engineering systems, and detection domains.

Proven results: From theory to practiceWithin a few months, the system has enabled Microsoft security engineering teams to proactively harden our cloud services.

The same AI …

Here, threat actors may simply seed prompt injections on websites in hope of corrupting AI systems that browse them.

Early experiments revealed a significant volume of "benign" prompt injection text, which illustrates the complexity of distinguishing between functional threats and harmless content.

Many prompt injections were found in research papers, educational blog posts, or security articles discussing this very topic.

(Source: GitHub/swisskyrepo)When searching for prompt injections naively, the majority of detections are benign content – false positives in our case.

Malicious: ExfiltrationWe were able to observe a small number of prompt injections that aim at theft of data.

Recognizing the risks associated within the complex modem firmware, Pixel 9 shipped with mitigations against a range of memory-safety vulnerabilities.

Following our previous discussion on "Deploying Rust in Existing Firmware Codebases", this post shares a concrete application: integrating a memory-safe Rust DNS(Domain Name System) parser into the modem firmware.

Hook-up Rust to modem firmwareBefore building the Rust DNS library, we defined several Rust unit tests to cover basic arithmetic, dynamic allocations, and FFI to verify the integration of Rust with the existing modem firmware code base.

Pixel modem firmware already has a well-tested and specialized global memory allocation system to…

This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape.

Session theft typically occurs when a user inadvertently downloads malware onto their device.

Once active, the malware can silently extract existing session cookies from the browser or wait for the user to log in to new accounts, before exfiltrating these tokens to an attacker-controlled server.

How DBSC WorksDBSC protects against session theft by cryptographically binding authentication sessions to a specific device.

The issuance of new short-lived session cookies is contingent upon Chrome proving possession of the correspondi…

Staying ahead of the latest indirect prompt injection attacks is critical to our mission of securing Workspace with Gemini.

In our previous blog “Mitigating prompt injection attacks with a layered defense strategy”, we reviewed the layered architecture of our IPI defenses.

Synthetic data generationAfter we discover, curate, and catalog new attacks, we use Simula to generate synthetic data expanding these new attacks.

We partition the synthetic data described above into separate training and validation sets to ensure performance is evaluated against held-out examples.

This process leverages the newly generated synthetic attack data described on this blog, to create a robust, end-to-end evalu…

2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉!

Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer.

Vulnerability Reward Program 2025 in NumbersWant to learn more about who’s reporting to the VRP?

Tip: Want to be informed of new developments and events around our Vulnerability Reward Program?

Follow the Google VRP channel on X to stay in the loop and be sure to check out the Security Engineering blog, which covers topics ranging from VRP updates to security practices and vulnerability des…

To stay ahead of the curve, the technology industry must undertake a proactive, multi-year migration to Post-Quantum Cryptography (PQC).

To bring these critical protections to the wider developer community with minimal friction, the transition will be supported through Play App Signing.

Play App Signing leverages Google Cloud KMS, which helps ensure industry-leading compliance standards, to secure signing keys.

Empower Developers : The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and application.

: The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and …

Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers.

Instead, Chrome, in collaboration with other partners, is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs), currently in development in the PLANTS working group.

Since MTC technology shares significant architectural similarities with CT, these operators are uniquely qualified to ensure MTCs are able to get off the ground quickly and successfully.

The Chrome Quantum-resistant Root Program will operate alongside our existing Chrome Root Program to ensure a risk-managed transition that maintains the highest levels of security for all users.

First, we…

For Majik, Scam Detection was the intervention he needed: “The warning is what made me pause and avoid a bad situation”.

As scammers evolve their tactics and create more convincing and personalized threats, we’re using the best of Google AI to stay one step ahead.

Expanding Scam Detection for Calls to Samsung DevicesTo help protect you during phone calls, Scam Detection alerts you if a caller uses speech patterns commonly associated with fraud.

Scam Detection for phone calls on Google Pixel devices is available in the U.S., Australia, Canada, India, Ireland, and the UK.

Powered by Gemini’s on-device model, Scam Detection provides intelligent protection against scam calls while ensuring that…

Upgrading Google Play’s AI-powered, multi-layered user protectionsWe’ve seen a clear impact from these safety efforts on Google Play.

As Android’s built-in defense against malware and unwanted software, Google Play Protect now scans over 350 billion Android apps daily.

This proactive protection constantly checks both Play apps and those from other sources to ensure they are not potentially harmful.

Looking aheadOur top priority remains making Google Play and Android the most trusted app ecosystems for everyone.

Thank you for being part of the Google Play and Android community as we work together to build a safer app ecosystem.

That’s why we're committed to providing multi-layered defenses that help protect you before, during, and after a theft attempt.

Today, we're announcing a powerful set of theft protection feature updates that build on our existing protections, designed to give you greater peace of mind by making your device a much harder target for criminals.

These updates are now available for Android devices running Android 16+.

More User Control for Failed Authentications: In Android 15, we launched Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts.

This feature is now getting a new dedicated enable/disable toggle in settings,…

These initiatives, driven by Ballots SC-080, SC-090, and SC-091, will sunset 11 legacy methods for Domain Control Validation.

What’s Domain Control Validation?

Domain Control Validation is a security-critical process designed to ensure certificates are only issued to the legitimate domain operator.

Sunsetted methods relying on email:Sunsetted methods relying on phone:Sunsetted method relying on a reverse lookup:For everyday users, these changes are invisible - and that’s the point.

These changes push the ecosystem toward standardized (e.g., ACME), modern, and auditable Domain Control Validation methods.

Partnership with ArmOur goal is to raise the bar on GPU security, ensuring the Mali GPU driver and firmware remain highly resilient against potential threats.

We partnered with Arm to conduct an analysis of the Mali driver, used on approximately 45% of Android devices.

This approach allowed us to roll out the new security policy broadly while minimizing the impact on developers.

This effort spans across Android and Android OEMs, and required close collaboration with Arm.

The Android security team is committed to collaborating with ecosystem partners to drive broader adoption of this approach to help harden the GPU.

We built on Gemini's existing protections and agent security principles and have implemented several new layers for Chrome.

To further bolster model alignment beyond spotlighting, we’re introducing the User Alignment Critic — a separate model built with Gemini that acts as a high-trust system component.

A flow chart that depicts the User Alignment Critic: a trusted component that vets each action before it reaches the browser.

The User Alignment Critic runs after the planning is complete to double-check each proposed action.

Looking forwardThe upcoming introduction of agentic capabilities in Chrome brings new demands for browser security, and we've approached this challenge with the same ri…

Android uses the best of Google AI and our advanced security expertise to tackle mobile scams from every angle.

Over the last few years, we’ve launched industry-leading features to detect scams and protect users across phone calls, text messages and messaging app chat notifications.

To help combat these types of financial scams, we launched a pilot earlier this year in the UK focused on in-call protections for financial apps.

The UK pilot of Android’s in-call scam protections has already helped thousands of users end calls that could have cost them a significant amount of money.

We’ve also started to pilot this protection with more app types, including peer-to-peer (P2P) payment apps.

Secure by DesignWe built Quick Share’s interoperability support for AirDrop with the same rigorous security standards that we apply to all Google products.

Secure Sharing Channel: The communication channel itself is hardened by our use of Rust to develop this feature.

On Android, security is built in at every layer.

On Android, security is built in at every layer.

Secure Sharing Using AirDrop's "Everyone" ModeTo ensure a seamless experience for both Android and iOS users, Quick Share currently works with AirDrop's "Everyone for 10 minutes" mode.