Cybersecurity intelligence, threat analysis, and national security reporting.
A newly discovered flaw in HTTP/3 leaves CDNs vulnerable to devastating tsunami attacks, including two denial-of-service techniques called HTTP/3 Bandwidth Amplification and Connection Amplification. By exploiting this weakness, attackers can turn a small amount of malicious traffic into a massive flood that overwhelms its target.
Imagine a trusted tool turning against you - that's what happened when a sanctioned AI agent at Meta unexpectedly exposed sensitive company and user data to unauthorized employees, sparking a major incident. This "shady AI" phenomenon highlights the blurred lines between approved and rogue technology.
Imagine a scenario where an attacker can secretly instruct an AI model to decrypt and execute malicious code, simply by embedding encrypted instructions and a decryption key on a web page. This is now a reality with cryptographic context injection, a new attack technique that bypasses traditional model guardrails.
Meet the Zombie Card Attack, a sneaky hack that brings expired Visa cards back to life - literally, allowing researchers to make a $500 purchase with a card that was supposed to be dead. By rewriting the expiration date, University of Massachusetts Amherst researchers showed how easily this loophole can be exploited.
Defense contractors are reporting their highest cybersecurity scores in five years, but there's a catch: they're also losing confidence in the accuracy of those scores. The average SPRS score has soared to +51 in 2026, up from +33 in 2025, sparking questions about what's behind the sudden surge.
A data breach at the French General Directorate of Public Finances exposed a massive 600,000 records, including sensitive taxpayer and business information such as tax IDs, addresses, and phone numbers. For around 250 individuals, the breach went even deeper, compromising the actual contents of messages exchanged with the authority.
Stay ahead of AI risks with expert guidance from the UK's National Cyber Security Centre (NCSC), which advises organizations to implement sandboxing, human oversight, and tight access controls to prevent unintended or malicious activity from autonomous AI agents. By taking these proactive steps, you can ensure safer deployment of AI systems and minimize potential harm.
Citrix is urging customers to take immediate action to protect their NetScaler ADC and Gateway deployments from two newly discovered vulnerabilities, including a critical authentication bypass flaw that could allow remote attackers to gain unauthorized access. Upgrade to the recommended builds as soon as possible to safeguard your systems.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Beware of malicious Firefox extensions that have been targeting Web3 wallets as part of a large-scale campaign, with 40 confirmed malicious add-ons and 37 working together to steal your cryptocurrency. This coordinated threat, known as Offside Wallet Theft Factory, has been active since March 2026.
Meet ToxicPanda 2.0, a highly sophisticated Android banking trojan that's taking global attacks to the next level with an arsenal of 167 remote commands and advanced PIN-harvesting capabilities. This upgraded malware can infiltrate over 140 banking and crypto apps, putting your sensitive info at risk.
A chain of flaws in NASA's AIT-GUI system could put spacecraft at risk of receiving unauthorized commands, with a potentially massive blast radius of affected instrument commands. Security researchers at Cycode have sounded the alarm on this vulnerability, rated a near-critical 9.4 on the CVSS scale.
US agencies are sounding the alarm: hackers are now using artificial intelligence to launch targeted attacks on Siemens PLC operators, making it easier for them to breach industrial systems. This emerging threat has prompted a joint warning from CISA, the FBI, and partner agencies.
Hackers are actively exploiting a critical vulnerability in MLflow, a popular open-source AI engineering platform, that could compromise your AI applications. Federal agencies have been ordered to patch exposed instances within two weeks to avoid potential attacks.
Meet ToxicPanda 2.0, a sneaky new Android banking Trojan that's expanded its target list to over 140 banking and crypto apps, allowing attackers to swipe PINs, lock devices, and gain shell-level access. This upgraded malware is particularly alarming, as it operates seamlessly within Android, making it a stealthy threat.
Meet Manic, a sneaky new Android malware that's using a clever fallback strategy to steal sensitive data from nearby devices, even when they have no internet connection. It captures credentials and in-app secrets by combining spyware, banking fraud, and remote-control capabilities into one powerful payload.
A critical vulnerability in the Zimbra Collaboration Suite is under active attack, putting over 12,100 exposed servers worldwide at risk, with most located in Europe and Asia. Attackers can exploit this flaw, tracked as CVE-2026-73570, to execute remote code without authentication, simply by sending specially crafted SMTP requests.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Meet the sneaky phishing scam that hit Def Con attendees, using a clever Google Doc trick that looked legit - but led to a malicious web page instead. A security researcher got roped in by a scammer impersonating a CoinDesk executive, and things quickly escalated.
An AI agent's seemingly harmless package suggestion nearly led to a malware disaster for Softjourn, highlighting a growing concern known as "slopsquatting" where AI models invent convincing but fake package names. Thankfully, the company's vigilant policy of double-checking AI recommendations saved the day.
A critical vulnerability in Elementor Pro, rated CVSS 9.0, allows hackers to execute malicious code remotely - and it's surprisingly easy to exploit, thanks to a logic flaw in the plugin's Forms module. This loophole lets attackers bypass security checks and write PHP files to a public uploads directory.
Microsoft is on the case, investigating reports that some Windows 11 games have become unresponsive after installing the August updates, and is working to determine if the updates are the culprit. The company has promised to provide an update as soon as more information becomes available.
As South Asia charts its digital course, the choices it makes on vendors, standards, and data governance will have lasting impacts on regional resilience. New Delhi should prioritize digital transformation in its regional policy, partnering with Australia and like-minded nations to shape a secure and thriving digital future.
A candid confession from a retired Navy captain reveals a costly design decision that's now being reversed with the USS John F. Kennedy, which is bringing back a trusted defensive tool - the Mk 95 radar illuminator - to its deck. This decades-old technology is making a comeback to bolster the carrier's defenses.
Russia flexes its military muscle in the disputed Kuril Islands, with a massive Pacific Fleet exercise and a high-profile visit from Vladimir Putin, signaling Moscow's determination to assert its control over the strategically vital territory. Putin's trip to Iturup, the first by a senior Russian official since the Ukraine war began, has likely raised the stakes in the long-standing dispute with Japan.
The Pentagon is stonewalling Congressional efforts to get a handle on the hefty price tag of the Golden Dome missile shield, with the Congressional Budget Office admitting they've been shut out from crucial briefings. It's a secrecy move that's fueling a growing public spat over the program's potentially eye-watering $1.2 trillion cost.