General cybersecurity news and analysis
Meet Raheim Hamilton, aka Sydney and ZeroAngel, the dark web kingpin behind Empire Market, who just got 40 years for facilitating a whopping $430 million in shady deals. He and his partner made it easy for users to stay under the radar with cryptocurrency, encryption, and even a rating system for vendors who could best conceal their illicit goods.
The Samsung Galaxy S26 proved to be a vulnerable target at Pwn2Own Ireland, falling to three separate zero-day exploits on day two of the competition, with security researchers scoring big with their discoveries. Each successful hack earned them a hefty payday, with a total of $232,500 in cash awards doled out that day.
The Army is taking a major leap forward in command and control capabilities, awarding $93.6 million in contracts to nine top companies to develop core software applications for its Next Generation Command and Control (NGC2) initiative. This critical investment lays the groundwork for rapid scalability, training, and unified force operations.
SonicWall has patched a critical security flaw in its SMA1000 appliances that could let attackers infiltrate internal systems and run unauthorized operations. The bug, rated 10.0 on the CVSS scale, can be exploited before login, making it a high-risk vulnerability.
AWS just launched Strands Box, an open-source sandbox that helps keep rogue AI agents in check by combining top-notch isolation with policy enforcement to prevent unchecked actions. This game-changing tool tackles the growing risk of AI agents running wild, approving every action without human review.
Relying on passwords for security is a recipe for disaster, as humans simply can't keep track of multiple complex combinations, leading to reused, shared, or poorly stored passwords. A recent survey found that nearly half of cybersecurity pros still use passwords for personal and work accounts, despite knowing they're one of the least secure authentication methods.
Microsoft is bolstering security in Outlook on the web and Windows by blocking MSIX attachments, including .msix and .msixbundle file types, to protect users from potential threats. This update will be applied to the default list of blocked file types, enhancing overall security in the platform.
Apple's new Reference Image system verifies that an image is genuine and exactly as taken by an iPhone, without revealing the photographer's identity or linking the image to a specific device. This innovative tool protects both the image and the photographer's anonymity, giving creatives peace of mind.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Public sector networks are facing a daunting challenge: managing tens of thousands of endpoints scattered across diverse environments, from remote mountain sites to manned stations and mobile units. Take the Coast Guard, for instance, which operates 1,500 locations worldwide, each with its own unique connectivity and security needs.
The threat landscape is evolving at an alarming rate: a 49.5% surge in CVEs reported in the first half of 2026, with exploits now emerging in as little as eight hours. This means traditional cyber defense validation methods are being outpaced by the speed and volume of attacks.
As AI tools become increasingly embedded in workflows, a growing number of organizations are struggling to balance innovation with security, with 78% of CISOs now recognizing GenAI as a security risk and restricting employee use. But blocking access alone isn't enough - effective governance is crucial to ensure AI systems are used safely and responsibly.
Don't let your SonicWall SMA1000 gateways become an open door for hackers - a critical SSRF flaw, CVE-2026-102255, has been discovered, allowing attackers to make internal requests without authorization, and hotfixes are available to patch this vulnerability. Over 400 Internet-exposed appliances are currently at risk, making immediate action crucial.
In just one day, top ethical hackers at Pwn2Own Ireland 2026 uncovered a staggering 32 zero-day vulnerabilities, raking in over $368,000 in prizes and showcasing the impressive skills of today's cybersecurity experts. This impressive haul highlights the vast attack surfaces of modern technology and the talent of the global ethical-research community.
Anthropic is supercharging cyber teams with expanded access to its AI models, following a staggering discovery of 129,000 flaws - with over 33,000 rated critical or high-severity. The company's Cyber Verification Program now offers tiered access to advanced models like Claude Opus 5.5, empowering teams to tackle vulnerabilities head-on.
Despite knowing better, nearly half of cybersecurity pros still rely on vulnerable usernames and passwords to protect their personal and work accounts. This surprising habit persists even though passwords are considered one of the least secure authentication methods.
South Korean President Lee Jae Myung is taking a bold stance against AI-powered cyber threats, calling for a government-led response to rapidly deploy cutting-edge defenses. He urges swift action to minimize damage and build unbreachable security capabilities.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Australia's ageing IT systems are a ticking time bomb, and AI-powered threats are making it easier for cyber attackers to exploit weaknesses, putting the entire nation at risk. The Department of Home Affairs has stepped in, ordering a national stocktake of legacy technology to identify and mitigate these vulnerabilities.
Anthropic is shaking up its approach to cybersecurity with a major overhaul of its Cyber Verification Program, combining it with Project Glasswing to supercharge security efforts. The move follows a successful six-month trial that helped partners uncover over 129,000 verified software vulnerabilities.
In a staggering display of cybersecurity prowess, researchers at Pwn2Own Ireland 2026 exploited a whopping 32 zero-day vulnerabilities on the competition's first day, raking in $388,500 in awards. The successful hacks targeted a range of products, from mobile phones like the Apple iPhone 17 and Samsung Galaxy S26, to smart home devices and AI infrastructure.
The astonishing truth is that a whopping 2,514 cybersecurity events occur every single second, according to the Comcast Business 2026 Cybersecurity Threat Report, which analyzed a massive 79.3 billion events over just 12 months.
A critical file-access flaw has been discovered in various Atlassian products, including Jira and Confluence, allowing unauthenticated attackers to access sensitive files. To stay safe, ensure you're running the latest versions: Bitbucket Data Center 9.4.26 or later, Confluence Data Center 9.2.26 or later, and more.
Magnet Forensics has just unveiled a game-changing solution that helps bypass iPhone security, allowing for seamless forensic analysis even after 72 hours of inactivity. Their innovative tools, GrayKey Preserve and Evidence Preservation Mode, are set to revolutionize iOS forensics.
Microsoft is taking a firmer stance on email attachments, adding two new file types to Outlook's restricted list in a bid to boost security and keep users safe. This move is the latest effort to crack down on potentially hazardous files.
Red Hat's Lightwell project has made a significant impact, remediating over 400 novel vulnerabilities in key Java libraries since its launch in June. This crucial initiative helps protect against the rapidly evolving threat landscape, where AI-powered tools can quickly exploit old code.