Cybersecurity
General cybersecurity news and analysis
North Korean Hackers Exploit npm Social Engineering Tactic
North Korean hackers pulled off a clever heist by using a social engineering tactic to trick a developer into handing over the keys to a popular software library, Axios revealed in a recent post-mortem. A single, convincing message was all it took to gain control and wreak havoc.
AI Takes Center Stage at Federal Cybersecurity Summit
At the Federal Cybersecurity Summit, AI is taking center stage as a crucial tool for federal leaders to tackle the daunting challenge of evolving cyber threats and limited resources. The summit aims to spark a practical conversation on harnessing AI-driven defenses to move beyond mere compliance and toward effective, real-world solutions.
Trump Proposes $707M Cut to Cybersecurity Agency Budget
A proposed $707 million cut to the Cybersecurity and Infrastructure Security Agency's budget could severely weaken the nation's cyber defenses, putting critical infrastructure at risk. This sudden reduction in funding would undermine the agency's ability to manage cyber risk, according to an ex-CISA official.
LinkedIn Harvests Browser Data with Secret JavaScript Scripts
Did you know that LinkedIn is quietly harvesting browser data, including a list of your installed Chrome extensions, every time you load a page? A recent analysis, dubbed BrowserGate, uncovered the surprising truth behind LinkedIn's use of secret JavaScript scripts to scan visitor browsers.
Vendor Breaches Spotlight Healthcare's Cyber Vulnerability
Recent vendor breaches have exposed healthcare's alarming cyber vulnerability, raising critical questions about who bears the cost - and the consequences - when a vendor's systems fail. As the threat landscape evolves, one thing is clear: the healthcare industry must rethink its approach to cybersecurity and vendor risk management.
CISOs Face Shadow AI Surge as Gen AI Deployments Stall
The alarming gap between AI pilot programs and enterprise-wide deployments has CISOs and IT leaders scratching their heads - while 60% of businesses are testing productivity AI tools like M365 Copilot, only 6% are successfully scaling them. What's holding them back, and how can organizations bridge the gap between experiment and enterprise?
Cloud Security Gaps Exposed on World Cloud Security Day
On World Cloud Security Day, it's clear that cloud security gaps are a pressing concern, but how do we measure the security of a technology that's both virtual and physical? Today's snapshot of cloud security reveals an uncertain landscape where digital protections and tangible safeguards intersect.
Securing Identities in a Decentralized Workforce
In today's decentralized workforce, the traditional network perimeter has disappeared, leaving us with a pressing question: who's responsible for securing identities when and where work happens? The shift to hybrid work has created a diffuse and distributed perimeter, where users and applications are scattered across various networks, devices, and clouds, making it harder for traditional security models to keep up.
Third-Party Risk Exposes Hidden Weaknesses in Client Security Posture
The next big security breach hitting your clients likely won't come from within their own walls, but from a blind spot they never suspected: their trusted third-party relationships with vendors, SaaS tools, and subcontractors. Most organizations are woefully underprepared for this expanding attack surface.
US Tightens Router Security with Ban on Foreign-Made Devices
The US has taken a major step to safeguard its digital landscape by banning foreign-made routers, citing concerns that they pose a severe cybersecurity risk and supply chain vulnerability that could disrupt the economy and national defense. As a result, all new routers manufactured outside the US will require Federal Communications Commission approval before being sold in the country.
Microsoft Accelerates Windows 11 Upgrades with Mandatory 25H2 Rollout
Microsoft is taking a bold step by automatically upgrading unmanaged Windows 11 devices running 24H2 Home and Pro editions to the latest 25H2 version, starting this week. This move marks a significant shift in the company's approach to Windows 11 upgrades.
Linx Security Bolsters Identity Governance with $50M Funding
Linx Security just secured $50 million to revolutionize identity governance with an AI-native approach, closing gaps that leave organizations vulnerable to attack. With this funding, they'll scale their cutting-edge platform to automate identity management and safeguard enterprises.
Cisco Fixes 9.8 CVSS Flaw Allowing Remote System Compromise
Cisco has patched a critical 9.8 CVSS flaw in its Integrated Management Controller (IMC) that could let hackers remotely seize control of your system - but thankfully, updates are now available to safeguard your network. Get the fix to prevent unauthenticated attackers from bypassing authentication and gaining elevated privileges.
Residential Proxies Bypass IP Reputation Checks in Most Sessions
Residential proxies are making it increasingly difficult for defenders to block threats, as they bypass IP reputation checks in a staggering 78% of cases, blending in with ordinary home users. This alarming trend is blurring the lines between attackers and legitimate users, making it harder to keep malicious traffic at bay.
Apple Bolsters iOS Security to Counter DarkSword Web Exploit Kit
Apple just took a major step to safeguard its users by expanding its iOS security update to include older devices, shielding them from the DarkSword web exploit kit. This move ensures that users with older devices, as well as enterprises relying on long-lived hardware, receive crucial protection against potential threats.
Report Exposes Open Source Vulnerability Trends
A new report, The State of Trusted Open Source, reveals eye-opening trends on open source vulnerability, shedding light on what teams consume and how those choices impact build artifacts and libraries. By analyzing real product data, it provides crucial insights into the open source components developers use every day.
Cisco Patches Authentication Bypass in Integrated Management Controller
Cisco just patched a critical vulnerability in its Integrated Management Controller that lets attackers bypass authentication and gain Admin access - essentially, walk right past the lock on the network's control panel. This fix is a must-have for any Cisco IMC users looking to keep their network secure.
Breakroom security: Exclusive look at costly risk
Think a coffee machine cant hurt your company? Breakroom security is the hidden weak link—default passwords and flat networks let plugged-in appliances become cheap pivots for attackers, turning a casual caffeine run into a million-dollar breach.
Coffee Machines Expose Corporate Networks to Hacking Risks
Your daily cup of coffee might be putting your company's network at risk of a massive breach, thanks to the humble coffee machine's connection to the internet. Connected devices like these can unwittingly create a backdoor for hackers into an otherwise secure environment.
Google Tightens Android App Verification for Sideloaded Software
Google is shaking things up in the mobile world by introducing a new requirement for Android apps installed outside its official store: developers must now verify their identity to ensure user safety. This move aims to strike a balance between platform openness and protection from potential harm.
Apple Bolsters iOS 18 Defenses Against DarkSword Exploit Kit
Apple is stepping up its game to protect iPhone users with a new security update for iOS 18, shielding against the sneaky DarkSword exploit kit that's been compromising devices. This proactive move is a crucial defense in the ever-evolving world of cybersecurity threats.
Unified Platforms Fortify Recovery Against Ransomware, AI Threats
As ransomware attacks intensify and AI-powered threats accelerate, consolidating infrastructure and automating recovery can be a game-changer for organizations, enhancing safety while slashing costs. By fortifying defenses with unified platforms, IT leaders and senior managers can meaningfully reduce risk and stay ahead of evolving cyber threats.
US Cyber Strategy May Embolden Private Sector Hackback
The Biden administration's 2026 Cyber Strategy for America is making waves with a bold call to action: unleashing the private sector to disrupt adversary networks and scale national cyber capabilities. This single move has sparked debate and concern, effectively greenlighting private companies to conduct hackback operations - a concept that's simple in theory but fraught with danger in practice.
HHS Realigns Cyber, AI Oversight Under CIO Office
The US Department of Health and Human Services has realigned its cyber and AI oversight under the Chief Information Officer's office, a move that aims to bolster protection of the nation's sensitive health data. This change reverses previous structural adjustments, refocusing the Office of the National Coordinator for Health IT on external policy and standards.