General cybersecurity news and analysis
A shocking 13% of employees admit to selling their work logins or knowing someone who has, revealing a surprisingly casual attitude towards protecting sensitive work credentials. This statistic raises serious concerns about workplace security and the vulnerability of company data.
Arctic Wolf is making a bold move to future-proof its business, cutting 250 jobs to free up resources for game-changing AI investments. The layoffs, which affect under 10% of its workforce, are a strategic cost-saving measure to drive innovation and growth.
A critical vulnerability, CVE-2026-26956, in the popular vm2 Node.js library can allow attackers to break free from the sandbox and execute malicious code on your host system, putting your entire environment at risk. To stay safe, upgrade to vm2 version 3.10.5 or later, or 3.11.2 for the latest protection.
Beware: a high-severity flaw in Cisco's system could allow attackers to overwhelm your network, causing a manual reboot to regain control. This vulnerability can be exploited remotely with ease, putting your connection resources at risk of exhaustion and leaving you vulnerable to a denial-of-service condition.
US cyber officials are considering a drastic reduction in patching deadlines, from two weeks to just three days, as AI-driven threats rapidly escalate and attackers gain unprecedented speed in discovering and exploiting vulnerabilities. This proposed shift reflects a urgent response to the evolving threat landscape, where AI-powered tools are revolutionizing the speed and efficiency of cyber attacks.
Kaspersky has introduced a new web-filtering category for sites that just don't feel right - they're not quite phishing sites, but you still shouldn't trust them. The new "Sites with an undefined trust level" category helps keep you safe from manipulative or shady online resources.
Researchers have discovered that NVIDIA chips are vulnerable to Rowhammer attacks, which can be exploited to gain unauthorized access to computer systems. This security threat can lead to a complete compromise of the machine, allowing attackers to read and write data freely.
The US Cybersecurity and Infrastructure Security Agency (CISA) has launched CI Fortify, a vital planning framework designed to shield critical infrastructure sectors like water, energy, and transportation from devastating cyber-attacks. This timely guidance helps organizations safeguard their networks and essential services from threat actors seeking to disrupt and degrade infrastructure.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
As AI agents become increasingly integral to enterprise operations, a concerning gap is emerging: the rapid adoption of AI is outpacing the development of essential governance policies to secure identities and access. Discover how this vulnerability impacts corporate applications and what you can do to protect your organization.
The Hacker News is shining a spotlight on the unsung heroes of cybersecurity with the launch of the Cybersecurity Stars Awards 2026, a global recognition program that celebrates the outstanding teams, leaders, and products making a real difference in the industry. Submissions are now open, offering a chance for innovators to showcase their work and be honored for their meaningful contributions.
Imagine biting into a mysterious birthday cake without knowing its ingredients or who baked it - that's what it's like for enterprises trying to secure their AI supply chains without visibility into the components used to build their AI systems. Traditional software bills of materials just aren't cutting it in this new landscape.
Kids are outsmarting age checks with a surprisingly simple trick: drawing on a fake mustache. This clever tactic allows them to bypass age verification systems with ease.
Imagine having multiple Security Information and Event Management platforms working in perfect harmony - Singapore researchers have made this a reality by developing a game-changing approach called agentic rule translation, enabling seamless interoperability between diverse SIEMs. This breakthrough simplifies life for teams managing SIEMs and developers building agentic systems that integrate with them.
Google is stepping up its game to keep your Android apps safe with a new public verification ledger that ensures the Google apps on your device are genuine and exactly as intended. This move builds on its Pixel Binary Transparency feature, now expanding it to all Android production apps.
With AI automation, CISA analysts can quickly sift through threats, cutting through the noise to focus on what matters most. This tech boost has supercharged their Security Operations Unit, enabling rapid, real-time assessments that help prevent threats from unfolding.
A critical Linux flaw, known as Copy Fail, has been discovered, exposing millions to potential local privilege escalation attacks - a vulnerability that highlights a deterministic logic error in the Linux kernel's cryptographic subsystem. This flaw, tracked as CVE-2026-31431, was publicly disclosed on April 29, 2026.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
To stay ahead of potential disruptions, critical infrastructure operators must plan for extended isolation - and CISA's CI Fortify initiative is here to help, offering targeted assessments and operational planning to keep essential services running smoothly.
BlueVoyant's innovative SaaS platform harnesses the power of AI to supercharge security operations, empowering teams to defend customers faster and more effectively. This cutting-edge technology also offers a standalone solution for companies seeking to elevate their SOC capabilities.
A growing concern for CISOs is the widening skills gap in their cybersecurity teams, with 60% citing a lack of skilled staff as a bigger challenge than filling vacant positions. The right people with the right skills are proving harder to find than more bodies to fill open roles.
By combining post-quantum cryptography and quantum key distribution, hybrid crypto approaches provide a robust security solution that protects systems even if one layer is compromised. This layered defense offsets the weaknesses of each, ensuring a stronger safeguard against emerging quantum threats.
To stay ahead of threats, organizations must move beyond generic risk assessments and instead focus on tailored risk management, taking into account the unique business context and technical severity of potential breaches. By doing so, they can harden identity controls, improve governance, and build a stronger defense against cyber attacks.
CISA has launched CI Fortify, a groundbreaking initiative that empowers critical infrastructure providers to bolster their defenses and ensure uninterrupted delivery of essential services, even in the face of cyber threats. By investing in resilience measures now, infrastructure owners and operators can safeguard against operational gaps and maintain business continuity during periods of cyber duress.
As AI adoption accelerates, organizations are essentially onboarding fast-moving digital colleagues that require a new risk oversight approach - one that acknowledges their unique behavior and risk profile, which differs significantly from human workers. Traditional human-centric controls may not be enough to secure this new digital perimeter.
The AI hacking landscape has reached a major milestone: two top AI models, GPT-5.5 and Anthropic's Mythos Preview, have demonstrated nearly identical capabilities in a rigorous 95-task cybersecurity evaluation, with scores of 71.4% and 68.6% respectively. This parity marks a significant tipping point in the development of AI-powered hacking tools.