General cybersecurity news and analysis
Microsoft has swiftly deployed a server-side fix to resolve a frustrating issue that left some Windows 11 23H2 users unable to access the Start Menu search feature. This quick action means you should now be able to search with ease again.
Imagine a tool meant to reveal operational insights being turned into a stealthy spy, siphoning off sensitive corporate secrets - that's what happened when researchers exploited Grafana's AI with a cunning technique called indirect prompt injection. Dubbed GrafanaGhost, this attack bypasses Grafana's defenses, exfiltrating data without leaving a digital trail.
Get ready to face the future of cyber threats! The Kaspersky Security Services report delivers eye-opening insights into the evolving cyberattack landscape, combining real-world incident response findings with hard data from its Managed Detection and Response service.
As APAC firms rush to adopt cloud technology, they're faced with a daunting dilemma: do they risk advancing without a plan, or delay and let identity-related risks leave them vulnerable? With identity issues already causing the majority of cloud breaches in the region, the clock is ticking to get cloud security right.
Unit 42's latest research reveals a hidden threat: multi-agent AI systems on Amazon Bedrock can be vulnerable to new and alarming risks, including prompt injection attacks that practitioners can't afford to ignore. Learn how to safeguard your AI applications from these emerging threats.
Security researchers at Unit 42 have uncovered critical vulnerabilities in Amazon Bedrock AgentCore's sandbox, revealing that a protective layer meant to separate code and services can be breached using DNS tunneling, exposing sensitive credentials in the process. This alarming discovery highlights the potential risks of slipping through the cracks of a supposedly secure system.
A single report of a sea mine can bring shipping lanes to a standstill, highlighting the powerful ripple effect of information in today's fast-paced maritime world. Even the mere rumor of a mine can disrupt vital waterways, as seen in the Strait of Hormuz, where news reports can quickly translate to real-world delays.
Indonesia is taking a giant leap in its military modernization efforts with plans to acquire an aircraft carrier, a strategic move that will bolster its naval capabilities and protect its maritime interests in the region. This ambitious acquisition has sparked debate and curiosity among analysts and policymakers, who are eager to see how it will enhance the country's defense posture.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Major tech players have joined forces to launch Project Glasswing, an AI-powered initiative that uses machine learning to identify and patch critical software vulnerabilities before malicious actors can exploit them. This game-changing project aims to stay one step ahead of attackers by harnessing the same AI technology that can be used for defense - and turning it into a powerful force for good.
To simplify security posture, the game plan for 2026 is clear: start by streamlining your defenses, then integrate smarter. By putting simplification first, businesses can cut unnecessary complexity and set themselves up for a more secure future.
As malicious actors turbocharge their attacks with artificial intelligence, eSentire CEO James Foster is revolutionizing the company's managed security approach with an AI-driven, agentic model that combines lightning-fast automation with human expertise. This game-changing strategy enables businesses to keep pace with the rapidly evolving threat landscape.
Imagine a future where you can ask an AI to create a custom spreadsheet, use it once, and then have it disappear - no more clutter, no more hassle. This is the emerging world of "instant software," where artificial intelligence makes it possible to write, deploy, and delete custom apps on demand.
Don't let your office's humble router become a backdoor for hackers - Microsoft warns that Russia's GRU military intelligence agency is exploiting SOHO routers to spy on cloud activities by hijacking DNS settings. This sneaky tactic allows attackers to decrypt TLS-protected traffic and snoop on high-value targets, including government and tech organizations.
Meet the new face of cybercrime: AI-powered scams that supercharge old cons with modern automation, resulting in a record-breaking $20 billion in losses in the US. Bots and artificial intelligence are helping crooks scale their schemes like never before, making cybercrime more efficient and devastating.
Researchers have uncovered a chilling new threat: GPUBreach, a flaw that uses GPU Rowhammer to corrupt memory, granting hackers a backdoor to escalate privileges and take control of your entire system. This sneaky attack exploits GDDR6 memory, flipping bits and paving the way for a complete system compromise.
A recent security patch meant to tighten up Docker Engine's defenses has left a gaping hole, exposing hosts to unauthorized access - and it's up to you to make sure you're not the one who gets exploited. A high-severity flaw, tracked as CVE-2026-34040, allows attackers to bypass authorization plugins and potentially gain access to your host.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Automated pentesting tools can deliver impressive early results, quickly uncovering low-hanging fruit and generating proof-of-concept failures - but often hit a plateau, leaving significant attack surfaces untested and creating a validation gap that's hard to ignore. This phenomenon, known as the PoC cliff, can abruptly halt progress, causing detection and exploitation attempts to drop off and tools to stop producing actionable findings.
Did you know that a single credential security breach can cost a whopping $4.4 million, making it a top priority for businesses to prevent? But while avoiding a major incident is crucial, what's often overlooked are the recurring credential incidents that quietly drain corporate finances.
Imagine landing in Hong Kong and being asked to hand over your phone's password or laptop's encryption key - blurring the line between a routine border check and an invasion of your private life. A recent change to the city's National Security Law now empowers police to demand this access from anyone, even transit passengers.
Imagine a scenario where the very processor that powers your gaming experiences or fuels your AI models becomes a vulnerability that attackers can exploit to hijack your entire machine - new research reveals that this is no longer just a theoretical threat. A recently discovered attack, dubbed GPUBreach, can escalate CPU privileges through graphics units, leaving your system exposed to potential takeover.
LY Corporation is ditching its complex, custom-built OpenStack clusters and consolidating 164 clouds into one sleek, upstream-aligned system, promising a more streamlined and reliable experience for users. By simplifying its cloud infrastructure, the company behind Yahoo! Japan aims to eliminate operational headaches and deliver a more efficient service.
Censys just secured $70 million in funding to supercharge its AI-driven threat intelligence platform, giving defenders real-time visibility into the global network's underlying infrastructure. This game-changing tech helps defenders stay one step ahead of attackers by mapping and monitoring the internet's technical surface.
A harmless printing service? Think again! Two flaws in the Common UNIX Printing System can be exploited by an unauthenticated attacker to execute code remotely and overwrite files as root, turning a routine print stack into a potential entry point for intruders.
Good news for Classic Outlook users on Outlook.com - Microsoft has fixed a frustrating bug that was preventing some users from sending emails, leaving them stuck in the outbox. The issue, now resolved, was affecting a subset of users, but thankfully, it's been successfully remedied.