General cybersecurity news and analysis
Microsoft just pulled the plug on the Support and Recovery Assistant (SaRA) command-line utility, a trusted tool for diagnosing and repairing Windows systems, from all supported Windows updates as of March 10. This small change could have big operational consequences for users relying on this tool.
In today's complex threat landscape, who's accountable when a single intrusion spreads across multiple systems, from Windows laptops to MacBooks, Linux servers, and mobile devices? The harsh reality is that no single team can contain it, as modern attack surfaces and campaigns have outgrown traditional Security Operations Center (SOC) workflows.
A recent breach of an FBI surveillance system has sent shockwaves through the security community, with experts warning of a major incident that threatens not only operations, but also trust and privacy. The incident has sparked urgent discussions among security leaders, highlighting the immediate risks and long-term consequences.
Google just made a bold move towards a more secure future, announcing plans to fully transition to post-quantum cryptography by 2029 - but what does this mean for your security planning today? This forward-thinking shift is a great step towards crypto-agility, and experts are already weighing in on its potential impact.
In a bold move, researchers fighting cybercrime decided to take a stand against the mystique surrounding digital gangs by roasting them with ridicule, stripping away their legendary status. By mocking notorious crews like Wizard Spider and Velvet Tempest, they're reclaiming the narrative and deflating the glamour often associated with these cybercrime teams.
Beware of malicious npm packages masquerading as harmless plugins - 36 fake Strapi CMS plugins were recently discovered to be carrying payloads that exploit databases, open remote shells, and deploy persistent implants. These sneaky packages can turn a routine install into a gateway for credential theft and long-term system compromise.
North Korean hackers pulled off a clever heist by using a social engineering tactic to trick a developer into handing over the keys to a popular software library, Axios revealed in a recent post-mortem. A single, convincing message was all it took to gain control and wreak havoc.
At the Federal Cybersecurity Summit, AI is taking center stage as a crucial tool for federal leaders to tackle the daunting challenge of evolving cyber threats and limited resources. The summit aims to spark a practical conversation on harnessing AI-driven defenses to move beyond mere compliance and toward effective, real-world solutions.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
A proposed $707 million cut to the Cybersecurity and Infrastructure Security Agency's budget could severely weaken the nation's cyber defenses, putting critical infrastructure at risk. This sudden reduction in funding would undermine the agency's ability to manage cyber risk, according to an ex-CISA official.
Did you know that LinkedIn is quietly harvesting browser data, including a list of your installed Chrome extensions, every time you load a page? A recent analysis, dubbed BrowserGate, uncovered the surprising truth behind LinkedIn's use of secret JavaScript scripts to scan visitor browsers.
Recent vendor breaches have exposed healthcare's alarming cyber vulnerability, raising critical questions about who bears the cost - and the consequences - when a vendor's systems fail. As the threat landscape evolves, one thing is clear: the healthcare industry must rethink its approach to cybersecurity and vendor risk management.
The alarming gap between AI pilot programs and enterprise-wide deployments has CISOs and IT leaders scratching their heads - while 60% of businesses are testing productivity AI tools like M365 Copilot, only 6% are successfully scaling them. What's holding them back, and how can organizations bridge the gap between experiment and enterprise?
On World Cloud Security Day, it's clear that cloud security gaps are a pressing concern, but how do we measure the security of a technology that's both virtual and physical? Today's snapshot of cloud security reveals an uncertain landscape where digital protections and tangible safeguards intersect.
In today's decentralized workforce, the traditional network perimeter has disappeared, leaving us with a pressing question: who's responsible for securing identities when and where work happens? The shift to hybrid work has created a diffuse and distributed perimeter, where users and applications are scattered across various networks, devices, and clouds, making it harder for traditional security models to keep up.
The next big security breach hitting your clients likely won't come from within their own walls, but from a blind spot they never suspected: their trusted third-party relationships with vendors, SaaS tools, and subcontractors. Most organizations are woefully underprepared for this expanding attack surface.
The US has taken a major step to safeguard its digital landscape by banning foreign-made routers, citing concerns that they pose a severe cybersecurity risk and supply chain vulnerability that could disrupt the economy and national defense. As a result, all new routers manufactured outside the US will require Federal Communications Commission approval before being sold in the country.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Microsoft is taking a bold step by automatically upgrading unmanaged Windows 11 devices running 24H2 Home and Pro editions to the latest 25H2 version, starting this week. This move marks a significant shift in the company's approach to Windows 11 upgrades.
Linx Security just secured $50 million to revolutionize identity governance with an AI-native approach, closing gaps that leave organizations vulnerable to attack. With this funding, they'll scale their cutting-edge platform to automate identity management and safeguard enterprises.
Cisco has patched a critical 9.8 CVSS flaw in its Integrated Management Controller (IMC) that could let hackers remotely seize control of your system - but thankfully, updates are now available to safeguard your network. Get the fix to prevent unauthenticated attackers from bypassing authentication and gaining elevated privileges.
Residential proxies are making it increasingly difficult for defenders to block threats, as they bypass IP reputation checks in a staggering 78% of cases, blending in with ordinary home users. This alarming trend is blurring the lines between attackers and legitimate users, making it harder to keep malicious traffic at bay.
Apple just took a major step to safeguard its users by expanding its iOS security update to include older devices, shielding them from the DarkSword web exploit kit. This move ensures that users with older devices, as well as enterprises relying on long-lived hardware, receive crucial protection against potential threats.
A new report, The State of Trusted Open Source, reveals eye-opening trends on open source vulnerability, shedding light on what teams consume and how those choices impact build artifacts and libraries. By analyzing real product data, it provides crucial insights into the open source components developers use every day.
Cisco just patched a critical vulnerability in its Integrated Management Controller that lets attackers bypass authentication and gain Admin access - essentially, walk right past the lock on the network's control panel. This fix is a must-have for any Cisco IMC users looking to keep their network secure.
Think a coffee machine cant hurt your company? Breakroom security is the hidden weak link—default passwords and flat networks let plugged-in appliances become cheap pivots for attackers, turning a casual caffeine run into a million-dollar breach.