In the beginning of April, three attacks detected in the Guardicore Global Sensor Network (GGSN) caught our attention. All three had source IP addresses originating in South-Africa and hosted by VolumeDrive ISP (see IoCs).

Guardicore Labs uncovers a Ransomware detection campaign targeting MySQL servers. Attackers use Double Extortion and publish data to pressure victims.

Our deception technology is able to reroute attackers into honeypots, where they believe that they found their real target. The attacks brute forced passwords for RDP credentials to connect to the victim download and execute a previously undetected malware, which we named Trojan.sysscan.

Guardicore security researchers describe and uncover a full analysis of a cryptomining attack, which hid a cryptominer inside WAV files. The report includes the full attack vectors, from detection, infection, network propagation and malware analysis and recommendations for optimizing incident response processes in data centers.

No content preview

No content preview

No content preview

No content preview

As firewall rule sets grow in complexity, security teams face a common challenge: manual log analysis is used to determine which rules are actively matching traffic and which are consuming capacity without being triggered. This lack of visibility creates operational and compliance gaps. Organizations with governance policies that require removal of dormant rules after a […]  ( 118 min )

Apple customers in 110 countries received threat notifications recently alerting them to suspected spyware attacks targeting their devices. The post ‘Unprecedented’ Number of Apple Users Received Recent Spyware Alert appeared first on The Citizen Lab.

"The emperor is a fan of Flock, and we must continue utilizing Flock technologies so that we can follow and surveil the rebel scum," Vader said during the meeting.

Nonconsensual AI images are getting much harder to spot.

The six month moratorium on major electrical infrastructure projects is the latest tactic meant to delay the massive data center meant to support America’s nuclear weapons.

OpenAI has strengthened ChatGPT's protections for teens, but some of its strongest parental controls still depend on linked accounts.  ( 24 min )

Twitch added an option to opt out of training Amazon AI with your content—two years after it confirmed that training had begun.  ( 23 min )

Malwarebytes Firewall gives you a clearer, more intuitive way to manage your Mac's inbuilt firewall.  ( 22 min )

A researcher found an exposed database containing 9 million images that belonged to people finder service ClarityCheck.  ( 23 min )

No content preview

Traditional vulnerability management was built for a smaller, slower problem than most teams face today. This post breaks down CTEM, why it exists, how its five stages work, and what it actually takes to move from a reactive pile of findings to a continuous, prioritized risk reduction program.

No content preview

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE CISA added a critical flaw in the open-source Ray distributed computing framework to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The bug, rated 9.4 in severity, stems from Ray’s lack of authentication on core endpoints and can be chained with a DNS […] The post Infosec News Nuggets — August 20, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Is LLM-assisted reverse engineering making obfuscation pointless? We spent a couple of weeks trying to find out, by handing sandboxed agents a series of progressively hardened AArch64 binaries and one prompt: recover the hidden strings inside. This post walks through what the agent actually did, three ways our experiment fell apart, and what those failures suggest about designing protections that hold against automated analysis.

Amazon buying and destroying rare books to train AI; a bunch of wild AI use in the courts; and Meta's new patent for its AI smart glasses.

The Moon was long thought to be inhospitable to life, but scientists have discovered that common Earth microbes could survive for up to a week in shadowed regions of the lunar south pole, a region targeted for future human exploration.

Body camera footage shows police surveillance abuse is common: "We’ve told them over and over again: 'You see a hot chick, you don’t look them up in a database.'"

No content preview

No content preview

Learn how Akamai uses Masked Autoencoder Transformer models to detect sparse behavioral telemetry from autonomous AI browser agents, such as Comet.

No content preview

A legitimate-looking link or valid digital signature can offer false reassurance. Here’s why familiar download safety checks aren’t always enough.  ( 26 min )

With the new Advanced Flow for sideloading being rolled out, it's time to discuss what sideloading is and how to do it more safely.  ( 25 min )

We found wallet-checking sites impersonating real anti-money laundering services that trick people into approving access to scammers.  ( 24 min )

Google has released a Chrome desktop update fixing 15 security vulnerabilities, including 2 buffer overflow flaws rated critical.  ( 24 min )

A polite reply to a wrong-number text may seem harmless. But scammers use it to profile their victims and fuel a multibillion-dollar fraud industry.  ( 29 min )

Microsoft is named a visionary leader in the 2026 Frost Radar for Cloud Workload Protection Platforms, recognized for unified runtime security with Microsoft Defender for Cloud. The post Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026 appeared first on Microsoft Security Blog.

Many teams now deploy AI agents that pull from Amazon DynamoDB tables, document repositories, software as a service (SaaS) platforms, and internal knowledge bases to answer questions and automate workflows. A key risk in these deployments is that the agent has no awareness of who’s asking, so it might return data the user shouldn’t see. […]  ( 126 min )

GitLab Patches Critical Code Injection Vulnerability GitLab issued an emergency out-of-cycle patch for a critical, unauthenticated code injection flaw tracked as CVE-2026-19478 (CVSS 9.4), which stems from improper handling of a GraphQL directive and lets attackers modify or delete user data and public projects without logging in. A second, lower-severity CSRF bug in the GraphQL […] The post Infosec News Nuggets — August 19, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack. The group subsequently published data allegedly obtained from the company, which included 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchases.

In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates. The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed data to HIBP.

No content preview

No content preview

No content preview

No content preview

When deploying AI agents with Amazon Bedrock AgentCore, organizations benefit from built-in modern support for OAuth 2.0, AWS Identity and Access Management (IAM), and API key authentication through Amazon Bedrock AgentCore Gateway. However, some enterprise environments still use legacy authentication mechanisms such as HTTP Basic Authentication (Basic Auth) (RFC 7617). The extensible architecture of AgentCore […]  ( 117 min )

Since February, we’ve grown AWS Security Hub Extended from 14 curated partners across 9 categories to 23 partners across 10. At Black Hat this month, 14 of those partners were at the Amazon Web Services (AWS) booth demoing live. Four of those partners delivered theater talks and ten were featured on SecurityLive streaming. We hosted […]  ( 116 min )

MacSync Stealer rapidly rotates domains to evade detection, but its behavior remains consistent. Learn how Microsoft uncovered 30+ related domains using durable hunting pivots. The post Hunting MacSync Stealer infrastructure through behavioral pivots appeared first on Microsoft Security Blog.

AI companies see words as interchangeable and have zero clue how to judge the “quality” of writing.

X is driving engagement by making users fight in the replies.

“I fear for the day when a visitor's National Park experience is interrupted by being pulled over and held at gunpoint because a license plate reader misread their plate.”

Apple has released updates fixing 27 vulnerabilities in iOS, iPadOS, and macOS Tahoe, including a potentially serious image-processing flaw.  ( 25 min )

As one developer found out when his Google Doc containing company passwords showed up in Google search results.  ( 23 min )

Leaked personal and financial data of around 750,000 US citizens, including SSNs and bank details, could put victims at risk of identity theft and phishing.  ( 22 min )

Introducing Akamai Valkey Managed Database: a low-latency, in-memory data layer to optimize AI inference costs, accelerate RAG, and power real-time AI agents.

No content preview

Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects GitLab shipped an out-of-cycle patch for a critical flaw, tracked as CVE-2026-19478 with a CVSS score of 9.4, that could have let an unauthenticated attacker remotely modify or delete public projects and user data through a GraphQL directive. The fix landed in versions 19.2.4, […] The post Infosec News Nuggets — August 18, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

The deal settles class action lawsuits claiming Mindgeek's sites hosted and profited from abuse videos of minors.

ChatGPT prompts show how an expert witness report was created in a $61 million lawsuit over an explosion that killed three people.

The past, present, and future of deepfakes, as seen by the world’s leading expert on synthetic media.

We placed a tracking device in a shipment of rare books to see which AI company was buying it, and found an Amazon facility where Amazon scans and destroys books.

A file upload accepted ZIP archives but never validated the paths inside. We used Zip Slip to plant a reverse shell in the server’s hooks… Continue reading on InfoSec Write-ups »

A hardcoded SAS token in the website’s JavaScript led to a service account. That service account unlocked an Azure Key Vault. The vault’s… Continue reading on InfoSec Write-ups »

A rewards system let you claim 50 points every 24 hours. We claimed it three times in the same millisecond. Welcome to race conditions. Continue reading on InfoSec Write-ups »

NoSQL injection bypassed the login. Server-Side Template Injection gave us code execution. A forgotten Node.js debugger running as a… Continue reading on InfoSec Write-ups »

A conversation overheard at breakfast leaked an email address. That email led to a forgotten Gravatar profile. That profile contained the… Continue reading on InfoSec Write-ups »

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

The Open Technology Fund is accepting applications for the 2026 Information Controls Research Program. The post Call for Applications: Information Controls Research Program 2026 appeared first on The Citizen Lab.

Amazon Web Services (AWS) is gradually introducing updates to the AWS Sign-In and sign-up experience to a limited number of customers. We’re sharing these changes so you will know what to expect as we gradually make the updated experience available to more customers. These updates include new options for creating and accessing AWS accounts. To […]  ( 115 min )

The researcher who found RoguePlanet has discovered ShieldBreak, a new way to bypass Microsoft’s fix and gain SYSTEM privileges.  ( 22 min )

TikTok-branded rewards pages offer cash for simple tasks and daily check-ins. But getting your hands on the money is another story.  ( 24 min )

Attackers are exploiting a Mac Screen Sharing vulnerability to gain root access and install Monero cryptominers.  ( 23 min )

One ad blocker is giving up the fight against Facebook ads. The consequences could go beyond annoying advertising.  ( 25 min )

A list of topics we covered in the week of August 10 to August 16 of 2026  ( 21 min )

No content preview

No content preview

McDonald’s, Vodafone Hit by Azure Credential Theft Campaign Exposing Millions of Enterprise Records A threat actor going by “TheHatman” has been flooding underground forums with employee directory data pulled from at least nine major corporations’ Azure and Entra tenants using compromised credentials, with McDonald’s alone accounting for more than 1.7 million exposed records alongside troves […] The post Infosec News Nuggets — August 17, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

No content preview

No content preview

No content preview

📖 [The CloudSecList] Issue 351 was originally published by Marco Lancini at CloudSecList on August 16, 2026.

Mice can access memories after hibernation, a state that largely shuts their brains off and reduces synapses, suggesting that memories are stored across shifting neural systems.

This week, we discuss the mainstreaming of Flock, media appearances, and Spotify's AI move.

Machine learning is a valuable tool in blockchain analytics – so long as it is used responsibly. Automated tools can… The post Machine Learning Has a Specific Role in Blockchain Intelligence appeared first on Chainalysis.  ( 12 min )

Apple explains how Threat Notifications help protect iPhone users targeted by mercenary spyware.  ( 22 min )

An optional new feature uses on-device AI to flag messages that look like scams.  ( 22 min )

No content preview

vCenter Flaw Exploited Just Five Days After Disclosure A critical directory-traversal flaw in VMware vCenter’s Syslog server, rated CVSS 9.8, was already being exploited within five days of Broadcom’s disclosure, with researchers tracing 361 victim IP addresses across 47 countries. The attacker deployed an open-source reverse shell tool to maintain access to compromised systems, and […] The post Infosec News Nuggets — August 14, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Today, we’re announcing that AWS Certificate Manager (ACM) will discontinue support for email-validated public certificates by September 30, 2027. If you use email validation for your ACM public certificates, you need to migrate to DNS validation before that date. This change aligns with the Certification Authority/Browser (CA/B) Forum’s industry-wide deprecation of email-based domain validation and […]  ( 116 min )

No content preview

No content preview

In this Akamai FLAME Trailblazer blog post, Suzanne Wheeler describes her journey into cybersecurity and gives advice to women who are finding their own path.

Social engineering, a Remote Access Trojan (RAT), and NFC relay malware walk up to an ATM. It's no joke. Together, they can empty your bank account.  ( 23 min )

In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. In their disclosure notice, RingCentral advised that the incident affected "a limited portion of RingCentral customers" and that it was communicating directly with those affected.

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor North Korea’s Lazarus Group exploited a Windows zero-day in the AFD.sys driver as part of a fresh wave of its long-running Dream Job campaign, targeting defense and aerospace firms in France, Germany, Brazil, and India with fake recruiter outreach on LinkedIn. Victims were lured […] The post Infosec News Nuggets — August 13, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

When you build a new application or capability on Amazon Web Services (AWS), you want to focus on what you’re building. Getting a service running almost always begins with AWS Identity and Access Management (IAM). Many AWS services that act on your behalf need an IAM role, an identity the service assumes to access your […]  ( 118 min )

pcode_graph is a Python library, published by Quarkslab, suitable to build semantic graphs from binary code. We present how to use it to detect function similarities in binaries.

No content preview

Microsoft Plugs Nearly 400 Security Holes August’s Patch Tuesday saw Microsoft fix 398 vulnerabilities across Windows and supported software, with 42 rated critical. The lone actively exploited zero-day, a privilege escalation flaw in the AFD.sys WinSock driver, gives attackers a path to SYSTEM control after gaining an initial low-privilege foothold. Microsoft has attributed the swelling […] The post Infosec News Nuggets — August 12, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Organizations operating in Germany and across Europe increasingly need to demonstrate cloud security compliance under the Cloud Computing Compliance Criteria Catalogue (C5:2020), published by Germany’s Federal Office for Information Security (BSI). Last year, we introduced Landing Zone Accelerator on AWS support for digital sovereignty and today we’re announcing the availability of a new independent assessment […]  ( 115 min )

Amazon Web Services (AWS) is pleased to announce that the Summer 2026 System and Organization Controls (SOC) 1 report is now available. The reports cover 185 services over the 12-month period from July 1, 2025–June 30, 2026, giving customers a full year of assurance. These reports demonstrate our continuous commitment to adhering to the heightened […]  ( 115 min )

Amazon Web Services (AWS) is pleased to announce its successful completion of the 2025-26 NHS Data Security and Protection Toolkit (NHS DSPT) assessment audit and achieving a status of Standards Exceeded. The NHS DSPT is an assessment that allows organizations to measure their performance against the National Data Guardian’s 10 data security standards. All organizations […]  ( 113 min )

I’ve successfully survived Hacker Summer Camp, and I have returned with a new outlook on patch density. When even Linus Torvalds says that huge updates are the “new normal”, it’s time to readjust what we consider a true bug apocalypse. This month’s release is thankfully smaller than last months, but still huge by historical standards. Take a break from your regularly scheduled activities as we take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for August 2026 For the first part of the August release, Adobe released five bulletins addressing 51 unique CVEs in Adobe ColdFusion, Commerce, Lightroom Classic, Content Credentials SDK, and Adobe Campaign Classic. Here…

No content preview

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild A deserialization flaw in on-premise JetBrains TeamCity servers is being actively exploited, letting unauthenticated attackers bypass authentication via the agent polling protocol and run arbitrary commands with the privileges of the TeamCity server process. Successful attacks can expose stored credentials and configurations and […] The post Infosec News Nuggets — August 11, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Immediate action is advised for all organizations running self-hosted Metabase. A critical, unauthenticated SQL injection vulnerability has been disclosed in Metabase's password reset functionality, and Metabase has confirmed active exploitation in the wild.

Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.

We’re excited to announce that our Europe (London) AWS Region has renewed its accreditation for United Kingdom (UK) Police-Assured Secure Facilities (PASF) for Official-Sensitive data. Since 2017, the Amazon Web Services (AWS) Europe (London) Region has been accredited under the PASF program. This demonstrates our continuous commitment to adhere to the heightened expectations of customers […]  ( 113 min )

We’re excited to announce that Amazon Web Services (AWS) has completed theCyberVadis assessment of its security posture with the highest score (Mature) in all assessed areas. This demonstrates our continued commitment to meet the heightened expectations for cloud service providers. Customers can now use the 2026 AWS CyberVadis report and scorecard to reduce their supplier […]  ( 114 min )

Summary The FATF just released its first DeFi-specific report: Acknowledging DeFi’s operational benefits, the global AML/CFT standard-setter explains how jurisdictions,… The post Understanding the FATF’s DeFi Report: A Functional Approach to Decentralized Finance Regulation appeared first on Chainalysis.  ( 17 min )

Microsoft is named a Leader in the 2026 IDC MarketScape for MDR services. Discover how Microsoft Defender Experts MDR combines AI, threat intelligence, and human expertise. The post Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise  appeared first on Microsoft Security Blog.

Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications, negotiations, and data leak operations alongside double extortion tactics used to pressure victims. The post DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure appeared first on Microsoft Security Blog.

18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers A use-after-free bug tracked as CVE-2026-64564 and nicknamed SCTPhantom has been lurking in Linux’s SCTP networking code since 2008 and can be chained into full root access on a host; researchers say they used it to escape a container and reach the […] The post Infosec News Nuggets — August 10, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

No content preview

In August 2026, the Alcon eye care company was named in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly sourced from Alcon containing 218k unique email addresses along with other largely corporate B2B contact fields, including name, phone number and physical address.

📖 [The CloudSecList] Issue 350 was originally published by Marco Lancini at CloudSecList on August 09, 2026.

In July 2026, Brinks Home was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they alleged was taken from the company, including 732k unique email addresses and other personal information relating to leads, customers and Brinks staff such as name, phone numbers and physical addresses. The data also included purchases from Brinks along with partial credit card data (last 4 digits, card type and expiry). In Brinks' disclosure notice, they acknowledged the incident and risk of disclosure, and advised that they would notify impacted parties "consistent with applicable law".

Ten years ago, we launched AWS Directory Service for Microsoft Active Directory, a fully managed Microsoft Active Directory in the AWS Cloud. In that original announcement, Jeff Barr described a straightforward promise: “You will spend less time administering and more time working on your applications and your business.” A decade later, AWS Managed Microsoft AD […]  ( 120 min )

Misconfigured Amazon Simple Storage Service (Amazon S3) buckets can expose your data to unauthorized access. Without proactive review, S3 bucket policies or Access Control Lists (ACLs) configured with broad access may go unnoticed in your environment. In this post, you learn how to identify and fix over-permissioned S3 buckets across your AWS environment, along with […]  ( 126 min )

No content preview

Journalists and civil society are being silenced by accusations of copyright infringement, says Alberto Fittarelli in a report by the OCCRP. The post Inside the Fake Copyright Racket Silencing News Outlets appeared first on The Citizen Lab.

No content preview

In July 2026, Exact Sciences (now owned by Abbott Laboratories) was the target of a ShinyHunters "pay or leak" extortion campaign. The group claimed to have obtained data from the company's cancer diagnostics business, which they later published publicly. The breach contained 10.9M unique email addresses belonging to customers, patients and healthcare providers, along with names, addresses, phone numbers and health records. Abbott subsequently published a public notice advising that "some of the impacted files contain personal information and/or personal health information" and that more specific information would follow once their review of the incident was complete. For context, Exact Sciences is the maker of the Cologuard at-home colorectal cancer screening test.

Customers tell us that managing TLS certificates at scale is one of their biggest operational concerns. The Certification Authority Browser Forum (CA/Browser Forum) has mandated a phased reduction in maximum certificate validity for public certificates. By March 2027, the maximum validity drops to 100 days. By March 2029, it lasts for 47 days. For an […]  ( 120 min )

This post assumes familiarity with envelope encryption and the AWS Encryption SDK. When your encryption system generates millions of duplicate API calls per hour, costs spiral and performance degrades. That’s exactly the challenge NICE Actimize faced while operating their global-scale, event-driven financial crime detection platform on Amazon Web Services (AWS). NICE Actimize, a leading provider […]  ( 121 min )

Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this

Discover how Akamai AI Professional Services helps enterprises bridge the gap from proof of concept to secure, scalable, and manageable production AI.

No content preview

Penlink, a leader in AI-powered digital intelligence, and Chainalysis, the blockchain data platform, this week announced a strategic partnership and… The post Penlink Plugs Into Trusted Blockchain Data With Chainalysis appeared first on Chainalysis.  ( 10 min )

Summary Annual value stolen in violent attacks peaked at $58 million in 2025, the highest on record, with 2026 already… The post Estimated $30 Million Stolen in Violent Crypto Attacks in 2026 as France Records Emerges as Hotspot appeared first on Chainalysis.  ( 17 min )

Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability CISA added CVE-2026-63077, a critical unauthenticated remote code execution flaw in JetBrains TeamCity On-Premises, to its Known Exploited Vulnerabilities catalog after confirming active exploitation, giving federal agencies just three days to patch under Binding Operational Directive 26-04. The deserialization vulnerability, rated CVSS 9.8, lets an attacker with mere […] The post InfoSec News Nuggets – 08/06/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

In June 2026, Inter-Con Security was targeted in a ShinyHunters “pay or leak” extortion campaign. The group subsequently published data it alleged was taken from the company, including 276k unique email addresses along with names, physical addresses, job titles and phone numbers. The data encompassed a combination of contacts, internal users and leads.

Abstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power

Abstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi

Customers have access to models that are continuously getting better with each new generation bringing larger context windows, stronger reasoning, and lower token costs. Getting the strongest AI-powered security will come from tools that combine the most relevant models with deep knowledge of a customer’s specific environment. AWS Continuum for code vulnerabilities (Preview) is built […]  ( 115 min )

Imagine preparing for your biggest sales event of the year, and you want to ensure your customer identity management service can handle the elevated traffic for carrying out application activities. For security teams, business leaders, and technologists managing identity infrastructure at scale, this scenario has been all too familiar. Whether you’re a CISO evaluating security […]  ( 118 min )

Learn why KuppingerCole named Microsoft a Leader in its Leadership Compass: Cloud Native Application Protection Platforms report. The post ​​Microsoft named a Leader in the KuppingerCole Leadership Compass for Cloud Native Application Protection Platforms (CNAPP) appeared first on Microsoft Security Blog.

A macOS ClickFix campaign shifted tactics from openly serving infostealer lures to hiding them behind a browser-fingerprinting gate. The change makes malicious infrastructure harder to detect while giving defenders new hunting opportunities. The post From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide appeared first on Microsoft Security Blog.

Chainalysis is excited to announce support for Cronos, an EVM-compatible Layer 1 blockchain. Cronos Network is a purpose-built settlement layer… The post Chainalysis Supports Cronos with Automatic Token Support appeared first on Chainalysis.  ( 9 min )

Citizen Lab researchers write that restrictive immigration policies are incompatible with attempts to counter transnational repression. The post Immigration Policy: The Backdoor to Transnational Repression appeared first on The Citizen Lab.

Discover top enterprise AI risks — from shadow AI to rogue agents and data leaks — plus practical CISO strategies in the new Akamai SOTI special report.

Bishop Fox discovered a privilege escalation vulnerability in Python for Windows affecting versions 3.11.0a3 through 3.15.0b2. A low-privilege user can plant malicious files and wait for a privileged account to run the interpreter, inheriting that account's elevated access. Patches are available.

A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates. This analysis details the attack chain, affected environments, and practical guidance for detection, hunting, and remediation. The post ChainDrop supply chain compromise: Anatomy of a self-propagating worm appeared first on Microsoft Security Blog.

Microsoft expands its Zero Trust for AI strategy to enhance security for AI and DevSecOps environments with new tools and guidance. The post Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps appeared first on Microsoft Security Blog.

Microsoft Defender automatically isolated a compromised QNET endpoint in 128 seconds, stopping a multi-stage attack before the payload could persist or spread. The post 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET  appeared first on Microsoft Security Blog.

Senior research fellow Jon Penney spoke with Tech Policy Press about how rising surveillance is causing people to self-censor.  The post A Roadmap for Confronting the Chilling Effects of Censorship, Surveillance and New Technology appeared first on The Citizen Lab.

Amazon Web Services (AWS) is pleased to announce the successful completion of our Payment Card Industry (PCI) Data Security Standard (DSS) and Three Domain Secure (3DS) certifications. As part of this renewal, we have expanded the scope to include three additional AWS services and one additional AWS Region: Newly added AWS services: Amazon Bedrock AgentCore […]  ( 114 min )

No content preview

No content preview

No content preview

📖 [The CloudSecList] Issue 349 was originally published by Marco Lancini at CloudSecList on August 02, 2026.

No content preview

In July 2026, the Russian VPN service SplitVPN (previously known as NotVPN) suffered a data breach. The incident exposed millions of customer records, including 865k unique email addresses. Other impacted data included IP addresses, the user's country, and partial payment card data (first 6 and last 4 digits plus expiry date).

Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an operation we call CaptiveCrunch. The post CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft appeared first on Microsoft Security Blog.

Today, we’re releasing the HIPAA Security Rule on AWS: Technical Safeguards Implementation and Readiness Guidance. This helps covered entities and business associates configure, implement, and evidence compliance with the HIPAA Security Rule Technical Safeguard requirements (45 CFR §164.312) when building healthcare workloads on AWS. The HIPAA Security Rule’s Technical Safeguards (§164.312) define five standards and […]  ( 115 min )

No content preview

No content preview

Earlier this month, the Canadian government announced that it had signed the United Nations Convention against Cybercrime.  Speaking with Michael Geist of Law Bytes, senior research associate Kate Robertson argues that the convention is a cross-border surveillance and electronic evidence sharing agreement that Canada originally opposed, which carries significant adverse implications around the world for […] The post Kate Robertson on the Risks That Lie Behind Canada’s Unexpected Signing of the UN Cybercrime Convention appeared first on The Citizen Lab.

No content preview

Frontier AI models are raising the ceiling for skilled attackers and lowering the bar for everyone else. Leaders from Vista Equity, Cisco, and Bishop Fox share what that shift looks like in practice, how the existing security stack needs to change, and how long defenders will stay at a disadvantage.

No content preview

Summary The 2026 World Cup generated $20 billion in prediction market volume and $24 million in digital collectible trades, with… The post The 2026 World Cup On-Chain: $20 Billion in Crypto Flows, From Bets to Tickets appeared first on Chainalysis.  ( 16 min )

No content preview

Discover why open source AI is vital for cybersecurity as we join the Open Secure AI Alliance to build an open, distributed defense stack for the AI era.

No content preview

Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month’s 210. Quite a jump. For July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn’t provide CVSS scores or other severity information, we’re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out. ·      CVE-2026-43818 (ImageIO) – This bug could allow the “Processing [of] a maliciously crafted image may lead to arbitrary code execution." ImageIO is the classic zero-/one-click remote sur…

Summary Institutions are shaping blockchain design: A new generation of hybrid blockchains are building capabilities that suit the privacy-forward needs… The post Monitoring Privacy Blockchains: How Compliance Teams Can Stay a Step Ahead appeared first on Chainalysis.  ( 15 min )

No content preview

No content preview

The OCCRP found that the co-founder of NSO Group, which develops Pegasus spyware, travelled to Panama in 2013 on an Israeli diplomatic passport. The post Co-Founder of Controversial Spyware Firm Had Israeli Diplomatic Passport appeared first on The Citizen Lab.

Learn how Akamai Guardicore Segmentation empowers partners to ease customer AI anxiety and contain machine-speed exploits with automated microsegmentation.

No content preview

In June 2026, Houston City College was the target of a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from the college was later published publicly and included 832k unique email addresses along with names, addresses, phone numbers, academic records, and other personal information relating to both current students and alumni.

Summary  OFAC designated Zaid Issam Ahmed al-Jebouri, an Iraqi national based in Istanbul, and two associates as Specially Designated Global… The post OFAC Sanctions Members of Hamas Financing Network appeared first on Chainalysis.  ( 11 min )

No content preview

No content preview

📖 [The CloudSecList] Issue 348 was originally published by Marco Lancini at CloudSecList on July 26, 2026.

No content preview

Summary The EU’s 21st Russia sanctions package introduces a transaction ban on 14 crypto-related service platforms across six jurisdictions: Georgia,… The post The EU’s 21st Russia Sanctions Package Targets Crypto Platforms for Sanctions Evasion, Introduces Third-Country Ban Mechanism appeared first on Chainalysis.  ( 12 min )

Senior fellow Gary Miller spoke with Cape Cellular about the exploitation of mobile network vulnerabilities to track US personnel during the Iran war. The post How Iran Uses Cellular Infrastructure to Target US Military Phones appeared first on The Citizen Lab.

No content preview

No content preview

Discover why modern applications are all part of the AI ecosystem, how real-time inference drives performance, and how to avoid hidden data transfer costs.

Learn why crypto-agility depends not just on adopting the right standards, but on maintaining a clear, unified view of your DNS environment before the migration begins.

Summary Laws are outpacing enforcement: While jurisdictions are increasingly adopting necessary regulations — from Travel Rule legislation to VASP licensing… The post What FATF’s 7th Crypto Compliance Report Card Means: Enforcement Must Catch Up With Legislation appeared first on Chainalysis.  ( 15 min )