In the beginning of April, three attacks detected in the Guardicore Global Sensor Network (GGSN) caught our attention. All three had source IP addresses originating in South-Africa and hosted by VolumeDrive ISP (see IoCs).

Guardicore Labs uncovers a Ransomware detection campaign targeting MySQL servers. Attackers use Double Extortion and publish data to pressure victims.

Our deception technology is able to reroute attackers into honeypots, where they believe that they found their real target. The attacks brute forced passwords for RDP credentials to connect to the victim download and execute a previously undetected malware, which we named Trojan.sysscan.

In this Akamai FLAME Trailblazer blog post, Rachel Bayley encourages women to step into the unknown and to be their authentic selves.

Guardicore security researchers describe and uncover a full analysis of a cryptomining attack, which hid a cryptominer inside WAV files. The report includes the full attack vectors, from detection, infection, network propagation and malware analysis and recommendations for optimizing incident response processes in data centers.

AI coding agents are part of the developer toolchain. Tools like Kiro and Claude Code generate features, tests, and code refactors from natural-language prompts. A single agent can open dozens of pull requests (PRs) across your repositories in an afternoon. That productivity comes with a trade-off: agents optimize for task completion at machine speed with […]  ( 125 min )

Amazon Inspector is an automated vulnerability management service that continually scans Amazon Web Services (AWS) workloads for software vulnerabilities. The vulnerability management capabilities of Amazon Inspector are powered by an asset inventory engine known as the Amazon Inspector SBOM Generator (inspector-sbomgen), a standalone command-line tool that produces a software bill of materials (SBOM) from container […]  ( 121 min )

No content preview

Install Malwarebytes for Windows from the Microsoft Store with the same full protection and features.

The FTC has sued telehealth provider Hims & Hers, alleging it shared customers' sensitive health information with advertisers.

A new type of attack can trick Microsoft Copilot for Word into spreading hidden prompt injections from document to document.

Summary The 2026 World Cup generated $20 billion in prediction market volume and $24 million in digital collectible trades, with… The post The 2026 World Cup On-Chain: $20 Billion in Crypto Flows, From Bets to Tickets appeared first on Chainalysis.  ( 16 min )

Chinese models show variation from month to month, highlighting the uncertain and unstable nature of their security posture

This month’s updates help security and IT teams secure their AI environments, use AI to defend, and strengthen the foundations that AI-powered operations depend on. The post ​​​​What’s new in Microsoft Security: July 2026 appeared first on Microsoft Security Blog.

How a company called Rosabella used AI content to market its supplements: "If you’re trying to sell health products to a 50-year-old, well, make your avatar 50 years old."

Following 404 Media's reporting on how LinkedIn is full of AI slop, the platform is giving users a chance to report it when they see it.

No content preview

Discover why open source AI is vital for cybersecurity as we join the Open Secure AI Alliance to build an open, distributed defense stack for the AI era.

No content preview

Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month’s 210. Quite a jump. For July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn’t provide CVSS scores or other severity information, we’re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out. ·      CVE-2026-43818 (ImageIO) – This bug could allow the “Processing [of] a maliciously crafted image may lead to arbitrary code execution." ImageIO is the classic zero-/one-click remote sur…

Coordinated Cyberattack Targets 30+ Minnesota Water Systems A coordinated intrusion hit operational technology at more than 30 community water and wastewater utilities across Minnesota on July 26 and 27, disrupting automated control functions and briefly knocking one city’s treatment plant offline while state and federal investigators, including the FBI, work to identify the attackers and […] The post Infosec News Nuggets — July 30, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

The case raises fresh questions about how effectively Apple polices apps that impersonate legitimate developers.

Behind TikTok's booming growth industry are fake engagements, stolen accounts, and a fast track to getting flagged.

AI is making robocall scams cheaper, more convincing, and harder to spot. Here's why caller ID still isn't enough.

OpenAI has published an update on the incident in which one of its agents escaped its sandbox and accessed Hugging Face infrastructure.

Fake Walmart stores are offering unbelievable bargains on liquor to lure shoppers into entering their credit card details.

These are the top threats you should know about this week.

Amazon is sharing new findings about how a threat actor linked to the Democratic People’s Republic of Korea (DPRK) is targeting open source software libraries, the shared building blocks that companies around the world use to develop applications. Amazon Threat Intelligence has linked several recent compromises of popular Node Package Manager (NPM) libraries to the […]  ( 121 min )

If you use and install packages from npm or PyPI, the first hours after a package is published are the riskiest because scanners can’t analyze packages before publication. Recent supply chain events affecting NodeJS and Python packages have been detected and removed within hours. However, while those packages were available to the general public, it’s […]  ( 119 min )

"I have a right to speak. I'm here to speak. I have a right to clap, and if you want me out, you're going to have to drag me out."

What happened when Flock came to Matthew's town; the rise of no phone Luddite events; and the influencers just making up BS about Flock.

A new AI data center can be up and running in a year. Building new energy infrastructure to power it could take a decade.

Summary Institutions are shaping blockchain design: A new generation of hybrid blockchains are building capabilities that suit the privacy-forward needs… The post Monitoring Privacy Blockchains: How Compliance Teams Can Stay a Step Ahead appeared first on Chainalysis.  ( 15 min )

Learn how better questions, trusted AI, and human judgment help security leaders make confident decisions and build resilient systems. The post ​​Better security starts with better questions appeared first on Microsoft Security Blog.  ( 20 min )

No content preview

No content preview

No content preview

Arista patches VeloCloud Orchestrator zero-day exploited in attacks Arista has shipped patches for a maximum-severity command injection flaw in on-premises VeloCloud Orchestrator deployments after confirming it is being actively exploited. The bug allows unauthenticated attackers with only network access to the web interface to reach privileged internal functionality, potentially compromising the confidentiality, integrity, and availability […] The post Infosec News Nuggets — July 29, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

No content preview

No content preview

No content preview

No content preview

No content preview

A beginner-friendly walkthrough of the TryHackMe “Grand Larceny Auto” reverse-engineering challenge Continue reading on InfoSec Write-ups »

No content preview

No content preview

Choosing the right cryptographic key management service on Amazon Web Services (AWS) starts with understanding the difference between AWS Key Management Service (AWS KMS) and AWS CloudHSM. Both provide key storage backed by a hardware security module (HSM) but serve very different needs. AWS KMS is a fully managed service that integrates with all AWS […]  ( 117 min )

Amazon Web Services (AWS) is excited to announce that the latest version of Information Security Registered Assessors Program (IRAP) report (Phase 1a – full assessment) is now available through AWS Artifact. An independent Australian Signals Directorate (ASD) certified IRAP assessor completed the IRAP assessment of AWS in June 2026. The new IRAP report includes four […]  ( 114 min )

The OCCRP found that the co-founder of NSO Group, which develops Pegasus spyware, travelled to Panama in 2013 on an Israeli diplomatic passport. The post Co-Founder of Controversial Spyware Firm Had Israeli Diplomatic Passport appeared first on The Citizen Lab.

The U.S. government has charged Samuel Tunick with allegedly typing in a passcode to wipe his phone before officers could search it. “I hope people understand that the charges against me are meant to intimidate people,” he said.

“They didn't understand it was satire in the beginning until the end,” Casa Grande, Arizona resident Jacob Petrosky told 404 Media. “They were not happy, they were very upset.”

“I’m not going to apologize for using AI in the creation process.”

Apple’s Sensitive Content Warning is supposed to protect users from unwanted nude images. It accidentally blurred my friend’s dog video.

Learn how Akamai Guardicore Segmentation empowers partners to ease customer AI anxiety and contain machine-speed exploits with automated microsegmentation.

No content preview

Your phone needs more than a lock screen to stay safe. We've rebuilt Malwarebytes Mobile Security to put scam protection first and keep your phone secure.

Reddit users found that by using a specific search query, they could find shared Claude conversations in search results.

Apple issued a large July security update with several image processing related vulnerabilities that could compromise your device.

Anyone could access other Click To Pray users' personal information. The flaw went unfixed for more than six months after it was reported.

Hackers Target US Firms in FastJson RCE Zero-Day Attacks Attackers are actively exploiting a critical remote code execution flaw in the open-source FastJson Java library, a widely used component in Alibaba-linked enterprise software, without needing user interaction or elevated privileges. Tracked as CVE-2026-16723, the bug affects versions 1.2.68 through 1.2.83 under common Spring Boot fat-JAR […] The post Infosec News Nuggets — July 28, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

No content preview

No content preview

In June 2026, Houston City College was the target of a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from the college was later published publicly and included 832k unique email addresses along with names, addresses, phone numbers, academic records, and other personal information relating to both current students and alumni.

No content preview

Summary  OFAC designated Zaid Issam Ahmed al-Jebouri, an Iraqi national based in Istanbul, and two associates as Specially Designated Global… The post OFAC Sanctions Members of Hamas Financing Network appeared first on Chainalysis.  ( 6 min )

The Wikimedia Foundation waited until immediately after its largest annual conference to say it wouldn't voluntarily recognize its workers' union.

Police refused to release the arrest report, saying it could "could interfere with ongoing investigative efforts."

Joseph speaks to Mike Yeagley about how he bought the world's location data, and what that means for everyone's privacy and security.

Claude users are creating public share links, but probably don't realize that means their chats are now ending up in Google searches where anyone can dig through them.

Spotify doesn’t label AI music on its platform, so websites like SoullessMusic.com and SlopTracker.org do it instead.

As tech backlash hits the mainstream, the ‘Summer of Ludd’ proves we don’t need social media to hang out and have a good time.

No content preview

July 29, 2026: We’ve updated this post to clarify the AWS Firewall Manager migration path. Application-layer distributed denial of service (DDoS) attacks are difficult to detect because they closely resemble legitimate traffic. HTTP request floods are now among the most common vectors targeting web applications, using valid-looking requests that blend in with normal user activity. […]  ( 124 min )

AWS Security Assurance Services is announcing the release of the Cloud Security Alliance (CSA) Compliance Guide on Amazon Web Service (AWS), a new resource that maps the 17 control domains and 207 control objectives of the Cloud Controls Matrix v4.1 (CCM) to AWS services and recommended implementation practices. The guide is intended to help organizations […]  ( 115 min )

A newly uncovered ad fraud campaign is spreading Android apps that display full-screen ads every time you end a phone call.

Scammers are posing as ShinyHunters and using leaked email addresses to make their sextortion emails seem more credible.

This week on the Lock and Code podcast, we discuss just exactly why it is that hackers and scammers want your data—and how you're at risk.

A list of topics we covered in the week of July 20 to July 26 of 2026

The physics of cybersecurity are changing. Introducing security's new cyber stack: Project Perception. The post Rethinking security for the age of AI appeared first on Microsoft Security Blog.

Microsoft's External Red Team Alliance (EXTRA) is a global AI security initiative designed to advance AI safety research and red teaming. By partnering with universities, researchers, and regional experts, EXTRA helps identify emerging AI risks, improve security testing, and strengthen the resilience of frontier AI systems. The post Enhancing AI security through global AI red teaming appeared first on Microsoft Security Blog.

Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researchers published a working exploit on July 24 for a flaw dubbed Certighost that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine, then use the resulting Kerberos credential to pull the krbtgt secret through […] The post Infosec News Nuggets — July 27, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

No content preview

📖 [The CloudSecList] Issue 348 was originally published by Marco Lancini at CloudSecList on July 26, 2026.

No content preview

No content preview

No content preview

No content preview

When an administrator introduces a rule change in AWS Network Firewall and network connectivity is disrupted, pinpointing the cause requires inspecting multiple points in the traffic path. The firewall gives you stateless and stateful rule engines, domain rules, and routing to the firewall endpoint inside your Amazon Virtual Private Cloud (Amazon VPC). A network drop […]  ( 127 min )

Summary The EU’s 21st Russia sanctions package introduces a transaction ban on 14 crypto-related service platforms across six jurisdictions: Georgia,… The post The EU’s 21st Russia Sanctions Package Targets Crypto Platforms for Sanctions Evasion, Introduces Third-Country Ban Mechanism appeared first on Chainalysis.  ( 12 min )

Scammers are using stolen videos and fake artist profiles to trick people into buying resin art that never arrives. Here's how to spot the warning signs.

A phishing site posing as a free Call of Duty Points giveaway is stealing Activision logins and two-factor authentication codes.

An OpenAI agent escaped its sandbox, stole credentials, and broke into Hugging Face. Here's what that actually means.

A new selfie video verification feature could make recovering your Google Account easier. But it also creates new security and privacy concerns.

Senior fellow Gary Miller spoke with Cape Cellular about the exploitation of mobile network vulnerabilities to track US personnel during the Iran war. The post How Iran Uses Cellular Infrastructure to Target US Military Phones appeared first on The Citizen Lab.

No content preview

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks Group-IB uncovered an exposed Alibaba Cloud server tied to a China-linked operation dubbed JadeProx, revealing a previously undocumented Windows loader called TriBack that was used against government, healthcare, and education targets across Asia and Latin America, including active intrusions into a Vietnamese hospital’s medical […] The post Infosec News Nuggets — July 24, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Black Hat 2026 (Aug 1-6, 2026) brings together over 22,000 security practitioners, researchers, and CISOs who build, break, and defend enterprise infrastructure. They’re security professionals who push the limits of offensive and defensive security and demand proof over promises. As frontier security models like Mythos reshape the enterprise landscape, they need security that operates at […]  ( 116 min )

No content preview

In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi-stage attack chains. The post Email threat landscape: Q2 2026 trends and insights appeared first on Microsoft Security Blog.

No content preview

Check Point Warns of SmartConsole Zero-Day Exploited in Attacks  Check Point patched CVE-2026-16232, an authentication bypass vulnerability in its SmartConsole GUI admin panel that allows unauthenticated attackers to obtain an application login token usable to authenticate with administrator privileges on a vulnerable Security Management Server. Successful exploitation requires the Management Server IP to be exposed to internet […] The post Infosec News Nuggets — July 23, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

No content preview

Learn why crypto-agility depends not just on adopting the right standards, but on maintaining a clear, unified view of your DNS environment before the migration begins.

Summary Laws are outpacing enforcement: While jurisdictions are increasingly adopting necessary regulations — from Travel Rule legislation to VASP licensing… The post What FATF’s 7th Crypto Compliance Report Card Means: Enforcement Must Catch Up With Legislation appeared first on Chainalysis.  ( 15 min )

No content preview

These are the top threats you should know about this week.

Our collaboration with AXA XL brings Microsoft Incident Response services directly to cyber insurance policyholders, helping organizations coordinate technical, business, and insurance decisions. The post Real world incident response: Microsoft and AXA XL strengthen cyber resilience appeared first on Microsoft Security Blog.

No content preview

‘Unprecedented’: OpenAI Says AI Models Autonomously Hacked Another Company  OpenAI disclosed that an autonomous AI agent built on its models — the newly released GPT-5.6 Sol and an unreleased, more capable model — broke out of a controlled test environment and hacked into Hugging Face’s servers using stolen credentials and a previously unknown vulnerability, all […] The post Infosec News Nuggets — July 22, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

No content preview

If you just want to read the rules, you can find them here.   Pwn2Own Ireland returns for 2026, and it’s the third year for this event in the Emerald Isle. Despite the dreary Irish skies (and the threat of a random banshee), we had an amazing event, even if we did end up in a jail at the end. With that in mind, we’re excited to return to Cork this fall for yet another great Pwn2Own event. We’ll also be returning to some of the great pubs Ireland has to offer in the evenings and wrapping the event up at a special location (stay tuned for that announcement). As for the contest itself, it will run from October 6-9, 2026. As always, we’ll have a random drawing to determine the schedule of attempts on the first day of the contest, and we will proceed from there. Registration closes at 5:00 p.m…

AWS WAF classifies web traffic by attaching metadata to each request it evaluates. Managed rule groups such as AWS WAF Bot Control and AWS WAF Fraud Control account takeover prevention (ATP) attach labels that describe what they found. A label can record that a request came from a known bot category or that it matched […]  ( 115 min )

ManageEngine's SSO ticket was just the millisecond wall-clock time at login, making unauthenticated account takeover theoretically possible. Bishop Fox confirmed the exploit end to end and breaks down why blind exploitation is still impractical and what defenders should do about it.

No content preview

Customers named Akamai a 2026 GartnerⓇ Peer Insights™ Customers’ Choice for Edge Distribution Platforms. See why they trust us to scale and secure their apps.

No content preview

Hackers Exploit Palo Alto PAN-OS Flaw to Deploy Qilin Ransomware  Arctic Wolf Labs linked multiple June 2026 intrusions to active exploitation of CVE-2026-0257, an authentication bypass flaw in Palo Alto Networks’ GlobalProtect portal and gateway, with attackers using it as an initial access point to deploy Qilin ransomware and, in some cases, steal data before encrypting networks. The flaw […] The post Infosec News Nuggets — July 21, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

The new Amazon GuardDuty investigation agent (now in public preview) investigates security findings across your Amazon Web Services (AWS) environment, reducing investigation time from hours to minutes. GuardDuty is our managed threat detection service that continuously monitors your AWS accounts and workloads for suspicious, potentially malicious activity, and unauthorized behavior, delivering detailed security findings for […]  ( 115 min )

Amazon Web Services (AWS) successfully completed an onboarding audit with no findings for ISO 9001:2015, 27001:2022, 27017:2015, 27018:2019, 27701:2019, 20000-1:2018, and 22301:2019, and Cloud Security Alliance (CSA) STAR Cloud Controls Matrix (CCM) v4.0. EY Certify Point auditors conducted the audit and reissued the certificates on May 31, 2026. The objective of the audit was to […]  ( 107 min )

In November 2025, AI music generation tool Suno suffered a data breach that later came to light in July the following year. The data contained over 55M unique email addresses. Phone numbers were also present where they had been used as the sign-up method. Although representing a small portion of the corpus, the breach also included tens of thousands of Stripe records relating to purchases, containing names, physical addresses, purchase amounts and partial credit card data including the card type, expiry date and last 4 digits. The company advised that "Suno does not have access to customers' full credit card numbers in Stripe".

Sensor Intel Series: July 2026 CVE Trends

No content preview

No content preview

No content preview

No content preview

Coca-Cola says Fairlife ransomware attack halts US dairy production Coca-Cola disclosed in an SEC filing that its Fairlife dairy subsidiary detected unauthorized access to systems tied to production as part of a ransomware attack, forcing a temporary suspension of Fairlife manufacturing across the United States while Canadian operations continue unaffected. The company activated incident response […] The post Infosec News Nuggets — July 20, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale. Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses. The breach also included a broad range of other data relating to the operation of the platform including user profile data, banking information, payout history for workers and passwords stored as bcrypt hashes.

📖 [The CloudSecList] Issue 347 was originally published by Marco Lancini at CloudSecList on July 19, 2026.

Senior research fellow Gary Miller spoke to Financial Times about attempts to exploit mobile network vulnerabilities to track US personnel during the Iran war.  The post US Military Smartphones Targeted Through Roaming and Ad Tech appeared first on The Citizen Lab.

Join Microsoft Security at Black Hat USA 2026 for supply chain research, hands-on security experiences, expert conversations, and our reception. The post Microsoft at Black Hat USA 2026: Defending trust in the age of AI and supply chain attacks appeared first on Microsoft Security Blog.

No content preview

AI agent harnesses are changing how penetration tests get executed. Bishop Fox used MCP agents across external, application, and cloud testing to surface two information leaks totaling over 12 million records in hours rather than days. Here is how the approach works and where it makes sense to use.

Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court for the 2024 hack of Transport for London, which left 148 TfL systems inoperable and forced all 27,000 of the transport authority’s […] The post Infosec News Nuggets — July 17, 2026 appeared first on AboutDFIR - The Definitive Compendium Project.

No content preview

From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments. The post ACR Stealer: Two observed intrusion chains amid increased threat activity appeared first on Microsoft Security Blog.

As AI agents become more autonomous, strong identity, access, and auditing controls are critical to keeping them secure. The post Least privilege for AI agents: Identity, access, and tool binding appeared first on Microsoft Security Blog.

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This analysis breaks down the attack chain, payload delivery, and recommended defenses. The post Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery appeared first on Microsoft Security Blog.

Discover why traditional security fails against autonomous AI agents and how machine-speed microsegmentation helps stop tool chaining and lateral movement.

No content preview

No content preview

The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) on Tuesday updated its Central Bank of Iran designation to… The post OFAC Sanctions Iran Central Bank Crypto Wallets, Freezing $131M in Stablecoins appeared first on Chainalysis.  ( 10 min )

These are the top threats you should know about this week.

No content preview

The SOTI Security report examines how agentic AI is disrupting commerce security, scaling API abuse, and driving up infrastructure costs.

No content preview

No content preview

In July 2026, electronic test and measurement equipment company Fluke was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published more than 100GB of data allegedly taken from the company. The corpus contained largely corporate contact information, including over 800k unique email addresses, names, phone numbers and physical addresses. A large collection of support cases was also present.

In June 2026, a party claiming to have access to data from Goose Creek Candle Company sent emails to a number of the company's customers, claiming the company had a security vulnerability and suffered a data breach. The data was subsequently sent to Have I Been Pwned and contained 6.6M unique email addresses along with names, phone numbers, physical addresses, order IDs and total spent. The data appears to have been obtained from the company's Shopify instance. Goose Creek is aware of the reports but was unable to provide Have I Been Pwned with any further information at the time of publication.

Read all about the latest AWS security features, compliance updates, and hands-on resources in our new, monthly digest posts. You’ll find expert blog posts, new service capabilities, code samples, and workshops. AWS Security Blog posts This month’s AWS Security Blog posts covered identity and access management, threat intelligence, network security, AI-powered security tooling, and multi-account […]  ( 112 min )

Security Hub is our foundation for full-stack enterprise security across clouds. It centralizes your security operations and turns raw signals into prioritized insights, so your team spends its time managing real risk instead of stitching tools together. Today that foundation grows in two directions our customers asked for most. We are adding purpose-built protection for […]  ( 112 min )

As AI agents and automated tools increasingly access web applications, distinguishing legitimate bot traffic from malicious attempts has become a critical security challenge. Traditional approaches such as IP-based filtering and reverse DNS lookups fail in multi-tenant systems (such as Amazon Bedrock AgentCore) where thousands of distinct workloads share the same IP space. Attackers can easily […]  ( 112 min )

No content preview

Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly scheduled activities as we let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for July 2026 Adobe has now moved to a bimonthly release schedule, which means they will be releasing patches on the second and fourth Tuesdays of the month. I’ll continue to cover the second Tuesday release here and update this blog should the fourth Tuesday release contain anything si…

No content preview

No content preview

No content preview

Research fellow Bill Robinson speaks with The Globe and Mail about CSE spending. The post Canada’s Electronic Spy Agency Conducted Cyberattacks on Criminals Brokering Fentanyl Ingredients, Report Says appeared first on The Citizen Lab.

A competitive open-weight model, Claude Fable, and Jade Puffer

Summary The United States, United Kingdom, and European Union announced sanctions targeting nation-state hackers, cybercriminals, and their enablers in one… The post “Stern,” Likely Most Prolific Ransomware Operator Ever, Sanctioned by EU as Action Targets Billions in Ransomware Damage appeared first on Chainalysis.  ( 8 min )

Chainalysis is excited to announce support for Stable, a Layer 1 blockchain optimized for stablecoin payments and aligned with the… The post Chainalysis Supports Stable with Automatic Token Support appeared first on Chainalysis.  ( 9 min )

ServiceNow portals can expose backend records through public widgets and API endpoints even when the visible portal looks locked down. Bishop Fox built snowpick to test both surfaces systematically, and across 166 authorized assessments, nearly a third of instances returned data they shouldn't have.

No content preview

No content preview

Blockchain tracing tools like Chainalysis Reactor help investigators untangle the financial networks behind illicit activity: fraud, theft, sanctions evasion, cybercrime,… The post Courtroom-Ready Analytics: How Chainalysis Met the Daubert Standard appeared first on Chainalysis.  ( 12 min )

We are pleased to announce the publication of a new AWS compliance implementation guidance: HITRUST i1 Compliance on AWS: Customer Implementation Guidance with an Illustrative Healthcare Platform. Healthcare organizations seeking HITRUST i1 certification increasingly rely on Amazon Web Services (AWS) as their cloud foundation. The HITRUST i1 assessment covers 182 curated controls at the Implemented […]  ( 108 min )

No content preview

No content preview

📖 [The CloudSecList] Issue 346 was originally published by Marco Lancini at CloudSecList on July 12, 2026.

No content preview

In June 2026, Glendale Community College was the target of a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from Glendale was later published online and included almost 800k unique email addresses along with various other data fields, including names, addresses, phone numbers, Social Security numbers and other information relating to student enrolments. In its disclosure notice, the college advised that "the potentially impacted information may vary for each individual and may include all or just one of the above-listed types of information".

No content preview

No content preview

Amazon Web Services EMEA Sarl (AWS) has been designated as a critical third party (CTP) to the UK financial sector by HM Treasury. The CTP regime came into force on January 1, 2025, and establishes a framework through which the Bank of England, PRA, and FCA (collectively the UK regulators) can set requirements on and […]  ( 107 min )

No content preview

No content preview

In this excerpt of a TrendAI Research Services vulnerability report, Yazhi Wang and Jonathan Lein of the TrendAI Research team detail a recently patched remote code execution bug in the Windows HTTP protocol stack. Successful exploitation of this vulnerability can result in a denial-of-service condition, or, in the worst case, code execution with kernel privileges. The following is a portion of their write-up covering CVE-2026-47291, with a few minimal modifications. A remote code execution vulnerability exists in the HTTP Protocol Stack for Microsoft Internet Information Services implemented in HTTP.sys. The vulnerability is due to invalid validating incoming HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending crafted HTTP packets to the target sys…

No content preview

You can now connect your agents to the AWS MCP Server using the same credentials and sign-in methods that you already use for connecting to the AWS Management Console or AWS Command Line Interface (AWS CLI) through a familiar browser-based experience powered by industry-standard OAuth. This new sign-in path supports AWS Identity and Access Management […]

No content preview

No content preview

No content preview

No content preview

Discover how Akamai Object Storage absorbs high-frequency machine data, mitigates egress costs, and scales production AI model outputs.

No content preview

No content preview

System prompts form the foundation of generative AI applications. A system prompt is a collection of instructions and operational context provided to a large language model (LLM) that shapes how the model behaves and interacts with users and tools. System prompts often contain proprietary information, including role definitions, behavioral guidelines, tool descriptions and usage instructions, […]

These are the top threats you should know about this week.

Senior research fellow Jon Penney and co-author Bruce Schneier argue that widely deploying AI surveillance could be corrosive to democracy. The post AI Surveillance Is Being Supercharged–And It Will Chill Social Progress appeared first on The Citizen Lab.

A senior Bishop Fox researcher once cracked SonicWall's proprietary firmware encryption by hand. We gave Claude the same problem, two artifacts, one instruction, and mostly got out of the way. What happened next reveals something important about where AI-assisted security research is heading.

No content preview

When compliance teams, regulators, or investigators evaluate blockchain analytics providers, the conversation almost always starts the same: How many services… The post Breadth, Depth, And Quality: Why Comparing Blockchain Analytics Vendors by Cluster Count Is Only Part of the Calculation appeared first on Chainalysis.  ( 12 min )

Every personalization decision adds latency that has a measurable cost in conversions and order value. Learn where that cost comes from — and how to avoid paying it.

No content preview

At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of Cortex, evaluating the security of its multi-tenant design and the mechanisms protecting tenant isolation.

📖 [The CloudSecList] Issue 345 was originally published by Marco Lancini at CloudSecList on July 05, 2026.

In June 2026, Moody Bible Institute was targeted by a ShinyHunters "pay or leak" extortion campaign. Over 2.3M unique email addresses and other personal data were later published publicly, including names, physical addresses, phone numbers, dates of birth and other information relating to donors, supporters, students and alumni. In their disclosure notice, Moody advised that they had "engaged both internal and external cybersecurity experts to thoroughly investigate the matter".

No content preview

No content preview

No content preview

Favicons are small, static, and rarely changed, which makes them a surprisingly durable fingerprint for identifying software across the internet. Bishop Fox built an AI-assisted pipeline to hash and enrich them at scale, and this post shares the methodology, the dataset, and why it matters.

These are the top threats you should know about this week.

We’re back with our look at the Apple macOS and iOS security updates. As this is a new feature for us, please let us know your feedback on the blog. For June 2026, Apple released 37 unique CVEs across iOS 26.5.2 / iPadOS 26.5.2, macOS Tahoe 26.5.2, Safari 26.5.2. Since Apple doesn’t provide CVSS scores or other severity information, we’re left to speculate on which of these bugs is the most severe. The overwhelming majority (31 of 37) are WebKit/WebRTC bugs reachable through malicious web content. Most of those are crash/DoS bugs rather than code execution, so the real risk lives in the small set of kernel bugs and the handful of WebKit sandbox escapes. However, there are a couple that stand out. -    CVE-2026-43724 (Kernel) – According to Apple, “An app may be able to cause unexpected sy…