Guardicore Labs uncovers a Ransomware detection campaign targeting MySQL servers. Attackers use Double Extortion and publish data to pressure victims.

In the beginning of April, three attacks detected in the Guardicore Global Sensor Network (GGSN) caught our attention. All three had source IP addresses originating in South-Africa and hosted by VolumeDrive ISP (see IoCs).

In this Akamai FLAME Trailblazer blog post, Rachel Bayley encourages women to step into the unknown and to be their authentic selves.

Guardicore security researchers describe and uncover a full analysis of a cryptomining attack, which hid a cryptominer inside WAV files. The report includes the full attack vectors, from detection, infection, network propagation and malware analysis and recommendations for optimizing incident response processes in data centers.

Our deception technology is able to reroute attackers into honeypots, where they believe that they found their real target. The attacks brute forced passwords for RDP credentials to connect to the victim download and execute a previously undetected malware, which we named Trojan.sysscan.

Agentic AI represents a qualitative shift in how software operates. Traditional software executes deterministic instructions. Generative AI responds to human prompts with output that humans review and use at their discretion. Agentic AI differs from both. Agents connect to software tools and APIs and uses large language models (LLMs) as reasoning engines to plan and […]  ( 112 min )

Chainalysis Links 2026 brought together the brightest minds across cryptocurrency exchanges, global law enforcement, and traditional finance (TradFi) for an… The post Chainalysis Links NYC 2026: AI Amplification, TradFi Convergence, and the Power of Networked Intelligence appeared first on Chainalysis.

※この記事は自動翻訳されています。正確な内容につきましては原文をご参照ください。 悪意のあるアクターはすでに AI を駆使し、詐欺、窃盗、マネーロンダリングを加速させています。対抗する側には、それを上回るスピードが求められます。 本日、イベント Links にて、Chainalysis の新たなステージとなる「ブロックチェーン・インテリジェンス・エージェント」を発表しました。新製品でも、後付けのチャットボット機能でもありません。数十億件のスクリーニング済みトランザクション、1,000 万件以上の捜査、10 年以上にわたるブロックチェーン分析で培った知見とプラットフォームの進化形であり、お客様のチームと連携して機能します。 ブロックチェーン分析を組織全体へ Chainalysis は、政府、金融機関、暗号資産事業者が捜査、規制対応、資産保護のために信頼を寄せる、世界で最も包括的なブロックチェーンデータセットを構築してきました。当社のデータは法廷で唯一信頼性を認められ、証拠として採用されています。そして当社のツールは、暗号資産史上最も重要な捜査を支えてきました。 しかし、その分析能力を最大限に活かすには、高度な専門スキルが求められていました。Chainalysis ブロックチェーン・インテリジェンス・エージェントは、プラットフォームの全機能、つまりデータ、製品、専門知識を組織内の誰もが活用できるようにします。熟練の捜査官やコンプライアンスアナリストから経営層まで、Chainalysis エージェントが的確なインサイトを提供し、チームの対応力を飛躍的に高めます。 すべてを支えるプラットフォーム 今、あらゆる企業が AI エージェントの開発に取り組んでいます。真の差別化要因は、その裏側にある基盤です。… The post Chainalysis、初のブロックチェーン・インテリジェンス・エージェントを発表 appeared first on Chainalysis.

No content preview

Posted by Adam Gavish, Google GenAI Security Team Indirect prompt injection (IPI) is an evolving threat vector targeting users of complex AI applications with multiple data sources, such as Workspace with Gemini. This technique enables the attacker to influence the behavior of an LLM by injecting malicious instructions into the data or tools used by the LLM as it completes the user’s query. This may even be possible without any input directly from the user. IPI is not the kind of technical problem you “solve” and move on. Sophisticated LLMs with increasing use of agentic automation combined with a wide range of content create an ultra-dynamic and evolving playground for adversarial attacks. That’s why Google takes a sophisticated and comprehensive approach to these attacks. We’re contin…

Generative AI is upgrading cyberattacks, from 450% higher phishing click‑through rates to industrialized MFA bypass. The post Threat actor abuse of AI accelerates from tool to cyberattack surface appeared first on Microsoft Security Blog.

Cookie-gated PHP webshells use obfuscation, php-fpm execution, and cron-based persistence to evade detection in Linux hosting environments. This post examines how this tradecraft conceals execution behind specially crafted HTTP cookies. The post Cookie-controlled PHP webshells: A stealthy tradecraft in Linux hosting environments appeared first on Microsoft Security Blog.

No content preview

A Minnesota journalist is challenging a 3,000 foot restriction on flying near DHS assets on First Amendment grounds.

In space, no one can hear you scream at Microsoft’s legacy software.

TeleGuard is an app downloaded more a million times that markets itself as a secure way to chat. The app uploads users’ private keys to the company’s server, and makes decryption of messages trivial.

Apple has quietly expanded patches against the vulnerabilities in the DarkSword exploit kit to include iOS and iPadOS 18.7.7

We commissioned a third-party audit for the infrastructure behind our VPNs. Here are the results.

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

An AI agent was banned from editing Wikipedia pages... and that's when things got weird, with the agent publishing its complaints publicly.

Microsoft warns WhatsApp on Windows users about an ongoing campaign that tries to gain permanent access to your machine

Scams are so convincing that two in three people can't tell them from the real thing. It's why we're not adding to the noise for April Fools.

On March 31, 2026, the popular HTTP client Axios experienced a supply chain attack, causing two newly published npm packages for version updates to download from command and control (C2) that Microsoft Threat Intelligence has attributed to the North Korean state actor Sapphire Sleet. Although the malicious versions are no longer available for download, since Axios is one of the most widely used HTTP clients in the JavaScript ecosystem, this compromise exposed hundreds to potentially millions of users. The post Mitigating the Axios npm supply chain compromise appeared first on Microsoft Security Blog.

No content preview

No content preview

No content preview

The proof-of-concept system produces psilocybin, DMT, and other compounds in leaves of the tobacco plant, potentially easing pressure on wild species and preserving Indigenous traditions.

I spent some time with a new browser-based augmented reality porn app.

Iran's AI and LEGO-focused propaganda; drama in the world of baseball; and perhaps one of the worst sex apps ever.

Groups that challenge books have begun using Gemini, ChatGPT, xAI, and other AI tools to try to get books banned.

These are the top threats you should know about this week.

In an essay for Lawfare, Citizen Lab director Ron Deibert warns that the Trump administration may authorize private firms to undertake offensive cyber operations with major consequences. The post The Perils of Privatized Cyberwarfare appeared first on The Citizen Lab.

No content preview

No content preview

In March 2026, the personal development and achievement media brand SUCCESS suffered a data breach. The incident exposed 250k unique email addresses along with names, IP addresses, phone numbers and, for a limited number of staff members, bcrypt password hashes. The data also included orders containing physical addresses and the payment method used. In SUCCESS' disclosure notice, they advised their system had also been abused to send offensive newsletters with quotes falsely attributed to contributors.

No content preview

No content preview

No content preview

We’re excited to announce the release of our latest compliance guide, ISO/IEC 27001:2022 on AWS, which provides practical guidance for organizations designing and operating an Information Security Management System (ISMS) using AWS services. As organizations migrate critical workloads to the cloud, aligning with globally recognized standards such as ISO/IEC 27001:2022 becomes an important step toward […]  ( 106 min )

AWS Security Agent on-demand penetration testing is now generally available, enabling you to run comprehensive security tests across all your applications, not only your most critical ones. This milestone transforms penetration testing from a periodic bottleneck into an on-demand capability that scales with your development velocity across AWS, Azure, GCP, other cloud-providers, and on-premises. With […]  ( 113 min )

AI chatbots, including ChatGPT, Claude, and Gemini, were all too willing to validate and hype up their users, a new Stanford study showed.

Developers using the axios package from npm may have downloaded a malicous version that drops a Remote Access Trojan

Reddit blamed a technical glitch for the removal of the living legend’s concert footage.

Thomson Reuters’ data, which can include peoples’ addresses and details on their ethnicity, is linked to tools used by ICE.

No content preview

No content preview

No content preview

Five facts critical infrastructure (CI) leaders need to act on in 2026, grounded in what Microsoft Threat Intelligence is observing across sectors right now. The post The threat to critical infrastructure has changed. Has your readiness? appeared first on Microsoft Security Blog.

Read actionable advice for CISOs on securing AI, managing risk, and applying core security principles in today’s AI‑powered environment. The post Applying security fundamentals to AI: Practical advice for CISOs appeared first on Microsoft Security Blog.

A malware campaign uses WhatsApp messages to deliver VBS scripts that initiate a multi-stage infection chain. The attack leverages renamed Windows tools and cloud-hosted payloads to install MSI backdoors and maintain persistent access to compromised systems. The post WhatsApp malware campaign delivers VBScript and MSI backdoors appeared first on Microsoft Security Blog.

Posted by Dirk Göhmann, Tony Mendez, and the Vulnerability Rewards Program Team 2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010, our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under this umbrella contribute to the safety and security of Google and its users, but also highlighting their acceptance by the external research community, without which such programs cannot function. Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer. This was more eviden…

Bad actors are already using AI to accelerate fraud, theft, money laundering, and more. We need to move fast to… The post Chainalysis Introduces the First Blockchain Intelligence Agents appeared first on Chainalysis.

No content preview

In March 2026, the NSFW AI companion platform Cuties AI suffered a data breach that was subsequently published to a public hacking forum. The incident exposed 144k unique email addresses along with display names, avatars, prompts and descriptions used to generate AI adult images, as well as URLs to the generated content. The data also included the account that created the content and a stated "preference" of either female or trans.

In this blog, we present how QBDI and TritonDSE can be used to attack a complex C++ binary implementing a VM.

MLB's ABS system somehow feels extremely human. It's not human vs robot, it's human vs human as judged by a robot.

The incident is yet another example of volunteer Wikipedia editors fighting to keep the world’s largest repository of human knowledge free of AI-generated slop.

This week Joseph talks to journalist and technologist Dhruv Mehrotra. Among many other things, Mehrotra tracked visitors to Epstein's island through location data.

Agentic AI introduces new security risks. Learn how the OWASP Top 10 Risks for Agentic Applications maps to real mitigations in Microsoft Copilot Studio. The post Addressing the OWASP Top 10 Risks in Agentic AI with Microsoft Copilot Studio appeared first on Microsoft Security Blog.

TL;DR Low-cost, commercially available drones have become central to modern conflict, allowing state and non-state actors, such as pro-Russia militias… The post From the Battlefield to the Blockchain: How Cryptocurrency Is Helping Finance the Drone Revolution appeared first on Chainalysis.

Chainalysis is excited to announce support for Tempo, an EVM-compatible Layer 1 blockchain purpose-built for stablecoin payments at scale. Tempo… The post Chainalysis Supports Tempo with Automatic Token Coverage appeared first on Chainalysis.

Apple introduced an extra layer of protection against ClickFix attacks, only for macOS Tahoe 26.4 and later

A list of topics we covered in the week of March 23 to March 29 of 2026

No content preview

📖 [The CloudSecList] Issue 331 was originally published by Marco Lancini at CloudSecList on March 29, 2026.

Earth’s magnetic field has created a huge void of galactic cosmic rays in space, which could help protect astronauts from radiation exposure.

High-value assets including domain controllers, web servers, and identity infrastructure are frequent targets in sophisticated attacks. Microsoft Defender applies asset-aware protection using Microsoft Security Exposure Management to detect and block threats against these critical systems. This article explores real-world attack scenarios and defense techniques. The post How Microsoft Defender protects high-value assets in real-world attack scenarios appeared first on Microsoft Security Blog.

This week, we discuss touching grass and Sora's demise.

“White House videos—AI or otherwise—are like group-chat in-jokes aimed at keeping cohesion.”

No content preview

Not a real phone, but good enough to fool your bank. Researchers warn criminals are using virtual devices to bypass fraud checks.

A fake Avast scan tells you your PC is infected, then installs the malware that steals passwords, session data and crypto wallets.

No content preview

No content preview

No content preview

No content preview

※この記事は自動翻訳されています。正確な内容につきましては原文をご参照ください。 要約 英国外務・英連邦・開発省（FCDO）が中国語圏の主要な不正担保マーケットプレイス Xinbi を制裁指定。個別の加害者のみを対象とする従来の手法から、大規模詐欺エコシステムを支える金融「担保プラットフォーム」そのものに切り込む戦略的転換 Chainalysis のデータによると、Xinbi は 2021 年から 2025 年にかけて 199 億ドル超の決済を仲介。「Black U」マネーロンダリング、無許可 OTC 取引、個人情報データベース販売、詐欺インフラの提供など、あらゆる不正取引を仲介 FCDO はグローバル人権制裁制度に基づき Xinbi… The post 英国政府が Xinbi を制裁：中国語圏の暗号資産詐欺を支えるインフラの中核を指定 appeared first on Chainalysis.

In March 2026, a breach of one of the many iterations of the BreachForums hacking forum known as "Version 5" was publicly disclosed. The incident exposed 340k unique email addresses along with usernames and argon2 password hashes.

Deploying agentic AI in financial services requires additional security controls that address AI-specific risks. This post walks you through comprehensive observability and fine-grained access controls—two critical capabilities for maintaining explainability and accountability in AI systems. You will learn seven design principles and get implementation guidance for meeting regulatory requirements while deploying secure AI solutions. Financial […]  ( 112 min )

No content preview

No content preview

A new macOS infostealer, NukeChain (now Infiniti Stealer), uses fake CAPTCHA pages to trick users into running malicious commands.

It hides inside developer tools, then monitors activity and steals data, turning a single infection into a wider risk across the supply chain.

Courts are starting to question how platforms are built, not just what’s posted.

Chainalysis is excited to announce extended support for Sui, an emerging high-performance blockchain that has rapidly grown its ecosystem since… The post Chainalysis Extends Sui Support with Automatic Token Support appeared first on Chainalysis.

TL;DR The UK’s Foreign, Commonwealth and Development Office (FCDO) has designated Xinbi, a major Chinese-language illicit guarantee marketplace. The designation… The post UK Government Designates Xinbi, Key Node in Chinese-Language Crypto-Enabled Scam Infrastructure appeared first on Chainalysis.

No content preview

Bishop Fox researchers took a deep dive into a new strongSwan vulnerability that allows unauthenticated attackers to take VPN services offline. We created an easy tool to test your strongSwan deployment & recommend upgrading to version 6.0.5 and later.

In June 2015, custom gaming controller maker Scuf Gaming suffered a data breach. The incident exposed 129k unique email addresses along with usernames, display names, IP addresses and password hashes.

In March 2026, the audio production tools company Sound Radix disclosed a data breach that they subsequently self-submitted to HIBP. The incident impacted 293k unique email addresses and names. Sound Radix advised that it is possible that additional data including hashed passwords may have been exposed, and that no financial or credit card information was impacted.

No content preview

Deep dive into Web Application Firewall (WAF) bypasses, from misconfiguration exploitation to crafting obfuscated payloads. We show the impact of the parsing discrepancy between how a WAF reads a request and how a backend executes it. It is not a bug, it is a feature.

These are the top threats you should know about this week.

A hacktivist group claims to have obtained sensitive data on crime tipsters and the people they reported, dating back to 1987.

The FCC announced a ban on routers made outside the US, but it could backfire. Here’s the real risk, and what you can do about it.

We talked to Khaled Mohamed on going from script kiddie to bug bounty hunter, and the moment he uncovered a flaw in Microsoft Authenticator.

Read the latest Microsoft Secure Access report for insights into why a unified identity and access strategy offers strong modern protection. The post Identity security is the new pressure point for modern cyberattacks appeared first on Microsoft Security Blog.

Threat actors abused trusted Trivy distribution channels to inject credential‑stealing malware into CI/CD pipelines worldwide. This analysis walks through the Trivy supply‑chain compromise, attacker techniques, and concrete steps security teams can take to detect and defend against similar attacks. The post Guidance for detecting, investigating, and defending against the Trivy supply chain compromise appeared first on Microsoft Security Blog.

Senior researcher Alberto Fittarelli spoke with the New York Times about the double threat of AI-produced disinformation. The post Netanyahu Posts ‘Proof of Life’ Video: AI Sows Doubts About What’s Real appeared first on The Citizen Lab.

Posted by Eric Lynch, Product Manager, Android and Dom Elliott, Group Product Manager, Google Play Modern digital security is at a turning point. We are on the threshold of using quantum computers to solve "impossible" problems in drug discovery, materials science, and energy—tasks that even the most powerful classical supercomputers cannot handle. However, the same unique ability to consider different options simultaneously also allows these machines to bypass our current digital locks. This puts the public-key cryptography we’ve relied on for decades at risk, potentially compromising everything from bank transfers to trade secrets. To secure our future, it is vital to adopt the new Post-Quantum Cryptography (PQC) standards National Institute of Standards and Technology (NIST) is urging…

Akamai Guardicore Segmentation, a Leader and Fast Mover in the 2026 GigaOm Radar for Microsegmentation report, balances innovation with platform strength.

No content preview

No content preview

The FBI and CISA join European agencies in warning of a widespread, easily scalable social engineering campaign targeting messaging apps.

Forced labor doesn’t play well on camera, so scam compounds are hiring women to deepfake their faces on video calls.

Chainalysis is proud to be a compliance partner for Solana Developer Platform (SDP), integrating Chainalysis KYT (Know Your Transaction) directly… The post Chainalysis Joins Solana Developer Platform to Bring Real-Time Compliance to Every Builder appeared first on Chainalysis.

No content preview

In around 2011, the now defunct RuneScape Boards forum (also known as RSBoards) suffered a data breach that was later redistributed as part of a larger corpus of data. The vBulletin-based service exposed 223k unique email addresses along with usernames, IP addresses and salted MD5 password hashes.

June 3, 2022: Original publication date of this post. This post has been updated to add the additional IAM policy types: Resource control policies. You manage access in AWS by creating policies and attaching them to AWS Identity and Access Management (IAM) principals (roles, users, or groups of users) or AWS resources. AWS evaluates these […]  ( 119 min )

No content preview

No content preview

Think you’re downloading from Google or Apple? 1,500+ fake app store sites look like the real thing, but push unvetted, cloned web-based casino apps.

No content preview

On March 23, Citizen Lab director Ron Deibert will appear before the House of Commons to testify on transnational repression.  The post Canadians Will Face ‘Tsunami’ of Transnational Repression in Coming Years appeared first on The Citizen Lab.

On March 22, 2026, the Resolv DeFi protocol became the latest example of how quickly things can unravel in DeFi… The post The Resolv Hack: How One Compromised Key Printed $23 Million appeared first on Chainalysis.

No content preview

📖 [The CloudSecList] Issue 330 was originally published by Marco Lancini at CloudSecList on March 22, 2026.

No content preview

No content preview

No content preview

No content preview

This blog post dives into the most common classes of macOS Local Privilege Escalation vulnerabilities, from insecure XPC communications and time-of-check to time-of-use (TOCTOU) Race Conditions to a range of implementation and configuration oversights. We will explore how attackers can exploit these weaknesses to escalate privileges, and highlight real-world examples to illustrate recurring patterns. This post ends the series on Intego products on macOS by revealing vulnerabilities that can lead to Local Privilege Escalation, as well as a surprise bonus.

The U.S. DOJ recently disrupted several large and powerful DDoS botnets and shut down their related DDoS-for-hire services with Akamai’s help.

Read about the top 10 critical threats related to Agent Skills that security teams should consider while building and evaluating agents.

Italian prosecutors have confirmed the hacking of journalist Francesco Cancellato, who was alerted of a suspected attack last year. The post Italian Prosecutors Confirm Journalist Was Hacked with Paragon Spyware appeared first on The Citizen Lab.

These are the top threats you should know about this week.

Amazon threat intelligence has identified an active Interlock ransomware campaign exploiting CVE-2026-20131, a critical vulnerability in Cisco Secure Firewall Management Center (FMC) Software that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device, which was disclosed by Cisco on March 4, 2026. After Cisco’s disclosure, Amazon threat […]  ( 113 min )

No content preview

No content preview

No content preview

In March 2026, the online safety service Aura disclosed a data breach that exposed 900k unique email addresses. The data was primarily associated with a marketing tool from a previously acquired company, with fewer than 20k active Aura customers affected. Exposed data included names, phone numbers, physical and IP addresses, and customer service notes. Aura advised that no Social Security numbers, passwords or financial information were compromised.

We’re excited to announce that Amazon Web Services (AWS) has completed its second GDV (German Insurance Association) community audit with 36 members from the Germany insurance industry participating, corresponding to over 63% coverage of the German market in terms of insurance premiums. Community audits are an efficient method to provide additional assurance to a group […]  ( 107 min )

The Citizen Lab has submitted an input on digital transnational repression to the OHCHR report on ‘Protecting Human Rights Defenders in the Digital Age’. The post Submission to the OHCHR: Protecting Human Rights Defenders in the Digital Age appeared first on The Citizen Lab.

Akamai is sponsoring Wasm IO 2026 as part of our commitment to WebAssembly. Get all the details.

No content preview

No content preview

No content preview

No content preview

I set out to build a rugged badge-cloning tool for field use, with zero hardware background. This is the story of learning electrical engineering from scratch, navigating bad assumptions, and discovering that curiosity, persistence, and hands-on testing can take you further than you think.

No content preview

No content preview

No content preview

In March 2026, the League of Legends custom skins service Divine Skins suffered a data breach. The incident was disclosed via the service's Discord server, where Divine Skins stated that an unauthorised third party accessed part of its systems, deleted all skins from the database and exposed email addresses and usernames. The data also contained a history of purchases made by users.

In March 2026, the Turkish restaurant chain Baydöner suffered a data breach which was subsequently published to a public hacking forum. The incident exposed over 1.2M unique email addresses along with names, phone numbers, cities of residence and plaintext passwords. A small number of records also included Turkish national ID number and date of birth. In their disclosure notice, Baydöner stated that payment and financial data was not affected.

📖 [The CloudSecList] Issue 329 was originally published by Marco Lancini at CloudSecList on March 15, 2026.

If your organization relies on AWS IAM Identity Center for workforce access, you can now extend that access across multiple AWS Regions with multi-Region replication. Previously, AWS access portal was only available in one Region, when you add an additional Region, users get an active access portal endpoint there. If the primary Region experiences a […]  ( 117 min )

No content preview

No content preview

CTF competitions push offensive security skills to their limits. In 2025, the Bishop Fox Mexico team claimed first place at both HackMex Finals and EkoParty Red Team Space. Discover how the team navigated web exploitation, infrastructure compromise, and AWS attack paths to win.

No content preview

No content preview

Sensor Intel Series: February 2026 CVE Trends

Senior researcher Wolfie Christl spoke with Forbes about OpenAI's deal with the Pentagon that permits the gathering of bulk data from users. The post OpenAI Blurs Its Mass Surveillance Red Line With New Pentagon Contract appeared first on The Citizen Lab.

Senior researcher and co-author of the report, Noura Aljizawi, speaks to the Fuller Project about the ways gender is weaponized to silence women.  The post The Market for Spyware is Growing: It’s Used Differently Against Women appeared first on The Citizen Lab.

Legacy security wasn't built for autonomous AI. See how Akamai partners are stepping into the ring to build trust and secure the agentic enterprise.

No content preview

As organizations scale their cloud infrastructure, maintaining proper lifecycle management of Amazon Machine Images (AMIs) is a critical component of their security and risk management goals. AMIs provide the essential information required to launch Amazon Elastic Compute Cloud (Amazon EC2) instances, however; they present security and compliance challenges if not tracked and managed throughout their […]  ( 117 min )

If you just want to read the contest rules, click here.   Willkommen zurück, meine Damen und Herren, zu unserem zweiten Wettbewerb in Berlin! That’s correct (if Google translate didn’t steer me wrong). After our inaugural competition last year, Pwn2Own returns to Berlin and OffensiveCon. Outside of our shipping troubles, we had an amazing time and can’t wait to get back. Last year, we added Artificial Intelligence as a category with great results. This year, we’re expanding this and splitting it into multiple different categories: AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products. In last year’s contest, NVIDIA targets had wins, losses, and collisions, so it will be interesting to see how they fare this year. The folks from AWS wanted to get into th…

In a blog post published last December, we demonstrated how we managed to extract the firmware from a smartwatch by exploiting an out-of-bounds read vulnerability and spying on its screen interface. Follow us on our long and unexpected journey to figure out how this smartwatch can measure heart rate or blood pressure with no visible sensor, the problems we encountered while analyzing its firmware, and how we solved them to uncover The Truth about this device.

These are the top threats you should know about this week.

No content preview

No content preview

No content preview

PageJack is a Linux kernel exploitation technique useful to generate a Use After Free (UAF) in the page allocator. In this article we provide a detailed example of how to use it to exploit a Linux kernel vulnerability from 2022.

In January 2026, we announced the general availability of the AWS European Sovereign Cloud, a new, independent cloud for Europe entirely located within the European Union (EU), and physically and logically separate from all other AWS Regions. The unique approach of the AWS European Sovereign Cloud provides the only fully featured, independently operated sovereign cloud […]  ( 109 min )

The RSAC 2026 Conference brings together thousands of professionals, practitioners, vendors, and associations to discuss issues covering the entire spectrum of cybersecurity—a place where innovation meets collaboration and the industry’s brightest minds converge to shape its future. This March, Amazon Web Services (AWS) returns to the annual RSAC Conference in San Francisco to share how […]  ( 108 min )

After talking with many customers, one thing is clear: the security challenge has not gotten easier. Enterprises today operate across a complex mix of environments, including on-premises infrastructure, private data centers, and multiple clouds, often with tools that were never designed to work together. The result is enterprise security teams spend more time managing tools […]  ( 107 min )

I am back in the friendly confines of the Mid-South headquarters of TrendAI ZDI (a.k.a. my home office), and am all set for the third patch Tuesday of 2026. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft.If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for March 2026 For March, Adobe released eight bulletins addressing 80 unique CVEs in Adobe Acrobat Reader, Commerce, Illustrator, Substance 3D Painter, Premier Pro, Experience Manager, Substance 3D Stager, and the Adobe DNG Software Development Kit (SDK). Two of these bugs were submitted through the TrendAI ZDI program. If you need to prioritize, the update for Acrobat likely has the most impac…

No content preview

Learn about the enhancements to Akamai Content Protector that stop evasive scraping across web and mobile while minimizing user friction and false positives.

No content preview

No content preview

FortiClient EMS 7.4.4 contains a pre-authentication SQL injection vulnerability (CVSS 9.1) in its multi-tenant site routing middleware. An unauthenticated attacker can inject arbitrary SQL by sending a crafted Site HTTP header to any pre-auth endpoint.

No content preview

📖 [The CloudSecList] Issue 328 was originally published by Marco Lancini at CloudSecList on March 08, 2026.

No content preview

No content preview

A Greek court sentenced four Intellexa executives to prison for their role in a 2022 scandal that involved the use of Predator spyware against more than 90 public figures in the country. Citizen Lab researchers first published evidence of Predator spyware in Greece in late 2021. The Lab later analyzed the phones of journalist Thanasis […] The post Intellexa Founder, Three Others Sentenced to 8 Years in Prison Over Greek Spyware Scandal appeared first on The Citizen Lab.

AI Security Insights – March 2026

We’re excited to announce that Amazon Web Services (AWS) has completed the annual Dubai Electronic Security Centre (DESC) certification audit to operate as a Tier 1 Cloud Service Provider (CSP) for the AWS Middle East (UAE) Region. This alignment with DESC requirements demonstrates our continued commitment to adhere to the heightened expectations for CSPs. Government […]  ( 106 min )

Amazon Web Services (AWS) successfully completed the annual recertification audit with no findings for ISO 9001:2015, 27001:2022, 27017:2015, 27018:2019, 27701:2019, 20000-1:2018, 22301:2019, and Cloud Security Alliance (CSA) STAR Cloud Controls Matrix (CCM) v4.0. The objective of the audit was to enable AWS to expand their ISO and CSA STAR certifications to include one new AWS […]  ( 106 min )

Find out how Harmonic achieved high-performance AI inference on Akamai Cloud with NVIDIA Blackwell GPUs, optimizing for speed and efficiency.

This blogpost explains how we bypassed the 16-byte password protection of the debug on several variants of the RH850 family using voltage fault injection.

On March 10, Citizen Lab senior researcher Noura Aljizawi will participate in an OSCE panel titled “From Harm to Justice: Ending Violence Against Women in the Public Sphere in the OSCE Region.”  Women who stand at the forefront of efforts to advance gender equality often face severe backlash for their public engagement, impacting individual rights […] The post From Harm to Justice: Ending Violence Against Women in the Public Sphere in the OSCE Region appeared first on The Citizen Lab.

No content preview

To help you troubleshoot access denied errors, we recently added the Amazon Resource Name (ARN) of the denying policy to access denied error messages. This builds on our 2021 enhancement that added the type of the policy denying the access to access denied error messages. The ARN of the denying policy is only provided in […]  ( 107 min )