⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Snowflake is ending password authentication for legacy service accounts, forcing organizations to migrate them to passwordless methods. Token Security explains why the harder challenge is identifying what uses each account, who owns it, and how much access it still needs.
NovaCookies campaigns are abusing genuine DocuSign notifications to steal Microsoft 365 credentials through sophisticated phishing lures. The attackers use legitimate DocuSign emails to bypass security filters and trick victims into revealing their login credentials.
Ubiquiti has released security patches for three new maximum-severity vulnerabilities that threat actors can exploit remotely without privileges.
The CISA Red Team successfully compromised two critical infrastructure organizations, demonstrating that even one organization exposed to the internet can serve as a gateway to disrupt operations across multiple entities. The exercise highlighted the importance of defense-in-depth and proper network segmentation.
A joint Tenable -SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. It is the shared attack surface where state-sponsored threat actors and financially motivated criminal groups independently converge — not the province of a single adversary category, and not exclusively a nation-state problem, despite two years of headlines about China-nexus actors targeting Ivanti, Fortinet, and Palo Alto Networks.
Microsoft has begun testing new privacy controls that will let Windows 11 users choose which desktop applications can access their camera, microphone, and precise location.