Browsing Category
Security
162 posts
Cybersecurity news, software supply chain risk, privacy threats, and practical security guidance.
EvilTokens Disruption Exposes the Device-Code Phishing Gap
Microsoft and partners disrupted EvilTokens after more than 12,000 inbox compromises. Here is how device-code phishing bypasses normal expectations and what Microsoft 365 teams should change now.
Check Point Zero-Day Puts Firewall Management Servers on a Three-Day Patch Clock
Check Point patched an exploited management-server zero-day and confirmed Spark VPN attacks. Here are the fixed hotfix takes, hunt commands, and September 25 deadline.
Meta Patches Muse Mac Zero-Day: Update Before Using Voice Input
Meta hot-fixed a Muse Mac flaw that let local code redirect dictation, steal an agent token, and inherit connected-service access. Here is how it worked and what users should check now.
Palo Alto Launches Always-On AI Pentesting With Mythos 5 and GPT-5.6-Cyber
Palo Alto Networks' Unit 42 now uses Mythos 5, GPT-5.6-Cyber, and open models for continuous attack-path testing. Its own results show why buyers should judge the harness, controls, and remediation workflow, not just the models.
IDScan Breach Shows Why Scanned IDs Need an Expiration Date
IDScan confirmed unauthorized access to customer identity data after a dark-web service advertised more than 153 million driver’s-license records. The breach exposes a larger problem: ID-scanning systems can keep sensitive documents long after the check is finished.
Cisco Email Gateway Zero-Day Turns Mail Security Into Incident Triage
Cisco has patched CVE-2026-76461, an actively exploited Secure Email Gateway SQL injection flaw that can let unauthenticated attackers run commands as root. Because CISA added it to the KEV catalog with a September 17 deadline, admins should treat patching as the start of incident triage, not the end.
Homebrew 7.0.0 Turns Mac Package Installs Into a Security Check
Homebrew 7.0.0 adds built-in vulnerability checks, a native BrewUI Mac app, stronger sandboxing, and several migration deadlines. For developers and Mac admins, the release turns package management into a security and inventory task.
EU Cyber Resilience Act Puts Product Security Teams on a 24-Hour Clock
The EU Cyber Resilience Act’s vulnerability-reporting duties start September 11, forcing makers of connected devices and commercial software to report actively exploited flaws quickly. Product teams should treat the deadline as an operational change, not a paperwork exercise.
Adobe Commerce Zero-Day Turns Online Stores Into Backdoor Targets
Adobe has issued an emergency hotfix for CVE-2026-75650, a critical Adobe Commerce and Magento Open Source flaw already exploited in the wild. Merchants should patch, confirm the hotfix, inspect for backdoors, and rotate more than the Magento encryption key.
Langflow Attacks Turn AI Workflow Servers Into Credential Targets
Attackers are actively exploiting Langflow flaws to pull OpenAI keys, AWS secrets, environment variables, and Langflow superuser credentials from exposed AI workflow servers. Teams running Langflow should treat patching as only the first step: credential rotation, log review, and network isolation matter just as much.