Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
Advanced persistent threats don’t discriminate by organization size — they discriminate by defense capability. Nation-state actors and their proxies invest months conducting reconnaissance, moving laterally through networks with surgical patience, and exfiltrating data long before any alert fires....
Two vulnerabilities in Progress ShareFile, an enterprise-grade secure file transfer solution, can be chained to enable unauthenticated file exfiltration from affected environments. [...]
iOS/iPadOS 18.7.7 updates expanded to protect older devices from DarkSword web exploit kit
Stryker Corporation, one of the world's leading medical technology companies, says it's fully operational three weeks after many of its systems were wiped out in a cyberattack claimed by the Iranian-linked Handala hacktivist group. [...]
Hasbro takes some systems offline after cybersecurity incident Hasbro disclosed that it detected unauthorized access on March 28 and responded by taking some systems offline, with the disruption affecting parts of its ability to ship products and process orders. The company said the investigation is...
An episode of the Talos Threat Perspective on the 2025 Year in Review trends. We explore how identity is being used to gain, extend, and maintain access inside environments.Â
Red Hat has announced Red Hat Enterprise Linux Extended Life Cycle Premium, a new subscription that provides a predictable 14-year life cycle for major Red Hat Enterprise Linux releases. This stand-alone subscription consolidates extended support, simplifying the management of multiple support strea...
We recently announced support for Passkeys on your Report URI account, and everyone should go and enable Passkeys for the amazing security benefits they offer. As a new implementation of an authentication technology, we wanted to be sure that everything was as secure as it should be for our customer...
Identity attacks are rising as trust expands — learn how to detect misuse, close gaps, and defend beyond authentication.
The explosion of AI-bot traffic, representing over 10 billion requests per week, has opened up new challenges and opportunities for cache design. We look at some of the ways AI bot traffic differs from humans, how this impacts CDN cache, and some early ideas for how Cloudflare is designing systems t...
We commissioned a third-party audit for the infrastructure behind our VPNs. Here are the results.
LNK files use GitHub C2, embedded decoders and PowerShell for persistence and data exfiltration
Halcyon says Akira is now capable of carrying out an entire ransomware attack in less than an hour
The latest ThreatsDay Bulletin is basically a cheat sheet for everything breaking on the internet right now. No corporate fluff or boring lectures here, just a quick and honest look at the messy reality of keeping systems safe this week.
Things are moving fast. The list includes researchers chaining...
A new phishing-as-a-service (PhaaS) campaign is abusing Microsoft’s device code authentication flow to gain unauthorized access to user accounts.
Sekoia researchers first spotted the toolkit “EvilTokens” that lets attackers capture authentication tokens by tricking users in...
The bugs could lead to authentication bypass, remote code execution, information disclosure, and privilege escalation.
The post Cisco Patches Critical and High-Severity Vulnerabilities appeared first on SecurityWeek.
Phishing attacks remain one of the most common, and most successful, cyber threats targeting K–12 schools. As districts continue to rely on Google Workspace for communication, collaboration, and file sharing, it has become a prime entry point for attackers looking to exploit human error and gain acc...
As March 2026 comes to a close, the newest AWS permissions reflect expansion across three distinct domains: customer engagement, AI-driven DevOps automation, and core database infrastructure. The volume is modest, but the risk profile is not. The central theme for March is “Silent Degradation.” Each...
Cellebrite’s Guardian Investigate helps investigators work with AI to resolve cases faster across departments and agencies.