A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager.
"The first stage drops a stegan...
Do you hold cryptocurrency? Have you received a letter telling you that you must register with a so-called "Digital Asset Compliance Portal"?
If so, it's time to hit the brakes, because it sounds like someone is trying to scam you.
Read more in my article on the Hot for Security blog.
More than 30 Minnesota community water systems were hit by coordinated cyber activity against their operational technology on July 26 and 27; several lost remote control or deliberately cut it while operators contained the intrusion. The reporting since — including CSO’s own n...
The UK’s Police National Legal Database and Ask the Police service have been breached
An extortion group stole personal, financial, and medical information from the hospital’s network.
The post 150,000 Impacted by Madera Community Hospital Data Breach appeared first on SecurityWeek.
Microsoft is reducing the lifetime of new NuGet.org API keys from 365 days to 30 days starting August 17, 2026, to improve the security of NuGet, its package repository for .NET developers. API keys created before August 17 will remain valid until November 1, after which developers will need to gene...
AI agents are increasingly being deployed across the enterprise, a rapid adoption that has significantly broadened the organization’s attack surface, turning sharable AI agent resources and configuration files into backdoors, security experts warn.
AI-assisted software deve...
Un attaquant non authentifié peut détourner un compte sur WAPT Server via un simple paquet forgé. Ce qu'il faut savoir sur la faille CVE-2026-33591.
Le post WAPT Server (CVE-2026-33591) : une faille permet de contourner l’authentification a été publié sur IT-Connect.
Cyberattack exposed data of 31,000 people in Liechtenstein’s beneficial ownership register for companies and foundations. A cyberattack compromised data belonging to about 31,000 people in Liechtenstein’s register of beneficial owners linked to companies, foundations, and trusts. Liechtenstein’s Reg...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild.
The vulnerability, tracked as CVE-2026-18577 (CVSS sco...
Pipeleek 1.0 is here. What started as a GitLab pipeline secret scanner now covers seven CI/CD platforms and comes with helpers for runner exploitation, Renovate bot abuse, and lateral movement across repositories. This post walks through what is new, shows two real-world findings from the Tor Projec...
Europe’s fight to regulate AI models moved from paper to practice on 2 August 2026, when the European Commission’s AI Office and national authorities began enforcing the AI Act. On the same date, new transparency rules took effect, requiring certain AI systems to tell users when they’re interacting...
Scammers are trying to take over WhatsApp accounts by sending messages asking people to vote for a friend in a fake online contest.
In this interview with Help Net Security, Brian Hill, Field CISO, Client Advisory for BlackCloak, explains how attackers reach companies through the personal lives of executives. He describes a case where a draft report sat in an executive’s personal email with no multifactor authentication, and tra...
An attacker who talks a user into opening an attachment gets whatever that machine still permits: a service account with rights across the domain, an outbound route to anywhere, a scripting engine sitting there for the taking. Christopher Frenz wants those capabilities deleted before anyone writes a...
The biggest single reward paid out by Microsoft between July 1, 2025, and June 30, 2026, was $200,000.
The post Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers appeared first on SecurityWeek.
An analyst opening a queue on Monday morning will spend most of it on tickets that amount to nothing. Stellar Cyber’s Agentic Auto Triage closed 8,047 of those tickets on its own during customer trials, filing them as confident false positives. That covers 64% of every verdict the software issued. A...
Automates bug bounty triage with Sonnet for $58 a month, CSO says Mythos would cost $200k
Scammers are sending physical letters to cryptocurrency holders that copy the look of official IRS notices. The letters tell recipients they must enroll in something called a Digital Asset Compliance Portal before a deadline, or risk penalties. “If you receive a letter claiming to be from the IRS th...