Eclypsium has launched InfraTrust, a new infrastructure cybersecurity knowledge base and monthly InfraTrust Pulse report designed to help organizations prioritize vulnerabilities affecting infrastructure, firmware, networking, and edge devices. [...]
The cycle is over. For years, cybersecurity followed a familiar pattern: defenses improved, attackers adapted, and the back-and-forth continued. Today, AI-equipped attackers are simply outpacing defenses. Most intrusions now bypass endpoint and malware-based detection entirely. …
Microsoft has reminded customers that it will stop shipping security updates for Exchange 2016 and 2019 through the Extended Security Update (ESU) program in October. [...]
Pesquisadores publicaram correções não oficiais e gratuitas para uma falha de dia zero no Windows, chamada de LegacyHive, que permite que atacantes não administradores elevem privilégios e executem código automaticamente em sistemas atualizados. A vulnerabilidade, que ainda não r…
Protected in Name Only: HIPAA’s Health Data Gap Is Becoming a National Security Risk Foundation for Defense of Democracies
AI-generated code introduces 15 vulnerabilities on average per codebase, but the actual risk depends on framework pairing more than the model used.
Every patch is a confession. The moment a vendor ships a security fix, the diff between the old code and the new code tells anyone watching exactly what was broken and where. Turn that diff back into a working exploit, and you can hit every system that hasn't updated yet. This i…
Microsoft has shared manual mitigations to help IT administrators fix Windows Server Update Services (WSUS) servers affected by a known issue that causes Windows Update scans to fail or time out. [...]
Um hacker invadiu a Agência Nacional de Cadastro e de Publicidade Imobiliária da Romênia (ANCPI) e apagou todo o banco de dados do registro de terras do país, depois de fracassar numa tentativa de extorsão, conforme informações divulgadas pelo jornalista Catalin Cimpanu em sua ne…
Marc Maiffret reflects on Code Red's legacy and the security lessons helping organizations navigate AI risk today.
Governments look at banning ransom payments in face of increasingly sophisticated threats.
Uma vulnerabilidade chamada HollowByte pode permitir ataques de negação de serviço contra servidores que usam versões não corrigidas do OpenSSL. A falha pode ser acionada por uma requisição TLS maliciosa de apenas 11 bytes. O problema não recebeu CVE nem alerta formal do projeto …
The industry spent the initial months after Anthropic's April 7 Mythos reveal focused on volume. How many new CVEs would Mythos add to an already overloaded pipeline? How quickly would the flood of AI-driven discovery overwhelm triage capabilities? How long would it take adversar…
The supply of the circuit boards needed to fix the devices is significantly constrained, preventing the company from immediately correcting all affected ventilators.
Microsoft is working to fix a known issue affecting Windows Server Update Services (WSUS) servers, which has caused synchronization problems for more than a week. [...]
Microsoft has released emergency updates to fix a known issue causing some Dell PCs to shut down after installing the July 2026 Windows 11 security updates. [...]
An anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable. Every 6.9 and 7.0 site was in range until Friday, when WordPress shipped 6.9.5 and 7.0.2 and enabled what it calls forced updates through its auto-…
Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, while also investigating a separate claim that attackers breached its LabCentral portal and…
Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On the glibc systems Okta tested, that memory is gone until the process restarts. OpenSSL shipped the HollowByte fix in June with no CVE, no advisory, and no cha…
Ernst & Young is notifying customers of a data breach caused by the compromise of a third-party support ticket system used by its IT personnel. [...]
