A malicious email delivered a .cmd malware that escalates privileges, bypasses antivirus, downloads payloads, sets persistence, and self-deletes. I received this email from a friend to make an analysis. First, let me express my thanks to Janô Falkowski Burkard for…
Category: EN
Why DDoS Mitigation Fails: 5 Gaps That Testing Reveals
Companies invest heavily in DDoS mitigation, yet outages still happen—often at the worst possible moment. The problem is rarely the protection technology, but the unseen gaps between deployment and a real attack, where misconfigurations, false assumptions, and untested scenarios quietly…
Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Financial groups lay out a plan to fight AI identity attacks Generative AI tools have brought the cost of deepfake production low enough that criminals…
Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS
Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-35616 (CVSS score: 9.1), has been described as a pre-authentication API access bypass leading to privilege escalation.…
36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants
Cybersecurity researchers have discovered 36 malicious packages in the npm registry that are disguised as Strapi CMS plugins but come with different payloads to facilitate Redis and PostgreSQL exploitation, deploy reverse shells, harvest credentials, and drop a persistent implant. “Every package…
Truckloads of food are being wasted because computers won’t approve them
Modern food systems may look stable on the surface, but they are increasingly dependent on digital systems that can quietly become a major point of failure. Today, food must be “recognized” by databases and automated platforms to be transported, sold,…
How do NHIs drive technology innovation
How Are NHIs Revolutionizing Technology Across Industries? What are the unseen forces revolutionizing technological? Non-Human Identities (NHIs) are among the top contenders, silently working behind the scenes to safeguard digital environments. NHIs drive technology innovation by providing security professionals with…
How scalable is Agentic AI for growing businesses
Is Your Organization Prepared to Manage Non-Human Identities Effectively? The rapid surge in digital transformation has fundamentally shifted how organizations across industries operate. When businesses embrace digital innovations, they also face a complex challenge: managing Non-Human Identities (NHIs). These machine…
Why choosing Agentic AI empowers business leaders
How Can Non-Human Identities Enhance Your Cloud Security? How are organizations safeguarding their systems from the increasing threats posed by cyberattacks? A critical factor is the effective management of Non-Human Identities (NHIs) and Secrets Security. With cybersecurity professionals navigate the…
Introducing the Landing Zone Accelerator on AWS Universal Configuration and LZA Compliance Workbook
November 20, 2025: Date this information was first published. We’re pleased to announce the availability of the latest sample security baseline from Landing Zone Accelerator on AWS (LZA)—the Universal Configuration. Developed from years of field experience with highly regulated customers…
Sample Malware Phone Back C&C (Command and Control) MD5s From Domains Belonging to XSS Forum Users – A Compilation
Dear blog readers, In my most recent analysis I decided to take a deeper look inside some of the domains which belong to members of the XSS forum are known to have been used as malicious software phone back C&C…
Qilin ransomware group claims the hack of German political party Die Linke
Qilin ransomware claims it stole data from Germany’s Die Linke and threatens to leak it; the party confirmed the incident, but not a breach. The Qilin ransomware group claims it stole data from Die Linke, a German political party, and…
US Lawmakers Question VPN Surveillance, Seek Transparency on Privacy Risks
Now under scrutiny: demands from American legislators for clearer rules on state tracking of online tools like virtual private networks. Backed by six congressional Democrats – including Ron Wyden – a letter reaches out to intelligence chief Tulsi Gabbard,…
Why Single-Signal Fraud Detection Fails Against Modern Multi-Stage Cyber Attacks
A Modern fraud operations resemble a coordinated relay, where multiple tools and actors manage different stages—from account creation to final cash-out. Focusing on just one indicator, such as IP address or email, leaves gaps that attackers can easily exploit…
China-based TA416 Targets European Businesses via Phishing Campaigns
Chinese state-sponsored attacks A China-based hacker is targeting European government and diplomatic entities; the attack started in mid-2025, after a two-year period of no targeting in the region. The campaign has been linked to TA416; the activities coincide with DarkPeony,…
U.S. CISA adds a flaw in TrueConf Client to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in TrueConf Client to its Known Exploited Vulnerabilities catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in TrueConf Client, tracked as CVE-2026-3502 (CVSS score of 7.8), to…
UNC1069 Targets Node.js Maintainers via Fake LinkedIn, Slack Profiles
North Korean group UNC1069 targets Node.js maintainers using fake LinkedIn and Slack profiles to spread malware and compromise open source packages. This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and More Read the original article:…
[un]prompted 2026 – Security Guidance as a Service
Author, Creator & Presenter: Shruti Datta Gupta, Product Security Engineer, Adobe & Chandrani Mukherjee, Product Security Engineer, Adobe Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations’) YouTube…
Microsoft Identifies Cookie Driven PHP Web Shells Maintaining Access on Linux Servers
Server-side intrusions are experiencing a subtle but consequential shift in their anatomy, where visibility is no longer obscured by complexity, but rather clearly visible. Based on recent findings from Microsoft Defender’s Security Research Team, there is evidence of a…
FortiClient EMS zero-day exploited, emergency hotfixes available (CVE-2026-35616)
Defused Cyber has spotted a critical Fortinet FortiClient Endpoint Management Server (EMS) zero-day vulnerability (CVE-2026-35616) being exploited in the wild. This time around, the confirmation of active exploitation came almost immediately from Fortinet, as well. “Fortinet has observed [CVE-2026-35616] to…