Kratos, a subscription-based phishing-as-a-service platform, is targeting Microsoft 365 users in the United States, Europe, and other regions through campaigns designed to blend into ordinary document-sharing workflows. The operation abuses trusted services, including Microsoft SharePoint, OneDrive, Microsoft Forms, Canva, Tilda,…
F5 Fixes 3 NGINX Flaws Enabling Potential Remote Code Execution, Memory Disclosure, and DoS Attacks
F5 has issued security advisories for three vulnerabilities affecting NGINX Plus and NGINX Open Source. These flaws could allow unauthenticated attackers to trigger crashes in worker processes, disclose limited memory contents, or potentially execute code under specific conditions. The vulnerabilities,…
Law firm insisted on one password to rule them all
Using the admin password, you could be anyone and see anything This article has been indexed from www.theregister.com – Articles Read the original article: Law firm insisted on one password to rule them all
Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day
The researcher stripped the proof-of-concept (PoC) exploit to prevent immediate exploitation of the vulnerability. The post Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original article: Nightmare Eclipse Drops…
UK AI Investment Reaches £4.56bn In Second Quarter
Fundraising by UK AI firms nearly triples over same period last year, as it takes more than half of total UK equity investment This article has been indexed from Silicon UK Read the original article: UK AI Investment Reaches £4.56bn…
UK Proposes Social Media Curfew For Older Teens
Proposed measures would see teens aged 16 and 17 have default overnight social media curfew, with autoplay, infinite scroll also targeted This article has been indexed from Silicon UK Read the original article: UK Proposes Social Media Curfew For Older…
Hackers Use Google Ads and Claude AI Chats to Steal macOS Credentials and Crypto Wallets
Threat actors have exploited Google Ads and Anthropic’s Claude shared-chat feature to distribute the MacSync Stealer to macOS users. They used a social engineering technique called ClickFix, designed to steal credentials, browser data, cloud keys, sensitive files, and cryptocurrency wallets.…
LLM-Assisted TuxBot Botnet Targets IoT Devices Across 17 Processor Architectures
TuxBot v3 Evolution, a modular IoT botnet framework capable of infecting devices running architectures ranging from ARM and MIPS to x86_64, PowerPC and RISC-V. The platform appears designed for mass compromise, persistence and distributed denial-of-service operations, with a C-based bot…
GPT-5.6 Sol Ultra Writes Complete Chrome Exploit With V8 Sandbox Escape
A security researcher reported that the GPT-5.6 Sol Ultra model successfully produced a working renderer exploit for Chrome version 149.0.7827.201. This exploit utilized V8 version 14.9.207.35. The model reportedly combined multiple patched issues in the JavaScript engine and WebAssembly infrastructure,…
What is a SIEM? How it Works, Use Cases, and Top Tools (2026)
By HOC Team | Last updated: July 2026 | Read time: ~22 min On 14 December 2020, FireEye announced… The post What is a SIEM? How it Works, Use Cases, and Top Tools (2026) appeared first on Hackers Online Club. This…
Tech support scam caused massive data breach at Australian airline Qantas
It’s possible to leak PII describing 5.7 million people without breaching privacy rules This article has been indexed from www.theregister.com – Articles Read the original article: Tech support scam caused massive data breach at Australian airline Qantas
Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities
The cybersecurity companies patched critical and high-severity vulnerabilities in some of their products. The post Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original article:…
Reading between the lines of a cyber insurance policy
Enterprises in regulated industries often carry cyber insurance policies because contracts require it or boards ask for documented risk transfer. The global market for these policies reached about $16 billion in premiums in 2024. Coverage has become widespread. Payouts have…
What public money does to open-source projects
Most of the software running inside a typical company was written by volunteers the company never paid. Open-source code sits under web apps, build pipelines, and the machine learning stacks getting so much attention right now. Roughly 96 percent of…
China-Linked Daxin Backdoor Resurfaces in Taiwan Alongside New STUPIG SYSTEM-Level Malware
The China-linked Daxin backdoor has resurfaced in an active intrusion targeting a Taiwan-based subsidiary of a multinational high-tech manufacturer, exposing the enduring reach of an espionage operation first publicly detailed in 2022. Daxin’s return is significant because the malware was…
Cursor 0-Day Flaw Executes Malicious git.exe From Repositories Without User Interaction
Cursor users on Windows may be at risk of arbitrary code execution following Mindgard’s disclosure of a zero-day vulnerability. This flaw allows the AI-powered integrated development environment (IDE) to automatically execute a malicious git.exe file located at the root of…
Ransom demands are down, email is the top way attackers get in
An employee opens an email that looks like any other, clicks a link, and gives up a password without noticing. A stolen login opens a door deeper in the network. Files stop opening a few days later. That chain now…
Quantum breakthrough links light and magnetism in atomically thin materials
A new review highlights exciting progress in atomically thin quantum materials where light and magnetism work together in ways never before possible. In these materials, light-generated excitons can interact directly with magnetic behavior, creating opportunities to control magnetic states using…
Companies keep getting breached by vulnerabilities they already knew about
Scanning tools have gotten good at their work. Organizations now find more weaknesses across more of their systems than at any earlier point in the industry’s history. A survey from the security firm Vicarius points to a gap that opens…
IT Security News Hourly Summary 2026-07-16 06h : 4 posts
4 posts were published in the last hour 4:4 : F5 Patches Multiple NGINX Vulnerabilities Enabling Heap Buffer Overflow and Code Execution Attacks 4:4 : Finance phishing works because it sounds boringly normal 4:4 : GPT-Red beat human red teamers…
F5 Patches Multiple NGINX Vulnerabilities Enabling Heap Buffer Overflow and Code Execution Attacks
F5 has disclosed three high-severity vulnerabilities affecting NGINX Plus and NGINX Open Source, warning that unauthenticated attackers could exploit them to trigger memory corruption, crash worker processes, or, in the worst case, execute arbitrary code. The vulnerabilities, published on July…
Finance phishing works because it sounds boringly normal
Finance departments process a constant stream of invoices, contracts, payment notices, and procurement emails, making email one of the most common initial access vectors for threat actors. According to Cofense, attackers exploit those workflows with phishing emails that resemble legitimate…
GPT-Red beat human red teamers on a prompt injection test
GPT-Red is an automated red-teaming model that OpenAI trains to find prompt injection weaknesses. It works the way a human red-teamer does. It sends a prompt, watches how a GPT model responds, and iterates toward a goal such as a…
ISC Stormcast For Thursday, July 16th, 2026 https://isc.sans.edu/podcastdetail/10010, (Thu, Jul 16th)
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Thursday, July 16th, 2026…