Fortinet has disclosed a high-severity vulnerability in FortiSandbox that could allow unauthenticated attackers to access the VNC servers of virtual machines used for malware scanning. Tracked as CVE-2026-59835, the flaw is classified as an Exposure of Resource to Wrong Sphere…
Claude for Chrome Vulnerability Lets Attackers Read Gmail, Docs, and Calendar Data
Anthropic’s Claude for Chrome browser extension has two unpatched flaws that allow attackers to read a victim’s Gmail, Google Docs, and Calendar data using just six lines of JavaScript, even after eight subsequent releases. Manifold researchers first reported the issues…
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak: I’m speaking (virtually) at the Policy-Relevant Privacy Research Workshop in Calgary, Canada, on Monday, July 20, 2026. I’m speaking at Boston Leadership Exchange in Boston, Massachusetts,…
Welsh Doxbin admin jailed for egging on swatters from behind a screen
Callum Dare encouraged others to carry out dangerous hoaxes, made mini-movies from the footage This article has been indexed from www.theregister.com – Articles Read the original article: Welsh Doxbin admin jailed for egging on swatters from behind a screen
Iran abused mobile networks’ vulnerabilities to locate US military in the Middle East, report says
The Iranian government exploited well-known flaws in cellphone networks to locate and then strike U.S. military personnel in the build-up and beginning of the war. This article has been indexed from Security News | TechCrunch Read the original article: Iran…
Healthcare sector faces persistent challenges with supply-chain security, identity management
A new report says doctors and nurses should train for cyberattacks the way firefighters train for major blazes — even if they expect them to be rare. This article has been indexed from Cybersecurity Dive – Latest News Read the…
Sharp rise in AI adoption for cyber defense exposes major governance gap
A report by the SANS Institute indicates a split between senior security leaders and frontline practitioners. This article has been indexed from Cybersecurity Dive – Latest News Read the original article: Sharp rise in AI adoption for cyber defense exposes…
IT Security News Hourly Summary 2026-07-14 18h : 8 posts
8 posts were published in the last hour 15:33 : Iran abused mobile networks’ vulnerabilities to locate U.S. military in the Middle East, report says 15:33 : 11-Year-Old Linux UEFI Shim Bootloaders Let Attackers Bypass Secure Boot 15:33 : One…
Iran abused mobile networks’ vulnerabilities to locate U.S. military in the Middle East, report says
The Iranian government exploited well-known flaws in cellphone networks to locate and then strike U.S. military personnel in the build-up and beginning of the war. This article has been indexed from Security News | TechCrunch Read the original article: Iran…
11-Year-Old Linux UEFI Shim Bootloaders Let Attackers Bypass Secure Boot
11-year-old Microsoft-signed UEFI shim bootloaders, some dating back over a decade, let attackers completely bypass UEFI Secure Boot on nearly any UEFI-based machine, regardless of the installed operating system. ESET researchers uncovered that the vulnerable shims, all at version 0.9 or…
One Malicious OAuth Approval Can Give Hackers Persistent Access to Salesforce Data
One mistaken approval inside Salesforce can hand attackers a quiet, durable route into a company’s most sensitive customer records. Recent campaigns tied to tradecraft associated with ShinyHunters show how a trusted application connection, rather than a software flaw, can be…
xAI Grok Build CLI Uploaded Entire Git Repositories and Unredacted .env Secrets to Cloud Storage
A wire-level analysis of xAI’s Grok Build CLI revealed that version 0.2.93 transmitted unredacted file contents, including secrets from .env files, and uploaded full Git repositories along with their commit history to cloud storage These findings are based on traffic…
Turkish Banks Targeted by 8,400 Phishing Domains and 6,600 Social Media Scam Ads
Turkey’s banking customers are facing a large fraud campaign built around fake websites and social media advertisements. Criminals are abusing trusted financial brands to draw people into credential theft, fake loan offers, and other scams designed to steal money quickly.…
Maximizing SOC Efficiency: How to Eliminate Alert Overload and Cut MTTR by 21 Minutes Per Case
Security Operations Centers (SOCs) face overwhelming challenges not due to a lack of alerts but because each alert requires a new investigation. Analysts must validate indicators, identify malicious behavior, assess the scope of threats, and determine whether to contain or…
US: Pentagon Suspends CMMC Phase II Requirements for Defense Contractors
The US Department of Defense announced the immediate suspension of the CMMC Phase II requirements until further review This article has been indexed from www.infosecurity-magazine.com Read the original article: US: Pentagon Suspends CMMC Phase II Requirements for Defense Contractors
Authenticate legitimate AI agent traffic with AWS WAF Bot Control
As AI agents and automated tools increasingly access web applications, distinguishing legitimate bot traffic from malicious attempts has become a critical security challenge. Traditional approaches such as IP-based filtering and reverse DNS lookups fail in multi-tenant systems (such as Amazon…
Telegram’s shortlink domain is back online after day-long suspension
Telegram CEO Pavel Durov confirmed an outage in a tweet, saying that short-links to the messaging app had “stopped working.” This article has been indexed from Security News | TechCrunch Read the original article: Telegram’s shortlink domain is back online…
Q2 2026 Cyber Attacks Statistics Infographic
Last Updated on July 14, 2026 Cyber Attacks Statistics — Q2 2026 Q2 Threat Intelligence Briefing Cyber AttacksQ2 2026 543 confirmed incidents between 1 April and 30 June 2026. Financially motivated Cyber Crime drove over 7 in 10 attacks, Malware…
Q2 2026 Cyber Attacks Statistics
Q2 2026 brought 578 recorded cyber incidents worldwide, with financially-motivated cyber crime accounting for over 71% of the total. Malware remained the attacker’s weapon of choice, exploiting public-facing applications as the leading entry point. Information & Communication stood out as…
UK Warns Parents: Limit Online Sharing of Kids’ Photos Amid AI Abuse Risks
UK authorities have issued urgent warnings to parents about sharing children’s photos online, as AI tools increasingly enable digital abuse and exploitation. The National Crime Agency (NCA) and the Internet Watch Foundation (IWF) say that ordinary images of kids…
Anthropic Delays Claude Fable 5 Usage Credit Requirement Until July 19
A number of Anthropic’s flagship AI model, Claude Fable 5, has been extended to eligible paid subscribers until July 19, 2026 for free access. This extension provides customers with another week of access while the company continues to expand…
RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata
Cybersecurity researchers have disclosed details of two access control-related flaws impacting the RabbitMQ message broker service that could allow attackers to leak OAuth client secrets, expose enterprise messaging infrastructure to takeover risks, and bypass tenant boundaries. Miggo’s security team, which…
Cyber Briefing: 2026.07.14
Jscrambler npm compromise, critical SAP memory bugs, and a paralyzing malware attack on Japan’s leading taxi firm This article has been indexed from CyberMaterial Read the original article: Cyber Briefing: 2026.07.14
Miasma Worm Returns as RAT-First npm Attack With Automatic Propagation Disabled
Four AsyncAPI packages previously affected by the Shai-Hulud: The Second Coming campaign have been compromised again, with new malicious releases delivering a RAT-focused build of the Miasma worm. The impacted versions are @asyncapi/generator 3.3.13.3.13.3.1, @asyncapi/generator-components 0.7.10.7.10.7.1, @asyncapi/generator-helpers 1.1.11.1.11.1.1, and @asyncapi/specs…