Security researchers at ADEX have documented a cloaking technique that requires no cloaking code at all. Instead of running user-agent detection on…
When Everyday Habits Become an Invisible Security Risk
By James Mackay, CEO, MetaCompliance When security teams think about their organisation’s attack surface, they’re usually focused on technology. Where…
Cisco Warns of Critical ISE 0-Day Vulnerability Exploited in Attacks
Cisco has issued an urgent security advisory for a critical zero-day vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity…
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution
Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the…
APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks
APT36, a Pakistan-linked threat group, has launched a campaign that uses infected removable drives to carry malware into disconnected government…
Python For Cybersecurity: Write Your First Security Tools And Scripts
By HOC Team | Updated: August 2026 Read time: ~28 min Python is the unofficial language of…
One Compromised Kubernetes Node Can Expose Every Workload Identity Running on It
A Kubernetes node becomes an identity breach point when an attacker gains root access. Research shows a hostile process can impersonate other workloads…
Aldi Responds To Complaint With AI Prompt
Aldi mistakenly sends AI prompt to customer after complaint about defective dip, in ‘disappointing’ gaffe
Critical Docker Sandbox Vulnerabilities Enable Malicious Guests to Escape Isolated microVM Workspaces
Docker patched two serious vulnerabilities in Docker Sandboxes that could let a malicious guest workload break out of its intended shared workspace and…
The latest AI doomsayer is China’s intelligence boss
Beijing’s response is to ‘firmly grasp technological sovereignty’ and broad regulations
U.S. Seizes NightmareStresser Domains Linked to Hundreds of Thousands of DDoS Attacks
The U.S. Department of Justice (DoJ) on Tuesday announced the court-authorized seizure of internet domains associated with a distributed denial-of-service…
Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM
A previously undocumented HEAVYGRAM and CRUDEEXCLUDE malware samples linked with moderate confidence to the Iran-aligned Handala Hack operation. The…
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The…
Revolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M Ransom
Revolut allegedly fed customer information to hackers impersonating an Italian government agency for five months.
Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be…
CISA Urges Critical Infrastructure to Plant Decoys Inside Networks
CISA released guidance on using cyber decoys to detect & disrupt malicious activity inside networks
BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its…
North Korean IT Workers Use AI and Remote Desktop Tools to Fake Technical Interviews
North Korean operators are using artificial intelligence, remote-control software, and hired stand-ins to make fraudulent job candidates look genuine…
OpenAI Reveals Six Model Incidents Involving Hidden Failures and Unauthorized Uploads
OpenAI on Wednesday disclosed six new instances of “unexpected or concerning model behavior” that took place over the past six months, while sharing a new…
FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor
FamousSparrow has introduced a new backdoor called SparroWocky after breaking into public-facing Microsoft Exchange servers. The campaign shows how a…
CISO’s Expert Guide to Agentic Pentesting for Websites
Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one…
Hacked Thai College Website Abused to Redirect Google Searchers to Illegal Online Casino
A compromised Thai college website was quietly turned into a springboard for an illegal online casino, according to new findings from anti-fraud platform…
Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records
A security breach at Gyazo, Helpfeel’s image-sharing service, exposed about 23.62 million user records, including email addresses and password hashes, the…
SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia
SilkParasite is a cyberespionage operation aimed at government, energy and telecommunications interests in Central Asia. New infrastructure analysis…