Researchers found Chinese and Russian SDKs in Android apps marketed to U.S. military users, highlighting software supply chain and enterprise privacy risks. The post Third-Party SDKs Raise Privacy Questions for Apps Marketed to U.S. Military appeared first on TechRepublic. This…
Tag: EN
Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass
Device code phishing abuses a legitimate authentication feature designed for devices with limited input capabilities. This article breaks down how the technique works, examines a recent observed case, and outlines the layered security measures organizations can implement. This article has…
How OpenAI’s human mistake led to the AI-powered hack on Hugging Face
OpenAI made a mistake setting up what it called a “highly isolated” testing environment and sandbox. According to cybersecurity experts, that human mistake is what made the AI-powered attack on Hugging Face possible. This article has been indexed from Security…
Refresh Token Rotation in Node.js: Stopping Token Theft Without Logging Users Out
JWT-based authentication is simple to start with and surprisingly hard to get right. The naive setup of a long-lived access token stored in the browser is a security liability. The textbook fixes short-lived access tokens plus a refresh token —…
How to choose the best SOC platform in 2026 (and our top 4)
Without the right tools, no security operations centre (SOC) can do its job properly. A SOC platform brings together a range of security technologies that let your analysts rapidly identify threats, investigate them and implement fixes. There are many cybersecurity…
Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
Cybersecurity researchers have disclosed details of a now-patched vulnerability chain in the Adobe Acrobat Chrome extension that has over 314 million users, which, if exploited, could facilitate a silent hijack of a user’s WhatsApp data. The shortcoming has been codenamed…
Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs
Cybersecurity researchers have disclosed details of a new local privilege escalation (LPE) vulnerability in snap-confine that an unprivileged user can trigger to obtain root access and gain complete control of a target environment. The high-severity flaw, tracked as CVE-2026-8933 (CVSS…
Public PoC Released for Windows NT OS Kernel Privilege Escalation Vulnerability
Public proof-of-concept (PoC) exploit code was released for CVE-2026-42980, a local privilege escalation vulnerability in the Windows NT OS Kernel. This vulnerability occurs due to an integer underflow in kernel-mode code. CVE-2026-42980 is an elevation-of-privilege flaw in the Windows NT…
A Hidden Line of Website Text Can Turn AWS Kiro Into a Remote Code Execution Tool
A recently disclosed vulnerability in AWS Kiro, an AI-powered Integrated Development Environment (IDE), reveals how a hidden line of text on a webpage can be exploited for remote code execution on a developer’s machine, bypassing the platform’s security model. Kiro…
ASUS Patches Critical Router Vulnerability Enabling Remote Command Execution
ASUS has released critical security updates to address a high-severity router vulnerability that could allow remote attackers to execute arbitrary commands on affected devices. The flaw, tracked as CVE-2026-13385, impacts multiple ASUS router firmware branches, including the widely deployed 3.0.0.4_386,…
Adobe Acrobat Extension Flaw Lets Attackers Steal WhatsApp Chats From 329 Million Users
A newly disclosed flaw in the Adobe Acrobat Chrome extension allowed attackers to silently harvest WhatsApp Web chats, contacts, and profile data from any user who simply visited a malicious webpage no clicks, downloads, or credential theft required. Security researchers…
RefluXFS Linux Kernel Vulnerability Lets Attackers Gain Root Access
A new Linux vulnerability dubbed “RefluXFS” — a race condition in the Linux kernel’s XFS filesystem copy-on-write path that lets an ordinary local user silently overwrite protected system files and seize host root privileges, even on systems running SELinux in…
2026 DevOps Security Insights: What Matters Most for CISOs
Rich threat landscape, agentic AI, vulnerabilities, third-party DevOps platforms… Securing a software supply chain is a multidimensional and complex undertaking, so it is easy to lose track. At GitProtect, we’ve… The post 2026 DevOps Security Insights: What Matters Most for…
Ghost in the Calendar: The Microsoft 365 Calendar Implant
How HollowGraph Operates On July 20, 2026, Group-IB security researchers released a study describing an implant known as HollowGraph that converts a hacked Microsoft 365 calendar into hidden communication channel…. The post Ghost in the Calendar: The Microsoft 365 Calendar…
Operational Cyberpsychology: Applying Behavioral Science to Harden Enterprise Cyber Defense
Somewhere between the third threat intelligence briefing of the morning and the seventh security alert of the afternoon, an analyst at a major defense contractor made a decision that cost… The post Operational Cyberpsychology: Applying Behavioral Science to Harden Enterprise…
Red Card for Piracy: Feds Seize Over 1,000 Illegal World Cup Streams
Targeted Crackdown on Piracy The US Department of Justice declared on July 20, 2026, that over 1,000 internet domains that were being utilized for illegal live streaming of 2026 FIFA… The post Red Card for Piracy: Feds Seize Over 1,000…
Rondo Meets Geoserver, (Wed, Jul 22nd)
This isn't a new attack, but something I saw “pop-up” in our logs this week: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Rondo Meets Geoserver, (Wed, Jul 22nd)
How Agentic Ransomware is Changing Enterprise Cybersecurity
Agentic ransomware is reshaping cyberattacks through autonomous AI. The post How Agentic Ransomware is Changing Enterprise Cybersecurity appeared first on eSecurity Planet. This article has been indexed from eSecurity Planet Read the original article: How Agentic Ransomware is Changing Enterprise…
Ostium Confirms $23.75 Million Vault Exploit After Off-Chain Price Feed Compromise
Ostium, a decentralized trading platform built on the Arbitrum blockchain, has confirmed that hackers stole $23.75 million from its liquidity provider vault after compromising the platform’s off-chain price feed infrastructure. In an update shared by the company, Ostium…
Meta’s Muse AI: How Instagram Users Can Opt Out After Privacy Backlash
Meta’s short‑lived Muse Image AI on Instagram let users remix public photos into AI images by default, triggering a storm of privacy and consent backlash before Meta pulled the feature. Meta’s Muse Image tool was designed to turn Instagram…