Don’t miss

Two new high severity WordPress vulnerabilities, patch immediately!

CVE, cybersecurity, Don't miss, Hot stuff, News, Searchlight Cyber, security update, vulnerability, WordPress /

Two new high severity WordPress vulnerabilities, patch immediately! 2026-07-18 at 17:57 By Help Net Security The 7.0.2 WordPress security release addresses one critical and one high severity security issue. The vulnerabilities reported to the WordPress security team include: CVE-2026-60137 – A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo CVE-2026-60137 […]

Two new high severity WordPress vulnerabilities, patch immediately! Read More »

The script, not the voice, is what makes AI voice phishing work

cybercrime, Don't miss, identity verification, News, phishing, research, scams, threats, vishing /

The script, not the voice, is what makes AI voice phishing work 2026-07-17 at 10:31 By Sinisa Markovic The call comes in at 4:40 on a Friday. The voice belongs to a senior manager, or sounds close enough, and she needs a password reset before a flight. She is polite, she is in a hurry,

The script, not the voice, is what makes AI voice phishing work Read More »

Prompt injection is becoming the XSS of the web agent era

agentic AI, AI, automation, Don't miss, News, prompt injection, research, XSS /

Prompt injection is becoming the XSS of the web agent era 2026-07-17 at 09:00 By Anamarija Pogorelec Autonomous web agents read whatever a page displays, and much of that content comes from strangers. Product reviews, seller listings, and advertisements sit beside trusted site menus on a single page. An agent that reads all of that

Prompt injection is becoming the XSS of the web agent era Read More »

The five step plan that cuts security budget waste

CISO, cybersecurity, Don't miss, News, security ROI, strategy, tips, Video /

The five step plan that cuts security budget waste 2026-07-17 at 08:00 By Help Net Security In this Help Net Security video, Viktor Bulanek, CTO of Penetrify, explains where security budget waste comes from. Budgets get built around vendor categories, compliance checkboxes, and last year’s headlines. Attackers work along attack paths, and that mismatch is

The five step plan that cuts security budget waste Read More »

CISA folds its own hard-won lessons into coordinated vulnerability disclosure guidance

CISA, Don't miss, GitGuardian, guide, Hot stuff, JPCERT/CC, NCSC-NL, News, NSA, UK NCSC, vulnerability disclosure /

CISA folds its own hard-won lessons into coordinated vulnerability disclosure guidance 2026-07-16 at 16:23 By Zeljka Zorz On Wednesday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and four allied cyber authorities published a guide telling software vendors how to build a coordinated vulnerability disclosure (CVD) program. Six days earlier, CISA published a blog post

CISA folds its own hard-won lessons into coordinated vulnerability disclosure guidance Read More »

Romania’s land registry hit by cyber attack, data allegedly for sale

cyberattack, Don't miss, EU, Government, Hot stuff, News /

Romania’s land registry hit by cyber attack, data allegedly for sale 2026-07-16 at 13:21 By Zeljka Zorz Romania’s National Agency for Cadastre and Land Registration (ANCPI) suffered a major disruption on Tuesday, July 14, when its e-Terra cadastre and land registry app became unavailable to users. What was first declared to be a “major technical

Romania’s land registry hit by cyber attack, data allegedly for sale Read More »

Reading between the lines of a cyber insurance policy

CISO, cyber insurance, Don't miss, Features, financial industry, Hot stuff, News, opinion, strategy, tips /

Reading between the lines of a cyber insurance policy 2026-07-16 at 09:00 By Mirko Zorz Enterprises in regulated industries often carry cyber insurance policies because contracts require it or boards ask for documented risk transfer. The global market for these policies reached about $16 billion in premiums in 2024. Coverage has become widespread. Payouts have

Reading between the lines of a cyber insurance policy Read More »

What public money does to open-source projects

code, cybersecurity, DevOps, Don't miss, News, open source, research /

What public money does to open-source projects 2026-07-16 at 08:30 By Mirko Zorz Most of the software running inside a typical company was written by volunteers the company never paid. Open-source code sits under web apps, build pipelines, and the machine learning stacks getting so much attention right now. Roughly 96 percent of codebases carry

What public money does to open-source projects Read More »

Ransom demands are down, email is the top way attackers get in

credentials, cybercrime, cybersecurity, Don't miss, Encryption, Malware, News, Ransomware, report, Sophos /

Ransom demands are down, email is the top way attackers get in 2026-07-16 at 08:00 By Mirko Zorz An employee opens an email that looks like any other, clicks a link, and gives up a password without noticing. A stolen login opens a door deeper in the network. Files stop opening a few days later.

Ransom demands are down, email is the top way attackers get in Read More »

Companies keep getting breached by vulnerabilities they already knew about

CISO, cybersecurity, Don't miss, News, report, Vicarius, vulnerability management /

Companies keep getting breached by vulnerabilities they already knew about 2026-07-16 at 07:30 By Mirko Zorz Scanning tools have gotten good at their work. Organizations now find more weaknesses across more of their systems than at any earlier point in the industry’s history. A survey from the security firm Vicarius points to a gap that

Companies keep getting breached by vulnerabilities they already knew about Read More »

GPT-Red beat human red teamers on a prompt injection test

agentic AI, AI, ChatGPT, Don't miss, News, OpenAI, prompt injection, red team /

GPT-Red beat human red teamers on a prompt injection test 2026-07-16 at 06:49 By Mirko Zorz GPT-Red is an automated red-teaming model that OpenAI trains to find prompt injection weaknesses. It works the way a human red-teamer does. It sends a prompt, watches how a GPT model responds, and iterates toward a goal such as

GPT-Red beat human red teamers on a prompt injection test Read More »

Threat actor impersonated hundreds of brands on GitHub to push infostealer malware

Arctic Wolf Networks, credentials, data theft, digital wallet, Don't miss, GitHub, Hot stuff, Malware, News /

Threat actor impersonated hundreds of brands on GitHub to push infostealer malware 2026-07-15 at 16:52 By Zeljka Zorz A financially motivated threat actor is impersonating hundreds of brands on GitHub and pushing a smash-and-grab infostealer masquerading as legitimate downloads of popular software, Arctic Wolf threat researchers have warned. “The 292 impersonated repositories span security tooling,

Threat actor impersonated hundreds of brands on GitHub to push infostealer malware Read More »

SingGuard-NSFA: Open-source guardrails for agentic AI

agentic AI, cybersecurity, Don't miss, GitHub, News, open source, software /

SingGuard-NSFA: Open-source guardrails for agentic AI 2026-07-15 at 08:30 By Anamarija Pogorelec SingGuard-NSFA is an open-source guardrail framework aimed at operational threats in agent workflows. Four models ship at 0.8B, 2B, 4B, and 9B parameters, all built on Qwen3.5 base backbones. Risk taxonomy The NSFA risk taxonomy organizes threats along the CIA triad of confidentiality,

SingGuard-NSFA: Open-source guardrails for agentic AI Read More »

The MDR renewal question: What changes when AI can handle the alerts

agentic AI, AI, cybersecurity, Don't miss, Expert analysis, Expert corner, Hot stuff, News, opinion, Prophet Security, SOC /

The MDR renewal question: What changes when AI can handle the alerts 2026-07-15 at 08:00 By Help Net Security For most of the past decade, the managed detection and response (MDR) decision was a simple one: teams that couldn’t staff a 24/7 SOC outsourced detection and response to a provider who could. It solved a

The MDR renewal question: What changes when AI can handle the alerts Read More »

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)

0-day, CVE, Don't miss, enterprise, Government, Hot stuff, News, secure access, SonicWall /

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410) 2026-07-14 at 20:40 By Zeljka Zorz SonicWall has fixed two actively exploited vulnerabilities (CVE-2026-15409, CVE-2026-15410) affecting its Secure Mobile Access (SMA) 1000 Series appliances, and is urging customer organizations to upgrade to a fixed firmare version and search for evidence of potential compromise. If the outlined

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410) Read More »

“Context bombs” can frustrate AI-driven attacks, researchers found

agentic AI, AWS, deception, Don't miss, Hot stuff, LLMs, News, prompt injection, research, Tracebit /

“Context bombs” can frustrate AI-driven attacks, researchers found 2026-07-14 at 15:27 By Zeljka Zorz A new approach tried out by Tracebit researchers has proven very effective at stopping AI agents from fully compromising targeted environments. What makes it notable isn’t the technique – prompt injection is old news – but the direction it’s pointed: not

“Context bombs” can frustrate AI-driven attacks, researchers found Read More »

No one knows how many old shims can still bypass UEFI Secure Boot

cybersecurity, Don't miss, ESET, Microsoft, News, PowerShell, research, vulnerability /

No one knows how many old shims can still bypass UEFI Secure Boot 2026-07-14 at 13:26 By Mirko Zorz The vast majority of UEFI computers carry a Microsoft certificate that will trust a small first-stage loader called a shim, a program Microsoft signs so that Linux and assorted boot tools can run with Secure Boot

No one knows how many old shims can still bypass UEFI Secure Boot Read More »

The best defense against AI attacks turns out to be a skeptical human

AI, cybersecurity, Don't miss, generative AI, Hot stuff, News, report, SANS, threats /

The best defense against AI attacks turns out to be a skeptical human 2026-07-14 at 09:00 By Mirko Zorz Analysts across the security industry now run generative AI through their daily work, from log triage to incident write-ups. Active use in cybersecurity strategy reached 78% of practitioners in 2026, up from half the field a

The best defense against AI attacks turns out to be a skeptical human Read More »

Fake OAuth client IDs are helping attackers slip past sign-in logs

authentication, credentials, cybercrime, Don't miss, Microsoft, Microsoft Entra ID, News, OAuth, Proofpoint, spoofing /

Fake OAuth client IDs are helping attackers slip past sign-in logs 2026-07-13 at 15:10 By Mirko Zorz Attackers running account enumeration against Microsoft cloud tenants have added a step that keeps their probing out of the usual telemetry. They spoof the OAuth client ID, the globally unique identifier assigned to an application and passed as

Fake OAuth client IDs are helping attackers slip past sign-in logs Read More »

Security threat prompts Progress to disable ShareFile accounts, tell customers to shut down servers

Don't miss, enterprise, file-sharing, Hot stuff, News, Progress, threat /

Security threat prompts Progress to disable ShareFile accounts, tell customers to shut down servers 2026-07-13 at 14:45 By Zeljka Zorz A “credible external security threat” targeting Progress Software’s ShareFile Storage Zone Controllers (SZC) – the on-premises, customer-managed server components where organizations store files shared via this popular enterprise platform – has spurred the company to

Security threat prompts Progress to disable ShareFile accounts, tell customers to shut down servers Read More »

Scroll to Top