Don’t miss

Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)

CISA, Don't miss, exploit, Gitea, Hot stuff, News, open source, software development, vulnerability /

Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004) 2026-08-26 at 13:59 By Zeljka Zorz Attackers have begun exploiting CVE-2026-60004, a critical code injection vulnerability in the Gitea Git platform, CISA confirmed on Tuesday by adding the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The KEV entry does not contain or point to details […]

Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004) Read More »

Production data in testing is still common, and Tricentis’ CISO wants it gone

AI, automation, CISO, Compliance, cybersecurity, Don't miss, Features, Hot stuff, LLMs, News, strategy, tips, Tricentis /

Production data in testing is still common, and Tricentis’ CISO wants it gone 2026-08-26 at 08:30 By Mirko Zorz In this Help Net Security interview, Erika Dean, CISO at Tricentis, talks about keeping production data out of test environments and why she thinks the alternatives are good enough now. She explains how her team caught […]

Production data in testing is still common, and Tricentis’ CISO wants it gone Read More »

Unpatched Zimbra servers are falling to CVE-2026-73570 attacks

CERT-PL, CISA, collaboration, Don't miss, email security, exploit, Hot stuff, News, Shadowserver, Synacor, vulnerability /

Unpatched Zimbra servers are falling to CVE-2026-73570 attacks 2026-08-25 at 13:03 By Zeljka Zorz At least 274 internet-facing Zimbra instances have been compromised by unknown attackers via CVE-2026-73570, the Shadowserver Foundation shared on Monday. About CVE-2026-73570 Zimbra Collaboration Suite (ZCS) is a communication and collaboration platform popular with organizations that need to have control over […]

Unpatched Zimbra servers are falling to CVE-2026-73570 attacks Read More »

AI supply chain risk is showing up in developer workflows first

agentic AI, AI, CXO, DevSecOps, Don't miss, Features, Hot stuff, News, strategy, supply chain attacks, tips, Zentera Systems, zero trust /

AI supply chain risk is showing up in developer workflows first 2026-08-25 at 09:00 By Mirko Zorz In this Help Net Security interview, Dr. Jaushin Lee, CEO of Zentera Systems, discusses where AI supply chain risk shows up. He says most incidents still hit developer workflows and open-source package repositories, while poisoned model weights and […]

AI supply chain risk is showing up in developer workflows first Read More »

HOL Guard: Open-source antivirus for AI agents

agentic AI, AI, antivirus, cybersecurity, Don't miss, News, open source, software /

HOL Guard: Open-source antivirus for AI agents 2026-08-25 at 08:30 By Anamarija Pogorelec HOL Guard is a free, open-source tool that sits between an AI assistant and the computer it runs on. When the assistant tries something risky, the tool pauses it and asks you first. It installs in about a minute, runs on your […]

HOL Guard: Open-source antivirus for AI agents Read More »

The cybercrime supply chain has five stages, each with a price

CXO, cybercrime, cybersecurity, Don't miss, News, Ransomware, strategy, supply chain attacks, tips, Video /

The cybercrime supply chain has five stages, each with a price 2026-08-25 at 08:00 By Help Net Security In this Help Net Security video, Chris Nyhuis, CEO at Vigilant, explains why the picture of a lone ransomware attacker is about 15 years out of date. He walks through the cybercrime supply chain and the five […]

The cybercrime supply chain has five stages, each with a price Read More »

Suspected Iran-linked attack knocked UK power plant offline for days

critical infrastructure, cyberattack, Don't miss, energy sector, Hot stuff, News, UK, UK NCSC /

Suspected Iran-linked attack knocked UK power plant offline for days 2026-08-24 at 17:22 By Zeljka Zorz News that suspected Iranian hackers caused the shutdown of a British power plant broke over the weekend, raising the question of whether UK’s power grid and, indeed, the country’s critical infrastructure can fend off destructive cyber attacks. According to […]

Suspected Iran-linked attack knocked UK power plant offline for days Read More »

CISA’s logging guidance works beyond government

CISA, critical infrastructure, Don't miss, enterprise, Government, guidelines, Hot stuff, logging, News, USA /

CISA’s logging guidance works beyond government 2026-08-24 at 13:56 By Zeljka Zorz The US Cybersecurity and Infrastructure Security Agency (CISA) wants federal agencies to (re)shape their logging strategy around one question: when an attack hits, can you actually use the logs you’ve collected to catch it and reconstruct what happened afterward? The Logging Reference Architecture […]

CISA’s logging guidance works beyond government Read More »

Hazmat: Open-source containment for AI agents

agentic AI, cybersecurity, Don't miss, GitHub, Hot stuff, News, open source, penetration testing, software /

Hazmat: Open-source containment for AI agents 2026-08-17 at 08:00 By Anamarija Pogorelec Hazmat is an open-source tool that runs AI coding agents inside a separate account on your own machine. It wraps the harnesses people use: Claude Code, Codex, OpenCode, Cursor Agent, and several more, plus any script you write yourself. An agent launched the […]

Hazmat: Open-source containment for AI agents Read More »

Four corporate investigation mistakes organizations make under pressure

BlackBerry, CISO, cybersecurity, Don't miss, Hot stuff, how-to, Incident Response, News, strategy, tips, Video /

Four corporate investigation mistakes organizations make under pressure 2026-08-13 at 08:00 By Help Net Security In this Help Net Security video, Christine Gadsby, VP and Chief Security Advisor at BlackBerry, explains why corporate investigations go wrong before the forensic team arrives. The first hours matter more than leaders assume. Access gets granted, conversations start, and […]

Four corporate investigation mistakes organizations make under pressure Read More »

A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months

cybersecurity, Data leak, data security, Don't miss, misconfiguration, News, research, Salesforce, ServiceNow, Threat Intelligence /

A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months 2026-08-12 at 16:51 By Mirko Zorz Most security stories start with something broken. This one starts with everything working as designed. Researchers at Reco have been tracking a campaign they call City-Forum, named after a domain registered in 2002, abandoned, and now […]

A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months Read More »

Post-quantum migration gets harder when every user holds a key

authentication, blockchain, CISO, CXO, cybersecurity, Don't miss, Features, Hot stuff, News, opinion, passwords, quantum computing, strategy, tips /

Post-quantum migration gets harder when every user holds a key 2026-08-12 at 09:00 By Mirko Zorz In this Help Net Security interview, Christopher Smith, CEO of Quantus, discusses what cryptographic inventories turn up in banks and hospitals, including default passwords and admin keys still held by former employees. He explains where post-quantum key sizes break […]

Post-quantum migration gets harder when every user holds a key Read More »

PentestGPT: Open-source automated penetration testing agentic framework

agentic AI, Claude Code, cybersecurity, Don't miss, GitHub, LLMs, News, open source, penetration testing /

PentestGPT: Open-source automated penetration testing agentic framework 2026-08-12 at 08:30 By Anamarija Pogorelec PentestGPT is an open-source penetration testing agent that points a large language model at a target and lets it work. In its default mode it runs recon, then exploit, then walkthrough, each stage feeding the next. Switch it to pentest mode and […]

PentestGPT: Open-source automated penetration testing agentic framework Read More »

Who will be the Stanislav Petrov in your organization?

AI, BH Consulting, boardroom, Brian Honan, CISO, cybersecurity, Don't miss, Expert analysis, Expert corner, Hot stuff, News, opinion /

Who will be the Stanislav Petrov in your organization? 2026-08-11 at 09:00 By Help Net Security The recent news coverage of “rogue AI” systems hacking innocent companies reminded me of one of the world’s most unsung heroes and genuinely someone who may well have saved the world. In 1983, the USSR’s early warning systems reported […]

Who will be the Stanislav Petrov in your organization? Read More »

An AI tool found 84 flaws in 5G network software and 23 of them still have no fix

5G, AI, cybersecurity, Don't miss, Features, Hot stuff, networking, News, research /

An AI tool found 84 flaws in 5G network software and 23 of them still have no fix 2026-08-11 at 08:30 By Mirko Zorz Researchers at Nanyang Technological University turned a set of AI agents loose on the software that runs 4G and 5G phone networks, and the agents came back with 84 security flaws […]

An AI tool found 84 flaws in 5G network software and 23 of them still have no fix Read More »

Metabase zero-day exploited to access Framework customer data

0-day, data analytics, data breach, Don't miss, Hot stuff, Metabase, News /

Metabase zero-day exploited to access Framework customer data 2026-08-10 at 16:42 By Zeljka Zorz Framework, the San Francisco-based company that designs repairable and upgradeable laptops, has suffered a data breach after attackers managed to exploit a zero-day vulnerability in the Metabase business intelligence service. According to the notification sent to affected Framework customers, the attackers […]

Metabase zero-day exploited to access Framework customer data Read More »

N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577

Don't miss, Hot stuff, Huntress, Microsoft, MSP, N-able, News, remote management, Sophos /

N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577 2026-08-10 at 14:34 By Zeljka Zorz To help customers fend off ongoing attacks, N-able released a second security hotfix for N‑central, its monitoring and management (RMM) solution popular with managed service providers (MSPs). “Hotfix 2 is required, even if you already applied the earlier hotfix. […]

N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577 Read More »

OpenAI locks down Astra over potential critical cyber capabilities

agentic AI, AI, cybersecurity, Don't miss, News, OpenAI /

OpenAI locks down Astra over potential critical cyber capabilities 2026-08-10 at 10:09 By Anamarija Pogorelec OpenAI’s internal evaluation of its upcoming model, Astra, found significant advances in agentic coding and cybersecurity, leading the company to conclude that it cannot rule out the model reaching the critical capability level for cybersecurity under its Preparedness Framework. The […]

OpenAI locks down Astra over potential critical cyber capabilities Read More »

Chainloop: Open-source evidence store and policy engine for the software supply chain

Application Security, devsec, Don't miss, GitHub, News, open source, software, supply chain /

Chainloop: Open-source evidence store and policy engine for the software supply chain 2026-08-10 at 08:30 By Sinisa Markovic Chainloop is an open source evidence store for the software supply chain. A command line tool runs inside a GitHub Actions, GitLab, Jenkins, or Dagger pipeline, picks up what the build produced, uploads those files to content-addressable […]

Chainloop: Open-source evidence store and policy engine for the software supply chain Read More »

August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse?

ACROS Security, Adobe, apple, Don't miss, Expert analysis, Expert corner, Google, Hot stuff, Microsoft, Mozilla, News, Patch Tuesday, SharePoint, Windows /

August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse? 2026-08-07 at 09:00 By Help Net Security July 2026 Patch Tuesday was record-setting in so many ways. The sheer volume of security patches for almost every product in the Microsoft portfolio was the highest ever and, of course, well over 600 CVEs […]

August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse? Read More »

Scroll to Top