Aviation cyber risk sits on the ground, the blindness sits in the air 2026-07-31 at 08:30 By Mirko Zorz In this interview with Help Net Security, Eliran Almong, CEO of Cyviation, explains why airline cyber losses happen on the ground while the aircraft stays unmonitored. He walks through GNSS jamming that leaves no trace in […]
Aviation cyber risk sits on the ground, the blindness sits in the air Read More »
Laundry Bear’s new Microsoft Exchange attack triggers on email open (CVE-2026-42897) 2026-07-30 at 17:23 By Zeljka Zorz Russia-affiliated cyber espionage group Laundry Bear (aka Void Blizzard, aka TA488) is exploiting CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Exchange, to target US and European government entities and a variety of private sector organizations via email. The […]
Laundry Bear’s new Microsoft Exchange attack triggers on email open (CVE-2026-42897) Read More »
Cisco FMC static credentials exploited by attackers (CVE-2026-20316) 2026-07-30 at 13:44 By Zeljka Zorz A static credentials vulnerability (CVE-2026-20316) in Cisco Secure Firewall Management Center (FMC), a platform for centrally managing multiple Cisco Secure Firewall devices across a network, is being leveraged by attackers, CISA warned. Two FMC flaws, one indicator of compromise CVE-2026-20316, reported […]
Cisco FMC static credentials exploited by attackers (CVE-2026-20316) Read More »
Data breach cost 2026 averaged $4.99 million, AI attacks ran higher 2026-07-30 at 09:15 By Mirko Zorz More than one in four organizations hit by a malicious attack over the past year say AI drove it. Those breaches averaged about $1 million above the malicious attacks that ran without AI. Defenders bought similar technology and […]
Data breach cost 2026 averaged $4.99 million, AI attacks ran higher Read More »
200 new CVEs a day and no realistic way to patch them all 2026-07-30 at 09:00 By Mirko Zorz Ryan Dewhurst, CEO at KEVIntel, explains how his team confirms exploitation that CISA’s catalog has not listed yet. He describes a global honeypot sensor network, AI triage, and human verification in a lab before a vulnerability […]
200 new CVEs a day and no realistic way to patch them all Read More »
Top companies to visit at Black Hat USA 2026 2026-07-30 at 08:30 By Mirko Zorz Black Hat USA 2026 returns to Mandalay Bay with a re-engineered six-day program designed to spark innovation, challenge assumptions, and unite the global security community. The event opens with four days of immersive, expert-led Trainings (August 1-4), continues with Summit […]
Top companies to visit at Black Hat USA 2026 Read More »
ShutterGap: Aryon Security finds 3.7M AWS cloud resources exposed beyond CSPM/CNAPP visibility 2026-07-29 at 16:00 By Help Net Security Research from Aryon reveals that each year, 3,731,699 short-lived cloud resources containing highly sensitive information are publicly exposed. This impacts any organization using AWS services that support public sharing. These exposures often last only minutes or hours, […]
The energy sector’s OT cybersecurity talent is retiring faster than it can be replaced 2026-07-29 at 08:30 By Mirko Zorz A ransomware hit lands a chemical plant in a safe state. Nobody is hurt, the site holds steady, and the operators begin the restart. The systems stay down. Every attempt to bring them online meets […]
The energy sector’s OT cybersecurity talent is retiring faster than it can be replaced Read More »
Your AI agents can reach data no one approved 2026-07-29 at 07:30 By Mirko Zorz A credential expired. An AI agent kept using it anyway, and a mid-sized company’s systems went down for a quarter’s worth of trouble before anyone traced the failure back to a non-human account no one had been logging. That agent […]
Your AI agents can reach data no one approved Read More »
Hugging Face breach reignites open-weights debate, raises liability questions 2026-07-28 at 18:55 By Zeljka Zorz The first publicly documented cyberattack run end-to-end by an autonomous AI was an OpenAI benchmark test that escaped its sandbox and breached Hugging Face. In an incident post-mortem compiled with the input from Hugging Face and several hundred members of […]
Hugging Face breach reignites open-weights debate, raises liability questions Read More »
Exposed BMCs hand out password hashes before login 2026-07-28 at 15:00 By Sinisa Markovic An attacker who reaches UDP port 623 on a server’s baseboard management controller can ask it for a password hash and receive one before logging in. The exchange is part of the IPMI 2.0 handshake, built on an authentication protocol introduced […]
Exposed BMCs hand out password hashes before login Read More »
JetBrains fixes critical unauthenticated RCE in TeamCity On-Premises (CVE-2026-63077) 2026-07-28 at 14:04 By Zeljka Zorz JetBrains has fixed a critical vulnerability (CVE-2026-63077) affecting TeamCity On-Premises and is urging admins to upgrade self-hosted servers as soon as possible. “For those who are unable to do so, we have released a security patch plugin,” noted Daniel Gallo, […]
JetBrains fixes critical unauthenticated RCE in TeamCity On-Premises (CVE-2026-63077) Read More »
Shadow AI incident response begins with logs that may already be gone 2026-07-28 at 09:00 By Mirko Zorz In this Help Net Security interview, Brandy Wityak, VP of Complex Matters at LevelBlue, explains what happens in the hours after a shadow AI incident. She describes how quickly logs roll over, why firewall records of outbound […]
Shadow AI incident response begins with logs that may already be gone Read More »
AI took more than junior developer jobs and the bill comes later 2026-07-28 at 08:30 By Sinisa Markovic A ticket comes in for a small bug fix. Hand it to the junior on your team and you wait a day, review something that half works, and sit down to explain what went wrong. Describe it […]
AI took more than junior developer jobs and the bill comes later Read More »
Download: The High-Performance Team Playbook 2026-07-28 at 08:00 By Help Net Security Get practical insight from teams who’ve built, scaled and handed over engineering functions at enterprise level. Most engineering teams don’t fail because of bad engineers. They fail because performance is assumed. This playbook shows how high-performance teams are built intentionally across people, structure, […]
Download: The High-Performance Team Playbook Read More »
PoC exploit released for critical AD CS domain-takeover flaw (CVE-2026-54121) 2026-07-27 at 15:04 By Zeljka Zorz Security researchers who discovered and reported CVE-2026-54121 (aka “Certighost”), a critical privilege elevation vulnerability in Active Directory Certificate Services (AD CS), have released a proof-of-concept (PoC) exploit for and technical details related to the flaw. The vulnerability AD CS […]
PoC exploit released for critical AD CS domain-takeover flaw (CVE-2026-54121) Read More »
The automotive software vulnerabilities hiding in your dashboard 2026-07-24 at 09:30 By Anamarija Pogorelec Pop the hood on a new car and you won’t find much you can fix with a wrench. What you’ll find is software, and a lot of it. The screen in the dash probably runs Android or a flavor of Linux. […]
The automotive software vulnerabilities hiding in your dashboard Read More »
Governing Al agents at scale: Lessons from the leaders who’ve done it 2026-07-24 at 09:00 By Help Net Security Enterprise AI leaders from ZoomInfo, Docusign and AppViewX share what it took to build AI Centers of Excellence and govern agent identities inside two companies operating at scale. What you’ll take away: What an AI Center […]
Governing Al agents at scale: Lessons from the leaders who’ve done it Read More »
How attackers hosted a fake Claude download page on the claude.ai domain 2026-07-23 at 16:12 By Zeljka Zorz A threat actor abused Anthropic’s Claude Artifacts feature to funnel users toward malware, Huntress researchers have disclosed. Employees at at least 29 organizations were compromised over two days in July, after searching for the Claude desktop app […]
How attackers hosted a fake Claude download page on the claude.ai domain Read More »
Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232) 2026-07-23 at 13:42 By Zeljka Zorz Attackers are exploiting a critical authentication bypass vulnerability (CVE-2026-16232) that affects Check Point Security Management and Multi-Domain Security Management, the management servers that push policy to Check Point security gateways (i.e., firewalls). “An unauthenticated attacker can obtain […]