Don’t miss

Vulnerability reports are arriving faster than GitHub can review them

CVE, DevOps, Don't miss, GitHub, News, vulnerability assessment, vulnerability management /

Vulnerability reports are arriving faster than GitHub can review them 2026-06-30 at 08:25 By Anamarija Pogorelec Across the open source world, people are reporting software flaws in record numbers, and the systems built to verify those reports are straining under the weight. The GitHub Advisory Database, which feeds automated security alerts to millions of projects, […]

Vulnerability reports are arriving faster than GitHub can review them Read More »

JSP webshells being dropped on unpatched PTC Windchill instances

BSI, CISA, Don't miss, Germany, Hot stuff, manufacturing sector, News, vulnerability /

JSP webshells being dropped on unpatched PTC Windchill instances 2026-06-29 at 19:18 By Zeljka Zorz The US Cybersecurity and Infrastructure Security Agency (CISA) added a vulnerability (CVE-2026-12569) in Windchill and FlexPLM, two product lifecycle management software platforms developed by PTC, to its Known Exploited Vulnerabilities (KEV) catalog. Entries in the KEV catalog don’t contain links […]

JSP webshells being dropped on unpatched PTC Windchill instances Read More »

Mozilla warns of indirect prompt injection risk in AI coding agents

agentic AI, Don't miss, Hot stuff, Mozilla, News, prompt injection, software development /

Mozilla warns of indirect prompt injection risk in AI coding agents 2026-06-29 at 13:48 By Zeljka Zorz A malicious GitHub repository can silently compromise a developer’s machine without containing a single line of malicious code, security researchers at Mozilla’s Zero Day Investigative Network (0DIN) warned. The attack The proof-of-concept attack targets AI-powered coding agents such […]

Mozilla warns of indirect prompt injection risk in AI coding agents Read More »

DarkMoon: Open-source AI pentesting platform

agentic AI, AI, automation, cybersecurity, Don't miss, GitHub, Hot stuff, LLMs, News, open source, penetration testing, software /

DarkMoon: Open-source AI pentesting platform 2026-06-29 at 08:30 By Mirko Zorz Penetration testing has long run on expert time, with specialists spending days probing a network or web application by hand. Manual engagements stretch across weeks, expert consultants run into thousands of dollars a day, and results vary with the tester. Automation promises to narrow […]

DarkMoon: Open-source AI pentesting platform Read More »

Sycophantic chatbots and the harms that build over many chats

AI, Don't miss, LLMs, News, research /

Sycophantic chatbots and the harms that build over many chats 2026-06-29 at 08:00 By Sinisa Markovic People use AI chatbots for company, advice, and emotional support, and these systems answer in ways meant to hold their attention. Researchers describe the resulting risks as affective safety, a class of harm that exists because humans are emotional […]

Sycophantic chatbots and the harms that build over many chats Read More »

Companies keep bolting AI onto their products, and the security bill is coming due

AI, Cobalt, cybersecurity, Don't miss, LLMs, News, penetration testing, report, survey /

Companies keep bolting AI onto their products, and the security bill is coming due 2026-06-29 at 07:30 By Mirko Zorz Companies keep bolting AI and LLM features onto their products, and the security results are starting to show a pattern. The vulnerabilities those features create get rated high risk far more often than anything else, […]

Companies keep bolting AI onto their products, and the security bill is coming due Read More »

Synology issues critical fix for MailPlus Server vulnerabilities

Don't miss, email security, Hot stuff, NAS, News, security update, SMBs, Synology, vulnerability /

Synology issues critical fix for MailPlus Server vulnerabilities 2026-06-26 at 13:57 By Zeljka Zorz Synology has has fixed critical vulnerabilities in MailPlus Server, a software package used to run private email infrastructure on Synology NAS devices. The security update fixes three flaws: CVE-2026-13136, stemming from faulty authorization checks, may allow remote attackers to read or […]

Synology issues critical fix for MailPlus Server vulnerabilities Read More »

Mystery hackers use novel SharkLoader dropper against governments, software devs

Asia, Don't miss, Europe, Government, Hot stuff, Kaspersky, Malware, News, software development /

Mystery hackers use novel SharkLoader dropper against governments, software devs 2026-06-26 at 12:13 By Zeljka Zorz Kaspersky researchers have uncovered a previously unknown cyberattack campaign that has compromised government organizations and software development companies in multiple countries. They first stumbled onto the campaign while investigating an attack on a diplomatic organization in Indonesia. What initially […]

Mystery hackers use novel SharkLoader dropper against governments, software devs Read More »

A privacy-first take on local malware analysis

cybersecurity, Don't miss, malware analysis, News, Privacy, research /

A privacy-first take on local malware analysis 2026-06-26 at 09:00 By Sinisa Markovic Submitting a suspicious file to VirusTotal or MalwareBazaar places a copy of that file on a platform other people can search. Analysts across the industry rely on these services to get a quick verdict on whether a binary is dangerous. The convenience […]

A privacy-first take on local malware analysis Read More »

Two CEOs on why security and AI readiness belong together

CXO, cybersecurity, Don't miss, Hot stuff, News /

Two CEOs on why security and AI readiness belong together 2026-06-26 at 08:30 By Mirko Zorz SuperOps and Guardz are bundling PSA, RMM, MDM, and agentic SecOps into one offering for MSPs. In this Help Net Security Q&A, SuperOps CEO Arvind Parthiban and Guardz CEO Dor Eisner explain how a connected stack cuts the time […]

Two CEOs on why security and AI readiness belong together Read More »

The uptime questions every engineering leader should ask this week

CXO, Don't miss, Features, Hot stuff, News, strategy, tips /

The uptime questions every engineering leader should ask this week 2026-06-25 at 09:30 By Mirko Zorz In this interview with Help Net Security, Mattias Geniar, CTO at Oh Dear, explains why most outages start quietly, as creeping latency or a slow rise in errors. He argues teams alert on the wrong things: absolute numbers instead […]

The uptime questions every engineering leader should ask this week Read More »

LLM security advice looks solid until you check the hard cases

Don't miss, Google, how-to, LLMs, News, Reddit, research, tips /

LLM security advice looks solid until you check the hard cases 2026-06-25 at 09:00 By Anamarija Pogorelec Plenty of people now type their security worries straight into a chatbot. A hacked account, a suspicious email, a stalker who might be tracking a phone, all of it lands in the same window someone would use to […]

LLM security advice looks solid until you check the hard cases Read More »

Law enforcement hits StealC and Amadey malware networks

cybercrime, Don't miss, Europol, Hot stuff, IBM X-Force, law enforcement, Malware, Microsoft, News, Proofpoint /

Law enforcement hits StealC and Amadey malware networks 2026-06-24 at 18:05 By Zeljka Zorz Operation Endgame, the largest international law enforcement operation aimed at disrupting ransomware and cybercrime infrastructure across the world, has claimed its latest targets: StealC and Amadey. The notice on disrupted websites (Source: Microsoft) While developed by separate criminal groups, those two […]

Law enforcement hits StealC and Amadey malware networks Read More »

Cisco Unified CM flaw actively exploited to drop webshells (CVE-2026-20230)

Cisco, communication, Defused, Don't miss, enterprise, Hot stuff, News, PoC, vulnerability /

Cisco Unified CM flaw actively exploited to drop webshells (CVE-2026-20230) 2026-06-24 at 14:36 By Zeljka Zorz CVE-2026-20230, a server-side request forgery (SSRF) vulnerability affecting Cisco’s Unified Communications Manager (Unified CM), is being exploited to drop webshells and achieve remote code execution capability on the underlying server. “Our honeypots are seeing automated sweeps dropping webshells, all […]

Cisco Unified CM flaw actively exploited to drop webshells (CVE-2026-20230) Read More »

What the Fortibleed campaign means for organizations running FortiGate firewalls

CloudSEK, Data leak, Don't miss, enterprise, Fortinet, Hot stuff, Hudson Rock, News, remediation, ZenoX /

What the Fortibleed campaign means for organizations running FortiGate firewalls 2026-06-23 at 17:46 By Zeljka Zorz A massive credential-harvesting campaign targeting FortiGate firewalls has exposed thousands of organizations to potential network compromise, and a trove of attacker tools, scripts, and credentials left inadvertently exposed on a server has given researchers an unusually detailed look at […]

What the Fortibleed campaign means for organizations running FortiGate firewalls Read More »

A $1,400 experiment in AI security auditing outperformed OpenAI’s Codex Security

agentic AI, AI, auditing, cybersecurity, Don't miss, Features, Hot stuff, News, open source, research /

A $1,400 experiment in AI security auditing outperformed OpenAI’s Codex Security 2026-06-23 at 08:30 By Mirko Zorz A research team has built a system that teaches AI agents to hunt for software bugs by writing the audit method down as plain text. The system, called EVOHUNT, keeps the underlying AI model fixed and improves only […]

A $1,400 experiment in AI security auditing outperformed OpenAI’s Codex Security Read More »

Residential proxy SDKs are hiding in LG and Samsung smart TV apps

Don't miss, hardware, Internet of Things, network, News, Proxy, smart tv /

Residential proxy SDKs are hiding in LG and Samsung smart TV apps 2026-06-23 at 08:08 By Anamarija Pogorelec Smart TVs in living rooms run small apps that show fish tanks, clocks, solitaire games, and slideshows of puppies. A share of those apps can also send other people’s internet traffic out through the home connection. Spur […]

Residential proxy SDKs are hiding in LG and Samsung smart TV apps Read More »

23 ClawHub plugins squatting official scopes expose AI registry security gaps

agentic AI, AI, cybersecurity, Don't miss, News, OpenClaw, research, Video /

23 ClawHub plugins squatting official scopes expose AI registry security gaps 2026-06-22 at 11:00 By Help Net Security Plugin registries for AI agents use npm-style scopes like @openclaw/ and @clawhub/ to signal who published a package. But on ClawHub, a registry whose plugins run with Claude, OpenClaw, and other agents, those official scopes weren’t reserved […]

23 ClawHub plugins squatting official scopes expose AI registry security gaps Read More »

Who pays when you gate cyber-capable AI models?

AI, CISO, cyber risk, cybersecurity, Don't miss, Features, Hot stuff, News, opinion, Risk Management, strategy /

Who pays when you gate cyber-capable AI models? 2026-06-22 at 09:00 By Mirko Zorz In this interview with Help Net Security, Jaya Baloo, COO & CISO at Aisle, examines the debate over restricting access to cyber-capable AI models. She lays out the strongest argument for gating these tools, then explains where it breaks down for […]

Who pays when you gate cyber-capable AI models? Read More »

Scroll to Top