Don’t miss

“Context bombs” can frustrate AI-driven attacks, researchers found

agentic AI, AWS, deception, Don't miss, Hot stuff, LLMs, News, prompt injection, research, Tracebit /

“Context bombs” can frustrate AI-driven attacks, researchers found 2026-07-14 at 15:27 By Zeljka Zorz A new approach tried out by Tracebit researchers has proven very effective at stopping AI agents from fully compromising targeted environments. What makes it notable isn’t the technique – prompt injection is old news – but the direction it’s pointed: not […]

“Context bombs” can frustrate AI-driven attacks, researchers found Read More »

No one knows how many old shims can still bypass UEFI Secure Boot

cybersecurity, Don't miss, ESET, Microsoft, News, PowerShell, research, vulnerability /

No one knows how many old shims can still bypass UEFI Secure Boot 2026-07-14 at 13:26 By Mirko Zorz The vast majority of UEFI computers carry a Microsoft certificate that will trust a small first-stage loader called a shim, a program Microsoft signs so that Linux and assorted boot tools can run with Secure Boot

No one knows how many old shims can still bypass UEFI Secure Boot Read More »

The best defense against AI attacks turns out to be a skeptical human

AI, cybersecurity, Don't miss, generative AI, Hot stuff, News, report, SANS, threats /

The best defense against AI attacks turns out to be a skeptical human 2026-07-14 at 09:00 By Mirko Zorz Analysts across the security industry now run generative AI through their daily work, from log triage to incident write-ups. Active use in cybersecurity strategy reached 78% of practitioners in 2026, up from half the field a

The best defense against AI attacks turns out to be a skeptical human Read More »

Fake OAuth client IDs are helping attackers slip past sign-in logs

authentication, credentials, cybercrime, Don't miss, Microsoft, Microsoft Entra ID, News, OAuth, Proofpoint, spoofing /

Fake OAuth client IDs are helping attackers slip past sign-in logs 2026-07-13 at 15:10 By Mirko Zorz Attackers running account enumeration against Microsoft cloud tenants have added a step that keeps their probing out of the usual telemetry. They spoof the OAuth client ID, the globally unique identifier assigned to an application and passed as

Fake OAuth client IDs are helping attackers slip past sign-in logs Read More »

Security threat prompts Progress to disable ShareFile accounts, tell customers to shut down servers

Don't miss, enterprise, file-sharing, Hot stuff, News, Progress, threat /

Security threat prompts Progress to disable ShareFile accounts, tell customers to shut down servers 2026-07-13 at 14:45 By Zeljka Zorz A “credible external security threat” targeting Progress Software’s ShareFile Storage Zone Controllers (SZC) – the on-premises, customer-managed server components where organizations store files shared via this popular enterprise platform – has spurred the company to

Security threat prompts Progress to disable ShareFile accounts, tell customers to shut down servers Read More »

Why SBOMs, signing, and provenance still don’t tell you if software is safe

cybersecurity, DevSecOps, Don't miss, Expert analysis, Expert corner, Hot stuff, News, opinion, strategy, zero trust /

Why SBOMs, signing, and provenance still don’t tell you if software is safe 2026-07-13 at 09:30 By Help Net Security We have made real progress in software supply chain security, improving visibility into software components, authenticity and build integrity. Much of this progress traces back to Executive Order 14028, which pushed agencies, contractors and enterprises

Why SBOMs, signing, and provenance still don’t tell you if software is safe Read More »

Cynative: Open-source deep research agent

agentic AI, AWS, cybersecurity, Don't miss, GitHub, Hot stuff, LLMs, News, open source, software /

Cynative: Open-source deep research agent 2026-07-13 at 09:00 By Mirko Zorz Running a large language model against a live cloud account to hunt for security holes comes with an obvious hazard. An agent that holds real credentials and a mandate to poke around can delete a bucket, flip a permission, or leak a secret on

Cynative: Open-source deep research agent Read More »

Microsoft demystifies how Windows updates work

cybersecurity, Don't miss, Hot stuff, Microsoft, News, Patch Tuesday, security update, Windows /

Microsoft demystifies how Windows updates work 2026-07-13 at 08:30 By Anamarija Pogorelec Microsoft has published a guide explaining the Windows servicing model, outlining the purpose of monthly security updates, optional preview releases, hotpatch updates, and the mechanisms used to deliver new features throughout the year. “Most individuals and organizations regularly deploy monthly security updates, released

Microsoft demystifies how Windows updates work Read More »

A hardware security AI assistant that checks chips for hidden backdoors

agentic AI, AI, backdoor, cybersecurity, Don't miss, hardware, Hot stuff, News, research /

A hardware security AI assistant that checks chips for hidden backdoors 2026-07-13 at 08:00 By Sinisa Markovic Chip designers license blocks of circuitry from outside vendors and drop them into larger products. A single processor can carry components from a range of suppliers, each written by a company the buyer may never deal with directly.

A hardware security AI assistant that checks chips for hidden backdoors Read More »

July 2026 Patch Tuesday forecast: Is CVE tracking still practical?

CVE, Don't miss, Expert analysis, Expert corner, Hot stuff, Ivanti, Microsoft, News, Patch Tuesday /

July 2026 Patch Tuesday forecast: Is CVE tracking still practical? 2026-07-10 at 10:30 By Help Net Security I was off by a month in my forecast of record-setting CVE releases from Microsoft. In June, we saw the deluge of over 200 reported CVEs that I expected in May. There were 116 CVEs for Windows 11

July 2026 Patch Tuesday forecast: Is CVE tracking still practical? Read More »

The open source library holding up your stack might have one maintainer

code, Don't miss, News, open source, research, software /

The open source library holding up your stack might have one maintainer 2026-07-10 at 10:00 By Sinisa Markovic Every serious software product runs on code that someone else wrote and released for free. A web service leans on a cryptography library, a data pipeline pulls in a parser, and a mobile app ships a handful

The open source library holding up your stack might have one maintainer Read More »

Most data brokers won’t tell you what happened to your deletion request

CCPA, data collection, Don't miss, News, Privacy, research, social engineering, USA /

Most data brokers won’t tell you what happened to your deletion request 2026-07-10 at 09:30 By Sinisa Markovic Data brokers collect personal details on most adults in the United States and sell them to buyers that include employers, landlords, insurance companies, and government agencies. California gives residents a way to push back. You can ask

Most data brokers won’t tell you what happened to your deletion request Read More »

Microsoft is rewriting Windows patch guidance because of AI

AI, Don't miss, Microsoft, Microsoft 365, News, patching, security update, Windows /

Microsoft is rewriting Windows patch guidance because of AI 2026-07-10 at 09:00 By Anamarija Pogorelec Microsoft is recommending that organizations shorten Windows update deployment timelines, warning that advances in AI are reducing the time attackers need to identify and exploit vulnerabilities after security updates are released. The company says organizations should reassess how quickly they

Microsoft is rewriting Windows patch guidance because of AI Read More »

Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656)

Don't miss, exploit, Hot stuff, Microsoft, Microsoft Defender, News, security update, vulnerability disclosure /

Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656) 2026-07-09 at 15:14 By Zeljka Zorz Microsoft has finally released a security update for its Microsoft Malware Protection Engine, which fixes CVE-2026-50656, the Windows Defender local privilege escalation vulnerability triggered by the RoguePlanet exploit. The vulnerability and the fix CVE-2026-50656 is due to improper link resolution before

Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656) Read More »

5,811 arrests, $293 million seized over social engineering scams

arrest, cybercrime, Don't miss, Interpol, law enforcement, News, scams, social engineering /

5,811 arrests, $293 million seized over social engineering scams 2026-07-09 at 14:14 By Sinisa Markovic Criminals who pose as police officers, romantic partners, and business suppliers have built fraud operations that reach across continents. A four-month enforcement campaign against these schemes wrapped up, and police in 97 countries and territories took part. Thousands of arrests

5,811 arrests, $293 million seized over social engineering scams Read More »

Your coding agent says no in chat and yes in the code

agentic AI, AI, cybersecurity, Don't miss, GitHub, News, research /

Your coding agent says no in chat and yes in the code 2026-07-09 at 13:44 By Mirko Zorz Millions of developers share their keyboard with GitHub Copilot. Inside Visual Studio Code, it opens their files, writes and edits code, runs scripts, and reworks its own output across many turns. The safety testing that vets these

Your coding agent says no in chat and yes in the code Read More »

Malicious AI agent skills can slip past the scanners built to stop them

agentic AI, AI, cybersecurity, Don't miss, News, research /

Malicious AI agent skills can slip past the scanners built to stop them 2026-07-09 at 10:24 By Sinisa Markovic Developers who build with AI coding agents grab capabilities off public marketplaces the same way they grab packages from npm or PyPI. The add-ons are called agent skills. Each one is a little bundle of plain-English

Malicious AI agent skills can slip past the scanners built to stop them Read More »

The fake report message that ends with a stolen Reddit account

cybercrime, Don't miss, Malwarebytes, News, Reddit, scams, social engineering /

The fake report message that ends with a stolen Reddit account 2026-07-09 at 08:30 By Anamarija Pogorelec A direct message arrives on Reddit from a stranger, and it invites a reply. That reply is the point. This scheme runs on social engineering, with no malware and no malicious links, and it has spread across Reddit,

The fake report message that ends with a stolen Reddit account Read More »

Attackers using Langflow flaw for credential harvesting (CVE-2026-55255)

AI, CISA, Don't miss, enterprise, exploit, Hot stuff, News, SentinelOne, Sysdig, vulnerability /

Attackers using Langflow flaw for credential harvesting (CVE-2026-55255) 2026-07-08 at 17:03 By Zeljka Zorz The US Cybersecurity and Infrastructure Security Agency (CISA) is warning about yet another Langflow vulnerability (CVE-2026-55255) leveraged by attackers in the wild. The flaw was added to the agency’s Known Exploited Vulnerabilities catalog on Tuesday, July 7, nearly two weeks after

Attackers using Langflow flaw for credential harvesting (CVE-2026-55255) Read More »

Scroll to Top