Hot stuff

ShinyHunters claims new campaign targeting Salesforce Experience Cloud sites

access controls, access management, data theft, Don't miss, Hot stuff, misconfiguration, News, Salesforce /

ShinyHunters claims new campaign targeting Salesforce Experience Cloud sites 2026-03-11 at 20:28 By Zeljka Zorz Salesforce customers have, once again, been targeted by the ShinyHunters group – or, at least, it’s what the group claims. Attackers modified and abused benign tool On Saturday, Saleforce confirmed that its security team has identified an attack campaign by […]

ShinyHunters claims new campaign targeting Salesforce Experience Cloud sites Read More »

Researchers uncover AI-powered vishing platform

AI, Artificial Intelligence, Don't miss, Hot stuff, Mirage Security, News, scams, threats, vishing /

Researchers uncover AI-powered vishing platform 2026-03-11 at 20:28 By Zeljka Zorz A vishing-as-a-service platform that helps scammers carry out so-called “press 1” scams is misusing text-to-speech (TTS) capabilities provided by AI voice technology company ElevenLabs, Mirage Security researchers claim. How “press 1” vishing scams work For “press 1” scams, fraudsters spoof phone numbers of trusted

Researchers uncover AI-powered vishing platform Read More »

Microsoft patches 80+ vulnerabilities, six flagged as “more likely” to be exploited

Don't miss, Hot stuff, Immersive, Microsoft, MS Office, MS SQL Server, NCSC-NL, News, Outlook, Rapid7, security update, Trend Micro, vulnerability, Windows /

Microsoft patches 80+ vulnerabilities, six flagged as “more likely” to be exploited 2026-03-11 at 12:31 By Zeljka Zorz On March 2026 Patch Tuesday, Microsoft addressed 80+ vulnerabilities affecting its software and cloud services. Of these, two were publicly disclosed, but not actively exploited. Privilege escalation vulnerabilities abound The two publicly disclosed flaws are CVE-2026-21262, a

Microsoft patches 80+ vulnerabilities, six flagged as “more likely” to be exploited Read More »

Cloud-audit: Fast, open-source AWS security scanner

AWS, cloud security, Don't miss, GitHub, Hot stuff, News, scanner, software /

Cloud-audit: Fast, open-source AWS security scanner 2026-03-11 at 09:21 By Mirko Zorz Running AWS security audits without a dedicated security team typically means choosing between enterprise platforms with per-check billing and generic open-source scanners that produce findings with no remediation guidance. Cloud-audit, a Python CLI tool published on GitHub by Mariusz Gebala, takes a narrower

Cloud-audit: Fast, open-source AWS security scanner Read More »

HR, recruiters targeted in year-long malware campaign

Aryaka, Don't miss, Hot stuff, Human Resources, Malware, News, phishing, social engineering /

HR, recruiters targeted in year-long malware campaign 2026-03-10 at 15:39 By Zeljka Zorz An attack campaign targeting HR departments and job recruiters has been stealthily compromising systems, Aryaka researchers have discovered. By avoiding analysis environments and leveraging a specialized module designed to kill antivirus and endpoint detection software, the Russian-speaking attacker(s) behind this campaign have

HR, recruiters targeted in year-long malware campaign Read More »

Airbus CSO on supply chain blind spots, space threats, and the limits of AI red-teaming

CISO, Compliance, cyber risk, cybersecurity, Don't miss, Features, Hot stuff, News, opinion, Risk Management, strategy, travel industry /

Airbus CSO on supply chain blind spots, space threats, and the limits of AI red-teaming 2026-03-10 at 08:30 By Mirko Zorz Pascal Andrei, CSO at Airbus, knows that the aerospace and defense sector is facing a threat environment that is evolving faster than most organizations can track. From sub-tier suppliers quietly becoming entry points for

Airbus CSO on supply chain blind spots, space threats, and the limits of AI red-teaming Read More »

Fake Claude Code install pages highlight rise of “InstallFix” attacks

Anthropic, Claude Code, Don't miss, Google Search, Hot stuff, malvertising, News, programming, Push Security, social engineering, software development /

Fake Claude Code install pages highlight rise of “InstallFix” attacks 2026-03-09 at 12:58 By Zeljka Zorz Users looking for Anthropic’s Claude Code agentic AI coding tool are being tricked via fake Claude Code install pages into running malware, Push Security researchers have warned. The attackers behind this scheme are faithfully cloning Anthropic’s installation page, hosting

Fake Claude Code install pages highlight rise of “InstallFix” attacks Read More »

Decoding silence: How deaf and hard-of-hearing pros are breaking into cybersecurity

CISO, cybersecurity, Don't miss, Features, Hot stuff, how-to, News, resilience, strategy, ThriveDX, tips /

Decoding silence: How deaf and hard-of-hearing pros are breaking into cybersecurity 2026-03-09 at 09:01 By Mirko Zorz Stu Hirst was already a CISO when he started to go deaf. It was 2023, and the hearing loss crept in over months, enough for him to adapt, to lean on hearing aids and captions, to quietly reorganize

Decoding silence: How deaf and hard-of-hearing pros are breaking into cybersecurity Read More »

Turning expertise into opportunity for women in cybersecurity

conferences, Don't miss, Features, Hot stuff, News /

Turning expertise into opportunity for women in cybersecurity 2026-03-09 at 08:32 By Mirko Zorz Speaker diversity in cybersecurity has been a talking point for over a decade, with panels, pledges, and dedicated conference tracks failing to produce change. Stages still skew heavily male, even as women represent millions of qualified professionals in the field. SheSpeaksCyber,

Turning expertise into opportunity for women in cybersecurity Read More »

Open-source tool Sage puts a security layer between AI agents and the OS

agentic AI, cybersecurity, Don't miss, Gen Digital, GitHub, Hot stuff, News, open source, software /

Open-source tool Sage puts a security layer between AI agents and the OS 2026-03-09 at 08:06 By Anamarija Pogorelec Autonomous AI agents running on developer workstations execute shell commands, fetch URLs, and write files with little or no inspection of what they are doing. Open-source project Sage inserts an interception layer between an AI agent

Open-source tool Sage puts a security layer between AI agents and the OS Read More »

Iran-linked APT targets US critical sectors with new backdoors

APT, backdoor, Carbon Black, Ctrl-Alt-Intel, cyber espionage, Don't miss, Hot stuff, Iran, Israel, News, Symantec, USA /

Iran-linked APT targets US critical sectors with new backdoors 2026-03-06 at 15:56 By Zeljka Zorz An Iran-linked hacking group has been active inside the networks of several US organizations since early February, raising concerns that the activity could precede broader cyber operations connected to escalating geopolitical tensions in the Middle East. New backdoors used by

Iran-linked APT targets US critical sectors with new backdoors Read More »

March 2026 Patch Tuesday forecast: Is AI security an oxymoron?

Adobe, apple, cybersecurity, Don't miss, Expert analysis, Expert corner, Google, Hot stuff, Ivanti, Microsoft, Mozilla, News, Patch Tuesday /

March 2026 Patch Tuesday forecast: Is AI security an oxymoron? 2026-03-06 at 10:47 By Help Net Security Developers and analysts are using more AI tools to produce code and to test both the performance and security of the finished products. They are also embedding AI functionality in their products directly. But just how secure are

March 2026 Patch Tuesday forecast: Is AI security an oxymoron? Read More »

Cisco warns of SD-WAN Manager exploitation, fixes 48 firewall vulnerabilities

Cisco, Don't miss, firewall, Hot stuff, News, SD-WAN, vulnerability /

Cisco warns of SD-WAN Manager exploitation, fixes 48 firewall vulnerabilities 2026-03-05 at 15:59 By Zeljka Zorz Cisco has confirmed that two Catalyst SD-WAN Manager vulnerabilities (CVE-2026-20128 and CVE-2026-20122) patched in late February 2025 are being exploited by attackers. The exploited vulnerabilities (CVE-2026-20128, CVE-2026-20122) CVE-2026-20128 is a bug in the Data Collection Agent (DCA) feature of

Cisco warns of SD-WAN Manager exploitation, fixes 48 firewall vulnerabilities Read More »

FreeScout vulnerability enables unauthenticated, zero-click RCE via email (CVE-2026-28289)

CVE, Don't miss, exploit, FreeScout, Hot stuff, News, open source, Ox Security, PoC, security update, vulnerability /

FreeScout vulnerability enables unauthenticated, zero-click RCE via email (CVE-2026-28289) 2026-03-05 at 14:27 By Zeljka Zorz A newly discovered vulnerability (CVE-2026-28289) in the open-source help desk platform FreeScout could allow attackers to take over vulnerable servers by sending a specially crafted email to a FreeScout mailbox. CVE-2026-28289 exploitation FreeScout is a free, open-source help desk and

FreeScout vulnerability enables unauthenticated, zero-click RCE via email (CVE-2026-28289) Read More »

As AI agents start making purchases, security teams must rethink risk

agentic AI, Chargebacks911, Don't miss, enterprise, Features, fraud, Hot stuff, News, Privacy, procurement, risk /

As AI agents start making purchases, security teams must rethink risk 2026-03-05 at 08:17 By Zeljka Zorz In this Help Net Security interview, Donald Kossmann, CTO at fintech company Chargebacks911, talks about the emerging security, fraud, and governance risks of “agentic commerce,” where AI agents can autonomously make purchasing decisions on behalf of users or

As AI agents start making purchases, security teams must rethink risk Read More »

Engineering trust: A security blueprint for autonomous AI agents

agentic AI, Artificial Intelligence, cybersecurity, Don't miss, framework, Google, Hot stuff, LLMs, News, opinion /

Engineering trust: A security blueprint for autonomous AI agents 2026-03-05 at 07:06 By Help Net Security AI agents have evolved from just chatbots, answering questions to executing actions using various integrated tools, often autonomously, and as such the traditional security models have become less efficient. I have seen that firsthand as a security lead for

Engineering trust: A security blueprint for autonomous AI agents Read More »

Over 1,200 IceWarp servers still vulnerable to unauthenticated RCE flaw (CVE-2025-14500)

CVE, Don't miss, enterprise, Hot stuff, IceWarp, News, security update, Shadowserver, SMBs, vulnerability /

Over 1,200 IceWarp servers still vulnerable to unauthenticated RCE flaw (CVE-2025-14500) 2026-03-04 at 15:57 By Zeljka Zorz A critical RCE vulnerability (CVE-2025-14500) in IceWarp, an EU-made business communication and collaboration platform, may be exploited by attackers to gain unauthorized access to exposed unpatched servers. According to the Shadowserver Foundation, there are currently over 1,200 internet-facing

Over 1,200 IceWarp servers still vulnerable to unauthenticated RCE flaw (CVE-2025-14500) Read More »

Why workforce identity is still a vulnerability, and what to do about it

1Kosmos, auditing, authentication, cybersecurity, Don't miss, Hot stuff, identity management, identity verification, News, opinion /

Why workforce identity is still a vulnerability, and what to do about it 2026-03-04 at 07:43 By Help Net Security Most organizations believe they have workforce identity under control. New hires are verified. Accounts are provisioned. Multi-factor authentication is enforced. Audits are passed. Then a breach happens, often through an account that was “properly secured.”

Why workforce identity is still a vulnerability, and what to do about it Read More »

Coruna: Spy-grade iOS exploit kit powering financial crime

CVE, cyber espionage, cybercrime, Don't miss, exploit kit, Google, Hot stuff, iOS, Mandiant, News, surveillance, vulnerability /

Coruna: Spy-grade iOS exploit kit powering financial crime 2026-03-03 at 21:02 By Zeljka Zorz A powerful iOS exploit kit has circulated among multiple threat actors over the past year, moving from a commercial surveillance operation to state-linked espionage campaigns and, ultimately, ended into the hands of financially motivated hackers, according to new research from Google’s

Coruna: Spy-grade iOS exploit kit powering financial crime Read More »

Scroll to Top