Hot stuff

CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)

0-day, CISA, Don't miss, enterprise, Government, Hot stuff, Ivanti, News, Rapid7, Volexity /

CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) 2026-11-02 at 17:58 By Zeljka Zorz CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws. Three flaws chained to gain a foothold […]

CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) Read More »

Second wave of refrigeration cyberattacks hits European supermarkets

ANSSI, Don't miss, Europe, Hot stuff, News, Retail /

Second wave of refrigeration cyberattacks hits European supermarkets 2026-11-02 at 16:28 By Zeljka Zorz Three weeks after the attack that turned refrigeration units in French supermarkets into ovens overnight, similar cyberattacks have hit shops in other European countries and again caused refrigerated food to be spoiled. Belgium, Luxembourg and Sweden affected “[In Belgium,] fridges and […]

Second wave of refrigeration cyberattacks hits European supermarkets Read More »

Trezor warns some of its wallets may hide a seed-stealing implant

Cryptocurrency, digital wallet, Don't miss, Hot stuff, News, supply chain compromise, Trezor /

Trezor warns some of its wallets may hide a seed-stealing implant 2026-11-02 at 14:48 By Sinisa Markovic A Trezor Safe 5 sold by CryptoBilis, the reseller linked to the recent Ledger wallet drains, may contain a hidden implant that steals the owner’s recovery phrase, Trezor has warned. Trezor is a Czech company and part of […]

Trezor warns some of its wallets may hide a seed-stealing implant Read More »

Chainalysis breached using “offensive agentic techniques”

Chainalysis, data breach, Don't miss, Hot stuff, News /

Chainalysis breached using “offensive agentic techniques” 2026-11-02 at 13:40 By Zeljka Zorz Blockchain analytics firm Chainalysis has suffered a cybersecurity incident that led to a data breach. According to the company’s Friday announcement, the incident is unrelated to the recent Binance hack. What was accessed? In October, the company detected external attackers using “offensive agentic […]

Chainalysis breached using “offensive agentic techniques” Read More »

FBI pins $6.3 billion Binance crypto heist on North Korea while scammers circle anxious users

Binance, Chainalysis, Crypto, Cryptocurrency, cybercrime, Don't miss, Elliptic, FBI, Hot stuff, News, North Korea /

FBI pins $6.3 billion Binance crypto heist on North Korea while scammers circle anxious users 2026-11-02 at 12:12 By Sinisa Markovic North Korea was behind the theft of more than $6 billion in cryptocurrency from Binance, the FBI has confirmed. “The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of […]

FBI pins $6.3 billion Binance crypto heist on North Korea while scammers circle anxious users Read More »

The first ten lines of a command policy for AI coding agents

CXO, cybersecurity, Don't miss, Features, Hot stuff, News, opinion, strategy, tips /

The first ten lines of a command policy for AI coding agents 2026-11-02 at 08:30 By Mirko Zorz In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents. He argues that agents should run under their own identity, with the person’s identity […]

The first ten lines of a command policy for AI coding agents Read More »

Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record

Binance, Chainalysis, Crypto, Cryptocurrency, cyberattack, cybercrime, Don't miss, Hot stuff, News, North Korea /

Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record 2026-10-30 at 10:26 By Sinisa Markovic About $6.3 billion in cryptocurrency was stolen from Binance in what might be the biggest crypto hack in history. “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s […]

Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record Read More »

What exactly is ISOC? And what does it mean for you?

AI, cybersecurity, Don't miss, Hot stuff, News, opinion, SIEM, SOC, Stellar Cyber /

What exactly is ISOC? And what does it mean for you? 2026-10-30 at 08:36 By Help Net Security Gartner recently released a new category of assessing security tools: the Integrated Security Operations Center (ISOC). Even though SIEM isn’t going anywhere, a rapidly evolving threat landscape is forcing a shift in industry logic that is reflected […]

What exactly is ISOC? And what does it mean for you? Read More »

Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls

0-day, China, CISA, Cisco, CrowdStrike, cyber espionage, Don't miss, DoS, Hot stuff, Linux, News, Palo Alto Networks, PHP2Shell, USA /

Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls 2026-10-29 at 18:25 By Zeljka Zorz China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the “Fragnesia” Linux kernel bug to root servers and firewalls, cybersecurity researchers claim. Cisco has also confirmed that […]

Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls Read More »

Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop

AI, Don't miss, Hot stuff, News, research, vulnerability /

Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop 2026-10-29 at 16:10 By Mirko Zorz Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. In all five, a web page or a local […]

Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop Read More »

Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network

0-day, APT, attack tools, Cisco, critical infrastructure, cyber espionage, Don't miss, enterprise, Fortinet, government-backed attacks, Hot stuff, Internet of Things, Lumen, News, telecommunications, USA /

Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network 2026-10-29 at 15:42 By Zeljka Zorz Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on […]

Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network Read More »

Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)

Defused, Don't miss, Hot stuff, News, Oracle, vulnerability /

Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) 2026-10-29 at 15:12 By Sinisa Markovic Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw. “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS’s Thin Client Framework servlet that chains to remote […]

Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) Read More »

Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents

data breach, Data leak, DHS, Don't miss, Hacktivism, Hot stuff, News, USA /

Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents 2026-10-29 at 12:16 By Sinisa Markovic Names, offices, contact details and assignments of more than 41,000 U.S. Department of Homeland Security (DHS) employees have been leaked by a hacktivist group calling itself the Department of Peace. The group handed the data to the transparency collective […]

Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents Read More »

Qualys CISO on what security teams can do as exploit campaigns grow

automation, CISO, cybersecurity, Don't miss, Features, Hot stuff, News, opinion, patching, Qualys, strategy, tips, vulnerability management /

Qualys CISO on what security teams can do as exploit campaigns grow 2026-10-29 at 08:30 By Mirko Zorz In this Help Net Security interview, Nathan Smolenski, CISO at Qualys, talks about how security teams can handle the growing volume of AI-discovered vulnerabilities. He explains why CISOs should track the average window of exposure instead of […]

Qualys CISO on what security teams can do as exploit campaigns grow Read More »

I underestimated how fast security teams would trust AI to act in the SOC

AI, CISO, Don't miss, Exaforce, Expert analysis, Hot stuff, News, opinion, SOC /

I underestimated how fast security teams would trust AI to act in the SOC 2026-10-28 at 17:25 By Help Net Security For most of my career, I have watched new security platforms work through enterprise programs at a slow pace, so when AI began showing up in security operations tools, I assumed it would follow […]

I underestimated how fast security teams would trust AI to act in the SOC Read More »

Tailscale fixes SSH flaws allowing lateral movement within tailnets

consumer, Don't miss, enterprise, Hot stuff, News, remote management, secure access, secure connectivity, SMBs, Tailscale, vulnerability /

Tailscale fixes SSH flaws allowing lateral movement within tailnets 2026-10-28 at 14:25 By Zeljka Zorz Tailscale, the company behind the popular software-defined mesh networking and connectivity platform of the same name, has shipped fixes for several vulnerabilities, including some in Tailscale SSH that could let an attacker who already had access to a device in […]

Tailscale fixes SSH flaws allowing lateral movement within tailnets Read More »

Data breach at Sony-owned internet provider compromises 2.6 million customer records

breach, data breach, Don't miss, Hot stuff, News, Sony /

Data breach at Sony-owned internet provider compromises 2.6 million customer records 2026-10-28 at 12:18 By Sinisa Markovic Attackers who broke into the So-net member database made off with personal information belonging to more than 2.58 million current and former customers, along with the email passwords of 54,401 users, Sony Network Communications has disclosed. So-net is […]

Data breach at Sony-owned internet provider compromises 2.6 million customer records Read More »

Bellini Capital CISO on AI security governance and the limits of patching faster

AI, CISO, cybersecurity, Don't miss, Features, Hot stuff, News, opinion, patching, strategy, tips /

Bellini Capital CISO on AI security governance and the limits of patching faster 2026-10-28 at 08:30 By Mirko Zorz In this Help Net Security interview, Brian Blakley, CISO at Bellini Capital, explains why AI makes finding vulnerabilities faster while fixing them still takes time. He argues that “patch faster” is not enough and that teams […]

Bellini Capital CISO on AI security governance and the limits of patching faster Read More »

Brotli bug reaches far beyond Node.js (CVE-2026-111497)

Aikido Security, CVE, cybersecurity, Google, Hot stuff, Imperva, News, Node.js, patch, Rapid7, Tenable, vulnerability /

Brotli bug reaches far beyond Node.js (CVE-2026-111497) 2026-10-27 at 19:38 By Zeljka Zorz A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”, CVE-2026-111497 is a remotely exploitable out-of-bounds write flaw that gained widespread attention after Node.js […]

Brotli bug reaches far beyond Node.js (CVE-2026-111497) Read More »

Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack

cyberattack, data breach, Don't miss, education, extortion, healthcare, Hot stuff, News, USA /

Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack 2026-10-27 at 14:24 By Zeljka Zorz University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of New Mexico, has suffered a cyberattack that has temporarily disrupted the operation of its hospitals and may have resulted in a […]

Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack Read More »

Scroll to Top