research

A $25 template helped scammers build hundreds of phantom bank domains

Allure Security, financial industry, fraud, News, research, scams /

A $25 template helped scammers build hundreds of phantom bank domains 2026-08-21 at 08:00 By Sinisa Markovic A phrase on a suspicious website turned into an investigation of phantom banks built to support scams, according to new research from Allure Security. Molly DeQuattro, the company’s VP of Operations, was reviewing a domain that resembled the […]

A $25 template helped scammers build hundreds of phantom bank domains Read More »

Windows 11’s strongest security defenses can be bypassed without a screwdriver

cybersecurity, hardware, News, research, Windows /

Windows 11’s strongest security defenses can be bypassed without a screwdriver 2026-08-17 at 08:30 By Sinisa Markovic Researchers from the University of Birmingham and Durham University have found a way to knock down some of the toughest protections in Windows 11 without physically opening or modifying the target machine. The attack assumes the attacker has

Windows 11’s strongest security defenses can be bypassed without a screwdriver Read More »

When companies get specific about AI, revenue growth looks different

AI, Carnegie Mellon University, cybersecurity, News, research, security ROI /

When companies get specific about AI, revenue growth looks different 2026-08-17 at 07:00 By Anamarija Pogorelec Companies that provide specific evidence of how they use AI tend to record stronger revenue growth. Researchers at Carnegie Mellon University and Larridin examined a study universe of 564 companies across 12 industry sectors. Individual analyses used smaller samples

When companies get specific about AI, revenue growth looks different Read More »

A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months

cybersecurity, Data leak, data security, Don't miss, misconfiguration, News, research, Salesforce, ServiceNow, Threat Intelligence /

A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months 2026-08-12 at 16:51 By Mirko Zorz Most security stories start with something broken. This one starts with everything working as designed. Researchers at Reco have been tracking a campaign they call City-Forum, named after a domain registered in 2002, abandoned, and now

A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months Read More »

Malicious SIMs can hijack smartphones, steal files, and lock them onto 2G

cybersecurity, mobile security, News, research, vulnerability /

Malicious SIMs can hijack smartphones, steal files, and lock them onto 2G 2026-08-11 at 15:10 By Sinisa Markovic Researchers have found that compromised or malicious SIM cards can issue commands to some smartphones and cellular-connected devices, allowing attackers to steal information, disrupt communications, downgrade connections to 2G, and in some cases execute code. Tomasz Piotr

Malicious SIMs can hijack smartphones, steal files, and lock them onto 2G Read More »

An AI tool found 84 flaws in 5G network software and 23 of them still have no fix

5G, AI, cybersecurity, Don't miss, Features, Hot stuff, networking, News, research /

An AI tool found 84 flaws in 5G network software and 23 of them still have no fix 2026-08-11 at 08:30 By Mirko Zorz Researchers at Nanyang Technological University turned a set of AI agents loose on the software that runs 4G and 5G phone networks, and the agents came back with 84 security flaws

An AI tool found 84 flaws in 5G network software and 23 of them still have no fix Read More »

Three in four AI-generated vulnerability patches leave something broken

1Password, agentic AI, AI, CVE, DevSecOps, Don't miss, Hot stuff, News, OpenAI, patching, research, Trail of Bits, vulnerability assessment /

Three in four AI-generated vulnerability patches leave something broken 2026-08-06 at 15:45 By Mirko Zorz Ask a frontier model to patch a real vulnerability and it will hand you something that looks like a fix. It reads like the patch a maintainer would write. When there is a test, it often passes. Roughly one time

Three in four AI-generated vulnerability patches leave something broken Read More »

Pre-auth RCE in enterprise Java hits Bonita and OFBiz servers

Black Hat, Black Hat USA 2026, conferences, CVE, cybersecurity, Don't miss, Hot stuff, Java, News, Novee, research /

Pre-auth RCE in enterprise Java hits Bonita and OFBiz servers 2026-08-05 at 21:45 By Mirko Zorz An attacker sends a single web request to a Bonita server and lands inside an internal API that assumed nobody could reach it. The request arrives unauthenticated. From there the attacker runs code on the host. Bonita BPM handles

Pre-auth RCE in enterprise Java hits Bonita and OFBiz servers Read More »

Code review used to be the only way to catch these bugs

cybersecurity, Don't miss, fuzzing, News, Palo Alto Networks, research, vulnerability assessment /

Code review used to be the only way to catch these bugs 2026-08-05 at 14:30 By Mirko Zorz An automated system called NOVA read the source code of 3,915 open-source projects over two months and came back with 14,090 vulnerabilities, each one confirmed through the system’s validation pipeline. Vulnerability researchers at Palo Alto Networks’ Unit

Code review used to be the only way to catch these bugs Read More »

15 TP-Link Omada vulnerabilities let attackers hijack routers and intercept camera traffic

Black Hat, Black Hat USA 2026, certificates, Don't miss, Forescout, Google Play, hardware, networking, News, report, research, router, smart home, SMBs, TP-LINK, vulnerability /

15 TP-Link Omada vulnerabilities let attackers hijack routers and intercept camera traffic 2026-08-05 at 12:35 By Mirko Zorz TP-Link prints the serial number of an Omada router on its packaging and on a label attached to the device. Those numbers run in sequence, and feeding a guessed one to the Omada cloud service returns the

15 TP-Link Omada vulnerabilities let attackers hijack routers and intercept camera traffic Read More »

Android malware detection collapses when the context stage comes out

Android, Google Play, machine learning, malware detection, News, research, scanning /

Android malware detection collapses when the context stage comes out 2026-07-29 at 07:00 By Anamarija Pogorelec A phone backup app asks for storage, contacts, SMS, and call logs. A device-management tool asks for more than that. Run either one past a machine learning malware scanner and it comes back flagged. Six Android detectors in wide

Android malware detection collapses when the context stage comes out Read More »

Exposed BMCs hand out password hashes before login

authentication, Don't miss, hardware, HPE, News, passwords, research, Supermicro, vulnerability /

Exposed BMCs hand out password hashes before login 2026-07-28 at 15:00 By Sinisa Markovic An attacker who reaches UDP port 623 on a server’s baseboard management controller can ask it for a password hash and receive one before logging in. The exchange is part of the IPMI 2.0 handshake, built on an authentication protocol introduced

Exposed BMCs hand out password hashes before login Read More »

AI took more than junior developer jobs and the bill comes later

AI, Don't miss, generative AI, News, research, skill development, software development /

AI took more than junior developer jobs and the bill comes later 2026-07-28 at 08:30 By Sinisa Markovic A ticket comes in for a small bug fix. Hand it to the junior on your team and you wait a day, review something that half works, and sit down to explain what went wrong. Describe it

AI took more than junior developer jobs and the bill comes later Read More »

The automotive software vulnerabilities hiding in your dashboard

automotive security, car, connected cars, cybersecurity, Don't miss, Internet of Things, News, research /

The automotive software vulnerabilities hiding in your dashboard 2026-07-24 at 09:30 By Anamarija Pogorelec Pop the hood on a new car and you won’t find much you can fix with a wrench. What you’ll find is software, and a lot of it. The screen in the dash probably runs Android or a flavor of Linux.

The automotive software vulnerabilities hiding in your dashboard Read More »

Multi-patch vulnerability fixes can leave open source exposed

CVE, Don't miss, Features, Hot stuff, News, open source, patching, research, strategy, tips, vulnerability management /

Multi-patch vulnerability fixes can leave open source exposed 2026-07-23 at 08:00 By Mirko Zorz Vulnerability management runs on a shorthand. A CVE shows a linked patch, someone applies it, and the ticket moves to closed. That shorthand covers most open source fixes. A share work in a different way, arriving as a run of two

Multi-patch vulnerability fixes can leave open source exposed Read More »

Small teams are the heaviest users of AI coding agents

agentic AI, AI, code, Don't miss, Features, GitHub, Hot stuff, News, research, software development /

Small teams are the heaviest users of AI coding agents 2026-07-22 at 09:00 By Sinisa Markovic The pull request arrives with the tests already run and the description already written, the work of an agent that handled the whole thing on its own. Somebody still has to read it. On GitHub that somebody is usually

Small teams are the heaviest users of AI coding agents Read More »

Nobody was checking the drives that encrypt your laptop

backup, Don't miss, Encryption, firmware, hardware, Hot stuff, KIOXIA America, Lenovo, Micron Technology, News, research, Samsung, SSD, storage, Western Digital /

Nobody was checking the drives that encrypt your laptop 2026-07-21 at 08:30 By Anamarija Pogorelec A drive ships with a label promising hardware encryption. You plug it in, set a password, and trust the chip inside to handle the rest. Millions of laptops and workstations run this way, on solid-state drives built to the TCG

Nobody was checking the drives that encrypt your laptop Read More »

A forensic tool for backdoored code completions in AI assistants

AI, code, code analysis, Don't miss, LLMs, News, research /

A forensic tool for backdoored code completions in AI assistants 2026-07-20 at 08:00 By Sinisa Markovic Developers lean on AI coding assistants for a growing share of their daily work, letting the tools predict the next few lines and accepting many suggestions with a quick glance. Those tools learn from large collections of code, and

A forensic tool for backdoored code completions in AI assistants Read More »

The script, not the voice, is what makes AI voice phishing work

cybercrime, Don't miss, identity verification, News, phishing, research, scams, threats, vishing /

The script, not the voice, is what makes AI voice phishing work 2026-07-17 at 10:31 By Sinisa Markovic The call comes in at 4:40 on a Friday. The voice belongs to a senior manager, or sounds close enough, and she needs a password reset before a flight. She is polite, she is in a hurry,

The script, not the voice, is what makes AI voice phishing work Read More »

Prompt injection is becoming the XSS of the web agent era

agentic AI, AI, automation, Don't miss, News, prompt injection, research, XSS /

Prompt injection is becoming the XSS of the web agent era 2026-07-17 at 09:00 By Anamarija Pogorelec Autonomous web agents read whatever a page displays, and much of that content comes from strangers. Product reviews, seller listings, and advertisements sit beside trusted site menus on a single page. An agent that reads all of that

Prompt injection is becoming the XSS of the web agent era Read More »

Scroll to Top