Uncategorized

HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 2026-07-20 at 17:33 By A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. Group-IB, which named […]

Dina Atwell — Women in Security 2026 2026-07-20 at 17:06 By A career in the security industry isn’t something that Dina Atwell planned for, but as with many things with life, the profession found her. This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

Hannah Behnke — Women in Security 2026 2026-07-20 at 17:06 By At the age of 18, Hannah Behnke took her first step into the security world in a classic way: she got a job as a “mall cop.” This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

Mythos Didn’t Break Your Security Program. Your Exposure Window Could. 2026-07-20 at 17:06 By The industry spent the initial months after Anthropic’s April 7 Mythos reveal focused on volume. How many new CVEs would Mythos add to an already overloaded pipeline? How quickly would the flood of AI-driven discovery overwhelm triage capabilities? How long would

⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More 2026-07-20 at 16:32 By A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools. The paths were often simple: exposed systems, weak checks,

Security’s 2026 Women in Security 2026-07-20 at 16:30 By Recognized for their achievements and influence, this year’s honorees drive progress throughout their organizations. This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine 2026-07-20 at 15:13 By At least one Russian intelligence service is systematically hijacking internet-connected security cameras across Europe and Ukraine, using the feeds to watch military transport routes, weapons shipments bound for Kyiv, and the locations of Ukrainian troops. That

Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs 2026-07-20 at 13:23 By A solo Russian-speaking threat actor known as “bandcampro” outsourced a chunk of their operations to Google’s open-source Gemini CLI artificial intelligence (AI) and commandeered a live botnet. The findings come from an analysis of 200 Gemini CLI

New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction 2026-07-20 at 13:23 By Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data, and Trend Micro’s Zero Day Initiative (ZDI)

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution 2026-07-20 at 13:23 By F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 (stable) and

SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines 2026-07-20 at 13:23 By Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below – git_credential_manager (versions

World’s Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent 2026-07-20 at 13:23 By In an ironic twist, open-source artificial intelligence (AI) platform Hugging Face revealed that it was the victim of a hack perpetrated by an autonomous AI agent system. The company said it detected and responded to the incident targeting its

Dem-backed ‘Project 2029’ wants a tech clampdown that looks like Europe’s — and risks war with Silicon Valley 2026-07-20 at 13:00 By Thomas Barrabi The liberal backers of “Project 2029” want the next Democratic presidential candidates to pursue a major crackdown that includes a social media ban for kids under age 16, limits on the

Dr. Jazma Mekelle Parker — Women in Security 2026 2026-07-20 at 12:00 By Dr. Jazma Mekelle Parker began her security career as a contract background investigator for the U.S. Office of Personnel Management (OPM). This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

World’s Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent 2026-07-20 at 08:27 By In an ironic twist, open-source artificial intelligence (AI) platform Hugging Face revealed that it was the victim of a hack perpetrated by an autonomous AI agent system. The company said it detected and responded to the incident targeting its

SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines 2026-07-20 at 08:15 By Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below – git_credential_manager (versions

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution 2026-07-19 at 23:42 By F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 (stable) and

Mom sends pre-teen to talk to AI about difficult problems 2026-07-19 at 19:01 By News.com.au A mother has shared a new-age parenting technique that has worked wonders for both her and her children. This article is an excerpt from Latest Technology News | New York Post View Original Source

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access 2026-07-19 at 17:39 By A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances as zero-days prior their public disclosure since June 22, 2026. Cybersecurity company Volexity is tracking the activity under

UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware 2026-07-19 at 16:30 By Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their own machines with data-stealing malware. According to the Computer Emergency Response Team of Ukraine (CERT-UA), the activity has been attributed to UAC-0145,