Introducing Wiz ASM: Context-Driven Attack Surface Management
Modern environments span cloud, AI, on-premises, SaaS, APIs, and more – each introduces potential exposures that make the attack surface wider, more dynamic, and harder…
Month: July 2026
No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack
Acknowledgments: Special thanks to Dave Kleinatland, Matt Kiely, Jamin Becker, Bryan Masters, Justin Allen, and Arnelle French for their contributions to this investigation. UPDATE @…
Progress urges ShareFile admins to shut down servers over “credible” threat
Progress Software is emailing ShareFile customers who use Storage Zone Controllers to immediately shut down their servers after identifying what it describes as a “credible…
Forg365 Phishing Platform Using AI to Attack Microsoft 365 Accounts
Forg365 is a phishing-as-a-service platform that targets Microsoft accounts, combining AI-powered phishing, session theft, and post-compromise mailbox access in a single operator panel The platform…
Linux FUSE Vulnerability Allows Unprivileged Users to Pop a Root Shell
A newly disclosed Linux kernel vulnerability in the FUSE subsystem allows unprivileged local users to escalate privileges to root by corrupting the page cache and…
AWS gives its ERP agent deny-by-default rules and a separate identity
Accounts receivable teams at large companies spend hours each day matching incoming bank payments to invoices by hand. When those payments sit unmatched for days,…
Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot
Researchers at firmware security firm Binarly have found six new flaws in U-Boot, the small program that starts up hardware as varied as home routers, smart cameras,…
Tesco VMware migration shows backup incompatibilities
The ongoing legal dispute between supermarket chain Tesco and Broadcom/VMware illustrates the challenges IT departments are likely to face if they plan to migrate to…
Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers
Organizations across multiple sectors have been targeted in a vishing campaign aimed at harvesting Microsoft 365 credentials, Okta warns. The campaign started in April and…
Former Ransomware Negotiator Sentenced to 70 Months in Prison for Secretly Helping BlackCat Gang
Former Ransomware Negotiator Sentenced to 70 Months in Prison for Secretly Helping BlackCat Gang Pierluigi Paganini July 10, 2026 A former ransomware negotiator was sentenced…
CISA credential leak prompts tighter security measures
A major credential leak spurred the Cybersecurity and Infrastructure Security Agency to strengthen protections for its sensitive materials, improve how researchers can report agency vulnerabilities…
Microsoft uncovers GigaWiper, a backdoor designed for destruction on demand
These integrations show up in the form of separate commands that the backdoor supports. One command performs raw physical disk wiping by overwriting drives and…