EY Data Breach – Hackers Access IT Support System and Download Documents
Ernst & Young LLP (EY) is notifying clients that an unauthorized third party breached a support ticket platform used by its IT staff, downloading documents…
Month: July 2026
Citrix Secure Access Client Flaw Lets Low-Privileged Windows Users Gain SYSTEM Privileges
Cloud Software Group has issued a High-severity security bulletin (CTX696734) disclosing two vulnerabilities in the Citrix Secure Access Client for Windows and the Citrix Endpoint…
A hard drive reliability check on 341,263 drives, from 4TB to past 20TB
Large cloud storage operators track their hard drives every day, recording which units keep running and which ones drop off the racks. Backblaze does this…
The Race to Field Military Autonomy Is On, Can Trusted Information Infrastructure Keep Pace?
Military forces are under increasing pressure to field autonomous capabilities faster than ever before. Across the U.S., UK, and NATO, new investment, evolving defense strategies,…
OpenSSL Fixes HollowByte Memory Exhaustion Bug
OpenSSL Fixes HollowByte Memory Exhaustion Bug Pierluigi Paganini July 18, 2026 Okta disclosed HollowByte, an 11-byte OpenSSL flaw that lets remote attackers exhaust server memory…
Kimi K3 Might Have Just Started a Crash of the US Economy
Not enough people realize that China’s push for open source AI is an explicit CCP strategy to crash the US stock market and economy. People…
7 skills and traits of elite security engineers
“The same generative tools that help security teams work faster are available to adversaries, and it shows,” Ahmed says. “Phishing campaigns read better and land…
A new type of long-lived key on AWS: Bedrock API keys
When AWS first launched two decades ago, the only way of authenticating applications was through long-lived access keys. Over the years AWS has created various…
OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials
At least two distinct threat actors are weaponizing a novel evasion technique called OAuth client ID spoofing in cloud campaigns, while slipping past telemetry. The…
Update now: 7-Zip fixes RCE flaw exploitable with malicious archives
7-Zip version 26.02 was released to fix a remote code execution vulnerability that could allow attackers to execute malicious code by convincing users to open…
Hugging Face Confirms AI-Driven Breach: Attackers used Autonomous Agents, defenders countered with AI
Hugging Face disclosed this week that it detected and contained a production infrastructure intrusion, driven end-to-end by an autonomous AI agent system, and defended against…
OpenSSL DoS Vulnerability Lets Remote Attackers Exhaust Server Memory With an 11-Byte Payload
A newly disclosed vulnerability reminds us how deeply our digital infrastructure relies on foundational libraries. The Okta Red Team recently discovered “HollowByte,” a Denial of…