How to get rid of AWS access keys- Part 1: The easy wins
Access keys associated with IAM users in AWS are unfortunately all too common. Wiz data indicates nearly every cloud customer has at least one. These…
Year: 2026
Runtime Reachability for Containers | Qualys
Key Takeaways Qualys Runtime Vulnerability Reachability for Containers brings runtime evidence directly into vulnerability prioritization. Package presence in a container image does not mean the…
Expanding America’s space capabilities.
HOST(S): Maria Varmazis is a podcast producer and journalist specializing in space, cybersecurity, and emerging technology. She translates complex industry developments into clear, engaging conversations…
Microsoft: Windows Server 2022 reached end of mainstream support
Microsoft announced that Windows Server 2022 has reached the end of mainstream support and will remain in extended support until October 2031. Microsoft unveiled Windows…
OpenCode Security Breach Exposes Third-Party API Keys of its Console Users
OpenCode has disclosed a security breach affecting 1.4% of its Console users, warning that third-party API keys saved in affected workspaces may have been exposed.…
SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with spear-phishing attacks that deploy ReverseRAT on Windows systems. The October…
Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a…
PhantomBuffer: Effective EDR Evasion Through Stealth Injection
I. INTRODUCTION During red teaming or penetration testing, we often need to perform stealth injection between processes. To do so, we must avoid detection…
CVE-2023-34362 RCE vulnerability in MOVEit Transfer exploited in the wild: everything you need to know
On May 31, 2023, Progress published details of a critical remote code execution (RCE) 0-day vulnerability in MOVEit Transfer being exploited in-the-wild (CVE-2023-34362). CVE-2023-34362 was…
TruConfidence: Why Your Patch Automation Can Finally Be Autonomous
TruConfidence: The AI-Powered Remediation Intelligence & Orchestration engine powering TruRisk Eliminate 2.0 delivers autonomous remediation at scale with proof at every step. Executive Summary Vulnerabilities…
The Flax Typhoon gets a cold front.
An international coalition disrupts Chinese state-backed hacking operations. Officials dismantle cybercrime centers in Ghana. Anthropic launches initiatives aimed at quicker remediation. A maximum-severity SonicWall vulnerability…
Fake Arch Linux packages push malware with root privileges
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. AUR is a community-maintained,…