The devil is still in the email – but wearing a new mask
When phishing can increasingly pass familiar checks, avoiding or limiting the damage depends on how quickly your company can detect and contain the attack 28…
Author: Cybernoz
Ensuring Supply Chain Security: Verify container image integrity with the Wiz Admission Controller
Developers are constantly building new microservices or native cloud applications using containers, which provide increased agility, flexibility, and portability. However, the creation of large numbers…
Lessons from Microsoft Patch KB5002907: Two Layers of Patch Control in Qualys TruRisk Eliminate
How reliability scoring keeps risky patches out of zero-touch jobs, and how one blocking rule stops a paused update across your environment. Executive Summary Microsoft…
Apple patches CoreGraphics zero-day flaw exploited in attacks
Apple released security updates to fix a zero-day vulnerability exploited in “extremely sophisticated” targeted attacks on iOS devices. Tracked as CVE-2026-20700, this flaw stems from…
Critical WatchGuard API Vulnerabilities Enables Command Execution Attacks
WatchGuard has disclosed three security vulnerabilities affecting WatchGuard AP devices, including two critical flaws that could allow attackers to gain unauthenticated access and execute commands…
Hackers Use Compromised Service Principals to Delete Azure Storage and Steal Cloud Credentials
Microsoft has uncovered an Azure-focused destructive campaign linked to JADEPUFFER, a threat actor the company tracks as Storm-3168. The group abused compromised service principals to…
Tech Support Scam Kit Uses Google Ads to Deliver Fake Security Alerts
Google Ads deliver a tech support scam kit that shows fake security alerts, makes browsers appear locked and targets users across hundreds of organizations. A…
GitHub’s AI agent found 24 Android app vulnerabilities
GitHub Security Lab researcher Kevin Stubbings built custom AI-driven audit workflows, called taskflows, on top of the lab’s open source Taskflow Agent, and used them…
Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials
Swati KhandelwalSep 29, 2026Identity Security / Artificial Intelligence A malicious MCP server could trick an application built on the official MCP Python SDK into handing…
Telstra payphone granted heritage status
Key points A Telstra payphone on the NSW south coast has earned heritage listing on social and historical grounds for its role during a major…
Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’
Apple on Monday released iOS and macOS updates to patch a zero-day vulnerability that may have been exploited in targeted attacks. The flaw, tracked as…
Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild
Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild Pierluigi Paganini September 28, 2026 Roundcube SQL injection CVE-2026-48842 is now being exploited in…