LastPass is warning users about an ongoing phishing campaign that is using fake security notices to direct them to fraudulent websites. […]
LastPass, Bitwarden users targeted with fake security alerts Read More »
Progress Software has confirmed that a high-severity zero-day vulnerability is behind the emergency shutdown of ShareFile Storage Zone Controllers last week and has released security updates to patch the flaw. […]
Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown Read More »
Microsoft has announced that passkeys will become the default authentication method for the Entra ID enterprise identity service starting September 2026. […]
Microsoft Entra ID gets passkeys default authentication starting September Read More »
At least two distinct threat actors are weaponizing a novel evasion technique called OAuth client ID spoofing in cloud campaigns, while slipping past telemetry. The activity allows users to enumerate user accounts and validate stolen credentials in Microsoft Entra ID environments, without ever generating a successful sign-in event that would otherwise alert defenders. And bad
OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials Read More »
Two new phishing kits, Jalisco and OmegaLord, have been discovered in attacks targeting Microsoft 365 accounts, using techniques that defeat multi-factor authentication (MFA). […]
New phishing kits target Microsoft 365 accounts, evade MFA Read More »
xAI’s Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed. A researcher publishing as cereblab, testing version 0.2.93, captured one of those uploads, cloned the git bundle out of the intercepted request, and
Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read Read More »
The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has designated two individuals and a VPN service provider for enabling ransomware actors’ and other cybercriminals’ malicious activities, including ransomware attacks against Americans. The VPN, named First VPN Service (1VPNS), has been accused of offering its tools to ransomware groups, along with its 45-year-old Ukrainian
U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support Read More »
The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned two individuals and one entity for enabling ransomware attacks against U.S. organizations. […]
US sanctions VPN, malware providers for enabling ransomware attacks Read More »
Microsoft is now testing a cleaner and faster version of Windows Search that should prioritize relevant results over ads and promotional content. […]
Microsoft starts testing cleaner Windows Search without ads Read More »
SAP has addressed 16 vulnerabilities across multiple products as part of its July 2026 security updates, including three critical flaws in NetWeaver, Commerce Cloud, and AppRouter. […]
SAP warns of critical flaws in NetWeaver and Commerce Cloud Read More »