Security Blog 2026- 2026 2025 2024 2023 2021 2020 2019 2018
AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
| 27.8.26 | ASIC Sounded the Alarm. Mobile is Where the Attack Starts. | On May 8, Commissioner Simone Constant of the Australian Security Investments Commission (ASIC) sent an open letter directly to every bank, superannuation fund, insurer, and financial services licensee in Australia. Not a report. Not a consultation. A direct instruction to boards and risk committees demanding urgent action on AI and cyber risk. Here's the full threat picture every CISO needs to add to that conversation. | Security blog | ZIMPERIUM |
| 27.8.26 | Why Financial Services Is the Canary in the Code Mine | Organizations have long known that attackers publish malicious packages to public open source registries. The more consequential question is if those packages are actually reaching enterprise development environments. | Security blog | SONATYPE |
| 27.8.26 | NHI Security: Is an Agent Just a Bot with PR? | I’ve recently spent time at identity-focused conferences and couldn’t miss all the messaging about agentic solutions. It got me thinking: agents are just bots with a better PR team. For over a decade, “bot” has been a dirty word. Botnets. Credential-stuffing bots. Bot traffic you pay to filter out. There is an entire security category designed to mitigate the impact of bots. And now, bot traffic now outnumbers human traffic. | Security blog | FLARE.IO |
| 27.8.26 | Agentic SOC alert triage: 60% to 92% AI accuracy | Elastic Security Labs | Elastic's InfoSec team runs three agents that read the detection rule's investigation guide and the closure reasons on 30 days of past cases. Analysts now clear most alerts with a single click in Slack. | Security blog | ELASTIC |
|
22.8.26 |
UNISOC T612 LPE | Summary UNISOC (Shanghai) Technologies Co., Ltd. is a top-three global fabless semiconductor company headquartered in Shanghai, specializing in 2G/3G/4G/5G mobile communication, IoT, and smart device chipsets. Formerly Spreadtrum, it serves major brands like Honor, realme, | Security blog | SSD-DISCLOSURE |
|
22.8.26 |
Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper | A compromised maintainer account and a same-day impersonator of one of Rust's best-known authors turned a routine cargo update into silent remote code execution. Three crates from the same owner were poisoned in 23 minutes (arrayref, internment, and append-only-vec), alongside six attacker-owned crates now deleted from crates.io. | Security blog | STEPSECURITY |
|
22.8.26 |
Don’t Break the Agent: Lessons in Token Optimization | Measuring a token optimizer when your users are 1,000 engineers and your test suite is production | Security blog | JFROG |
| 22.8.26 | Every detection needs a next step: Why runbooks solve the investigation problem | An alert appears in the security operations center. It reports a suspicious sign-in from an unusual location, involving an account that matters. The analyst opens it and reviews the information provided by the detection. | Security blog | SEKOIA |
|
22.8.26 |
CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms | Falcon Cloud Security earns the highest scores in both Innovation and Growth by connecting risk, adversary intelligence, and real-time protection to stop attacks. | Security blog | CROWDSTRIKE |
| 22.8.26 | Brand Impersonation Takedown: From Whack-a-Mole to Managed Response | Manual brand impersonation takedowns fail because attackers move faster than ticket-based abuse reports can resolve. Solution? Managed takedowns. | Security blog | Cyble |
|
15.8.26 |
Inside the Modern SOC: The Identity Front Door | In The 72-Minute Race, we explored how attackers are compressing the time between initial access and business impact. But as attacks continue to accelerate, another trend has emerged: Attackers are increasingly gaining access through compromised identities rather than exploiting technology vulnerabilities. | Security blog | Palo Alto |
|
15.8.26 |
Why metaphor may dictate your security strategy | In this week's newsletter, Martin looks at how the metaphors we use to describe AI "escaping" its sandbox can completely change how we react to the threat. | Security blog | CISCO TALOS |
|
15.8.26 |
Black Hat USA 2026: What the Hugging Face hack tells us about human responsibility | The incident involving OpenAI models shows that autonomous hacks make human oversight more important, not less | Security blog | Eset |
|
8.8.26 |
Benchmarking the Agentic SOC: How we evaluate LLMs for security workflows | Public leaderboards can't tell you which LLM to trust in your SOC, so Elastic built an evaluation framework that grades models on the work (tool calls, execution traces, blind judging) across Agent Builder, Attack Discovery, and automatic migration. | Security blog | ELASTIC |
|
1.8.26 |
Threat Coverage Digest: New TI Report, Threat Research and 750+ Detection Rules | July brought another set of threat coverage updates designed to help security teams work faster and with more confidence. ANY.RUN added 42 behavior signatures, 11 YARA rules, and 703 Suricata rules, giving SOCs broader visibility across files, malware behavior, and network activity. | Security blog | ANYRUN BLOG |
|
1.8.26 |
Infrastructure Health, Now Agentic: The IT Engineer Teammate Is Here | Technology and infrastructure health is the foundation of the SOC. Investigations, threat hunts, and detection engineering all assume the same thing: the tools underneath are up, generating telemetry, and functioning as intended. When that assumption breaks, the rest of the SOC breaks with it. | Security blog | RELIAQUEST |
|
1.8.26 |
Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here | Elastic's first automatic migration from a modern SIEM. Translate your Sentinel detection rules into Elastic Security without rebuilding them. | Security blog | ELASTIC |
| 27.6.26 | Introduction to COM usage by Windows threats | Component Object Model (COM) is a fundamental Windows technology used by legitimate applications for object activation, inter-process communication, automation and language-independent component reuse. Those same qualities make it useful to threat actors. | Security blog | CISCO TALOS |
| 27.6.26 | SMB cyber readiness: the road to resilience starts here | Security blog | Eset | |
| 19.6.26 | Protecting legacy OT systems against modern cyberthreats | Many manufacturing plants depend on OT systems that stay in service for many years. That long run can hide significant cybersecurity risks. | Security blog | Eset |
| 6.6.26 | You do surprise me.exe: An unexpected executable in Hola Browser | Following a certification test, Sophos X-Ops found an unexpected guest had hitched a ride | Security blog | SOPHOS |
| 6.6.26 | Microsoft Secure Boot Certificates Expiring in 2026: Enterprise Impact | Three certificates expire, two UEFI stores are affected, and one permanent gap opens if you miss the deadline. You can use Eclypsium’s solution to identify these gaps that will inevitably affect your Windows fleet. | Security blog | Eclypsium |
| 6.6.26 | DICOM, Pydicom, GDCM, and Orthanc: A technical tour of what really happens in the heap | This white paper presents a concrete case study demonstrating the creation of a heap overflow vulnerability through the exploitation of the DICOM file format. | Security blog | CISCO TALOS |
| 23.5.26 | DBIR 2026: Network Asset Breaches Up 3x as Vulnerability Exploitation Accelerates | The Verizon Data Breach Investigations Report remains one of the most useful annual sources for understanding how real-world breaches are changing. The 2026 report analyzes more than 31,000 security incidents, including more than 22,000 confirmed data breaches, and shows a clear shift in attacker focus: exploitation of vulnerabilities is now the leading known initial access vector. | Security blog | Eclypsium |
| 23.5.26 | Inside the JDownloader Supply-Chain Attack: An r77 Rootkit Bot That Kills Your Antivirus | Malware that hid itself on infected systems and disabled antivirus protection. | Security blog | GENDIGITAL |
| 23.5.26 | Paved With Intent: ROADtools and Nation-State Tactics in the Cloud | ROADtools is a publicly available toolkit for offensive and defensive security purposes that attackers have integrated into cloud attacks. The tool is designed to: | Security blog | Palo Alto |
| 23.5.26 | The art of being ungovernable | In this edition of the Threat Source newsletter, William explores the value of being "ungovernable" in a professional setting, sharing how challenging the status quo and seeking out the smartest people in the room can lead to a more fulfilling and successful career. | Security blog | CISCO TALOS |
| 16.5.26 | Undermining the trust boundary: Investigating a stealthy intrusion through third-party compromise | Microsoft Incident Response investigated an attack operated through legitimate and trusted administrative mechanisms to blend seamlessly into routine operations and remain undetected demonstrating that intrusions have increasingly avoided using noisy exploits, obvious malware, or custom tooling, instead leveraging systems that organizations already trust within their environments. | Security blog | Microsoft blog |
| 16.5.26 | What Is the Instructure Canvas Breach? Impact, Risks, and What Institutions Should Do | The Instructure Canvas breach affects universities, K–12 school districts, and teaching hospitals globally. This blog entry intends to provide context and practical guidance. | Security blog | Trend Micro |
| 16.5.26 | The time of much patching is coming | In this week’s newsletter, Martin reflects on what the next iteration of AI tools means for vulnerability discovery and our ability to manage large-scale patch releases. | Security blog | CISCO TALOS |
| 16.5.26 | Eyes wide open: How to mitigate the security and privacy risks of smart glasses | Smart glasses allow anyone to track and record the world around them. That could put your data and the privacy of those nearby at risk. | Security blog | Eset |
| 9.5.26 | Cyble Named a Challenger in the 2026 Gartner® Magic Quadrant™ for Cyber Threat Intelligence | Recognized for Completeness of Vision and Ability to Execute | Security blog | Cyble |
| 9.5.26 | Unplug your way to better code | Cybersecurity concepts — logs, packets, DNS exfiltration, and more — are usually intangible, and its practitioners are prone to mental fatigue, Amy takes a second to yell at you to go touch grass. | Security blog | CISCO TALOS |
| 9.5.26 | Fixing the password problem is as easy as 123456 | How come it’s still possible to ‘secure’ an online account with a six-digit string? | Security blog | Eset |
| 25.4.26 | Supply chain attacks hit Checkmarx and Bitwarden developer tools | Two supply chain attacks, same day, same command-and-control domain | Security blog | SOPHOS |
| 25.4.26 | Strengthening authentication with passkeys: A CISO playbook | Our passkey rollout took three tries. Here's a playbook to make your implementation smoother. | Security blog | SOPHOS |
| 25.4.26 | Sophos Firewall v22 MR1 is now available | Sophos Firewall v22 bolstered Secure by Design, taking it to a whole new level with major updates to the architecture and new features like the Health Check to help identify high-risk configurations. | Security blog | SOPHOS |
| 18.4.26 | More than pretty pictures: Wendy Bishop on visual storytelling in tech | Wendy shares the unique challenges and rewards of bridging the gap between artistic expression and highly technical research. | Security blog | CISCO TALOS |
| 28.3.26 | Virtual machines, virtually everywhere – and with real security gaps | Cloud VMs offer unmatched speed, scale and flexibility – all of which could eventually count for little if they’re left to fend for themselves | Security blog | Eset |
| 14.3.26 | CISOs in a Pinch: A Security Analysis of OpenClaw | Learn about OpenClaw (a sovereign agent) and how this can be viable for enterprises. | Security blog | Trend Micro |
| 7.3.26 | Firewall Vulnerability Exploitation: Why the Edge is Fraying | There is a reasonable assumption baked into most enterprise security strategies: the firewall is the defender. It sits at the edge, it inspects traffic, it keeps the bad stuff out. Organizations spend real money on these devices specifically because of that assumption. | Security blog | Eclypsium |
| 7.3.26 | How SMBs use threat research and MDR to build a defensive edge | We speak to Director of ESET Threat Research Jean-Ian Boutin about where solutions that blend advanced technology with human expertise provide the most practical value for businesses | Security blog | Eset |
| 7.3.26 | Protecting education: How MDR can tip the balance in favor of schools | The education sector is notoriously short on cash, but rich in assets for threat actors to target. How can managed detection and response (MDR) help learning institutions regain the initiative? | Security blog | Eset |
| 28.2.26 | Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security | Industrial organizations are facing a growing paradox in cybersecurity. While operational technology (OT) environments are increasingly connected, most security strategies still assume threats will only materialize once attackers reach the plant floor. | Security blog | Palo Alto |
| 21.2.26 | Is it OK to let your children post selfies online? | When it comes to our children’s digital lives, prohibition rarely works. It’s our responsibility to help them build a healthy relationship with tech. | Security blog | Eset |
| 14.2.26 | SMS & OTP Bombing Campaigns: Evolving API Abuse Targeting Multiple Regions | Cyble analyzes expanding OTP/SMS bombing ecosystems using high‑speed APIs, SSL bypass, and cross‑platform automation. | Security blog | Cyble |
| 14.2.26 | When SPNs Go Rogue: Detection and Remediation with Trellix NDR | To address this detection gap, the blog shows how Trellix Network Detection and Response (NDR) detects Kerberoasting activity by analyzing deviations in identity behavior and comparing network-level telemetry. | Security blog | Trelix |
| 17.1.26 | AuraInspector: Auditing Salesforce Aura for Data Exposure | Mandiant is releasing AuraInspector, a new open-source tool designed to help defenders identify and audit access control misconfigurations within the Salesforce Aura framework. | Security blog | |
| 10.1.26 | How Cisco Talos powers the solutions protecting your organization | What happens under the hood of Cisco's security portfolio? Our reputation and detection services apply Talos' real-time intelligence to detect and block threats. Here's how. | Security blog |