Cyber blog

Cyber Blog- 2026 2025 2024 2023 2022 2021 2020 2019 2018

AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog

DATE	NAME	Info	CATEG.	WEB
24.10.26	The Art of Security Podcast: Episodes 13–17 Recap	You know the line: defenders have to be right every time, but attackers only have to get lucky once. Tyler and Josh wonder if that gives attackers too much credit. They explore how layered security, deception, active defense, preparation, and threat intelligence can tip the scales toward defenders, and whether the cat-and-mouse idea works the same for an enterprise as it does for you at home.	Cyber blog	Fortra Blog
24.10.26	When DNS Trust Breaks: What the Counterfeit Google Certificates Reveal	Between September 22 and 27, 2026, attackers hijacked the .gh, .sl, and .as country-code TLD registries and obtained 12 publicly trusted TLS certificates for Google and YouTube domains without compromising Google or the issuing certificate authorities.	Cyber blog	Akamai
24.10.26	Why is Preemptive Cyber Defense Important in 2026?	Preemptive cyber defense is a prevention-first security strategy that stops threats before they execute, rather than detecting and responding to them after they have already run. Instead of recognizing an attack in progress, it removes the conditions an attack needs to succeed, blocking malicious code deterministically at the moment of execution.	Cyber blog	Morphisec Blog
24.10.26	Introducing tsrs: a Port of TypeScript to Rust	Cloudflare and VoidZero are now working with Max Schwenk of Owner.com on tsrs, a Rust port of the TypeScript compiler. We are doing this work in close collaboration with the TypeScript team, and incubating tsrs as part of the Oxc JavaScript compiler toolchain.	Cyber blog	Cloudflare Blog
24.10.26	Localizing compliance at scale: Achieving South Korea’s ISMS certification	For ten days, auditors appointed by the Korea Internet & Security Agency (KISA) sat together with us and worked through 80 controls. That is what it took for a company headquartered in the United States, operating a global network serving Korean users, to be certified in South Korea. Cloudflare has now obtained South Korea's Information Security Management System (ISMS) certification under the ISMS-P framework.	Cyber blog	Cloudflare Blog
24.10.26	From Mobile Threat Detection to Autonomous Investigation: Connecting Zimperium with Sekoia	Mobile devices have become essential to how organizations work. Employees use smartphones and tablets to access business applications, authenticate to corporate services, exchange sensitive information, and stay connected from almost anywhere.	Cyber blog	ZIMPERIUM
24.10.26	Beyond the Sandbox: Leveraging Android Intrusion Logs to Expose Advanced Threats	Some of the most important activity on a compromised Android device occurs when a threat attempts to move beyond the normal application sandbox: an unexpected process starts, a shell is opened, or a binary is staged outside the application’s lifecycle.	Cyber blog	ZIMPERIUM
24.10.26	The Com: How Fear & Bad Attribution Distorted It	Part 1: The Ecosystem and the Actors By Jon DiMaggio, Cybersecurity Researcher The most dangerous thing about The Com isn’t any single group inside of it, but that the ecosystem replaces them faster than law enforcement can arrest the ones already operating. In 2025 and 2026, law enforcement handed down real sentences to real people…	Cyber blog	Flare
24.10.26	Russia Is Tightening Internet Controls, Leading to Operational Risks	Since mid-2025, the Kremlin has intensified restrictions on digital communications and infrastructure, very likely to suppress the organization of domestic political dissent and conduct digital surveillance within Russia. Increasingly strict measures targeting virtual private networks (VPNs), state-managed internet shutdowns, limitations on civilian communications platforms, and monitoring of domestic and foreign entities very likely represent an escalation from the approaches to censorship and surveillance pursued prior to 2024.	Cyber blog	Elastic Security Labs
24.10.26	Sekoia + Zimperium: Investigate Mobile Threats In Your SOC	Zimperium Mobile Threat Defense now sends its mobile threat telemetry to the Sekoia SOC platform. Sekoia Elevate AI agents investigate each mobile alert alongside identity, cloud and network evidence, so analysts can see what it means for the whole organization.	Cyber blog	SEKOIA
24.10.26	EMudhra Intermediate CA Certificates Compromised	Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a critical cryptographic defect during the certificate generation process. The private keys in this incident were generated with insufficient randomness, allowing potential attackers to derive the private keys from the public certificates.	Cyber blog	Palo Alto
24.10.26	I had plans for that second	Here for the latest on the PHP vulnerabilities? Head on down to ‘The One Big Thing’. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset.	Cyber blog	CISCO TALOS
24.10.26	Compromised eMudhra intermediate certificates	Cisco Talos is aware of eight compromised intermediate certificates belonging to the intermediate certificate authority, eMudhra. Rather than possessing the mandatory 384 bits of pseudo-random security, several private keys evaluated single-digit and double-digit integers. This misconfiguration allows an attacker with the private key of any of the compromised intermediate CAs to impersonate any website or service.	Cyber blog	CISCO TALOS
17.10.26	Leaking the Keys to the Kingdom: How a Single Slip Handed Over a Darknet Empire	A flaw in GoBalance, a load-balancing tool used by many darknet sites, allows anyone to recover a site's master signing scalar from its publicly available data. With that key, an attacker can take over the site and redirect its visitors.	Cyber blog	SEARCHLIGHT
17.10.26	DNS as C2 in Noir, An AI-Developed Crypto Wallet Drainer	We found a cryptocurrency wallet-drainer kit, self-branded as Noir, that uses DNS TXT records to locate its hosted pool; currently these run on Cloudflare Pages. The loader races three public DNS-over-HTTPS (DoH) services and uses the first valid answer.	Cyber blog	Adaptive Security
17.10.26	ontinue.com/1h2026threatintelligencereport/	1H 2026 findings reveal growing abuse of trusted identities, AI-assisted tooling, SaaS platforms, and business workflows as attackers achieve greater impact with less effort.	Cyber blog	ONTINUE
17.10.26	2026_10_1h2026-TI-Report-Executive-Summary-en.pdf	The first half of 2026 reinforced a significant shift in the threat landscape: the most effective attacks increasingly do not look like attacks at all. They look like a Microsoft Teams message from someone claiming to be in IT, a login prompt from a trusted brand, a software package from a familiar repository, or a routine request that appears legitimate on the surface	Cyber blog	ONTINUE
17.10.26	Q3 2026 DDoS, bad bots, and BGP incidents: statistics and overview	As we predicted, botnet sizes returned to growth after a sharp decline in the previous quarter. The largest botnet observed in Q3 2026 comprised 3.56 million devices, up from 2.09 million in Q2.	Cyber blog	QRATORLABS
17.10.26	TRM Labs Supports Microsoft's Disruption of YAM Store, CoGUI, and Iron Man, Three Services Behind Global Scam Operations \|	On October 14, 2026, Microsoft's Digital Crimes Unit and Health-ISAC announced that they are dismantling three components of a Chinese-language cybercrime marketplace: YAM Store, CoGUI, and Iron Man.	Cyber blog	TRM Labs
17.10.26	Threat intel blog	GitHub security improvements, GhostAction phishes OSS maintainers, and DoJ shuts down DPRK laptop farms	Cyber blog	OpenSourceMalware
17.10.26	GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories -	On October 8, 2026, attackers operating the GhostAction GitHub Actions credential-theft campaign compromised two high-profile open-source maintainer accounts and swept 345 repositories in two automated windows lasting minutes. Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC.	Cyber blog	StepSecurity
17.10.26	Front Lines Podcast: What Founders Get Wrong When Pitching CISOs	On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.	Cyber blog	Socket
17.10.26	Socket for Origin Now Available	Socket for Origin scans dependency changes in pull requests and flags security risks based on your team’s policies. Now available in Cursor’s App Marketplace.	Cyber blog	Socket
17.10.26	Deploy with Void	VoidZero's tools such as Vite, Vitest, Oxc, and Rolldown — bundled in one toolchain as Vite+ — have made frontend development faster, but building full-stack applications requires more than just a tooling stack. These applications need server routes, databases, local development environments, and a fast and easy way to deploy ideas to production.	Cyber blog	Cloudflare Blog
17.10.26	Acronis Cyberthreats Update, October 2026	The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in September 2026 and reflect threats that Acronis detected, as well as news stories from the industry. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world.	Cyber blog	ACRONIS
17.10.26	5 Key Takeaways From Censys’ State of the Internet Report	New research from Censys’ 2026 State of the Internet Report challenges familiar assumptions about where Internet infrastructure lives, how it changes, and what’s exposed.	Cyber blog	Censys
17.10.26	Analysis of the Infrastructure of ARTEX, a Chinese AI Penetration Testing Tool #4 – The Birth of Copy Cat	Since the original ARTEX GitHub repository disappeared, there has been an increase in independent distributions and customized instances based on the existing ARTEX codebase. These distributions are being redistributed with the product name, UI, filesystem structure, agent settings, and language modified, while retaining traces of ARTEX.	Cyber blog	ASEC
17.10.26	Weekly Vulnerability Report: Langflow, N8n, And 54 ICS Flaws	This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble’s global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS).	Cyber blog	CYBLE
10.10.26	Open Enrollment Is Where Digital Strategy Gets Tested. Are You Ready?	Most retail purchases come with a return policy. If the sweater doesn't fit, you send it back. But health plan selections work differently. Once a member chooses a plan during open enrollment, they generally keep that plan for the year unless they qualify for a Special Enrollment Period or get coverage another way.	Cyber blog	Akamai
10.10.26	Oh Noes! is updated and free for Cybersecurity Awareness Month	October means Cybersecurity Awareness Month, which for a lot of security teams means the same routine: send a fake phishing email, see who clicks, remind everyone not to click links from strangers. Again.	Cyber blog	Expel
10.10.26	Blinder Tunnel Campaign Targets Iraqi Infrastructure	We discovered that an Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. Unit 42 tracks the activity as CL-STA-1178. This activity includes a campaign we call “Blinder Tunnel,” that targeted Iraqi critical infrastructure in March 2026, following infrastructure staging that was observed as early as November 2025.	Cyber blog	Palo Alto
10.10.26	Making sure the checks get printed	My name is Pierre Cadieux, and I’ll be helping contribute to these newsletters. A little about me: I’ve been working in the cybersecurity industry in many roles over the past 20+ years, first focusing on endpoint security, policies, and firewalls, then moving to risk management and compliance, disaster recovery, and investigations.	Cyber blog	CISCO TALOS
10.10.26	Give yourself room to be human	Fall is officially here in Maryland, and I can’t be more relieved. I flourish in 50 degree weather, where it feels natural to burrow under blankets, knit sweaters, and listen to an audiobook.	Cyber blog	CISCO TALOS
10.10.26	The quest for simplicity: Why SMBs want advanced protection without the complexity	The cybersecurity market is often making it tougher for SMBs to keep threats at bay	Cyber blog	Eset
3.10.26	Beyond Vendor Assessments: Managing Third-Party Risk	Software supply chain security has a well-defined starting line. It has no finish line, even though most programs are built as if it does.	Cyber blog	JSCRAMBLE
3.10.26	Introducing Cloudflare Basin: an open, serverless data platform, now generally available	During Birthday Week 2025, we announced the Cloudflare Data Platform, a suite of products that ingest, store, and query your analytical data. Today, we’re announcing that the platform is generally available, and we’re giving it a new name: Cloudflare Basin.	Cyber blog	CLOUDFLARE
3.10.26	Introducing Workers KV Instant — powered by Quicksilver	Today, we’re introducing Workers KV Instant, a new mode for Workers KV that pushes your changes globally for instant availability without cold read penalties.	Cyber blog	CLOUDFLARE
3.10.26	Cloudflare OS: your company’s agent workspace, managed for you	Cloudflare OS gives everyone in your organization an agent workspace that knows how your company works and connects to its data and systems. Today, we're opening the waitlist for fully managed Cloudflare OS deployments.	Cyber blog	CLOUDFLARE
3.10.26	Announcing Cloudflare K2: serverless event streams	With traditional Remote Procedure Call (RPC) architectures, there exists a core challenge: producers and consumers must align in scale and in time. If your producers send too much data for your consumers to handle or if your consumers or downstream services become unavailable, events are dropped.	Cyber blog	CLOUDFLARE
3.10.26	We want you to build the next Git platform on Cloudflare	GitHub was built for a world where humans write code, organize it into repositories, and collaborate through branches, commits, issues, and pull requests.	Cyber blog	CLOUDFLARE
3.10.26	Support for modern cryptographic algorithms in Workers	Today, Cloudflare Workers is adding support for post-quantum-resistant algorithms within Web Crypto. These are defined in Modern Algorithms in the Web Cryptography API draft community group report, and include:	Cyber blog	CLOUDFLARE
3.10.26	Cloudflare Impact reaches $100 million in donations	This week, Cloudflare's Impact programs will reach $100 million in donated services. It's a significant milestone, and one that we are proud of because it means that thousands of organizations, like journalism outlets, civil society, state and local governments, election management bodies, and public schools are being protected from cyberattacks.	Cyber blog	CLOUDFLARE
3.10.26	Cloud Security Assessments: Set the Right Cadence	While cloud practitioners are accustomed to their fast-moving environments, it’s still common practice to move on to the next priority after the cloud assessment report is delivered and the major findings get remediated.	Cyber blog	GUIDESECURITY
3.10.26	New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles	The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive programs.	Cyber blog	RAPID7
3.10.26	Gotta Breach 'Em All! The Journey Of ShinyHunters	ShinyHunters has outlasted forum takedowns, multiple arrests, and its own founders' convictions. This report traces six years of activity and tactical evolution. From stolen S3 buckets to zero-day exploits, we attempted to explain why the brand keeps surviving what should have ended it.	Cyber blog	SEKOIA
3.10.26	ANY.RUN's Threat Coverage Digest: September 2026	September saw an expansion of detection coverage across network, file, and behavioral activity, providing analysts with additional visibility into suspicious activity. ANY.RUN added 76 behavior signatures, 16 YARA detections, and 1,098 Suricata rules, strengthening coverage across malware activity, suspicious files, and network communications.	Cyber blog	ANYRUN BLOG
3.10.26	CrowdStrike Expands Federal SOC Modernization via CISA-Funded SIEMaaS	Falcon Next-Gen SIEM is now part of CISA’s SIEMaaS technology stack, which gives eligible agencies a funded path to modernize security through the CDM DEFEND F shared service.	Cyber blog	CROWDSTRIKE
3.10.26	Attack Surface Management 2026: Why Point-in-Time Scans Fail	Quarterly scans leave cloud exposures hidden for months. Learn why CISA and FBI data now make continuous attack surface management essential in 2026.	Cyber blog	Cyble
3.10.26	Your IP, Their Traffic	You install an app that offers a reward, a premium feature or perhaps a little money in exchange for sharing some of your unused internet bandwidth. It sounds harmless enough. Your connection is idle most of the time anyway.	Cyber blog	GENDIGITAL
3.10.26	The Fine Art of Frustrating the Adversary	For Cybersecurity Awareness Month, eight Cisco Talos researchers share practical ways defenders can frustrate adversaries at different stages of an operation.	Cyber blog	CISCO TALOS
3.10.26	Give yourself room to be human	Fall is officially here in Maryland, and I can’t be more relieved. I flourish in 50 degree weather, where it feels natural to burrow under blankets, knit sweaters, and listen to an audiobook.	Cyber blog	CISCO TALOS
3.10.26	Securing the keys to the kingdom: Announcing Executive Threat Detection	Attackers are using greater sophistication to gain access to high-yield targets like executives, and company-wide security measures can easily miss these subtle, personal attacks.	Cyber blog	CISCO TALOS
3.10.26	This month in security with Tony Anscombe – September 2026 edition	Autonomous AI agents go on a hacking spree, and Microsoft ships what used to be a year's worth of security patches in one go – here's how to keep pace	Cyber blog	Eset
3.10.26	Is that new (vibe coded) app safe? 5 questions to ask first	As AI lets anyone build software, here’s how to vet that shiny new app before it exposes your data	Cyber blog	Eset
29.9.26	Browser-Based Threat Intelligence & Research	We all know the routine. You’re deep into a new threat report or a breaking blog post, and the tab management anxiety starts to kick in. You find a suspicious indicator, copy it, pivot to your internal tools to see if you’ve seen it before, paste it into a notepad, and then—maybe—try to get it into an actual investigation.	Cyber blog	Securonix SynQ
26.9.26	BengalSEO Part 1: Anatomy of the Operation - The DFIR Report	In March 2026, a widespread SEO Poisoning campaign leading to malware deployment and tech support scams was identified by the DFIR Report.	Cyber blog	THEDFIRREPORT
26.9.26	The OpenSourceMalware Show #22	ShinyHunters vs. the FBI and Cl0p: ShinyHunters claims it stole data from an FBI jobs website through a PeopleSoft zero-day, and it is threatening to leak that data unless the FBI retracts a May FLASH tied to the Instructure Canvas breach. We cover why aging enterprise monoliths like PeopleSoft and WebLogic are such attractive targets. We also get into the group’s escalating public feud with ransomware crew Cl0p.	Cyber blog	OpenSource Malware Blog
26.9.26	New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles	The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive programs. Success going forward can’t be about patching as much as possible - it has to be about understanding what matters most and reducing the exposures attackers can actually reach.	Cyber blog	RAPID7
26.9.26	‘Nudify’ apps: What to do if someone makes a fake nude of you	Whether you’re a victim, the parent of a victim, or just concerned, here’s what you can do about fake nude images	Cyber blog	Eset
26.9.26	Dark Web Roast - August 2026 Edition	Blog - Dark Web Roast August 2026 Edition.	Cyber blog	TRELLIX
23.9.26	Announcing the Next Evolution of Proofpoint Cyber Defense	The most dangerous attacks today don’t come from strangers. They come from real accounts, in familiar threads, asking for exactly the kind of thing those accounts normally ask for.	Cyber blog	PROOFPOINT
23.9.26	In Cybersecurity, Behavior is a Signal. Intent is the Full Story.	For most of cybersecurity’s history, we built defenses around a simple assumption: people use technology, and technology follows their direction.	Cyber blog	PROOFPOINT
23.9.26	The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026	In sports, a great defense must understand the offense. It is no different in security operations. It is not enough to just know threat intelligence—it needs to be acted on. Forrester recognizes ReliaQuest in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026, where ReliaQuest was named a Strong Performer.	Cyber blog	RELIQUEST
23.9.26	Berlin Data Leak: What Rhysida Published, and What Is Still Unresolved	In August 2026, the Rhysida extortion group breached Berlin’s state network and copied roughly 1.44 million files from two of the city-state’s Senate administrations. Berlin disconnected the affected departments on August 14, refused a ransom demand of 30 BTC, and on September 4 the group released the archive to public access on its Dark Web leak site.	Cyber blog	SOCRADAR
22.9.26	Dominican Republic Leak, Celestial Malware, Money Network Sale, CVV Auction, and US VPN Access	SOCRadar Dark Web Team identified several new underground posts, including an alleged Dominican Republic citizen data leak, an alleged Celestial malware suite sale, and an alleged Money Network database sale.	Cyber blog	SOCRADAR
22.9.26	Clop Hack: ShinyHunters Hijacks Data Leak Site	ShinyHunters has turned the tables on rival cybercrime operation Clop (a.k.a. Cl0p), hijacking and defacing the ransomware gang’s own Dark Web leak site (DLS).	Cyber blog	SOCRADAR
18.9.26	S&P Global Agrees to Buy OpenZeppelin and Fold Smart Contract Audits Into Ratings	The ratings firm that cut Tether’s stability grade to its lowest level last year is buying the security company behind the open source smart contract libraries widely used across DeFi, and it is placing the business under S&P Global Ratings.	Cyber blog	UNCHAINEDCRYPTO
18.9.26	Stop Fraudulent Hires	You can't out-verify a stolen identity at the door. What you can do is make the enterprise a place where behavior that doesn't match the story surfaces early, before access is ever granted.	Cyber blog	Abnormal AI
18.9.26	Global Public Sector Under Siege: Threat Intelligence for Q2 2026	In the second quarter of 2026, threats to the public sector have become increasingly persistent: from AI-generated ransomware, nation-state espionage, supply chain attacks, and many more, critical institutions face a rapidly growing range of risks.	Cyber blog	Trend Micro
18.9.26	Cyber Threats in Times of Conflict	The image of powerful nations releasing their cyber-arsenal to disrupt or cripple their victims’ infrastructure, military capabilities or economy during times of conflict has been largely a matter of speculation and Hollywood movies until recently.	Cyber blog	EMISISOFT
18.9.26	Acronis Cyberthreats Update, September 2026	The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in August 2026 and reflect threats that Acronis detected, as well as news stories from the industry. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world.	Cyber blog	ACRONIS
18.9.26	Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR	The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface.	Cyber blog	RAPID7
18.9.26	Sisterhood of the Traveling Pants CTF Writeup	With women comprising approximately 22% of the global cybersecurity workforce, organizations like Women in CyberSecurity (WiCyS) are actively working to close the gender gap. As a proud partner of WiCyS, we joined forces with SANS Institute to bring the “Sisterhood of the Traveling Packets” CTF to life.	Cyber blog	FLARE.IO
18.9.26	Dynamic Protection: When Controls Move With the Risk	The fastest way to lose confidence in a data protection program is to block something the business needed to do. Anyone who has run DLP knows the sequence: a rule fires on a legitimate transfer, an exception gets written, and after enough false positives, policies slide into monitor-only mode. Protection that doesn't fit the moment doesn't protect anything for long.	Cyber blog	PROOFPOINT
18.9.26	How MSSPs Can Prove Their Value During a Quiet Month	The problem is not that the SOC did nothing. Quite the opposite. Analysts may have investigated hundreds of suspicious files, URLs, emails, and alerts. They may have confirmed malicious activity, closed false positives, identified new infrastructure, and stopped cases from consuming more time or reaching higher escalation tiers.	Cyber blog	ANYRUN BLOG
18.9.26	ANY.RUN & SentinelOne: One Workspace, Instant Threat Context	Speed and clarity are the ultimate advantages for modern SOC teams. The integration of ANY.RUN into SentinelOne delivers exactly that. Instant threat intelligence and interactive sandbox capabilities embedded right where your analysts already work.	Cyber blog	ANYRUN BLOG
18.9.26	Enterprise Threat Intelligence Buying Guide	Choosing an enterprise threat intelligence solution is about more than just data volume or integrations. The right provider should deliver relevant intelligence, fit existing workflows, and help security teams investigate threats faster.	Cyber blog	ANYRUN BLOG
18.9.26	CrowdStrike Named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026	CrowdStrike has been named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026, receiving the highest scores in both the Current Offering and Strategy categories. We believe this recognition reflects an important shift in what organizations need from threat intelligence.	Cyber blog	CROWDSTRIKE
18.9.26	Cybersecurity Compliance APAC 2026: What CISOs Need Now	Cybersecurity compliance APAC 2026 has moved from guidance to enforcement across three of Southeast Asia’s largest economies, almost in step. Singapore’s Cyber Security Agency issued an updated Cybersecurity Code of Practice 2026 for Critical Information Infrastructure on 29 July 2026.	Cyber blog	Cyble
18.9.26	Inside the Modern SOC: Defending the Cross-Environment Pivot	Across Unit 42 investigations, we continue to see adversaries move well beyond where an attack begins. They pivot across the enterprise, avoiding detection by exploiting the visibility gaps created by disconnected security tools.	Cyber blog	Palo Alto
18.9.26	Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection	As cloud environments expand to include human, machine and autonomous agent identities, mapping the functional roles of these identities has become a significant security challenge. To address this challenge, we designed a behavioral clustering model that extracts activity patterns from cloud audit logs.	Cyber blog	Palo Alto
18.9.26	We've got one word for it, and it's usually the wrong one	In this week's Threat Source newsletter, Joe explores why the word "burnout" often fails to capture the true toll of working in the cybersecurity industry and why we need better language to address it.	Cyber blog	CISCO TALOS
18.9.26	Cyberthreats are moving faster than SMBs: Readiness must accelerate	As AI adoption expands the attack surface and adds to the security workload, businesses need automation backed by experts	Cyber blog	Eset
16.9.26	Sisterhood of the Traveling Pants CTF Writeup	With women comprising approximately 22% of the global cybersecurity workforce, organizations like Women in CyberSecurity (WiCyS) are actively working to close the gender gap. As a proud partner of WiCyS, we joined forces with SANS Institute to bring the “Sisterhood of the Traveling Packets” CTF to life.	Cyber blog	FLARE.IO
16.9.26	Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware	On X, the threat actor posed as the head of marketing at CoinDesk, appearing to use one person's name and another's photograph. Huntress confirmed that this account reached out to multiple security researchers at the tail end of DEFCON, using a boilerplate lure themed around an upcoming crypto conference.	Cyber blog	Huntress
16.9.26	ANY.RUN & SentinelOne: One Workspace, Instant Threat Context	Speed and clarity are the ultimate advantages for modern SOC teams. The integration of ANY.RUN into SentinelOne delivers exactly that. Instant threat intelligence and interactive sandbox capabilities embedded right where your analysts already work.	Cyber blog	ANYRUN BLOG
16.9.26	H1 2026 Cyber Risk Report by ANY.RUN	ANY.RUN has released its H1 Cyber Risk Report, built on unique data from real-world submissions analyzed in the ANY.RUN Interactive Sandbox from January to June 2026 by over 700,000 analysts and 16,000 SOC teams.	Cyber blog	ANYRUN BLOG
12.9.26	DefCon 2026: The Sandbox Is a Suggestion: Breaking Claude Code, Gemini CLI, and Codex Sandboxes	How we broke the default sandboxes in Claude Code, Gemini CLI, and Codex — leaking credentials from all three, including a CVSS 10.0 chain. DefCon 2026 research.	Cyber blog	NOVEE
12.9.26	DefCon 2026: No Prompt Required: Pre-Task RCE in Google Gemini CLI	How a CVSS 10.0 pre-task RCE in Google Gemini CLI ran attacker code before the sandbox started. No prompt injection required. Full DefCon 2026 research.	Cyber blog	NOVEE
12.9.26	CRA Reporting Goes Live September 11: What Manufacturers Must Have in Place When the Clock Starts	Product security continues to stand as a forefront of risk for manufacturers and developers worldwide. Consumers are consistently seeking new ways to protect themselves, their environments and their own systems. While some of this responsibility may fall on user’LAUDs, many look to the product engineers behind their solutions as a first line of defense.	Cyber blog	GUIDESECURITY
12.9.26	15 Minutes Saved Per Alert: How a Lean German Manufacturer Protects 10,000 Endpoints with ANY.RUN	To get an insider’s view on how teams navigate these industry demands, we sat down with Philipp Z., Security Lead at a leading German manufacturer. He shared how replacing complex manual analysis with ANY.RUN’s Interactive Sandbox helped his team accelerate incident response by 15 minutes per case, eliminate tedious routines, and strengthen their overall security posture.	Cyber blog	ANYRUN BLOG
12.9.26	Cyble Introduces Major Upgrade to its Executive Monitoring Module	Cyble has rolled out a significant upgrade to Executive Monitoring inside Cyble Vision, bringing unified findings, AI-driven scoring, and expanded alerting together in a single protection suite.	Cyber blog	Cyble
12.9.26	Qatar’s Digital Boom Has a Blind Spot: What the 2025-26 Threat Data Is Telling Us	Qatar is racing toward a knowledge-based, fully digital economy. But that pace of transformation makes Qatar an attractive target in the cyber realm.	Cyber blog	Cyble
12.9.26	We've got one word for it, and it's usually the wrong one	In this week's Threat Source newsletter, Joe explores why the word "burnout" often fails to capture the true toll of working in the cybersecurity industry and why we need better language to address it.	Cyber blog	CISCO TALOS
10.9.26	NSA Best Practices for Cyber Hygiene recommends allowlisting, Zero Trust controls	On September 3, 2026, the NSA released new cyber hygiene best practices focused on defending against AI-enhanced threats. With cybercriminals increasingly using AI tools to boost attacks, the NSA highlighted weak authentication, unpatched systems, and misconfigurations as persistent issues attackers take advantage of.	Cyber blog	THREATLOCKER
5.9.26	Compliance at the Speed of Regulation	For years, compliance teams built their programs around a manageable, well-known set of frameworks: PCI-DSS for payment data, HIPAA for healthcare, SOC 2 for service organizations, ISO 27001 for information security management. These frameworks were stable. Auditors knew them. Tooling was built around them. And most importantly, the list didn't change very often.	Cyber blog	PROOFPOINT
5.9.26	Why Proofpoint Is Signing On to Collective Cyber Defense with Frontier Labs	Last week, OpenAI published an open letter calling for a global surge in cyber defense. Proofpoint is proud to stand alongside frontier labs, fellow security vendors, and global enterprises in signing it.	Cyber blog	PROOFPOINT
5.9.26	Proofpoint Introduces SOC Analyst Agent, Powered by OpenAI Daybreak Models Through Daybreak Defense Network	Security teams don’t have a data problem. They have a prioritization problem. Alerts arrive faster than any team can review them, spread across a growing set of products, each with its own console and its own version of the truth.	Cyber blog	PROOFPOINT
5.9.26	Impersonating IT support: how threat actors turn a remote session into enterprise-wide access	Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.	Cyber blog	Microsoft blog
5.9.26	Counterfeit installers to system compromise: Tracking a deceptive software download campaign	An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives.	Cyber blog	Microsoft blog
5.9.26	The story behind the intelligence	From engaging with cybercriminals to surviving a live Flamin’ Hot Cheetos taste test, Hazel reflects on the latest Beers with Talos with Azim, where they cover the full spectrum of what it takes to gather threat intel.	Cyber blog	CISCO TALOS
5.9.26	I’ve been deepfaked: What do I do?	Don’t panic if you spot an illegally created image or video of you online – there are ways to request its removal	Cyber blog	Eset
5.9.26	This month in security with Tony Anscombe – August 2026 edition	Details about the Hugging Face hack, critical infrastructure under attack, a spoofed in-flight Wi-Fi network, and more of this month's cybersecurity news	Cyber blog	Eset
3.9.26	Counterfeit installers to system compromise: Tracking a deceptive software download campaign	Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers.	Cyber blog	Microsoft blog
3.9.26	Clop Never Left: Inside the PTC Windchill Data Theft Campaign	Patch CVE-2026-12569, but do not confuse patching with scoping. Hunt back to early June for hex-named JSP files in the Windchill codebase login directory, for flst.txt, and for the X-windchill-req header if you happen to log headers.	Cyber blog	SUCERONIX
2.9.26	Proofpoint Sponsors the Insider Threat Matrix: Building a Common Language for Insider Risk	Today, Proofpoint is proud to sponsor the Insider Threat MatrixTM, an open, community-driven framework designed to help organizations better understand, detect, and investigate insider risk—both human and synthetic.	Cyber blog	PROOFPOINT
29.8.26	Cymulate Cowork: Engineering Cyber Defenses at Machine Speed	Security teams feel the squeeze of AI across threats, CVE discovery and weaponization. It’s time for AI to give cyber defenders an advantage by integrating validation into automated workflows that filter out the noise and build stronger defenses.	Cyber blog	CYMULATE
29.8.26	How Play Achieves Encryption	TL;DR – Play (aka PlayCrypt) is a successful threat actor that employs double extortion techniques against its victims in North and South America and Europe. Understand what it does and why its techniques have been successful thus far.	Cyber blog	GUIDESECURITY
29.8.26	How Nokian Tyres found a cybersecurity partner it could trust	Learn how Nokian Tyres improved email security, gained threat visibility and built a trusted cybersecurity partnership with Barracuda.	Cyber blog	BARRACUDA
29.8.26	SOC Threat Radar — August 2026	Barracuda Research highlights recent SOC findings on GlobalProtect scanning, credential harvesting, firewall misconfigurations, and abuse of trusted remote access software.	Cyber blog	BARRACUDA
29.8.26	From ‘High/Medium/Low’ to Dollars: Making Cyber Risk Legible to Your CFO	Learn how cyber risk quantification helps CFOs measure financial exposure, assess business impact, and prioritize security investments.	Cyber blog	Cyble
22.8.26	Rapid7 and Licencias OnLine Partner to Accelerate Cybersecurity Maturity across Latin America	Across Latin America, organizations are embracing cloud, AI, and digital transformation to drive innovation and business growth. These technologies create new opportunities, but also introduce greater complexity and expanding attack surfaces.	Cyber blog	RAPID7
22.8.26	SOCRadar Ranks No. 542 on the 2026 Inc. 5000 List of America's Fastest...	SOCRadar Ranks No. 542 on the 2026 Inc. 5000 List of America’s Fastest-Growing Private Companies SOCRadar Is Recognized for 645% Three-Year Revenue Growth, Marking Its Second Consecutive Year on the L...	Cyber blog	SOCRADAR
22.8.26	Italy RDWeb Access, GBCSA Data Sale, SCHUFA Claim, and FLY Firebase Ex...	Italy RDWeb Access, GBCSA Data Sale, SCHUFA Claim, and FLY Firebase Exposure SOCRadar Dark Web Team identified several new underground posts involving alleged initial access sales and large-scale data...	Cyber blog	SOCRADAR
22.8.26	From Blackwater to Cyber-Privateers: When States Outsource Force	From Blackwater to Cyber-Privateers: When States Outsource Force On August 12, 2026, President Donald Trump signed a National Security Presidential Memorandum titled “Expanding Capabilities to Combat ...	Cyber blog	SOCRADAR
22.8.26	Efimer Brings Its Own Tools to the Job	This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of Efimer malware. This is a Python-based executable compiled with PyInstaller and protected with PyArmor to obfuscate the many libraries and payloads that are packed within. Efimer has extensive anti-analysis capabilities and, when executed, uses geo-IP information to identify Tor network connections for data exfiltration.	Cyber blog	SonicWall
22.8.26	Identity Abuse Through Trusted Communication Channels	Identity has become a primary security boundary for most organizations, reducing the ability to solely trust other boundaries once associated with corporate networks. Users authenticate to cloud services using enterprise identities that provide access to collaboration platforms, business applications and sensitive data. With the adoption of software-as-a-service (SaaS) on the rise, people are shifting to platforms for communication and collaboration.	Cyber blog	Palo Alto
22.8.26	Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect	StopAndProtect is a newly identified operation that combines file encryption with data theft. The criminals abuse thousands of hacked WordPress websites as their infrastructure – using them to spread the malware, control infected machines, and store stolen documents, screenshots, and activity logs (records created by malware to track its actions, progress, or status during execution).	Cyber blog	CHECKPOINT
22.8.26	BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive	What if a trusted security component could be repurposed into an attacker-controlled kernel primitive? What if a signed Microsoft remediation driver could be instructed to execute arbitrary file and registry operations from Ring 0 – without exploits, vulnerabilities, or memory corruption?	Cyber blog	CHECKPOINT
22.8.26	Describing attacks with crime script analysis	Martin explores how using crime script analysis to describe an attack with everyday language makes the situation accessible to non-technical audiences and identify points where the crime can be disrupted.	Cyber blog	CISCO TALOS
22.8.26	Is Cyber missing the Marque?	In this week's newsletter, new author Mick Baccio introduces himself and explores the operational and security implications of the new White House memorandum regarding private sector participation in government-authorized offensive cyber operations.	Cyber blog	CISCO TALOS
15.8.26	From Blackwater to Cyber-Privateers: When States Outsource Force	On August 12, 2026, President Donald Trump signed a National Security Presidential Memorandum titled “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime.”	Cyber blog	SOCRADAR
15.8.26	Curiouser and Curiouser	In this edition of the Threat Source newsletter, William reflects on the “Make Hazel a Hacker” segment in Beers with Talos, and how cybersecurity is a field where questions can lead to multiple correct answers.	Cyber blog	CISCO TALOS
15.8.26	This month in security with Tony Anscombe – July 2026 edition	OpenAI models going rogue, the first documented agentic ransomware operation, and an emergent AI-driven supply chain threat made for a packed July roundup	Cyber blog	Eset
8.8.26	UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments	Google Threat Intelligence Group (GTIG) continues to track UNC6671 actively conducting compromises leading to data theft extortion, despite the alleged announced retirement of the BlackFile extortion brand in May 2026. Telemetry and infrastructure analysis reveal that rather than disbanding, UNC6671 has diversified its operations across multiple extortion fronts including Redact, Pink, Helix, and Falcon.	Cyber blog	GTI
8.8.26	No File, No Trace: How a Fake Invoice Hides a Formbook Loader in Plain Sight	This week, the SonicWall Capture Labs Threat Research Team identified an ongoing campaign distributing Formbook malware through phishing emails disguised as routine business documents, purchase orders, shipping notices, and request-for-quote attachments targeting unsuspecting users and businesses.	Cyber blog	SonicWall
8.8.26	Why metaphor may dictate your security strategy	In this week's newsletter, Martin looks at how the metaphors we use to describe AI "escaping" its sandbox can completely change how we react to the threat.	Cyber blog	CISCO TALOS
1.8.26	Bitdefender Threat Debrief \| July 2026	This edition of the Bitdefender Threat Debrief covers the latest developments in the ransomware threat landscape, including Qilin’s fall from the number one rank in Top Groups. Other events featured in this release include the arrest of a Scattered Spider operator, the criminal act of ransom negotiation, and an update on the FortiBleed campaign.	Cyber blog	BITDEFENDER
1.8.26	The US CFO’s Playbook: How to Reduce Cyber Risk Without Scaling SOC Team in a Tight Labor Market	Cyber risk is increasing, but so is the cost of managing it. More than 514,000 cybersecurity job listings appeared in the US between May 2024 and April 2025, while the mean annual wage for an information security analyst reached $132,510.	Cyber blog	ANYRUN BLOG
1.8.26	Huntress Threat Advisory: Widespread SonicWall Credential Stuffing Campaign	Starting on July 25, 2026, at approximately 18:02:21 UTC, the Huntress SOC detected an out-of-the-ordinary spike in successful SonicWall VPN and firewall logins. These logins originated from a suspicious Autonomous System Number (ASN). We did not observe any post-compromise hands-on-keyboard activity from these attacks.	Cyber blog	Huntress
1.8.26	Elastic goes all-in on Hacker Summer Camp at Black Hat and DEF CON in Las Vegas	Attack Discovery turns raw alerts into validated threats and Elastic Defend closes vulnerable driver gaps as fast as they're disclosed. Watch it all run against real attacks at the booth.	Cyber blog	ELASTIC
1.8.26	Announcing InfraTrust, the source of intelligence on security risks across hardware infrastructure	Today we’re excited to announce InfraTrust, a global hardware infrastructure security knowledgebase making mission critical infrastructure security data available faster, so you have it when you need it to defend your enterprise. InfraTrust is a searchable, continuously updated source of security advisories and risk data from major enterprise hardware infrastructure vendors.	Cyber blog	Eclypsium
1.8.26	Email threat landscape: Q2 2026 trends and insights	In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi-stage attack chains.	Cyber blog	Microsoft blog
1.8.26	IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains	Talos IR's Q2 report highlights a significant surge in phishing-based initial access and the weaponization of legitimate remote management tools. Learn how to sharpen your defenses.	Cyber blog	CISCO TALOS
1.8.26	Black Hat special: Rewind and revisit	Amy looks back at the incredible journeys that brought past guests to the world of threat intelligence.	Cyber blog	CISCO TALOS
1.8.26	Preview: Cisco Talos at Black Hat USA 2026	Here’s some of the ways Talos is showing up at Black Hat, alongside our friends at Cisco and Splunk.	Cyber blog	CISCO TALOS
1.8.26	You were onto something with “It’s the Climb,” Miley	Amy hikes Virginia’s most difficult trail and muses on the persistent challenges of cybersecurity. The two aren't dissimilar.	Cyber blog	CISCO TALOS
1.8.26	Don’t swing at everything	Thorsten explores Q2 2026 stats, the artificial buffer zone of 2026, and why smart, prioritized patching is more critical than ever.	Cyber blog	CISCO TALOS
1.8.26	Begun, the Patch Wars have	Long foretold, the Great Patching has begun and it’s a doozy. Buckle in as Joe takes you through the story.	Cyber blog	CISCO TALOS
1.8.26	The Hunter's Paradox: Is it time to embrace automated threat hunting?	Humans can no longer keep up with the volume and velocity of security data on their own, but AI can't be fully trusted. David discusses the merits of both and muses on what the future might look like.	Cyber blog	CISCO TALOS
1.8.26	Beyond the screenshot: Why you should verify what you see	The screenshot may look convincing, but it doesn’t necessarily prove that the payment, booking or conversation is genuine	Cyber blog	Eset
25.7.26	Announcing InfraTrust, the source of intelligence on security risks across hardware infrastructure	Today we’re excited to announce InfraTrust, a global hardware infrastructure security knowledgebase making mission critical infrastructure security data available faster, so you have it when you need it to defend your enterprise. InfraTrust is a searchable, continuously updated source of security advisories and risk data from major enterprise hardware infrastructure vendors.	Cyber blog	Eclypsium
25.7.26	Preview: Cisco Talos at Black Hat USA 2026	Here’s some of the ways Talos is showing up at Black Hat, alongside our friends at Cisco and Splunk.	Cyber blog	CISCO TALOS
18.7.26	[Video] Where protection starts: Cisco Talos Intelligence Integrations	Every day, defenders make high-consequence decisions with incomplete information. Learn how Cisco Talos Intelligence Integrations help reduce uncertainty by turning the latest threat intelligence into proactive protections across Cisco technologies.	Cyber blog	CISCO TALOS
18.7.26	The serpent’s tongue: Luring the Python out of its den	This blog examines the full lifecycle of a Python package, from hosting on repositories such as PyPI or custom web servers, through source and wheel distribution formats, to the final installation into virtual or system-wide Python environments.	Cyber blog	CISCO TALOS
11.7.26	Sophos named a 2026 Gartner® Peer Insights™ Customers’ Choice for Email Security	Sophos has been named a 2026 Gartner® Peer Insights™ Customers’ Choice in the 2026 Gartner® Peer Insights™ Voice of the Customer for Email Security. This marks Sophos’ entry into the report, as well as Sophos’ first ever Customers’ Choice distinction for Email Security.	Cyber blog	SOPHOS
11.7.26	Inside the Underground Economy: 5 Dark Web Trends Shaping the 2026 Threat Landscape	Cyble breaks down how dark web ecosystems are evolving in 2026 with ransomware, initial access brokers, AI-driven attacks, and underground threat activity.	Cyber blog	Cyble
11.7.26	Mid-Year Threat Trends: What H1 2026 Signals for the Rest of the Year	H1 2026 threat intelligence trends show rising ransomware, AI-driven attacks, and identity risks reshaping the global cyber risk outlook for 2026.	Cyber blog	Cyble
11.7.26	Winning 54% of the time	With Wimbledon's help, Hazel argues against the popular myth that "Attackers only need to be right once, but defenders need to be right 100% of the time."	Cyber blog	CISCO TALOS
11.7.26	ESET Threat Report H1 2026	A view of the H1 2026 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts.	Cyber blog	Eset
4.7.26	Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment	Authors: Dixit Panchal & Soumen Burma Table of Contents: Introduction: Key Targets: Infection Chain: Initial Findings about Campaign: Initial Mail: Email Attachment: Lure: Official GoI, Income Tax Document: Technical Analysis: Infrastructural Artefacts & Threat actor Attributions. Campaign Timeline. Conclusion:...	Cyber blog	Seqrite
4.7.26	Catan and Mouse	What do board games and cybersecurity have in common? Pattern recognition. Strategy. Adaptation. In this week’s Threat Source Bill explores why curiosity may be a defender’s most valuable skill.	Cyber blog	CISCO TALOS
4.7.26	Martin Lee: Running through the Arctic (and the threat landscape)	Ever wonder how someone goes from studying human viruses to leading cybersecurity teams? In this Humans of Talos, we’re joined by Martin Lee, EMEA Lead, to talk about his journey into the industry.	Cyber blog	CISCO TALOS
4.7.26	Cyber readiness for SMBs: Getting the basics right	AI is changing cybercrime, but SMB cyber readiness still largely depends on closing the familiar gaps	Cyber blog	Eset
4.7.26	This month in security with Tony Anscombe – June 2026 edition	Three-day patching deadlines, exposed fuel-tank systems, scams costing billions of dollars, and social media bans for children all gave Tony plenty to unpack in June 2026	Cyber blog	Eset
4.7.26	Inside the inbox: Why cybercriminals want to break into your email account	Your inbox is an identity system all of its own: whoever owns it may own a lot more	Cyber blog	Eset
27.6.26	Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment	Authors: Dixit Panchal & Soumen Burma Table of Contents: Introduction: Key Targets: Infection Chain: Initial Findings about Campaign: Initial Mail: Email Attachment: Lure: Official GoI, Income Tax Document: Technical Analysis: Infrastructural Artefacts & Threat actor Attributions. Campaign Timeline. Conclusion:...	Cyber blog	Cyble
27.6.26	Fake invoices are moving from inboxes to shopping apps	Scammers are using order-tracking apps to place fake receipts where users expect to see real purchases, then pushing them to call fake support numbers.	Cyber blog	GENDIGITAL
19.6.26	FortiBleed: You Can't Patch Your Way Out of This	A multi-phase campaign has cracked administrative credentials on roughly half of the world’s internet-facing FortiGate firewalls, and because the persistence lies below the operating system, patching will not mitigate all the threats.	Cyber blog	Eclypsium
19.6.26	Operation FanTrap: Inside the FIFA 2026 Fraud Ecosystem	Operation FanTrap reveals FIFA 2026 fraud ecosystem with 4,000+ fake domains, phishing, streaming scams, and dark web-driven cybercrime activity.	Cyber blog	Cyble
19.6.26	Fake hiring pages abuse FIFA and other major brands to steal work credentials	Scammers are copying recruitment and calendar-booking flows to make fake Google and Facebook sign-ins look routine.	Cyber blog	GENDIGITAL
19.6.26	Governing Claude Enterprise in Environments Where Inline Controls Can't Go	TrendAI™ integrates the Claude Compliance API into TrendAI Vision One™ through two collectors that bring AI-aware visibility and detection to Claude Enterprise usage: one keeps all data inside the environment, while the other feeds TrendAI Vision One™ for deeper correlation and compliance.	Cyber blog	Trend Micro
19.6.26	Close Encounters of the Human Kind	In the latest Threat Source, Hazel channels her inner Spielberg to explore why humans are delightfully irrational, reminding us that while security best practices are simple in theory, they’re a lot harder to pull off when you’re busy dealing with real life.	Cyber blog	CISCO TALOS
19.6.26	Winning the cyber marathon with Tony Giandomenico	Tony Giandomenico, Senior Director of Product Management, joins Amy to discuss the Talos Threat Hunting launch what he's excited about for the future of cybersecurity, and, of course, his Ironman triathlons.	Cyber blog	CISCO TALOS
19.6.26	Hypotheses, telemetry, and human judgment: Inside Cisco Talos Threat Hunting	Learn how Cisco Talos Threat Hunting uses hypothesis-driven methods and multi-domain telemetry correlation to find stealthy threats operating below automated detection thresholds.	Cyber blog	CISCO TALOS
13.6.26	FIFA World Cup 2026 Scams Are Already Active: Fake Domains, Phishing Sites, and How to Stay Safe	FIFA World Cup 2026 scams are rising as cybercriminals launch fake tickets, recruitment, and streaming websites targeting fans worldwide.	Cyber blog	Cyble
13.6.26	Who's Really Using Your Home Internet Connection?	Since January 2026, we have detected 7.4 million malicious incidents tied to residential proxy traffic, affecting 572,000 users in our telemetry. In this model, the household whose connection is being used is often not the buyer of the traffic. It is the exit point.	Cyber blog	GENDIGITAL
13.6.26	Fake hiring pages abuse FIFA and other major brands to steal work credentials	In samples reviewed by Gen threat researchers, scammers used branded hiring pages that looked like ordinary recruitment flows: a company logo, a recruiter profile, a 30-minute meeting, and a button to continue with Google or Facebook. There was no attachment to open and no software to install. The credential theft attempt sat inside a step many job applicants already expect: signing in to schedule a call.	Cyber blog	GENDIGITAL
13.6.26	GenAI Is Both Hunter and Hunted at Pwn2Own Berlin 2026	This year’s Pwn2Own competition in Berlin revealed just how much of the AI stack remains exposed -- and the gap between what these tools promise and what they can withstand point to the fragile security foundations underneath.	Cyber blog	Trend Micro
13.6.26	A tale of two eras	In this week’s newsletter, Amy reminisces on the tech toys of their childhood, inspired by a hilarious lesson about why your digital privacy shouldn't be left on an open channel.	Cyber blog	CISCO TALOS
13.6.26	What makes or breaks SMB cyber-readiness	A company that's expecting a cyberattack but hasn’t actively prepared for it risks making the hardest decisions at the worst possible moment	Cyber blog	Eset
13.6.26	Cybercriminals: the 'auditors' you never hired	Every organisation gets audited. The question is who does the auditing.	Cyber blog	Eset
6.6.26	Pwn2Own Berlin 2026: On the Ground With TrendAI™ ZDI's Biggest AI Showdown Yet	47 zero-days fell at Pwn2Own Berlin 2026 for US$1,298,250 in payouts. TrendAI™ was on the ground all three days — here's what we saw.	Cyber blog	Trend Micro
6.6.26	The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2)	The security of the npm ecosystem reached a critical inflection point in September 2025. The Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious packages, marked the end of the “nuisance” era of npm attacks and the beginning of a high-consequence threat landscape.	Cyber blog	Palo Alto
6.6.26	Hypotheses, telemetry, and human judgment: Inside Cisco Talos Threat Hunting	Learn how Cisco Talos Threat Hunting uses hypothesis-driven methods and multi-domain telemetry correlation to find stealthy threats operating below automated detection thresholds.	Cyber blog	CISCO TALOS
6.6.26	Reporting from Vegas: Networking, AI, and good boys	Joe’s on-the-ground report from Cisco Live U.S. is here, complete with therapy dog pictures and tips on handling conference overstimulation.	Cyber blog	CISCO TALOS
6.6.26	Winning the cyber marathon with Tony Giandomenico	Tony Giandomenico, Senior Director of Product Management, joins Amy to discuss the Talos Threat Hunting launch what he's excited about for the future of cybersecurity, and, of course, his Ironman triathlons.	Cyber blog	CISCO TALOS
30.5.26	Introducing EvidenceForge: Synthetic security logs that don’t look (as) fake	EvidenceForge generates high-quality, realistic, and consistent datasets across multiple log formats, enabling teams to effectively train personnel and validate detection models without the need for complex manual simulations.	Cyber blog	CISCO TALOS
30.5.26	Less panic patching, more precision	In this newsletter, Thor breaks down why you should stop relying solely on CVSS and start using EPSS and GCVE to focus your patching efforts on the threats that actually matter.	Cyber blog	CISCO TALOS
30.5.26	DICOM, Pydicom, GDCM, and Orthanc: A technical tour of what really happens in the heap	This white paper presents a concrete case study demonstrating the creation of a heap overflow vulnerability through the exploitation of the DICOM file format.	Cyber blog	CISCO TALOS
30.5.26	This month in security with Tony Anscombe – May 2026 edition	In this roundup, Tony looks at attacks against Polish water treatment facilities, how AI-directed attacks failed in Mexico, and what Google believes is the first AI-generated zero-day exploit	Cyber blog	Eset
23.5.26	Operation Dragon Whistle: UNG0002 Targets Chinese Academia via Weaponized Institutional Lure	Table of Contents: Introduction: Key Targets: Infection Chain: Initial Findings about Campaign: Analysis of Decoys & Spear phishing Email: Technical Analysis: Stage1: Analysis of LNK File. Stage2: Analysis of VBS. Stage3: DLL Side Loading. Infrastructural Artefacts & Threat actor...	Cyber blog	Seqrite
23.5.26	Cyble Named a Challenger in the Inaugural 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies	One of the only two vendors recognized as a Challenger out of 17 evaluated vendors in the first-ever Gartner® evaluation of cyberthreat intelligence market.	Cyber blog	Cyble
23.5.26	Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise	Watch out for bogus World Cup websites that mimic official ticket and merchandise flows to steal money and personal data	Cyber blog	Eset
23.5.26	The quest for greater tech independence	A complete decoupling from US technology is neither realistic nor necessary, but the changing environment does require nations and companies to reassess their relationships and dependencies	Cyber blog	Eset
16.5.26	Breaking things to keep them safe with Philippe Laulheret	Philippe shares his unique journey from French engineering school to the front lines of cybersecurity, explaining how his lifelong love for solving puzzles helps him uncover critical security flaws before they can be exploited.	Cyber blog	CISCO TALOS
16.5.26	Unplug your way to better code	Cybersecurity concepts — logs, packets, DNS exfiltration, and more — are usually intangible, and its practitioners are prone to mental fatigue, Amy takes a second to yell at you to go touch grass.	Cyber blog	CISCO TALOS
16.5.26	Why geopolitical turmoil is a gift for scammers, and how to stay safe	Conflict is a boon for opportunistic fraudsters. Look out for their ploys.	Cyber blog	Eset
9.5.26	Zero Trust Target Level Compliance Device Pillar Challenges: Do The Hard Parts Now	The Department of War’s Zero Trust Target Level deadline may be September 30, 2027, but for agencies responsible for device security, the practical deadline comes much sooner.	Cyber blog	Eclypsium
9.5.26	Cyble Recognized in the 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies — and What Cyble Feels It Means for the Next Era of Threat Intel	A note from our CEO on the recognition, what we believe it signals about the category, and where we go from here.	Cyber blog	Cyble
2.5.26	The Week in Vulnerabilities: GitHub Enterprise, Argo CD, Oracle Identity Manager, and Mozilla Security Flaws	Cyble weekly vulnerability report shows 1,095 vulnerabilities, PoCs, KEV additions, and active attacks across enterprise, cloud, and open-source.	Cyber blog	Cyble
2.5.26	Five defender priorities from the Talos Year in Review	With attackers moving faster than ever, it’s easy to feel overwhelmed. This blog breaks down five practical priorities from the Cisco Talos 2025 Year in Review to help defenders focus and prioritize, amidst all the noise.	Cyber blog	CISCO TALOS
2.5.26	Great responsibility, without great power	In this week’s newsletter, Hazel uses International Superhero Day as a springboard to explore why empathy — rather than just technical prowess — is the most essential, underrated superpower for navigating the human side of cybersecurity.	Cyber blog	CISCO TALOS
2.5.26	This month in security with Tony Anscombe – April 2026 edition	Warnings about helpdesk impersonation scams and Iran-linked hackers targeting critical sectors in the US, plus the most damaging scams of 2025 - here's some of what made the headlines this month	Cyber blog	Eset
25.4.26	The Week in Vulnerabilities: SharePoint, Fortinet, OpenClaw, and GPL Odorizers	Cyble Research & Intelligence Labs (CRIL) tracked 1,675 vulnerabilities, last week, reflecting continued high disclosure volume across enterprise software, cloud services, and emerging AI ecosystems.	Cyber blog	Cyble
25.4.26	Why Indian Enterprises Are a Prime Target for Dark Web Credential Markets	Dark web credential markets in India are fueling enterprise data breaches, corporate leaks, and escalating cybersecurity threats across Indian organizations.	Cyber blog	Cyble
25.4.26	Threat Landscape March 2026: Ransomware Dominance, Access Brokers, Data Leaks, and Critical Exploitation Trends	March 2026 threat landscape saw 702 ransomware attacks, rising data breaches, active access brokers, and critical vulnerability exploitation across industries globally.	Cyber blog	Cyble
25.4.26	TGR-STA-1030: New Activity in Central and South America	TGR-STA-1030 remains an active threat. Since February, we have observed widespread activity from this group across multiple countries. Most recently, their efforts appear to be heavily focused on regions within Central and South America.	Cyber blog	Palo Alto
25.4.26	IR Trends Q1 2026: Phishing reemerges as top initial access vector, as attacks targeting public administration persist	Phishing reemerged as the most observed means of gaining initial access, accounting for over a third of the engagements where initial access could be determined. Phishing has not been the top vertical for initial access since Q2 2025.	Cyber blog	CISCO TALOS
25.4.26	[Podcast] It's not you, it's your printer: State-sponsored and phishing threats in 2025	In this episode of Talos Takes, Amy and Martin Lee unpack state-sponsored and phishing trends from the 2025 Talos Year in Review.	Cyber blog	CISCO TALOS
18.4.26	Four Nationally Significant Cyberattacks Every Week — Is the UK Ready?	UK cyberattacks are rising sharply, with NCSC reporting record incidents, growing infrastructure risk, and urgent calls for stronger cyber resilience.	Cyber blog	Cyble
18.4.26	Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)	As of April 17, 2026, Iran has begun restoring limited access to the internet after disconnecting from it for the past 47 days. Iran is limiting domestic access to only websites and applications mirrored on its National Information Network.	Cyber blog	Palo Alto
18.4.26	Supply chain dependencies: Have you checked your blind spot?	Your biggest risk may be a vendor you trust. How can SMBs map their third-party blind spots and build operational resilience?	Cyber blog	Eset
11.4.26	Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets	Check Point Research identified a zero-day vulnerability in the TrueConf client application, tracked as CVE-2026-3502, with a CVSS score of 7.8. The flaw stems from the abuse of TrueConf’s updater validation mechanism, allowing an attacker who controls the on-premises TrueConf server to distribute and execute arbitrary files across all connected endpoints.	Cyber blog	CHECKPOINT
11.4.26	[Video] The TTP Ep. 22: The Collapse of the Patch Window	In this episode of The Talos Threat Perspective, we discuss how vulnerability exploitation is accelerating, and why attacker speed, AI, and exposed systems are affecting the patch window.	Cyber blog	CISCO TALOS
11.4.26	The threat hunter’s gambit	Bill discusses why obsessing over strategy games is actually a secret weapon to outsmart threat actors.	Cyber blog	CISCO TALOS
11.4.26	Talos Takes: 2025's ransomware trends and zombie vulnerabilities	In this episode of Talos Takes, Amy and Pierre Cadieux unpack the ransomware and vulnerability trends that defined 2025.	Cyber blog	CISCO TALOS
4.4.26	Operation DualScript – A Multi-Stage PowerShell Malware Campaign Targeting Cryptocurrency and Financial Activity	Operation DualScript – A Multi-Stage PowerShell Malware Campaign Targeting Cryptocurrency and Financial Activity Introduction During our investigation, we identified a multi-stage malware infection leveraging Scheduled Task persistence, VBScript launchers, and PowerShell-based execution. The attack operates through two parallel chains:...	Cyber blog	Seqrite
4.4.26	The Week in Vulnerabilities: AI Frameworks, VMware, and Critical ICS Exposure	Critical vulnerabilities in AI frameworks, VMware environments, EV charging platforms, and ICS systems show growing risks across enterprise and industrial ecosystems.	Cyber blog	Cyble
4.4.26	Hybrid Warfare 2026: When Cyber Operations and Kinetic Attacks Converge	In 2026, hybrid warfare blends cyberattacks and physical strikes, disrupting infrastructure and shaping global security dynamics.	Cyber blog	Cyble
4.4.26	Inside the Talos 2025 Year in Review: A discussion on what the data means for defenders	A conversation between Cisco Talos and Cisco Security leaders on the 2025 threat landscape, from identity attacks and legacy vulnerabilities to AI-driven threats, and what defenders should prioritize now.	Cyber blog	CISCO TALOS
4.4.26	[Video] The TTP Ep 21: When Attackers Become Trusted Users	An episode of the Talos Threat Perspective on the 2025 Year in Review trends. We explore how identity is being used to gain, extend, and maintain access inside environments.	Cyber blog	CISCO TALOS
4.4.26	This month in security with Tony Anscombe – March 2026 edition	The past four weeks have seen a slew of new cybersecurity wake-up calls that showed why every organization needs a well-thought-out cyber-resilience plan	Cyber blog	Eset
28.3.26	NICKEL ALLEY strategy: Fake it ‘til you make it	Counter Threat Unit™ (CTU) researchers continue to investigate trends in Contagious Interview campaign activity conducted by NICKEL ALLEY, a threat group operating on behalf of the North Korean government.	Cyber blog	SOPHOS
28.3.26	The global CISO landscape: A leadership gap too large to ignore	The 2026 CISO Report, published by Cybersecurity Ventures in partnership with Sophos, highlights a critical imbalance in global cybersecurity leadership.	Cyber blog	SOPHOS
28.3.26	M-Trends 2026: Data, Insights, and Strategies From the Frontlines	Every year, the cyber threat landscape forces defenders to adapt to evolving adversary tactics, techniques, and procedures (TTPs). In 2025, Mandiant observed a clear divergence in adversary pacing that closely aligns with the trends we have been documenting for defenders over the past year.	Cyber blog	GTI
28.3.26	Talos Takes: 2025 insights from Talos and Splunk	This episode of Talos Takes breaks down the 2025 Year in Review as well as Splunk's Top 50 Cybersecurity Threats report.	Cyber blog	CISCO TALOS
28.3.26	Beers with Talos breaks down the 2025 Talos Year in Review	The Beers with Talos team unpack the biggest cybersecurity threats of 2025, from React2Shell to ransomware and identity abuse, and what it all means for defenders going forward.	Cyber blog	CISCO TALOS
28.3.26	Cloud workload security: Mind the gaps	As IT infrastructure expands, visibility and control often lag behind – until an incident forces a reckoning	Cyber blog	Eset
21.3.26	Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency	Contents Introduction Key Targets Industries Affected Geographical focus Geopolitical Context Infection Chain Timeline of Activity Initial Findings Looking into the Decoy Documents Technical Analysis Stage 1 – Malicious Archive Delivery Stage 2 – Malicious Shortcut Execution Stage 3	Cyber blog	Seqrite
21.3.26	Cyble and Optiv Partner to Bring Digital Risk Protection to Managed Security Operations	Cyble Optiv partnership brings digital risk protection into MSSP operations, enabling visibility into external threats across the open, deep, and dark web.	Cyber blog	Cyble
21.3.26	Middle East Cyber Warfare Intensifies: Rising Attacks, Hacktivist Surge, and Global Risk Exposure	Middle East cyber warfare escalates in 2026 as hybrid attacks disrupt infrastructure, supply chains, and global security.	Cyber blog	Cyble
21.3.26	When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures	During tax season, threat actors reliably take advantage of the urgency and familiarity of time-sensitive emails, including refund notices, payroll forms, filing reminders, and requests from tax professionals, to push malicious attachments, links, or QR codes.	Cyber blog	Microsoft blog
21.3.26	You have to invite them in	While a garlic and wooden stakes keep the vampires at bay in movies, they won’t save your network once an attacker has been "invited in." Discover why identity is the new frontier of cyber horror in this week’s edition.	Cyber blog	CISCO TALOS
21.3.26	Dark Web Roast February 2026 Edition	Grab your mug and settle in: February’s roast is served hot, fresh, and with zero detections.	Cyber blog	Trelix
14.3.26	Operation CamelClone: Multi-Region Espionage Campaign Targets Government and Defense Entities Amidst Regional Tensions	Contents Introduction Key Targets Industries Affected Geographical focus Geopolitical Context Infection Chain Timeline of Activity Initial Findings Looking into the Decoy Documents Technical Analysis Stage 1 – Malicious Archive Delivery Stage 2 – Malicious Shortcut Execution Stage 3	Cyber blog	Seqrite
14.3.26	The Ultimate Guide to Dark Web Monitoring in 2026: Protect Your Data Before Attackers Strike	Dark web intelligence helps organizations detect stolen credentials, leaked data, and cyber threats early, enabling faster response and stronger security.	Cyber blog	Cyble
14.3.26	This one’s for you, Mom	This week, Joe talks about allyship and how being aware of an issue is the first step in helping to fix it.	Cyber blog	CISCO TALOS
14.3.26	Face value: What it takes to fool facial recognition	ESET’s Jake Moore used smart glasses, deepfakes and face swaps to ‘hack’ widely-used facial recognition systems – and he'll demo it all at RSAC 2026	Cyber blog	Eset
14.3.26	Cyber fallout from the Iran war: What to have on your radar	The cybersecurity implications of the war in the Middle East extend far beyond the region. Here’s where to focus your defenses.	Cyber blog	Eset
7.3.26	What cybersecurity actually does for your business	The ability to continue operating safely in an unsafe environment where competitors cannot is a competitive advantage that is rarely measured or discussed	Cyber blog	Eset
28.2.26	Nowhere, man: The 2026 Active Adversary Report	AI headline hype didn’t deliver a sea change for practical defense — but one below-the-radar development should	Cyber blog	SOPHOS
28.2.26	Counterfeit Network Gear Creates Cyber Risk in Critical Infrastructure	As the supply chain for information technology components and raw materials is squeezed by the AI boom, the secondary market is heating up, and introducing new cyber risk into the IT supply chain.	Cyber blog	Eclypsium
28.2.26	2025: The Untold Stories of Check Point Research	Check Point Research (CPR) continuously tracks threats, following the clues that lead to major players and incidents in the threat landscape. Whether it’s high-end financially-motivated campaigns or state-sponsored activity, our focus is to figure out what the threat is, report our findings to the relevant parties, and make sure Check Point customers stay protected.	Cyber blog	CHECKPOINT
28.2.26	Henry IV, Hotspur, Hal, and hallucinations	Henry IV, Hotspur, Hal, and hallucinations	Cyber blog	CISCO TALOS
28.2.26	Mobile app permissions (still) matter more than you may think	Start using a new app and you’ll often be asked to grant it permissions. But blindly accepting them could expose you to serious privacy and security risks.	Cyber blog	Eset
28.2.26	Faking it on the phone: How to tell if a voice call is AI or not	Can you believe your ears? Increasingly, the answer is no. Here’s what’s at stake for your business, and how to beat the deepfakers.	Cyber blog	Eset
21.2.26	How the Protective Security Policy Framework Shapes Australia’s Commonwealth Cyber Security Strategy	The 2025 Commonwealth Cyber Security report outlines Essential Eight progress, compliance results, and key resilience challenges.	Cyber blog	Cyble
21.2.26	U.S. Public Sector Under Siege	Discover why Government and Education must prioritize Cyber Risk Management.	Cyber blog	Trend Micro
14.2.26	The US False Claims Act Becomes a Cybersecurity Enforcement Engine	DOJ recovered $52M in False Claims Act for cyber settlements, signaling tougher enforcement over contractor cybersecurity representations.	Cyber blog	Cyble
14.2.26	Ryan Liles, master of technical diplomacy	Ryan Liles reveals how he bridges the gap between Cisco’s product teams and third-party testing labs, mastering the art of technical diplomacy while driving industry standards forward and keeping the internet’s defenders ahead of the game.	Cyber blog	CISCO TALOS
1.2.26	No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network	This week Google and partners took action to disrupt what we believe is one of the largest residential proxy networks in the world, the IPIDEA proxy network. IPIDEA’s proxy infrastructure is a little-known component of the digital ecosystem leveraged by a wide array of bad actors.	Cyber blog	GTI
1.2.26	Embracing Choice in Cybersecurity: TrendAI Vision One™ and SentinelOne Integration	Discover how the TrendAI Vision One and SentinelOne integration exemplifies our commitment to endpoint flexibility.	Cyber blog	Trend Micro
1.2.26	Pwn2Own: Researchers Earn $1 Million for 76 Zero-Days	Discover how TrendAI Zero Day Initiative (ZDI) identified critical vulnerabilities across connected vehicles, EV chargers, and automotive systems.	Cyber blog	Trend Micro
1.2.26	Understanding the Russian Cyber Threat to the 2026 Winter Olympics	The 2026 Winter Games in Milano Cortina extend beyond sport. Tensions between the Russian Federation and the International Olympic Committee (IOC), stemming from disputes over compliance and governance, lie within a broader geopolitical context.	Cyber blog	Palo Alto
1.2.26	Happy 9th Anniversary, CTA: A Celebration of Collaboration in Cyber Defense	At certain moments in a career, you get the rare opportunity to look back and say, this work mattered. Not because of an individual accomplishment, but because it contributed to something larger — something that changed how an industry thinks and operates. The Cyber Threat Alliance (CTA) is one of those efforts.	Cyber blog	Palo Alto
1.2.26	Cyber Security Report 2026	Check Point Research continuously investigates real-world attacks, vulnerabilities, attackers’ infrastructure, and emerging techniques across global networks and environments. The Cyber Security Report 2026 consolidates our research efforts throughout 2025 to deliver a clear, data-driven view of the current threat landscape and its trajectory in 2026.	Cyber blog	CHECKPOINT
1.2.26	IR Trends Q4 2025: Exploitation remains dominant, phishing campaign targets Native American tribal organizations	A drop in exploitation and ransomware, but a spike in phishing and credential abuse, show why timely patching and robust MFA matter more than ever.	Cyber blog	CISCO TALOS
1.2.26	I'm locked in!	Hazel reflects on how to find balance while staying informed, then delivers practical updates and insights on the latest cybersecurity threats.	Cyber blog	CISCO TALOS
1.2.26	I scan, you scan, we all scan for... knowledge?	In this week's newsletter, Bill hammers home the old adage, "Know your environment" — even throughout alert fatigue.	Cyber blog	CISCO TALOS
1.2.26	Predicting 2026	In this week’s newsletter, Martin examines the evolving landscape for 2026, highlighting key threats, emerging trends like AI-driven risks, and the continued importance of addressing familiar vulnerabilities.	Cyber blog	CISCO TALOS
1.2.26	This month in security with Tony Anscombe – January 2026 edition	The trends that emerged in January offer useful clues about the risks and priorities that security teams are likely to contend with throughout the year	Cyber blog	Eset
1.2.26	From Digital Innovation to Patient Harm: Why Healthcare Cybersecurity Is Now a C-Suite Imperative	Healthcare is in the midst of a digital revolution, but without cybersecurity at the center of this transformation, innovation becomes a liability.	Cyber blog	Trelix
24.1.26	Operation DupeHike : UNG0902 targets Russian employees with DUPERUNNER and AdaptixC2	Contents Introduction Key Targets. Industries Affected. Geographical Focus. Infection Chain. Initial Findings. Looking into the decoy-document Technical Analysis Stage 1 – Malicious LNK Script Stage 2 – DUPERUNNER Implant Stage 3 – AdaptixC2 Beacon. Infrastructural Artefacts. Conclusion SEQRITE Protection....	Cyber blog	Seqrite
24.1.26	Operation Covert Access: Weaponized LNK-Based Spear-Phishing Targeting Argentina’s Judicial Sector to Deploy a Covert RAT	Table of Contents: Introduction: Infection Chain: Targeted sectors: Initial Findings about Campaign: Analysis of Decoy: Technical Analysis: Stage-1: Analysis of Windows Shortcut file (.LNK). Stage-2: Analysis of Batch file. Stage-3: Details analysis of Covert RAT. Conclusion: Seqrite Coverage: IOCs...	Cyber blog	Seqrite
24.1.26	Operation Nomad Leopard: Targeted Spear-Phishing Campaign Against Government Entities in Afghanistan	Contents Introduction Key Targets Industries Affected Geographical focus Infection Chain. Initial Findings Looking into the decoy-document Technical Analysis Stage 1 – Malicious ISO File Stage 2 – Malicious LNK File Stage 3 – Final Payload: FALSECUB Infrastructure & Attribution...	Cyber blog	Seqrite
24.1.26	From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers	This blog entry provides an in-depth analysis of the multistage delivery of the Evelyn information stealer, which was used in a campaign targeting software developers.	Cyber blog	Trend Micro
24.1.26	I scan, you scan, we all scan for... knowledge?	In this week's newsletter, Bill hammers home the old adage, "Know your environment" — even throughout alert fatigue.	Cyber blog	CISCO TALOS
24.1.26	Old habits die hard: 2025’s most common passwords were as predictable as ever	Once again, data shows an uncomfortable truth: the habit of choosing eminently hackable passwords is alive and well	Cyber blog	Eset
17.1.26	Silent Push Uncovers New Magecart Network: Disrupting Online Shoppers Worldwide	Silent Push Preemptive Cyber Defense Analysts recently uncovered an extensive network of domains associated with a long-term, ongoing web-skimmer campaign, known under the umbrella name: “Magecart.”	Cyber blog	Silent Push
17.1.26	Looking for fingerprints instead of footprints: A bit of honesty about the current cybersecurity landscape by Ken Bagnall	Most of us in cybersecurity have fallen into a bit of a trap. We have been taught to defend our networks by looking at the past. We rely on Indicators of Compromise (IOCs). These are things like malicious IPs or file hashes. Using them as a primary defense is not really a strategy. It is just playing catch-up.	Cyber blog	Silent Push
17.1.26	Predicting 2026	In this week’s newsletter, Martin examines the evolving landscape for 2026, highlighting key threats, emerging trends like AI-driven risks, and the continued importance of addressing familiar vulnerabilities.	Cyber blog	CISCO TALOS
17.1.26	Is it time for internet services to adopt identity verification?	Should verified identities become the standard online? Australia’s social media ban for under-16s shows why the question matters.	Cyber blog	Eset
17.1.26	Dark Web Roast December 2025 Edition	This month's underground activities proved that while crime may not pay, it certainly provides endless entertainment for those monitoring the digital underbelly of society.	Cyber blog	Trelix
10.1.26	Human-in-the-loop security will define 2026: Predictions from Sophos experts	Cybersecurity in 2026 will be shaped by extremes: attackers operating with unprecedented speed and scale, and defenders navigating the widening gap between automation and human judgment. Sophos experts predict a year where the “little things” — basic hygiene, configuration discipline, visibility across platforms — will matter more than ever.	Cyber blog	SOPHOS