Insights

10 Nov

Microsoft Fixes Nearly 1,100 Security Vulnerabilities

Information, Insights

Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month’s Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla. Image: Shutterstock.com. Diorama by @zepp1969. November’s patch release from Redmond tackles 1,093 vulnerabilities, fixing 63 “critical” flaws that can be exploited…

Read More
04 Nov

Want to Rent an Internet Address at the White House?

Information, Insights

Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016. The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the…

Read More
02 Nov

Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies

Information, Insights

Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based…

Read More
27 Oct

Design Tenets for Agent Identity Management Systems

Insights

As a starting point, we have proposed an initial set of ten design tenets, with a focus on defining a vision for IAM systems that seek to manage agents across both enterprise and consumer-facing use cases. Each tenet has a description of the core of what it means to meet that tenet, along with the primary risks that tenet mitigates. Tenets should be applied and implemented by organizations based on the risk associated with the…

Read More
21 Oct

Widespread PHP Flaw May Cause Many Site Outages Today

Information, Insights

Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild. Image: Shutterstock.com, Sashkin. The flaws at issue are present in PHP, the programming language that…

Read More
21 Oct

Critical Vulnerabilities in PHP Require Immediate Patching

Attacks, Insights, Malware

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if…

Read More
19 Oct

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

Data Breaches, Information, Insights

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom. Hackers aligned with ShinyHunters have claimed credit for dozens of…

Read More
16 Oct

CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support

Attacks, Insights, Malware

CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026.  CISA urges organizations with affected self-hosted…

Read More
14 Oct

U.K. Sanctions Cryptomus for RU Money Laundering

Information, Insights

The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions. Heleket’s support agent on Telegram claims, despite all evidence to the contrary, that it is not affiliated with Cryptomus. Image: Richard Sanders. On October 8, the U.K. issued sanctions (PDF) against Cryptomus — previously…

Read More
14 Oct

Kicking off Cybersecurity Career Week with NIST!

Insights

Credit: NIST Considering a career in cybersecurity? Cybersecurity Career Week (CCW), a campaign led by the NICE Program at NIST from October 19-24, 2026, aims to raise public awareness and help people find their path to #ChooseCyber. During this week, academia, industry, non-profit organizations, and government agencies host events, share resources, provide trainings, and engage community to build awareness about the cybersecurity job opportunities, educate people on how to develop capabilities to qualify for cybersecurity…

Read More