Cisco on Wednesday announced patches for 35 vulnerabilities across its products, including over a dozen critical-severity bugs. A fresh Meraki security hardening release fixes multiple bugs grouped together under seven CVEs, based on the underlying weakness type. The most severe… Read More "Cisco Patches a Dozen Critical Vulnerabilities"
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN. According to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel. The… Read More "UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML"
SMB cyber-readiness: What makes or breaks it
“Fix the roof while the sun is shining.” – proverb Cybersecurity has a familiar way of saying the storm will come: “a breach is a matter of when, not if.” While the industry’s sternest maxim has probably never been more… Read More "SMB cyber-readiness: What makes or breaks it"
Attackers Hijack Three ccTLDs to Obtain Google Certificates
Attackers have compromised three country-code top-level domain (ccTLD) registries and obtained unauthorized HTTPS certificates covering several Google domains and sites belonging to other organizations. The incidents affected the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) namespaces, according to… Read More "Attackers Hijack Three ccTLDs to Obtain Google Certificates"
Security Awareness Training Isn’t Dead, but It Needs a Rethink
All enterprises conduct security awareness training for their employees. But whether this has tangible benefits is debatable. Empirical evidence suggests that security awareness training isn’t working – successful attacks keep increasing. But opinions on the efficacy of awareness training range… Read More "Security Awareness Training Isn’t Dead, but It Needs a Rethink"
We are fighting phishing at the wrong layer
The wall, and the crack in it The kits that matter now are adversary-in-the-middle proxies. Rather than serve a fake login page, they relay the victim’s traffic to the real Microsoft sign-in service in real time, hand the real responses… Read More "We are fighting phishing at the wrong layer"
EvilTokens: A phishing attack that doesn’t steal your password
A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages 15 Jun 2026 • , 5 min. read Much has been written about how the days of phishing emails… Read More "EvilTokens: A phishing attack that doesn’t steal your password"
ASOS Confirms Data Breach Linked to Stolen Employee Credentials
UK fashion retailer ASOS has notified customers the threat actor had accessed personal and customer account data following the October 6 data breach. In the email to customers on October 8, shared with Infosecurity, ASOS also confirmed that payment information… Read More "ASOS Confirms Data Breach Linked to Stolen Employee Credentials"
Security Posture Monitoring and Board Reporting Tools
Every quarter, your board asks the same question, just phrased differently: Are we more secure than we were last time? A point-in-time assessment can’t answer it, because it shows where you stood on the day someone ran it, not which… Read More "Security Posture Monitoring and Board Reporting Tools"
US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward
The US Department of State is offering up to $10 million for information on Zhang Yu, a Chinese national accused of taking part in the Hafnium campaign against Microsoft Exchange servers. The State Department’s Rewards for Justice (RFJ) program announced… Read More "US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward"