Security researchers at Forescout have disclosed 15 new vulnerabilities in the zero-touch provisioning (ZTP) systems used by TP-Link’s Omada networking ecosystem, warning that some of the flaws can be chained to compromise entire fleets of managed devices. The vulnerabilities affect… Read More "TP-Link Omada ZTP Vulnerabilities Chain Into Full Network Takeover"
Don’t trust image processing pipelines Complex image libraries support many formats and rely on numerous parsers and third-party components, creating a broad attack surface, Seker noted. Therefore, the libraries “should be treated as untrusted code execution territory.” Image processing should… Read More "Ruby on Rails critical bug puts every image upload under scrutiny"
Online disagreements among young people can easily spiral out of control. Parents need to understand what’s at stake. 27 Nov 2025 • , 5 min. read The digital world offers countless opportunities for self-expression, learning and personal development, but it’s… Read More "What parents should know to protect their children from doxxing"
A crypter service used by multiple unrelated cyber-criminal groups has been documented cloaking commodity malware with process ghosting, kernel-driver abuse and more than 90 mix-and-match encryption routines. According to new research from Proofpoint published on July 20, the crypter, marketed… Read More "Cruciferra Crypter Uses Process Ghosting to Evade Detection"
AI security and governance company Zenity has raised $125 million in a Series C funding round that brings its total raised to $180 million. The investment round was led by Norwest, with additional support from Qumra Capital, SoftBank Vision Fund… Read More "Zenity Raises $125 Million in Series C Funding"
Mitigation Unfortunately, enterprise security teams must perform full audits of developer machines. The compromised packages are transient dependencies for thousands of others and if any of the poisoned versions were installed during the attack window, all possible credentials accessible on… Read More "ChainDrop credential stealing worm infects over 400 npm packages"
From LinkedIn to X, GitHub to Instagram, there are plenty of opportunities to share work-related information. But posting could also get your company into trouble. 01 Dec 2025 • , 5 min. read Employee advocacy has been around as a… Read More "Oversharing is not caring: What’s at stake if your employees post too much online"
Security researchers have uncovered a coordinated campaign designed to steal developers’ AI-related API keys via malicious plugins. Aikido Security found at least 15 integrated development environment (IDE) plugins on the JetBrains Marketplace which had slipped past security checks and have now… Read More "Fifteen JetBrains Marketplace Plugins Steal API Keys"
It’s officially getting hard to keep track of all the times and ways AI models from OpenAI and Anthropic have been involved in “security incidents,” going outside the confines of their testing and interacting with the wider internet in unintended,… Read More "OK, Well, Rogue AI Agents Are Hacking Again"
Most email systems provide an AI Assistant for the account holder. Attackers can use the chatbot of a compromised account as an alternative and versatile form of Living off the Land (LotL). Compromising an email account is the most difficult… Read More "Weaponized Email AI Assistants Could Help Attackers Hijack Accounts"
