Ravie LakshmananJun 23, 2026Malware / Social Engineering Direct messages sent via WhatsApp are being used to distribute malicious Visual Basic Script (VBScript) files that lead to the installation of legitimate Remote Monitoring and Management (RMM) software. Per findings from Kaspersky,… Read More "WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool"
That is the contradiction at the heart of modern cybersecurity strategy. We say, “Assume the breach,” but we budget, govern, architect, and rehearse as if the wall will hold. We tell boards compromise is inevitable, then ask for more money… Read More "Cybersecurity is no longer about protection. It’s about survival."
A 10-month Android malware campaign has used nearly 250 fake apps to sign victims up to premium services on their mobile bills, with hardcoded operator targeting for users in Malaysia, Thailand, Romania and Croatia. According to new analysis from Zimperium’s… Read More "Android Malware Used Fake Apps to Charge Users in Mass Billing Scam"
Healthcare technology company Xsolis, Inc. has disclosed a data breach affecting nearly 1.4 million individuals. Tennessee-based Xsolis provides utilization management and revenue cycle solutions for hospitals, health systems, and payers. The company published a data security notice in early June,… Read More "Xsolis Data Breach Affects 1.4 Million Individuals"
A popular developer of open source analytics software has revealed that a recent data breach and extortion incident was caused by the Mini Shai-Hulud campaign which compromised TanStack packages. Grafana Labs, which makes the AI-powered visualization app Grafana, said on… Read More "Grafana Labs Says Code Breach Stemmed from TanStack Attack"
OpenAI on Monday said it’s releasing an improved version of its GPT‑5.5‑Cyber model to trusted defenders as part of the Daybreak initiative, the artificial intelligence (AI) company announced last month. Calling GPT‑5.5‑Cyber its “strongest model yet for finding and helping… Read More "OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security Flaws"
A nine-year-old logic flaw in the Linux kernel’s process trace (ptrace) path has been discovered that could let unprivileged local users read sensitive files, including secure shell host (SSH) private keys and the system password hash, on default installations of… Read More "Nine-Year-Old Linux Kernel Flaw Leaks SSH Keys and Password Hashes"
Three-quarters of organizations have admitted to shipping vulnerable code, as AI risk proliferates in supply chains, according to two new studies out this week. Checkmarx published new data on May 21 showing that 75% of organizations often or sometimes deploy… Read More "Three-Quarters of Firms Knowingly Ship Vulnerable Code, Says Checkmarx"
Ilia Kolochenko, CEO of ImmuniWeb and adjunct professor of cybersecurity practice and cyber law at US-based Capitol Technology University, said the Five Eyes statement “makes perfect sense. However, it should have been sent in late 2023. Today, careless implementation and… Read More "Change your cyber risk strategy to meet AI threats, Five Eyes countries warn CSOs"
GitHub has confirmed that a recent breach into its internal repositories was caused by a vulnerability in a Microsoft Visual Studio Code (VS Code) extension called ‘Nx Console.’ The security team at the Microsoft-owed software developer platform warned on May… Read More "GitHub Breach Traced to Malicious ‘Nx Console’ VS Code Extension"
