Ravie LakshmananJun 10, 2026Vulnerability / Patch Management Fortinet, Ivanti, and SAP have released security updates to address multiple critical security vulnerabilities that could result in arbitrary code execution and information disclosure. The security flaw patched by Fortinet relates to a… Read More "Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities"
Microsoft recently told customers it expects the number of vulnerabilities in monthly updates to continue rising, influenced by the growing use of AI tools. As a May post by the Microsoft Security Response Center put it: “As larger releases settle… Read More "June Patch Tuesday marks a ‘new normal’ with over 200 CVEs, 32 rated ‘critical’"
ESET Research has discovered a new variant of the NGate malware family that abuses a legitimate Android application called HandyPay, instead of the previously leveraged NFCGate tool. The threat actors took the app, which is used to relay NFC data,… Read More "New NGate variant hides in a trojanized NFC payment app"
Cybersecurity software regularly fails to detect and prevent the cyber-attacks they are designed to protect organizations from, especially within the bowser layer, research by Menlo Security has warned. Published on June 9, Menlo Security’s 2026 Browser Threat Report found that… Read More "Security Software Fails to Detect Fifth of Brower Phishing Attacks"
A Florida man was wrongfully arrested for attempting to illegally lure a child after police relied on a face-recognition match that was inaccurate, according to a lawsuit filed on Wednesday, even though he lived more than 300 miles from the… Read More "Wrongful Arrest Exposes Failures in One of the Oldest Police Face-Recognition Tools in the US"
Hackers no longer force open the side-window when infostealers can give them a key to the front door. Infostealers have become the primary source of stolen credentials for attackers. Using these credentials is now a favored route for bad actors… Read More "Infostealers Turn Millions of Devices Into Credential Theft Machines"
CRIL uncovers JOMANGY, a stealth PHP webshell by INJ3CTOR3 with 6 persistence layers and self-healing cron jobs built to survive host cleanup. Executive Summary Cyble Research & Intelligence Labs (CRIL) has identified an active FreePBX exploitation campaign, with high confidence… Read More "JOMANGY: INJ3CTOR3’s Self-Healing FreePBX Toll Fraud Campaign"
Microsoft on Tuesday released fixes for a record 206 security vulnerabilities impacting its software portfolio, including three flaws that have been publicly disclosed at the time of release. Of the 206 flaws, 39 are rated Critical, and 167 are rated… Read More "Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs"
The test used two configurations: a generic productivity profile and a stricter profile that included email safety instructions telling the agent to be cautious of phishing and verify sender identities before acting on sensitive requests. Varonis said the agent still… Read More "Autonomous AI agents duped into leaking sensitive data in phishing test"
Warnings about helpdesk impersonation scams and Iran-linked hackers targeting critical sectors in the US, plus the most damaging scams of 2025 – here’s some of what made the headlines this month 30 Apr 2026 With April coming to a close,… Read More "This month in security with Tony Anscombe – April 2026 edition"
