The China-aligned advanced persistent threat (APT) group Webworm has expanded its victim list beyond Asia, shifting focus to European governmental organizations as it evolves its tactics. Analysis of Webworm activity in 2025 by ESET researchers found it targeting government organizations… Read More "China-Linked Webworm APT Evolves Tactics, Expands to European Targets"
The “patch everything” model has become technically and operationally unsustainable for mid- to large-scale organizations. Today’s security teams navigate an environment where thousands of new CVEs are published monthly, necessitating a shift from reactive, point-in-time scanning to a disciplined remediation… Read More "What is Vulnerability Remediation? | UpGuard"
The Department of Homeland Security tried to obtain a Canadian man’s location information, activity logs, and other identifying information from Google after he criticized the Trump administration online following the killings of Renee Good and Alex Pretti by federal immigration… Read More "DHS Demanded Google Surrender Data on Canadian’s Activity, Location Over Anti-ICE Posts"
A fresh Mini Shai-Hulud supply chain attack has hit over 320 NPM packages, along with GitHub Actions and a VS Code extension, security researchers report. The NPM maintainer account ‘atool’, which has access to multiple packages across the @antv namespace,… Read More "Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack"
AI-generated lookalike domains are now embedded inside the third-party scripts running on your web properties. Here’s why your current stack can’t see them, and what detection actually requires. Download the CISO Expert Guide to Typosquatting in the AI Era →… Read More "Typosquatting Is No Longer a User Problem. It’s a Supply Chain Problem"
Warnings about helpdesk impersonation scams and Iran-linked hackers targeting critical sectors in the US, plus the most damaging scams of 2025 – here’s some of what made the headlines this month 30 Apr 2026 With April coming to a close,… Read More "This month in security with Tony Anscombe – April 2026 edition"
The Microsoft-owed software developer platform, GitHub, has confirmed a third-party has gained unauthorized access to 3800 internal repositories. The breach was detected on May 19 and likely comes from a “poisoned” Visual Studio Code (VS Code) extension found by the… Read More "GitHub Confirms Breach of Internal Repositories"
Financial services cybersecurity has evolved into a prerequisite for institutional solvency, moving far beyond traditional perimeter defense into the realm of total digital operational resilience. As the industry scales toward hyper-connected API ecosystems and decentralized service delivery, the sector’s risk… Read More "What is Financial Services Cybersecurity? Threats and Defenses"
EPIC’s researchers were unable to locate an opt-out process at all on Meta, X, OpenAI, and Tinder without first logging in. And HireVue and the surveillance vendor DataTrust frame their opt-out instructions as available only to California residents, even though… Read More "Data Brokers’ and AI Firms’ Opt-Out Forms Are Built to Fail, Report Finds"
Industrial control systems (ICS) and operational technology (OT) environments are often described as quiet, highly controlled worlds. In reality, they contain a range of risks, unexpected configurations, and operational complexities that are difficult to fully uncover through standard penetration testing… Read More "Real-World ICS Security Tales From the Trenches"
