Fortinet, Ivanti, and ServiceNow on Tuesday rolled out patches for 15 vulnerabilities across their products. ServiceNow resolved a critical remote code execution (RCE) flaw in the ServiceNow AI platform that can be exploited without authentication. The bug is tracked as… Read More "Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow"
Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security, SafeDep, Socket, and StepSecurity. The affected packages are listed below – @asyncapi/generator-helpers@1.1.1 @asyncapi/generator-components@0.7.1 @asyncapi/generator@3.3.1 @asyncapi/specs(v6.11.2, v6.11.2-alpha.1) “The compromised… Read More "Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware"
Secondly, in such a high-stakes, highly integrated environment, real-time monitoring and centralized visibility is crucial. With centralized visibility across the network, IT personnel can effectively conduct deep traffic flow analyses, identifying which devices are attempting to communicate with which systems.… Read More "When 80,000 fans log on at once: The 2026 World Cup’s unique cybersecurity issues"
Microsoft has released updates for an unprecedented 570 CVEs during this month’s Patch Tuesday on July 14. The patch deluge came after warnings from the tech giant that its use of agentic AI to find new flaws would lead to… Read More "Microsoft Patches 570 CVEs in Record Patch Tuesday"
Progress Software has confirmed that a zero-day vulnerability was behind the recent ShareFile Storage Zones Controller disruption and that access to the service is being restored. The confirmation comes two days after the company disabled access to ShareFile accounts for… Read More "Progress Confirms Zero-Day Vulnerability Behind ShareFile Disruption"
The limits of a detection-first model When we gather for industry forums like the RSAC Conference, the topics include automation, AI-driven response and operational resilience. These are certainly important, but they have limits. Detection produces false positives and noise. The… Read More "Cybersecurity needs more prevention and less reliance on cure"
The UK government has added several new cyber-related scenarios to its National Risk Register; some of which could theoretically result in mass casualties. The register is based on the government’s internal, classified National Security Risk Assessment, and considers malicious risks… Read More "Government Updates UK’s National Risk Register with Cyber Warnings"
Google and Mozilla have released fresh Chrome 150 and Firefox 152 updates that resolve critical-severity vulnerabilities. Mozilla rolled out Firefox 152.0.6 with patches for two critical security defects, warning that exploit code has been published for both. The bugs are… Read More "Critical Vulnerabilities Patched With Fresh Chrome 150, Firefox 152 Updates"
“The same generative tools that help security teams work faster are available to adversaries, and it shows,” Ahmed says. “Phishing campaigns read better and land more precisely than they did a year ago. Social engineering is harder to catch when… Read More "7 skills and traits of elite security engineers"
System administrators are in for a busy few weeks after Microsoft published updates to fix 200 vulnerabilities including three publicly disclosed zero-days June’s Patch Tuesday. A total of 33 critical CVEs were tackled, with most (28) remote code execution (RCE)… Read More "Microsoft Fixes 200 CVEs This Patch Tuesday"
