Oct 31, 2025Ravie LakshmananMalware / Browser Security A suspected nation-state threat actor has been linked to the distribution of a new malware called Airstalk as part of a likely supply chain attack. Palo Alto Networks Unit 42 said it’s tracking… Read More "Nation-State Hackers Deploy New Airstalk Malware in Suspected Supply Chain Attack"
Oct 31, 2025Ravie LakshmananMalware / Threat Intelligence A China-affiliated threat actor known as UNC6384 has been linked to a fresh set of attacks exploiting an unpatched Windows shortcut vulnerability to target European diplomatic and government entities between September and October… Read More "China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats"
Oct 31, 2025The Hacker NewsBusiness Continuity / Risk Management MSPs are facing rising client expectations for strong cybersecurity and compliance outcomes, while threats grow more complex and regulatory demands evolve. Meanwhile, clients are increasingly seeking comprehensive protection without taking on… Read More "The MSP Cybersecurity Readiness Guide: Turning Security into Growth"
Oct 31, 2025Ravie LakshmananVulnerability / Threat Intelligence The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA), along with international partners from Australia and Canada, have released guidance to harden on-premise Microsoft Exchange Server instances from potential… Read More "CISA and NSA Issue Urgent Guidance to Secure WSUS and Microsoft Exchange Servers"
Oct 31, 2025The Hacker NewsEndpoint Security / Network Security A design firm is editing a new campaign video on a MacBook Pro. The creative director opens a collaboration app that quietly requests microphone and camera permissions. MacOS is supposed to… Read More "A New Security Layer for macOS Takes Aim at Admin Errors Before Hackers Do"
Oct 30, 2025Ravie LakshmananDevSecOps / Software Security Cybersecurity researchers have uncovered yet another active software supply chain attack campaign targeting the npm registry with over 100 malicious packages that can steal authentication tokens, CI/CD secrets, and GitHub credentials from developers’… Read More "PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs"
Oct 30, 2025Ravie LakshmananMalware / Cybercrime The open-source command-and-control (C2) framework known as AdaptixC2 is being used by a growing number of threat actors, some of whom are related to Russian ransomware gangs. AdaptixC2 is an emerging extensible post-exploitation and… Read More "Russian Ransomware Gangs Weaponize Open-Source AdaptixC2 for Advanced Attacks"
Google on Thursday revealed that the scam defenses built into Android safeguard users around the world from more than 10 billion suspected malicious calls and messages every month. The tech giant also said it has blocked over 100 million suspicious… Read More "Google’s Built-In AI Defenses on Android Now Block 10 Billion Scam Messages a Month"
Oct 30, 2025Ravie LakshmananBrowser Security / Vulnerability A severe vulnerability disclosed in Chromium’s Blink rendering engine can be exploited to crash many Chromium-based browsers within a few seconds. Security researcher Jose Pino, who disclosed details of the flaw, has codenamed… Read More "New “Brash” Exploit Crashes Chromium Browsers Instantly with a Single Malicious URL"
Security doesn’t fail at the point of breach. It fails at the point of impact. That line set the tone for this year’s Picus Breach and Simulation (BAS) Summit, where researchers, practitioners, and CISOs all echoed the same theme: cyber… Read More "BAS Is the Power Behind Real Defense"
