Cybersecurity

Feeds last updated @: UTC - 18:45 - 10/03/2026

Security.nl

More

Slashdot

 Edit

Claude AI Finds Bugs In Microsoft CTO's 40-Year-Old Apple II Code

  Openen als pagina
An anonymous reader quotes a report from The Register: AI can reverse engineer machine code and find vulnerabilities in ancient legacy architectures, says Microsoft Azure CTO Mark Russinovich, who used his own Apple II code from 40 years ago as an example. Russinovich wrote: "We are entering an era of automated, AI-accelerated vulnerability discovery that will be leveraged by both defenders and attackers." In May 1986, Russinovich wrote a utility called Enhancer for the Apple II personal computer. The utility, written in 6502 machine language, added the ability to use a variable or BASIC expression for the destination of a GOTO, GOSUB, or RESTORE command, whereas without modification Applesoft BASIC would only accept a line number. Russinovich had Claude Opus 4.6, released early last month, look over the code. It decompiled the machine language and found several security issues, including a case of "silent incorrect behavior" where, if the destination line was not found, the program would set the pointer to the following line or past the end of the program, instead of reporting an error. The fix would be to check the carry flag, which is set if the line is not found, and branch to an error. The existence of the vulnerability in Apple II type-in code has only amusement value, but the ability of AI to decompile embedded code and find vulnerabilities is a concern. "Billions of legacy microcontrollers exist globally, many likely running fragile or poorly audited firmware like this," said one comment to Russinovich's post.

Read more of this story at Slashdot.

https://it.slashdot.org/story/26/03/10/0521258/claude-ai-finds-bugs-in-microsoft-ctos-40-year-old-apple-ii-code?utm_source=rss1.0mainlinkanon&utm_medium=feed

 Edit

Meta Acquires Moltbook, the Social Network For AI Agents

  Openen als pagina
Axios reports that Meta has acquired Moltbook, the viral, Reddit-like social network designed for AI agents. Humans are welcome, but only to observe. Axios reports: The deal brings Moltbook's creators -- Matt Schlicht and Ben Parr -- into Meta Superintelligence Labs (MSL), the unit run by former Scale AI CEO Alexandr Wang. Meta did not disclose Moltbook's purchase price. The deal is expected to close mid-March, Meta says, with the pair starting at MSL on March 16. When it launched in late January, Moltbook was labeled the "most interesting place on the internet" by open-source developer and writer Simon Willison. "Browsing around Moltbook is so much fun. A lot of it is the expected science fiction slop, with agents pondering consciousness and identity. There's also a ton of genuinely useful information, especially on m/todayilearned." In an internal post seen by Axios, Meta's Vishal Shah said existing Moltbook customers can temporarily continue using the platform. "The Moltbook team has given agents a way to verify their identity and connect with one another on their human's behalf," Shah says. "This establishes a registry where agents are verified and tethered to human owners." He added: "Their team has unlocked new ways for agents to interact, share content, and coordinate complex tasks."

Read more of this story at Slashdot.

https://tech.slashdot.org/story/26/03/10/1524229/meta-acquires-moltbook-the-social-network-for-ai-agents?utm_source=rss1.0mainlinkanon&utm_medium=feed

 Edit

German Publishers Push Regulators To Fine Apple Over App Tracking Transparency

  Openen als pagina
German publishers and advertising groups are urging regulators to fine Apple over its App Tracking Transparency (ATT) system, arguing it unfairly restricts access to advertising data while allowing Apple to remain the central gatekeeper -- without subjecting its own apps to the same restrictions. If Germany's antitrust authority does rule against Apple, the company could face fines of up to 10% of its global revenue. 9to5Mac reports: One of the countries investigating whether ATT is anticompetitive is Germany. Last year, in an attempt to appease the country's antitrust watchdog, the company proposed several changes to the framework's rules. From Reuters' original coverage of Apple's changes proposals: "Apple had agreed to introduce neutral consent prompts for both its own services and third-party apps, and to largely align the wording, content and visual design of these messages, said Andreas Mundt, head of Germany's Bundeskartellamt. The company also proposed simplifying the consent process so developers can obtain user permission for advertising-related data processing in a way that complies with data protection law." [...] At the time, German regulators launched a consultation with industry publications to determine whether the proposals addressed their concerns. As it turns out, the answer was a hard no. As Reuters reported today: "Apple's proposed changes to its app tracking rules do not resolve antitrust issues in the mobile advertising market, associations representing German publishers and advertisers said on Tuesday as they urged the country's antitrust authority to slap a fine on the U.S. tech giant. [...] 'The proposed commitments would not change the negative effects of the App Tracking Transparency Framework,' Bernd Nauen, chief executive of the German Advertising Federation, said in a joint letter signed by the trade bodies. 'Apple would remain the data gatekeeper and would continue to decide who gets access to advertising-relevant data and how companies can communicate with their end customers,' he said."

Read more of this story at Slashdot.

https://apple.slashdot.org/story/26/03/10/050253/german-publishers-push-regulators-to-fine-apple-over-app-tracking-transparency?utm_source=rss1.0mainlinkanon&utm_medium=feed

 Edit

EQT Eyes $6 Billion Sale of SUSE

  Openen als pagina
Private equity firm EQT AB is reportedly exploring a sale of SUSE that could value the open-source Linux pioneer at up to $6 billion, roughly doubling the valuation since EQT took the company private in 2023. Reuters reports: EQT "has hired investment bank Arma Partners to sound out a group of private equity investors for a possible sale of the company, said the sources, who requested anonymity to discuss confidential matters. The deliberations are at "an early stage and there is no certainty that EQT will proceed with "a transaction, the sources said. [...] The potential deal comes amid a broader selloff in software stocks, which has disrupted mergers and acquisitions activity. Investors are "concerned that new artificial intelligence tools could displace many existing software products, weighing on technology "valuations and making deals harder to price. Some investors, however, see Luxembourg-headquartered SUSE as a potential beneficiary of AI adoption, arguing that demand for enterprise-grade infrastructure software is likely to grow as companies build and deploy more AI applications. The company generates about $800 million in revenue and more than $250 million in earnings before interest, taxes, depreciation, and amortization (EBITDA) and could fetch between $4 billion and $6 billion in a sale, the sources said.

Read more of this story at Slashdot.

https://linux.slashdot.org/story/26/03/10/0450204/eqt-eyes-6-billion-sale-of-suse?utm_source=rss1.0mainlinkanon&utm_medium=feed

 Edit

Many International Game Developers Plan To Skip GDC In US

  Openen als pagina
An anonymous reader quotes a report from Ars Technica: This week, tens of thousands of game developers and producers will once again gather in San Francisco, as they have since 1988, for the weeklong Game Developers Conference. But this year's show will be missing many international developers who say they no longer feel comfortable traveling to the United States to attend, no matter how relevant the show is to their work and careers. Dozens of those developers who spoke to Ars in recent months say they're wary of traveling to a country that has shown a callous disregard for -- or outright hostility toward -- the safety of international travelers. That's especially true for developers from various minority groups, those with transgender identities, and those who feel they could be targeted for outspoken political beliefs. "I honestly don't know anyone who is not from the U.S. who is planning on going to the next GDC," Godot Foundation Executive Director Emilio Coppola, who's based in Spain, told Ars. "We never felt super safe, but now we are not willing to risk it." "I honestly don't know anyone who is not from the U.S. who is planning on going to the next GDC," says Godot Foundation Executive Director Emilio Coppola, who's based in Spain. "We never felt super safe, but now we are not willing to risk it." "Hearing European citizens getting arrested by border control over their views on the U.S. is not something I would like to test for myself," adds Nazih Fares, a French-Lebanese citizen and creative director at indie studio Le Cabinet du Savoir.. Many of the developers who spoke to Ars cite the intrusive questioning, racial profiling, and other horror stories reported at the U.S. border. "I read a few long reads about how UK/German tourists ended up detained, and that was the final straw for me," Austrian-based Cohop Game founder Eline Muijres said. "It doesn't feel safe for me." Domini Gee, a Canadian game writer and narrative designer echoed that concern, adding: "There's no shortage of stories... about the risk of detainment, deportation, phones being searched... the consequences if I'm not [OK] could be high."

Read more of this story at Slashdot.

https://games.slashdot.org/story/26/03/10/0442249/many-international-game-developers-plan-to-skip-gdc-in-us?utm_source=rss1.0mainlinkanon&utm_medium=feed

More

theregister.com/security

 Edit

Ericsson blames vendor vishing slip-up for breach exposing thousands of records

  Openen als pagina
Crooks used simple phone scam to compromise vendor account, spilling personal and financial data belonging to more than 15,000 people

A voice-phishing scam targeting one of Ericsson's service providers has exposed the personal data of more than 15,000 individuals after attackers sweet-talked an employee into handing over access....

https://go.theregister.com/feed/www.theregister.com/2026/03/10/ericsson_blames_vendor_vishing_slipup/

 Edit

Protecting democracy means democratizing cybersecurity. Bring on the hackers

  Openen als pagina
Digital freedom needs a Kali Linux for the rest of us

Opinion The hacker mind is a curious way to be. To have it means to embody endless analytical curiosity, an awareness of any given rule set as just one system among many, and an ability to see any system in ways that its creators never expected. Combine this with a drive to find the bad and make things better, and you become one of the fundamental forces of the technological universe....

https://go.theregister.com/feed/www.theregister.com/2026/03/10/democratizing_security_opinion/

More

CISO2CISO.com

 Edit

The Critical Role of Sboms (Software Bill of Materials) In Defending Medtech From Software Supply Chain Threats – Source: www.cyberdefensemagazine.com

  Openen als pagina

Source: www.cyberdefensemagazine.com – Author: News team Software supply chain attacks have emerged as a serious threat in the rapidly evolving field of cybersecurity, especially in medical devices. As these devices become more and more interconnected and dependent on complex software ecosystems, the potential for exploitation through the supply chain has grown exponentially. One powerful tool [...]

La entrada The Critical Role of Sboms (Software Bill of Materials) In Defending Medtech From Software Supply Chain Threats – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

https://ciso2ciso.com/the-critical-role-of-sboms-software-bill-of-materials-in-defending-medtech-from-software-supply-chain-threats-source-www-cyberdefensemagazine-com/

 Edit

Ransomware Tactics Are Shifting. Here’s How to Keep Up – Source: www.cyberdefensemagazine.com

  Openen als pagina

Source: www.cyberdefensemagazine.com – Author: News team It’s common knowledge in the cybersecurity industry that ransomware is on the rise, with median demands rising 20% year-over-year across virtually all industries. But it’s not only the ransom sums themselves that are escalating; threat actors are engaging in increasingly aggressive tactics and techniques to extort their victims. It’s [...]

La entrada Ransomware Tactics Are Shifting. Here’s How to Keep Up – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

https://ciso2ciso.com/ransomware-tactics-are-shifting-heres-how-to-keep-up-source-www-cyberdefensemagazine-com/

 Edit

French Advisory Sheds Light on Apple Spyware Activity – Source: www.darkreading.com

  Openen als pagina

Source: www.darkreading.com – Author: Rob Wright CERT-FR’s advisory follows last month’s disclosure of a zero-day flaw Apple said was used in “sophisticated” attacks against targeted individuals. Original Post URL: https://www.darkreading.com/vulnerabilities-threats/french-sheds-light-apple-spyware-activity Category & Tags: – Views: 11

La entrada French Advisory Sheds Light on Apple Spyware Activity – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

https://ciso2ciso.com/french-advisory-sheds-light-on-apple-spyware-activity-source-www-darkreading-com/

More

Hackread.com

More

Vuldb

 Edit

CVE-2026-30934 | gtsteffaniak filebrowser up to 1.2.1-stable/1.3.0-beta /public/share/ cross site scripting

  Openen als pagina
A vulnerability has been found in gtsteffaniak filebrowser up to 1.2.1-stable/1.3.0-beta and classified as problematic. Affected is an unknown function of the file /public/share/. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2026-30934. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

https://vuldb.com/?id.349976

 Edit

CVE-2026-30930 | nicolargo glances up to 4.5.0 TimescaleDB Export normalize sql injection

  Openen als pagina
A vulnerability, which was classified as critical, was found in nicolargo glances up to 4.5.0. This impacts the function normalize of the component TimescaleDB Export Module. The manipulation results in sql injection. This vulnerability is cataloged as CVE-2026-30930. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

https://vuldb.com/?id.349975

 Edit

CVE-2026-30928 | nicolargo glances up to 4.5.0 REST API Endpoint /api/4/config self.config.as_dict information disclosure

  Openen als pagina
A vulnerability, which was classified as problematic, has been found in nicolargo glances up to 4.5.0. This affects the function self.config.as_dict of the file /api/4/config of the component REST API Endpoint. The manipulation leads to information disclosure. This vulnerability is listed as CVE-2026-30928. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

https://vuldb.com/?id.349974

 Edit

CVE-2026-27661 | Siemens SINEC Security Monitor up to 4.8.x exposure of sensitive information through metadata (ssa-430425)

  Openen als pagina
A vulnerability classified as problematic was found in Siemens SINEC Security Monitor up to 4.8.x. The impacted element is an unknown function. Executing a manipulation can lead to exposure of sensitive information through metadata. This vulnerability is tracked as CVE-2026-27661. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

https://vuldb.com/?id.349973

 Edit

CVE-2026-25605 | Siemens SICAM SIAPP SDK up to 2.1.6 file inclusion (ssa-903736)

  Openen als pagina
A vulnerability classified as problematic has been found in Siemens SICAM SIAPP SDK up to 2.1.6. The affected element is an unknown function. Performing a manipulation results in file inclusion. This vulnerability is identified as CVE-2026-25605. The attack is only possible with local access. There is not any exploit available. It is recommended to upgrade the affected component.

https://vuldb.com/?id.349972

More

Debian.org/security

More

Microsoft Security

More

advisories.ncsc.nl

 Edit

NCSC-2026-0059 [1.01] [M/H] Kwetsbaarheden verholpen in Ivanti Endpoint Manager

  Openen als pagina
Ivanti heeft kwetsbaarheden verholpen in Ivanti Endpoint Manager (Specifiek voor versies vóór 2024 SU5). De kwetsbaarheid met kenmerk CVE-2026-1603 betreft een authenticatie-bypass die het mogelijk maakt voor externe, niet-geauthenticeerde aanvallers om toegang te krijgen tot bepaalde opgeslagen inloggegevens, wat kan leiden tot compromittering van gevoelige data. De kwetsbaarheid met kenmerk CVE-2026-1602 betreft een SQL-injectie die het mogelijk maakt voor externe, geauthenticeerde aanvallers om willekeurige SQL-query's uit te voeren, wat kan leiden tot ongeautoriseerde toegang tot gevoelige database-informatie. Beide kwetsbaarheden kunnen de integriteit en vertrouwelijkheid van de gegevens in het systeem in gevaar brengen. Van de kwetsbaarheid met kenmerk CVE-2026-1603 meldt het Amerikaanse CISA dat deze binnen een Amerikaanse overheidsorganisatie is misbruikt. Verdere details zijn niet vrijgegeven en er is (nog) geen publieke Proof-of-Concept-code of exploit bekend.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0059

 Edit

NCSC-2026-0079 [1.00] [M/H] Kwetsbaarheden verholpen in Siemens producten

  Openen als pagina
Siemens heeft kwetsbaarheden verholpen in diverse producten als Heliox, Ruggedcom, SICAM, SIDIS en SIMATIC. De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: - Denial-of-Service (DoS) - Manipulatie van gegevens - Omzeilen van een beveiligingsmaatregel - (Remote) code execution (root/admin rechten) - Toegang tot systeemgegevens - Verhogen van rechten Voor succesvol misbruik van de genoemde kwetsbaarheden moet de kwaadwillende toegang hebben tot de productie-omgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0079

 Edit

NCSC-2026-0071 [1.02] [H/H] Kwetsbaarheden verholpen in Cisco Catalyst SD-WAN Manager

  Openen als pagina
Cisco heeft meerdere kwetsbaarheden verholpen in de Cisco Catalyst SD-WAN Manager. De kwetsbaarheden bevinden zich in de peering authenticatiemechanismen van de Cisco Catalyst SD-WAN Controller en Manager producten. Deze kwetsbaarheden stellen een niet-geauthenticeerde externe aanvaller in staat om het authenticatieproces te omzeilen, waardoor administratieve privileges op de getroffen systemen kunnen worden verkregen. Daarnaast kunnen aanvallers root-level privileges verkrijgen, wat kan leiden tot ongeautoriseerde toegang tot gevoelige informatie en de mogelijkheid om willekeurige bestanden te overschrijven, wat kan resulteren in verdere exploitatie of systeeminstabiliteit. De meest ernstige kwetsbaarheid, met kenmerk CVE-2026-20127, kan door een ongeauthenticeerde kwaadwillende worden misbruikt om op afstand willekeurige code uit te voeren met hoge administratieve rechten. Cisco geeft aan dat actief misbruik van deze kwetsbaarheid bekend is. Na misbruik van deze kwetsbaarheid zou de kwaadwillende de kwetsbaarheid met kenmerk CVE-2022-20775 gebruiken om de rechten te escaleren tot root. Dit doet de actor door het systeem te downgraden naar een versie waarin CVE-2022-20775 niet verholpen is, de rechten middels deze kwetsbaarheid te verhogen naar root en vervolgens het systeem weer terug te zetten in de oorspronkelijke versie. Er is publieke Proof-of-Concept-code (PoC) verschenen die de kwetsbaarheid met kenmerk CVE-2026-20127 aantoont en mogelijk misbruikt. De kans op grootschalig misbruik neemt hierdoor toe en het NCSC verwacht een significante toename in scan- en misbruikverkeer. Het NCSC adviseert met klem de update zo spoedig mogelijk te installeren. Ook van de kwetsbaarheden met kenmerk CVE-2026-20122 en CVE-2026-20128 meldt Cisco berichten te ontvangen dat deze actief worden misbruikt. Voor deze kwetsbaarheden is (nog) geen publieke Proof-of-Concept-code of exploit beschikbaar.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0071

 Edit

NCSC-2026-0078 [1.00] [M/H] Kwetsbaarheden verholpen in Kibana

  Openen als pagina
Elastic heeft kwetsbaarheden verholpen in Kibana. De kwetsbaarheden bevinden zich in verschillende componenten van Kibana. Een geauthenticeerde gebruiker met alleen weergaveprivileges kan een fout in de invoervalidatie misbruiken om een Denial of Service-voorwaarde te veroorzaken door speciaal vervaardigde, verkeerd gevormde payloads te verzenden. Dit leidt tot overmatig gebruik van resources en kan resulteren in crashes. Daarnaast bevat de zoekendpoint van Kibana's interne Content Connectors een kwetsbaarheid die het mogelijk maakt voor aanvallers om gemanipuleerde invoergegevens te leveren, wat ook kan leiden tot een Denial of Service. De AI Inference Anonymization Engine maakt gebruik van een inefficiënt geconstrueerde reguliere expressie, wat kan worden misbruikt om een Denial of Service te veroorzaken door de regex-processor te overweldigen. De Timelion-component kan ook worden misbruikt om ongecontroleerd middelenverbruik te veroorzaken, wat de beschikbaarheid van de Kibana-service beïnvloedt. Ten slotte staat de kwetsbaarheid in de workflow template engine geauthenticeerde gebruikers met executeWorkflow-rechten toe om code in te voegen die willekeurige bestanden van het serversysteem kan lezen en server-side request forgery (SSRF) aanvallen mogelijk maakt.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0078

 Edit

NCSC-2026-0077 [1.00] [M/H] Kwetsbaarheden verholpen in Cisco Secure Firewall systemen

  Openen als pagina
Cisco heeft meerdere kwetsbaarheden verholpen in Cisco Secure Firewall (inclusief ASA en FTD software). De kwetsbaarheden omvatten SQL-injectie, privilege-escalatie, denial-of-service, cross-site scripting, en onjuist beheer van invoer in verschillende componenten van de Cisco Secure Firewall. Authenticated remote attackers kunnen deze kwetsbaarheden misbruiken om ongeautoriseerde toegang te krijgen, systeemintegriteit te compromitteren, of netwerkdiensten te verstoren. De kwetsbaarheden zijn aanwezig in de webinterfaces, REST API's, en andere functionaliteiten van de firewall software.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0077

More

NCSC Nieuws

NIST Cybersecurity

wid.cert-bund.de

More

cert.ssi.gouv.fr

More

theHackerNews

 Edit

How to Stop AI Data Leaks: A Webinar Guide to Auditing Modern Agentic Workflows

  Openen als pagina
Artificial Intelligence (AI) is no longer just a tool we talk to; it is a tool that does things for us. These are called AI Agents. They can send emails, move data, and even manage software on their own. But there is a problem. While these agents make work faster, they also open a new "back door" for hackers. The Problem: "The Invisible Employee" Think of an AI Agent like a new employee who has

https://thehackernews.com/2026/03/how-to-stop-ai-data-leaks-webinar-guide.html

 Edit

FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials

  Openen als pagina
Cybersecurity researchers are calling attention to a new campaign where threat actors are abusing FortiGate Next-Generation Firewall (NGFW) appliances as entry points to breach victim networks. The activity involves the exploitation of recently disclosed security vulnerabilities or weak credentials to extract configuration files containing service account credentials and network topology

https://thehackernews.com/2026/03/fortigate-devices-exploited-to-breach.html

 Edit

KadNap Malware Infects 14,000+ Edge Devices to Power Stealth Proxy Botnet

  Openen als pagina
Cybersecurity researchers have discovered a new malware called KadNap that's primarily targeting Asus routers to enlist them into a botnet for proxying malicious traffic. The malware, first detected in the wild in August 2025, has expanded to over 14,000 infected devices, with more than 60% of victims located in the U.S., according to the Black Lotus Labs team at Lumen. A lesser number of

https://thehackernews.com/2026/03/kadnap-malware-infects-14000-edge.html

 Edit

New "LeakyLooker" Flaws in Google Looker Studio Could Enable Cross-Tenant SQL Queries

  Openen als pagina
Cybersecurity researchers have disclosed nine cross-tenant vulnerabilities in Google Looker Studio that could have permitted attackers to run arbitrary SQL queries on victims' databases and exfiltrate sensitive data within organizations' Google Cloud environments. The shortcomings have been collectively named LeakyLooker by Tenable. There is no evidence that the vulnerabilities were exploited in

https://thehackernews.com/2026/03/new-leakylooker-flaws-in-google-looker.html

 Edit

The Zero-Day Scramble is Avoidable: A Guide to Attack Surface Reduction

  Openen als pagina
You can't control when the next critical vulnerability drops. You can control how much of your environment is exposed when it does. The problem is that most teams have more internet-facing exposure than they realise. Intruder's Head of Security digs into why this happens and how teams can manage it deliberately. Time-to-exploit is shrinking The larger and less controlled your attack surface is,

https://thehackernews.com/2026/03/the-zero-day-scramble-is-avoidable.html

More

Techrepublic

 Edit

Veeam’s ‘Agent Commander’: Bringing Guardrails and Resilience to the Wild West of AI

  Openen als pagina

Veeam’s Agent Commander turns backup into an AI-era command center, giving enterprises the guardrails, visibility, and precision “undo” they need to safely scale autonomous agents.

The post Veeam’s ‘Agent Commander’: Bringing Guardrails and Resilience to the Wild West of AI appeared first on TechRepublic.

https://www.techrepublic.com/article/news-veeam-agent-commander-ai-resilience/

More

BleepingComputer.com

More

securityboulevard.com

 Edit

Zero Trust for B2B SaaS: What Every Founder and CTO Needs to Know

  Openen als pagina

For B2B SaaS companies, Zero Trust isn't an optional enterprise security concept. It's what enterprise buyers are demanding, what audit frameworks require, and increasingly what separates companies that close deals from those that don't.

The post Zero Trust for B2B SaaS: What Every Founder and CTO Needs to Know appeared first on Security Boulevard.

https://securityboulevard.com/2026/03/zero-trust-for-b2b-saas-what-every-founder-and-cto-needs-to-know/

 Edit

OpenAI Acquires Security Startup Promptfoo to Fortify AI Agents

  Openen als pagina

OpenAI has snapped up Promptfoo, a specialized artificial intelligence (AI) security startup, to bolster the safety of autonomous digital workers and convince enterprise clients that AI co-workers are ready for high-stakes business environments. OpenAI did not disclose financial terms of the transaction. PitchBook data indicates Promptfoo was valued at $119 million following a $22 million..

The post OpenAI Acquires Security Startup Promptfoo to Fortify AI Agents appeared first on Security Boulevard.

https://securityboulevard.com/2026/03/openai-acquires-security-startup-promptfoo-to-fortify-ai-agents/

 Edit

How MSPs Bridge the Gap Between Cloud Potential and Day‐to‐Day Reality

  Openen als pagina

Managed service providers (MSPs) bridge the gap between what the cloud makes possible and what most organizations can realistically run, secure, and scale with their current teams. MSPs turn AWS capabilities into reliable services that drive customer value instead of sitting unused on a roadmap.

The post How MSPs Bridge the Gap Between Cloud Potential and Day‐to‐Day Reality appeared first on Security Boulevard.

https://securityboulevard.com/2026/03/how-msps-bridge-the-gap-between-cloud-potential-and-day%e2%80%91to%e2%80%91day-reality/

 Edit

USENIX Security ’25 (Enigma Track) – Security Theater Is Canceled: Time For A Real Show

  Openen als pagina

Author, Creator & Presenter: Lea Kissner, LinkedIn

Our thanks to USENIX Security '25 (Enigma Track) (USENIX '25 for publishing their Creators, Authors and Presenter’s tremendous USENIX Security '25 (Enigma Track) content on the Organizations' YouTube Channel.

Permalink

The post USENIX Security ’25 (Enigma Track) – Security Theater Is Canceled: Time For A Real Show appeared first on Security Boulevard.

https://securityboulevard.com/2026/03/usenix-security-25-enigma-track-security-theater-is-canceled-time-for-a-real-show/

 Edit

Phishing Scammers Impersonating City, County Officials, Demanding Payment: FBI

  Openen als pagina

Scammers are impersonating local municipal officials around the country with seemingly legitimate phishing messages demanding payment for permits. The bad actors grab publicly available information and use them in their emails to fool their targets.

The post Phishing Scammers Impersonating City, County Officials, Demanding Payment: FBI appeared first on Security Boulevard.

https://securityboulevard.com/2026/03/phishing-scammers-impersonating-city-county-officials-demanding-payment-fbi/

More

CXSecurity.com

More

Brian Krebs

 Edit

How AI Assistants are Moving the Security Goalposts

  Openen als pagina
AI-based assistants or "agents" -- autonomous programs that have access to the user's computer, files, online services and can automate virtually any task -- are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priorities for organizations, while blurring the lines between data and code, trusted co-worker and insider threat, ninja hacker and novice code jockey.

https://krebsonsecurity.com/2026/03/how-ai-assistants-are-moving-the-security-goalposts/

 Edit

Who is the Kimwolf Botmaster “Dort”?

  Openen als pagina
In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to assemble Kimwolf, the world's largest and most disruptive botnet. Since then, the person in control of Kimwolf -- who goes by the handle "Dort" -- has coordinated a barrage of distributed denial-of-service (DDoS), doxing and email flooding attacks against the researcher and this author, and more recently caused a SWAT team to be sent to the researcher's home. This post examines what is knowable about Dort based on public information.

https://krebsonsecurity.com/2026/02/who-is-the-kimwolf-botmaster-dort/

 Edit

‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA

  Openen als pagina
Most phishing websites are little more than static copies of login pages for popular online destinations, and they are often quickly taken down by anti-abuse activists and security firms. But a stealthy new phishing-as-a-service offering lets customers sidestep both of these pitfalls: It uses cleverly disguised links to load the target brand's real website, and then acts as a relay between the target and the legitimate site -- forwarding the victim's username, password and multi-factor authentication (MFA) code to the legitimate site and returning its responses.

https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/

 Edit

Kimwolf Botnet Swamps Anonymity Network I2P

  Openen als pagina
For the past week, the massive "Internet of Things" (IoT) botnet known as Kimwolf has been disrupting the The Invisible Internet Project (I2P), a decentralized, encrypted communications network designed to anonymize and secure online communications. I2P users started reporting disruptions in the network around the same time the Kimwolf botmasters began relying on it to evade takedown attempts against the botnet's control servers.

https://krebsonsecurity.com/2026/02/kimwolf-botnet-swamps-anonymity-network-i2p/

More

Troy Hunt

 Edit

Weekly Update 492

  Openen als pagina

Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite

The recurring theme this week seems to be around the gap between breaches happening and individual victims finding out about them. It's tempting to blame this on the corporate victim of the breach (the hacked company), but they're simultaneously dealing with a criminal intrusion, a ransom

https://www.troyhunt.com/weekly-update-492/

More

Bruce Schneier

 Edit

New Attack Against Wi-Fi

  Openen als pagina

It’s called AirSnitch:

Unlike previous Wi-Fi attacks, AirSnitch exploits core features in Layers 1 and 2 and the failure to bind and synchronize a client across these and higher layers, other nodes, and other network names such as SSIDs (Service Set Identifiers). This cross-layer identity desynchronization is the key driver of AirSnitch attacks.

The most powerful such attack is a full, bidirectional machine-in-the-middle (MitM) attack, meaning the attacker can view and modify data before it makes its way to the intended recipient. The attacker can be on the same SSID, a separate one, or even a separate network segment tied to the same AP. It works against small Wi-Fi networks in both homes and offices and large networks in enterprises...

https://www.schneier.com/blog/archives/2026/03/new-attack-against-wi-fi.html

 Edit

Friday Squid Blogging: Squid in Byzantine Monk Cooking

  Openen als pagina

This is a very weird story about how squid stayed on the menu of Byzantine monks by falling between the cracks of dietary rules.

At Constantinople’s Monastery of Stoudios, the kitchen didn’t answer to appetite.

It answered to the “typikon”: a manual for ensuring that nothing unexpected happened at mealtimes. Meat: forbidden. Dairy: forbidden. Eggs: forbidden. Fish: feast-day only. Oil: regulated. But squid?

Squid had eight arms, no bones, and a gift for changing color. Nobody had bothered writing a regulation for that. This wasn’t a loophole born of legal creativity but an oversight rooted in taxonomic confusion. Medieval monks, confronted with a creature that was neither fish nor fowl, gave up and let it pass...

https://www.schneier.com/blog/archives/2026/03/friday-squid-blogging-squid-in-byzantine-monk-cooking.html

 Edit

Anthropic and the Pentagon

  Openen als pagina

OpenAI is in and Anthropic is out as a supplier of AI technology for the US defense department. This news caps a week of bluster by the highest officials in the US government towards some of the wealthiest titans of the big tech industry, and the overhanging specter of the existential risks posed by a new technology powerful enough that the Pentagon claims it is essential to national security. At issue is Anthropic’s insistence that the US Department of Defense (DoD) could not use its models to facilitate “mass surveillance” or “fully autonomous weapons,” provisions the defense secretary Pete Hegseth ...

https://www.schneier.com/blog/archives/2026/03/anthropic-and-the-pentagon.html

 Edit

Claude Used to Hack Mexican Government

  Openen als pagina

An unknown hacker used Anthropic’s LLM to hack the Mexican government:

The unknown Claude user wrote Spanish-language prompts for the chatbot to act as an elite hacker, finding vulnerabilities in government networks, writing computer scripts to exploit them and determining ways to automate data theft, Israeli cybersecurity startup Gambit Security said in research published Wednesday.

[...]

Claude initially warned the unknown user of malicious intent during their conversation about the Mexican government, but eventually complied with the attacker’s requests and executed thousands of commands on government computer networks, the researchers said...

https://www.schneier.com/blog/archives/2026/03/claude-used-to-hack-mexican-government.html

More

Security Affairs

 Edit

APT28 conducts long-term espionage on Ukrainian forces using custom malware

  Openen als pagina
APT28 used BEARDSHELL and COVENANT malware to spy on Ukrainian military personnel, enabling long-term surveillance since April 2024. The Russia-linked group APT28 (aka UAC-0001, aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM) has used BEARDSHELL and COVENANT malware to conduct long-term surveillance of Ukrainian military personnel. According to ESET, the campaign began in April 2024 and relies on [...]

https://securityaffairs.com/189230/apt/apt28-conducts-long-term-espionage-on-ukrainian-forces-using-custom-malware.html

 Edit

Threat actors use custom AuraInspector to harvest data from Salesforce systems

  Openen als pagina
Attackers are mass-scanning Salesforce Experience Cloud sites using a modified AuraInspector tool to exploit misconfigurations and access sensitive data. Salesforce CSOC warns that threat actors are mass-scanning publicly accessible Experience Cloud sites using a modified version of the AuraInspector tool. AuraInspector is an open‐source command‐line tool released by Google/Mandiant to audit Salesforce Aura and Experience [...]

https://securityaffairs.com/189214/security/threat-actors-use-custom-aurainspector-to-harvest-data-from-salesforce-systems.html

 Edit

U.S. CISA adds Ivanti EPM, SolarWinds, and Omnissa Workspace One flaws to its Known Exploited Vulnerabilities catalog

  Openen als pagina
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds EPM, SolarWinds, and Omnissa Workspace One flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple, Rockwell, and Hikvision flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: The first vulnerability added to the catalog is [...]

https://securityaffairs.com/189172/security/u-s-cisa-adds-ivanti-epm-solarwinds-and-omnissa-workspace-one-flaws-to-its-known-exploited-vulnerabilities-catalog.html

 Edit

Ericsson US confirms breach after third-party provider attack

  Openen als pagina
Ericsson US reports a data breach after attackers hacked a service provider, exposing employee and customer information. Ericsson Inc., the U.S. branch of the Swedish telecom giant, disclosed a data breach after a service provider was hacked. The attack compromised the personal information of an unspecified number of employees and customers. “On April 28, 2025, [...]

https://securityaffairs.com/189197/data-breach/ericsson-us-confirms-breach-after-third-party-provider-attack.html

 Edit

Law enforcement disrupted Tycoon 2FA phishing-as-a-service platform

  Openen als pagina
Authorities disrupted the Tycoon 2FA phishing-as-a-service platform used to send millions of phishing emails to over 500,000 orgs worldwide. The joint effort, led by Microsoft, Europol, and industry partners, aimed to target the infrastructure of Tycoon 2FA phishing-as-a-service platform responsible for tens of millions of fraudulent emails reaching over 500,000 organizations each month worldwide. By [...]

https://securityaffairs.com/189205/cyber-crime/law-enforcement-disrupted-tycoon-2fa-phishing-as-a-service-platform.html

More

news.sophos.com

More