Latest from todayNewsFortinet admins urged to update software to close FortiCloud SSO holesVulnerabilities could allow an attacker to bypass single sign-on login protection; users should disable SSO until patching is complete.By Howard SolomonDec 10, 20254 minsAccess ControlIdentity and Access ManagementSingle Sign-on News Making cybercrime illegal won't stop it; making cybersec research legal mayBy Maxwell CooterDec 10, 20255 minsCybercrimeGovernmentIndustryNews Analysis Hidden .NET HTTP proxy behavior can open RCE flaws in apps — a security issue Microsoft won’t fixBy Lucian ConstantinDec 10, 20256 minsApplication SecuritySecuritySoftware Development NewsHundreds of Ivanti EPM systems exposed online as critical flaw patchedBy Gyana Swain Dec 10, 20255 minsEndpoint ProtectionSecurityVulnerabilities News AnalysisKey cybersecurity takeaways from the 2026 NDAABy Cynthia Brumfield Dec 10, 202510 minsGovernmentGovernment ITSecurity NewsGitHub Action Secrets aren’t secret anymore: exposed PATs now a direct path into cloud environmentsBy Taryn Plumb Dec 9, 20256 minsCloud SecurityGitHubSecurity NewsDecember Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploitedBy Howard Solomon Dec 9, 20257 minsSecurity SoftwareThreat and Vulnerability ManagementZero-Day Vulnerabilities NewsGemini for Chrome gets a second AI agent to watch over itBy Gyana Swain Dec 9, 20255 minsArtificial IntelligenceBrowser SecurityEndpoint Protection NewsManufacturing fares better against ransomware — with room for improvementBy Julia Mutzbauer Dec 9, 20252 minsCybercrimeMalwareRansomware news Apache Tika hit by critical vulnerability thought to be patched months ago The scope of an old PDF parsing flaw has been widened to include more Tika modules. Dec 8, 2025 3 mins Application Security Development Tools Vulnerabilities news Keep AI browsers out of your enterprise, warns Gartner They’re already in use but may lead to “irreversible and untraceable” data loss, analysts said. Dec 8, 2025 5 mins Artificial Intelligence Browser Security Endpoint Protection news Warning: React2Shell vulnerability already being exploited by threat actors It has been seen spreading cryptojacking malware and in attempts to steal cloud credentials from compromised machines. Dec 5, 2025 5 mins Cyberattacks Cybercrime Development Tools news Insecure use of Signal app part of wider Department of Defense problem, suggests Senate report Committee calls for a more comprehensive review of ‘shadow communication’ app use in DoD. Dec 5, 2025 4 mins Government Government IT Security Practices news Chinese cyberspies target VMware vSphere for long-term persistence CISA and the NSA warn that Chinese state-sponsored attackers are deploying malware dubbed BRICKSTORM on VMware servers to perform lateral movement inside victim networks. Dec 5, 2025 4 mins Advanced Persistent Threats Cyberattacks Cybercrime news AI in CI/CD pipelines can be tricked into behaving badly Malicious content in issues or pull requests can trick AI agents in CI/CD workflows into running privileged commands in an attack researchers nicknamed PromptPwnd. Dec 5, 2025 4 mins CI/CD Code Security Devops news Cloudflare firewall reacts badly to React exploit mitigation In attempting to fix one problem, Cloudflare caused another. Dec 5, 2025 3 mins Cloud Security Network Security Security news Coupang breach of 33.7 million accounts allegedly involved engineer insider South Korea’s worst data breach in over a decade raises concerns about poor authentication key management and a potential insider threat. Dec 4, 2025 5 mins Cyberattacks Data Breach E-commerce Services news Suspicious traffic could be testing CDN evasion, says expert SANS Institute honeypots recently captured curious requests with CDN-related headers. Dec 4, 2025 5 mins Cybercrime Malware Security news AI creates new security risks for OT networks, warns NSA Although intended for OT administrators, new multi-agency AI guidelines raise issues that apply across IT networks as well. Dec 4, 2025 4 mins Artificial Intelligence Critical Infrastructure IT Strategy news Windows shortcuts’ use as a vector for malware may be cut short A third-party patch management company is cutting short attackers’ use of LNK files to smuggle in malicious commands, while Microsoft prefers to tell the whole story. Dec 4, 2025 4 mins Endpoint Protection Vulnerabilities Windows Security news Developers urged to immediately upgrade React, Next.js Critical vulnerability in React library should be treated by IT as they did Log4j – as an emergency, warns one expert. Dec 3, 2025 5 mins Developer Development Tools Vulnerabilities news analysis RCE flaw in OpenAI’s Codex CLI highlights new risks to dev environments Researchers found that .env files inside cloned repositories could be used to change the Codex CLI home directory path and load a rogue configuration file leading to arbitrary command execution. Dec 3, 2025 5 mins Artificial Intelligence Generative AI Vulnerabilities news Hybrid 2FA phishing kits are making attacks harder to detect A new Salty-Tycoon hybrid is slipping through defenses undetected, and weakening enterprise MFA. Dec 3, 2025 3 mins Authentication Multifactor Authentication Phishing news Get poetic in prompts and AI will break its guardrails Twenty-five frontier proprietary and open-weight models yielded high attack success rates when prompted in verse, indicating a deeper, underlying problems in their ability to process ambiguity veiled in poetry. Dec 3, 2025 7 mins Artificial Intelligence news Newly discovered malicious extensions could be lurking in enterprise browsers Once-trusted Chrome and Edge add-ons have quietly turned into tools for data harvesting, search manipulation, and a remote-execution backdoor affecting more than 4.3 million users. Dec 2, 2025 4 mins Browser Security Cybercrime Malware news Microsoft gives Windows admins a legacy migration headache with WINS sunset Although organizations have until 2034 to remove the name server technology, that’s not long for OT platforms that still depend on it. Dec 1, 2025 6 mins Endpoint Protection Network Administrator Windows Security news Contagious Interview attackers go ‘full stack’ to fool developers The originators of the Contagious Interview cyberattack campaign are stitching GitHub, Vercel, and NPM together into a development and delivery pipeline to drop malware. Dec 1, 2025 4 mins Code Security Security Security Practices news RomCom tries dropping a not-so-romantic payload on Ukraine-linked US firms The new RomCom campaign uses SocGholish fake update lures to deliver its Mythic Agent tool against US firms doing business with Ukraine. Nov 28, 2025 3 mins Cyberattacks Cybercrime Security news Scattered Lapsus$ Hunters target Zendesk users with fake domains Researchers found over 40 fake domains using the same setup as the group's August Salesforce attack. Nov 28, 2025 5 mins Cyberattacks Cybercrime Malware 12345678910…418 Show me morePopularArticlesPodcastsVideos opinion Cybersecurity isn’t underfunded — It’s undermanaged By JC GaillardDec 11, 20257 mins C-SuiteCSO and CISOIT Strategy how-to How to justify your security investments By Chritstoph SchuhwerkDec 11, 20256 mins C-SuiteCSO and CISOIT Leadership opinion How can staff+ security engineers force-multiply their impact? By Priyank DesaiDec 10, 202510 mins IT LeadershipIT ManagementStaff Management podcast CISO Reality: Record Pay, Rising Pressure, and Retention Risk By Joan GoodchildDec 10, 202527 mins CSO and CISOSecurity Infrastructure podcast Inside Visa’s Cyber Defense: CISO Subra Kumaraswamy on blending AI and Human Defense By Joan GoodchildDec 3, 202527 mins Artificial IntelligenceCSO and CISOPhishing podcast The Future of Cybersecurity Leadership: AI, Governance & Education | Kevin Powers, Boston College Nov 19, 202523 mins CyberattacksCybercrimeRisk Management video CISO Reality: Record Pay, Rising Pressure, and Retention Risk By Joan GoodchildDec 10, 202527 mins CSO and CISOSecurity Infrastructure video Inside Visa’s Cyber Defense: CISO Subra Kumaraswamy on blending AI and Human Defense By Joan GoodchildDec 3, 202527 mins Artificial IntelligenceCSO and CISOPhishing video The Future of Cybersecurity Leadership: AI, Governance & Education | Kevin Powers, Boston College Nov 19, 202523 mins CyberattacksCybercrimeRisk Management