Microsoft has officially ended support for Windows 10, affecting hundreds of millions of users worldwide. This decision comes nearly a decade after the operating system's initial release and signals the end of free security updates, bug fixes, and technical support for the platform. The termination of support show more ...
The UK cyberattacks increase continues to alarm security experts, with the National Cyber Security Centre (NCSC) revealing that it handled a record 204 nationally significant cyber incidents in the past year — more than double the 89 incidents recorded the previous year. The surge highlights the growing scale of UK show more ...
A managed security services provider has detected credential attacks on SonicWall SSLVPN devices. The attacks, reported by Huntress, involve “widespread compromise” of SonicWall SSLVPN devices. “Threat actors are authenticating into multiple accounts rapidly across compromised devices,” the service provider show more ...
Microsoft’s Patch Tuesday October 2025 included fixes for 175 vulnerabilities, including three exploited zero-days and 13 additional high-risk vulnerabilities. The three zero-days under attack were quickly added to CISA’s Known Exploited Vulnerabilities (KEV) database. One of those vulnerabilities is show more ...
The Dutch government has invoked the Goods Availability Act (Wet Beschikbaarheid Goederen) to assert control over decisions made by Chinese-owned semiconductor firm Nexperia, citing risks to national and European technological security. The announcement, made public on October 12, revealed that the Act was invoked on show more ...
A critical security flaw has been identified in Happy DOM, a widely used JavaScript library primarily employed for server-side rendering and testing frameworks. The vulnerability, cataloged as CVE-2025-61927, allows attackers to escape the library’s virtual machine (VM) context, leading to potential remote code show more ...
Active Directory is a key target for hackers, so a recent report detailing Active Directory attack techniques contains useful lessons for security defenders. The attack, which targeted the critical NTDS.dit file at the core of Active Directory, was detailed in a blog post by Trellix Staff Research Scientist Maulik show more ...
October 2025's enormous Patch Tuesday offers plenty of nightmares for admins, including actively exploited zero-days and insidious high-severity privilege-escalation bugs — and it spells curtains for Windows 10 updates.
The proof-of-concept exploit allows an attacker to steal sensitive data from Gmail, Google Accounts, Google Authenticator, Google Maps, Signal, and Venmo.
Chinese APT threat actors compromised an organization's ArcGIS server, modifying the widely used geospatial mapping software for stealth access.
The British government is announcing on Tuesday it will be writing to the chief executives and chairs of the country's leading businesses to “take concrete actions” to protect their enterprises from attacks.
California's governor signed a bill that requires chatbot operators to set up a system to prevent suicidal ideation — an issue that several federal lawmakers have also focused on in recent months.
Taiwan’s National Security Bureau says network intrusions and influence operations by China have increased this year, with critical infrastructure drawing the most attention.
The Australian airline Qantas confirmed that hackers have published customer data they stole by exploiting Salesforce technology.
Michigan City, Indiana, has confirmed that a damaging cyber incident in September that impacted government systems was a ransomware attack.
The Florida attorney general's office sued the smart television company Roku for collecting and selling children’s sensitive data, including information showing precise geolocation, without notice and parental consent.
The Treasury Department targeted the company, Prince Group, and 146 associated people and entities with sanctions.
Cybersecurity researchers have shed light on a previously undocumented threat actor called TA585 that has been observed delivering an off-the-shelf malware called MonsterV2 via phishing campaigns. The Proofpoint Threat Research Team described the threat activity cluster as sophisticated, leveraging web injections and filtering checks as part of its attack chains. "TA585 is notable because it
Cybersecurity researchers have identified several malicious packages across npm, Python, and Ruby ecosystems that leverage Discord as a command-and-control (C2) channel to transmit stolen data to actor-controlled webhooks. Webhooks on Discord are a way to post messages to channels in the platform without requiring a bot user or authentication, making them an attractive mechanism for attackers to
Every October brings a familiar rhythm - pumpkin-spice everything in stores and cafés, alongside a wave of reminders, webinars, and checklists in my inbox. Halloween may be just around the corner, yet for those of us in cybersecurity, Security Awareness Month is the true seasonal milestone. Make no mistake, as a security professional, I love this month. Launched by CISA and the National
Chipmaker AMD has released fixes to address a security flaw dubbed RMPocalypse that could be exploited to undermine confidential computing guarantees provided by Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP). The attack, per ETH Zürich researchers Benedict Schlüter and Shweta Shinde, exploits AMD's incomplete protections that make it possible to perform a single memory
Android devices from Google and Samsung have been found vulnerable to a side-channel attack that could be exploited to covertly steal two-factor authentication (2FA) codes, Google Maps timelines, and other sensitive data without the users' knowledge pixel-by-pixel. The attack has been codenamed Pixnapping by a group of academics from the University of California (Berkeley), University of
Before an attacker ever sends a payload, they’ve already done the work of understanding how your environment is built. They look at your login flows, your JavaScript files, your error messages, your API documentation, your GitHub repos. These are all clues that help them understand how your systems behave. AI is significantly accelerating reconnaissance and enabling attackers to map your
Threat actors with ties to China have been attributed to a novel campaign that compromised an ArcGIS system and turned it into a backdoor for more than a year. The activity, per ReliaQuest, is the handiwork of a Chinese state-sponsored hacking group called Flax Typhoon, which is also tracked as Ethereal Panda and RedJuliett. According to the U.S. government, it's assessed to be a publicly-traded
In episode 72 of The AI Fix, GPT-5's "secret sauce" turns out to be phrases from adult websites, Irish police beg TikTokers to stop faking AI home intruders, Jeff Bezos pitches gigawatt data centers in space, OpenAI rolls out Agent Kit for drag-and-drop agents, and a Chinese startup unveils the creepiest show more ...
As the number of software vulnerabilities continues to increase, delaying or skipping security updates could cost your business dearly.
