Collaborate Disseminate
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
The vulnera… Continue reading Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation
AI-driven exploitation timelines are rapidly shrinking, and they are not going to stop shrinking. Vulnerabilities are being discovered, reproduced, and weaponized faster than ever in the history of enterprise security. As a result, the window between a… Continue reading AI-Driven Exploitation is Destroying Vulnerability Management. Here’s How to Handle It.
Most organizations now recognize that endpoint protection alone is no longer sufficient.
That’s why adoption of endpoint detection and response (EDR) has accelerated rapidly in recent years. Organizations understand that modern attacks move faster, ev… Continue reading How Leading Organizations Are Turning EDR Into Operational Resilience
Cybersecurity researchers have disclosed details of a spear-phishing campaign likely undertaken by the Pakistan-aligned SideCopy group targeting Afghanistan’s Ministry of Finance with an open-source remote access trojan called Xeno RAT.
“The campaign … Continue reading Pakistan-Linked SideCopy Targets Afghanistan Finance Ministry with Xeno RAT
Password manager Dashlane has disclosed that “fewer than” 20 users on the personal subscription plan had their encrypted vaults downloaded following a brute-force attack launched by an unknown party.
On May 31, 2026, the company said an “external” thr… Continue reading Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded
A new Mini Shai-Hulud supply chain attack campaign, codenamed Miasma, has compromised @redhat-cloud-services packages to steal credentials and secrets from developer machines and deliver a self-propagating worm.
“This is effectively a Mini Shai-Hulud … Continue reading Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
Monday hit like a cron job with anger issues.
A busted auth path here, a repo-side faceplant there, some “patched-ish” thing already getting chewed on in the wild, and then the usual bonus round: poisoned dev tools, sketchy forum chatter, phishing kit… Continue reading ⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More
A new cyber espionage campaign codenamed Operation Dragon Weave has been observed targeting officials and citizens in the Czech Republic and Taiwan to deliver an AdaptixC2 agent.
According to Seqrite Labs, targets of the campaign include government, r… Continue reading China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan
Three years ago, the practical question for an MSP building a cybersecurity practice was which “vCISO platform” to buy. The term was good shorthand for the work at the time: assessments, advisory, reporting, maybe a compliance module bolted on the side… Continue reading The Security Growth Platform: Why MSPs Are Moving Beyond vCISO Tools
Cybersecurity researchers have disclosed details of a new malicious supply chain campaign that’s targeting developers using OpenAI Codex through a legitimate-looking remote web UI.
The tool, named codexui-android, is advertised on GitHub and npm as a … Continue reading OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack