Collaborate Disseminate
Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of vulnerabilities. Engineering explains what it would take to upgrade the platform where they live. Somebody prices … Continue reading How Financial Services Companies Can Modernize Their Software Supply Chain
OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models.
A “core cluster of the activity,” going back to the first… Continue reading OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities (KEV), following reports of active exploitation.
T… Continue reading CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
Google on Wednesday announced its latest frontier artificial intelligence (AI) model, Gemini 4 Argon, that it said is being rolled out to a set of trusted cyber defenders through its Fairwind Program.
“It delivers frontier performance in complex workf… Continue reading Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders, Plans Guardrail-Free Version
Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals.
The trigger is a malicious PDF with a crafted embedded… Continue reading Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party security products, citing ongoing investigation findings from SlowMist.
“Their investigation identified ma… Continue reading Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
MetaMask on Thursday said it’s responding to what it described as an “ongoing security incident” impacting part of its infrastructure.
“We are actively addressing and remediating the issue internally, in coordination with external partners and securit… Continue reading MetaMask Security Incident Prompts Exit of Affected Ethereum Validators
Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data.
LevelBlue’s Threat Hunt Operations &… Continue reading Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team.
The attack exploits CVE-2026-73570 (CVSS score… Continue reading Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content…. Continue reading Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks