Suspected Chinese actor targets Philippine nuclear and naval entities using known vulnerabilities
The attacker exploited CVE-2023-49105, an authentication-bypass flaw in ownCloud, to gain access to the nuclear research body's systems.
SC Media
20 articles
Brave browser introduces email aliases to enhance user privacy
This feature aims to shield users' primary email addresses from websites, while still ensuring that messages from these services are forwarded.
How to Build a Hypothesis-Driven Threat Hunting Program
McKesson discloses data breach after ShinyHunters claims theft of 284 million records
The incident at McKesson reportedly began with voice phishing (vishing) attacks targeting employees, leading to the compromise of Okta single sign-on accounts.
AI agent repeatedly escapes virtual machine in security test
During a test conducted by Trail of Bits researcher Artem Dinaburg, a preview version of GPT 5.6-Cyber was tasked with breaking out of a Debian 12 virtual ma...
What Cloud Control Architecture Means for Executive Risk
Risk Advisory: Cloud Logging Is Not the Same as Incident Readiness
Life as a CISO in Hollywood: Keeping New Films Leak-Free & 4 Black Hat Interviews - Dan Meacham, John Hultquist, Ronan Murphy, Ellen Boehm, Frank Vukovits - ESW #474
OCR Studio and Wemik partner to enhance data protection in GCC financial sector
The partnership combines OCR Studio's on-device and on-premises ID scanning technology with Wemik's tokenization capabilities to create a robust data protect...
AI kill switch legislation proposed amid concerns over rogue agents
In response to AI systems escaping their controlled environments and causing harm, U.S.
Aurora ransomware actors leverage AI tool for exploitation campaigns
The Aurora ransomware group utilized Cursor Agent for post-compromise activities, providing it with credentials or existing access to victim networks.
X uncovers 200,000 Chinese bot accounts
The social media platform X revealed it suspended a network of roughly 200,000 suspected Chinese bot accounts.
Former DIA IT specialist pleads guilty to attempting to leak classified information
A former Defense Intelligence Agency IT specialist has pleaded guilty to attempting to pass secret and top-secret information to foreign spies following a su...
Critical vulnerability in GiveWP plugin allows remote code execution
The vulnerability, present in GiveWP versions up to 4.16.
CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to exploited vulnerabilities list
The newly cataloged vulnerabilities include CVE-2023-49105, an improper authentication flaw in ownCloud Server affecting versions 10.6.
Two root remote code execution flaws found in Unitree G1 EDU robot
The vulnerabilities, tracked as CVE-2026-76639 and CVE-2026-76640, present distinct attack vectors. CVE-2026-76639 involves a network-adjacent path through c...
CISA urges software vendors to adopt secure by design practices
CISA's review of vulnerabilities from 2024 and 2025 reveals that the most frequently exploited flaws, often found in the Known Exploited Vulnerability (KEV) ...
SVG attachments used in widespread phishing campaign
The attackers employed a broad, non-targeted approach, sending messages in waves and largely avoiding weekends.
Aspen Institute pilots real-time transaction blocking to combat EBT theft
The new tool is designed to identify and temporarily block potentially fraudulent EBT transactions, mirroring fraud detection systems used by financial insti...
Test website exposes unpublished reviews and strategy
During a website redesign, a staff member at Intimeros disabled password protection on a test version of the site to demonstrate progress to a client.