Vulnerabilities & patches · News & analysis
Node2Shell Makes the Running Runtime the Critical Patch Check
Node.js fixes and an independent exploitation test put the focus on deployed containers and the paths that decode untrusted compressed data.
NEWS · ALERTS · RESEARCH
Search cybersecurity coverage
Original cybersecurity reporting and practical analysis, alongside headlines from trusted publications, agencies and researchers.
Original reporting & analysis
Cybercrime & fraud · News & analysis
Unit 42 Separates AI-Assisted Intrusions From a Criminal Operator’s Plans
A new investigation reports university data theft alongside uncompleted fraud preparations, an important distinction for defenders evaluating AI-enabled crime.
Policy & compliance · News & analysis
EU Council Backs National Entry Points in Cyber Incident Reporting Proposal
The October 21 negotiating mandate would reshape reporting routes, but businesses should keep current procedures in force while legislation is negotiated.
Cybercrime & fraud · News & analysis
Phishing Infrastructure Market Turns Cloud Accounts Into Criminal Inventory
Microsoft’s latest investigation describes how illicit marketplaces connect account access, hosting and phishing tools.
Identity & access · News & analysis
Auth0.js Fix Restores a Check on How Recently a User Signed In
The October advisory concerns applications that request a fresh authentication event, with implications for sensitive account actions.
Cloud security · News & analysis
AWS GuardDuty Guidance Puts Cloud Alert Coverage Under the Microscope
An October operational guide explains how resource context strengthens attack-sequence findings—and why teams must check the services supplying that context.
Identity & access · News & analysis
Okta Sets Zendesk Provisioning Migration Dates as OAuth Replaces Basic Authentication
The change affects account provisioning rather than single sign-on, making lifecycle testing the important acceptance check.
Security technology · News & analysis
Patch Dashboards Need to Show Which Devices Are Still Exposed
N-able’s October guidance highlights the gap between sending an update and verifying the endpoint has completed it.
Cloud security · News & analysis
AWS SPIRE Blueprint Makes Workload Identity an Operations Decision
New AWS guidance connects machine identity to managed infrastructure, raising practical questions about recovery, ownership and permission design.
Security technology · News & analysis
SIM-Based Verification Moves Another Step Into Business Applications
U Mobile and Telenor Linx’s Malaysia launch removes the manual SMS-code step for supported services, while leaving businesses with important recovery and fallback decisions.
Cloud security · News & analysis
Cloud Supply-Chain Attacks Turn Build Credentials Into the Prize
Unit 42 describes how malicious dependencies and blockchain-based coordination reach beyond the infected developer machine.
AI security · News & analysis
AWS’s AI Triage Guidance Puts Evidence Ahead of Confident-Sounding Findings
New guidance describes repository checks and deployment context for assessing AI-generated vulnerability reports.
Security technology · News & analysis
GitHub Extends Secret Detection Beyond Recognizable Token Formats
A new classifier aims to identify password-like values from code context, with push protection still in preview.
Identity & access · News & analysis
Auth0’s PrivateLink Gateway Pattern Puts Environment Boundaries in Focus
Auth0’s new architecture guidance routes a private connection to multiple environments, placing gateway rules at the center of the security review.
Vulnerabilities & patches · News & analysis
Exploited Cisco SD-WAN Flaw Puts Network Management on the Emergency List
Cisco’s authentication-bypass warning calls for a release check, restricted management access and a separate investigation into earlier activity.
Cybercrime & fraud · News & analysis
ATM Jackpotting Sanctions Highlight the Gap Between Physical and Cyber Security
Treasury’s action against an alleged criminal network puts attention on the handoff between cash-machine servicing, malware detection and fraud response.
Cloud security · News & analysis
A Password Reset Became a Route Into Cloud Deployment Credentials
Microsoft’s Storm-3068 case study shows why identity recovery, development pipelines and Kubernetes access need a shared incident view.
Cloud security · News & analysis
Restored GitHub Actions Expose a Hidden Risk in Build-System Recovery
Socket says previously compromised Actions became reachable again with malicious tags intact, reopening questions about trusted dependencies.
Policy & compliance · News & analysis
FTC Opens Review of Platform Advertising’s Role in Impersonation Scams
The agency is seeking public input on possible changes, putting scam-ad handling on the agenda for platforms and business advertisers.
Data breaches · News & analysis
Cloudflare Fixes Container Data Exposure, Finds No Evidence of Malicious Use
A disclosed isolation flaw offers cloud customers a concrete way to examine how providers handle residual data and incident communication.
Vulnerabilities & patches · News & analysis
CISA Adds SharePoint and MikroTik Flaws to Its Exploited-Vulnerability List
The September 25 additions give businesses a specific inventory check, with remediation decisions grounded in affected products and vendor guidance.
AI security · News & analysis
SalesBleed Puts the AI Agent’s Data Permissions Under Scrutiny
Patched Agentforce research shows how an ordinary external business record can become an instruction an AI system should never obey.
Headlines from our sources
0 sourced updates · Publication dates or labeled coverage weeks shown · Read full coverage at the source
No matching headlines in the current collection. Try another filter or browse all coverage.