Government auditors report that federal agencies have not met required security steps for operational technology, a gap highlighted by recent water sector breaches.
Security researchers demonstrated that malicious spreadsheets can trigger code execution in LibreOffice and Apache OpenOffice without displaying standard macro warnings.
A new assessment reveals that the vast majority of Internet of Medical Things and operational technology devices lack the capacity for post-quantum cryptographic upgrades.
Project RedTeam: Contract Offensive combines card-based gameplay with realistic cyberattack techniques to educate players on network security.
The Japanese media giant disclosed unauthorized access to staff accounts, with one leveraged to distribute thousands of phishing messages.
Attackers are storing VBScript payloads in browser cache to evade execution length restrictions, according to Infosecurity Magazine.
Microsoft will stop providing security updates for Office 2021 on October 13. Organizations must plan for migration or accept increased risk.
A new cyber technique creates a silent detection gap by blocking updates to Microsoft Defender while leaving the service running normally.
Malware in South Korea and Taiwan mimics email security tools and legitimate OS processes to hide from defenders on network appliances.
Analysis of 2.5 million devices across 50 organizations reveals significant gaps in readiness for quantum-era cryptography standards.
Threat actors behind the ClickFix campaign are using DNS TXT records and browser cache pre-fetching to conceal malicious payloads, complicating early-stage detection.
U.S. law enforcement agencies issued a new alert stating that the FortiBleed threat persists, posing risks of user lockouts and ransomware deployment.
Ukraine’s CERT-UA identified more than 100 compromised websites serving the LunexStealer malware through malicious JavaScript injections in September 2026.
Security teams evaluating autonomous penetration testing tools must verify what these agents can discover and exploit versus where they fall short of human expertise.
Law enforcement agencies report that the FortiBleed credential harvesting campaign remains active, targeting internet-facing Fortinet devices and exploiting legacy password storage methods.
Investigators identify the Telegram account behind the fake ASOS alert as previously involved in trading virtual gaming items.
A new report indicates that cybersecurity risks are no longer peripheral but are embedded directly within daily business operations and systems.
Barracuda reports phishing emails designed to trick both human recipients and AI assistants through hidden prompt injection techniques.
Attackers are increasingly compromising backup systems to eliminate recovery paths and force ransom payments, experts warn.
The Operational Technology Coalition is calling on CISA to enforce baseline security requirements for federal OT systems to improve national infrastructure resilience.
A new malware strain named PoeLLM has compromised thousands of servers, using poetic text to conceal its command-and-control infrastructure coordinates.
Microsoft will add MSIX file types to its blocked attachment list in Outlook Web and the new Windows client starting next month.
Researchers attribute eight malicious npm packages delivering the Overlord RAT and stealers to a single threat actor since August 2023.
Regulations covering controlled unclassified information handling and breach reporting for federal contractors are approaching completion.