Security
Breaches, threats, patches and the security moves worth knowing about.
SonicWall SSL-VPN flaw lets attackers sidestep SAML login and MFA
A SonicOS SSL-VPN bug exploited in the wild can bypass SAML controls, and SonicWall says no workarounds exist, so patching is the only fix.
Read article →
CERT-In warns BFSI firms: AI attackers are hitting payment APIs again
CERT-In says an AI-assisted actor is abusing payment and disbursement APIs at Indian financial firms, including some that had already acted on earlier advisories.
Read article →
The *sshole bug shows how a 2016 security fix can open a login hole
A flaw in OpenSSH on musl-based Linux lets an oversized password log attackers into accounts that should block passwords. Alpine cloud images are exposed.
Read article →
Binance breach shows how a fake interview and one bad install can reach your signing keys
Binance says a trojanized Homebrew install and a fake job interview were part of the campaign behind its $6.43 billion theft. Here is what engineering teams…
Read article →
VOLTA and NIK C2 show infostealers now use LLMs as triage analysts
Cisco Talos describes two Windows threats that use LLMs to rank victims and analyse stolen data, one by borrowing the victim's own OpenAI key.
Read article →
Chainalysis breach is a vendor-risk test for teams that trust analytics tools
Chainalysis says attackers using AI-driven techniques reached customer names and emails, a prompt to recheck what your analytics vendors hold about your staff.
Read article →
Binance probes possible $5.8B theft: what custody risk means for your team
Binance is investigating a suspected multi-billion dollar hot wallet breach, and teams that hold crypto or depend on exchanges should review their exposure now.
Read article →
SiteGuard WAF exploit shows the risk of security tools running as root
Attackers are exploiting a critical command-injection flaw in SiteGuard Server Edition, turning a defensive web firewall into a path to root or SYSTEM access.
Read article →