Cybersecurity news — data breaches, vulnerability disclosures, AI-powered security tools, threat intelligence, and enterprise security research.
According to the article, the most dangerous threat to the internet in 2026 is the rise of age verification laws, which force users to upload government IDs to third-party companies, thereby walling off large portions of…
The article argues that the traditional 90-day responsible disclosure window for security vulnerabilities is obsolete because large language models (LLMs) have drastically accelerated both bug discovery and exploit devel…
A cyberattack disrupted the online learning platform Canvas on Thursday, causing chaos at US schools and colleges as students were taking final exams. The ransomware group ShinyHunters claimed responsibility, stating it …
A data extortion attack by the cybercrime group ShinyHunters targeted the education technology platform Canvas, disrupting classes nationwide after the group defaced the login page with a ransom demand threatening to lea…
On April 29, 2026, the Linux kernel vulnerability "Copy Fail" (CVE-2026-31431) was publicly disclosed, prompting Cloudflare's security teams to assess the exploit technique and evaluate their infrastructure for exposure.…
Critical evaluation framework for purchasing AI-powered penetration testing tools, warning that the market is fragmented and that vendors often use the same terms to describe different capabilities. It emphasizes that bu…
The article highlights the high demand for cybersecurity consultants, with information security analyst roles projected to grow nearly 30% by 2034 and over $10 trillion spent annually on cybercrime damage. To help profes…
On May 5, 2026, DENIC, the operator of the .de country-code top-level domain, began publishing incorrect DNSSEC signatures, causing validating DNS resolvers like Cloudflare's 1.1.1.1 to reject the records and return SERV…
The popular disk-mounting application Daemon Tools was compromised in a monthlong supply-chain attack starting April 8, with malicious, digitally signed updates infecting Windows versions 12.5.0.2421 through 12.5.0.2434.…
The article distinguishes between a "weakness" (a theoretical code pattern that could cause issues) and a "vulnerability" (a specific, exploitable flaw in a live system). It argues that the security industry conflates th…
The Trump administration is considering new oversight for advanced AI models, including discussions of an executive order to create a government-industry working group and a process for reviewing models before their publ…
The author filed a lawsuit against the U.S. Department of Justice and FBI after the agencies denied his Freedom of Information Act request for records explaining why FBI agents visited his home in 2020 to question him ab…
DARPA's post-AIxCC bounty program led Xint.io to discover CVE-2026-31789, a critical heap buffer overflow vulnerability in OpenSSL that could enable code execution. Xint's AI-powered scan analyzed over 600,000 lines of c…
The article describes a single-character logic bug discovered in OpenSSL version 4.0.0's implementation of the SLH-DSA post-quantum signature algorithm. The bug occurs in the `slh_dsa_sign()` function, where a conditiona…
The Free Software Foundation Europe (FSFE) has criticized NHS England's reported plan to make most of its public source code repositories private by default, citing security concerns over AI vulnerability scanning. The F…
This article provides a technical guide for setting up a two-server Xray proxy configuration using VLESS, XHTTP, and TLS Reality protocols. Server A acts as an inbound relay that accepts client connections via XHTTP with…
The article argues that organizations should make it easy to report security flaws, as failing to do so drives people to contact the media instead. It explains that when customers or researchers find bugs but have no way…
Cloudflare has completed its "Code Orange: Fail Small" engineering initiative, which focused on making its network more resilient and reliable. The project introduced safer configuration changes through a new system call…
Ubuntu and Canonical's web infrastructure has been offline for over 24 hours following a sustained, cross-border DDoS attack, preventing users from accessing most official websites and downloading OS updates. A pro-Irani…
A critical Linux vulnerability, tracked as CVE-2026-31431 and named CopyFail, was publicly disclosed on Wednesday after being privately reported to the Linux kernel security team five weeks prior. The flaw is a local pri…