Cybersecurity news — data breaches, vulnerability disclosures, AI-powered security tools, threat intelligence, and enterprise security research.
Trump Mobile confirmed that customers' names, email addresses, mailing addresses, cell numbers, and order identifiers were exposed to the open internet. The company stated that the exposure was linked to a third-party pl…
A security analysis of the top 500 most popular MCP servers on the Smithery registry found that 15.3% (76 servers) had at least one security finding, including actively maintained servers like Slack and Google Sheets. Th…
Cox Media Group agreed to pay $930,000 to settle Federal Trade Commission (FTC) allegations that it falsely claimed its AI-powered service could eavesdrop on conversations through smart devices. The FTC accused the media…
This article describes a Linux privilege escalation exploit (CVE-2024-0582) that targets a use-after-free vulnerability in the Generic Receive Offload (GRO) subsystem. The bug occurs when `skb_gro_receive()` copies zero-…
The article explains that the standard OAuth 2.0 Authorization Code flow has a security gap, as it cannot verify that the application exchanging an authorization code is the same one that originally requested it, leaving…
The article explains that traditional centralized Security Operations Centers (SOCs) are failing due to latency and data volume, necessitating a shift to distributed, autonomous systems. It introduces HookProbe's 7-POD a…
The article introduces NVEN, a command-line tool designed to simplify environment variable management for developers by centralizing secrets across different environments (dev, staging, prod) directly within the terminal…
The article describes a production pattern for implementing multi-tenant row-level security (RLS) in PostgreSQL, arguing that application-layer tenant isolation is unreliable because bugs like missing authorization check…
A contractor for the U.S. Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository until recently that exposed credentials for highly privileged AWS GovCloud accounts and internal syste…
The article provides configuration snippets for Unix shells (`.zshrc`, `.bashrc`) and PowerShell profiles to wrap package manager commands (`npm`, `pnpm`, `bun`, `yarn`) with the Socket Firewall (`sfw`) tool for supply c…
Riot Games has upgraded Valorant's Vanguard anti-cheat system to combat Direct Memory Access (DMA) cheats, which run on separate hardware to evade traditional detection. The update targets the firmware connected to these…
Riot Games has upgraded Valorant's Vanguard anti-cheat system to block expensive DMA (Direct Memory Access) cheating hardware, which operates externally to read game memory and evade traditional detection. The update tar…
Based on the provided text, the article titled "VLESS Keys Auto-update" from May 22, 2026, contains a list of VLESS proxy configuration links. These links use the Reality security protocol and are configured to route tra…
The article announces a call for beta testers for LocalPanel, a £60 desktop application that enables local management of SSH-accessible servers with features like one-click app installation and drag-and-drop bash shell c…
The article describes the process of mirroring a production EKS cluster locally on a Mac, focusing on integrating Vault for secret management. It explains how Vault's Kubernetes auth method allows pods to authenticate us…
Two Dutch company directors, aged 57 and 39, were arrested by the Fiscal Information and Investigation Service (FIOD) for allegedly helping a Russian-linked company evade EU sanctions by running its servers from the Neth…
Ukraine has launched an experimental program allowing 27 private companies to form their own air defense units to combat the growing number of Russian attack drones, with some units already conducting combat missions in …
Valve removed the free horror game *Beyond The Dark* from Steam after it was discovered to contain malware designed to steal personal data and cryptocurrency wallet information. The malicious actor hijacked an existing S…
The article explains that JSON Web Tokens (JWTs) signed with current algorithms like RS256 and ES256 are vulnerable to future quantum computer attacks, with nation-state actors already employing "harvest now, decrypt lat…
The FBI has issued a warning about a phishing kit called "Kali365" that is being used to steal Microsoft OAuth tokens on a large scale. This crimeware bypasses multi-factor authentication (MFA) by tricking users into gra…