Over Security

Di fronte a uno scenario sempre più complesso, limitare l’intervento a logiche legate a scelte tecnologiche non è sufficiente. Serve un ecosistema completo che permetta il salto di qualità

Discover why ANY.RUN is a G2 Malware Analysis Leader and how it helps SOC teams deliver measurable value to their enterprises.

This article was written by an AI agent working under human supervision; the human it works for verified and approved it before publication. An open directory on a freshly-registered Indonesian dom…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a critical WatchGuard Firebox firewall vulnerability, which it flagged as actively exploited in December.

Surfshark al prezzo di 2,49 euro al mese offre una VPN con antivirus integrato su dispositivi illimitati: ecco come attivarla e come funziona

In vigore dal 2024, il Cyber Resilience Act prevede severi obblighi di segnalazione dall'11 settembre 2026. Ecco cosa comportano gli obblighi di comunicazione dell’articolo 14

La rappresentazione classica, veicolata anche sui siti dell’UE, prevede quattro diversi livelli di rischio: ecco quali e ulteriori interventi da parte dell’autorità

Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability

Microsoft says the September 2026 Patch Tuesday updates fix a known issue causing desktop settings to be lost or reset on some Windows devices.

Proteggere gli impianti industriali oggi significa superare la separazione tra IT e OT. Il progetto sviluppato da A2A Smart City mostra come standardizzazione, monitoraggio continuo e governance unificata rafforzino resilienza e continuità operativa delle infrastrutture critiche: un modello replicabile anche per altre realtà industriali

Trezor warned customers on Wednesday that threat actors who breached its third-party email provider are targeting them in phishing attacks.

In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published a substantial corpus of data they alleged was sourced from the company, which included 6.4M unique email addresses among other personal and corporate data attributes. The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, staff and healthcare provider contacts. In McKesson's disclosure notice, the company advised it had identified unauthorised access to "certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units", but had "reasonable assurance of no ongoing unauthorized activity".

Healthcare company AdaptHealth has confirmed that data of 4.1 million people was exposed in a cyberattack discovered in July that was attributed to the ShinyHunters threat group.

Cisco has confirmed that a maximum-severity authentication bypass vulnerability tracked as CVE-2026-20079 in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks.

The Carnegie Mellon University CERT Coordination Center (CERT/CC) is warning that Skullcandy Dime 3 wireless earbuds accept Bluetooth pairing requests from nearby unpaired devices without requiring user interaction.

U.S. cybersecurity and intelligence agencies say that six Chinese AI companies conducted industrial-scale distillation attacks on American frontier AI models since at least late 2024.

Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software.

I sistemi legacy e i PLC obsoleti restano essenziali in molti impianti, ma vulnerabilità non correggibili e assenza di supporto ne aumentano il rischio cyber. Segmentazione, monitoraggio e compensating controls permettono di proteggerli mentre si pianifica un ammodernamento sostenibile

Healthcare technology company Veradigm disclosed a data breach after a cybersecurity incident at one of its third-party vendors exposed patients' personal data.

Flashpoint’s weekly analysis tracks shifting kinetic and cyber threat radiuses, geopolitical disruptions, and provides critical operational forecasts for the ongoing Middle East conflict.

MFA makes account takeover harder, but attackers are increasingly targeting the recovery processes used to reset passwords and authentication methods. Specops explains why stronger identity verification at the service desk is critical to preventing social engineering attacks from turning account recovery into account takeover.

AI, vishing, furto di identità e social engineering funzionano perché spesso non serve bucare un sistema. Agli aggressori è sufficiente convincere qualcuno ad aprire la porta e l’AI accelera tutto questo, rendendo gli attacchi più personalizzati e scalabili

Con 974 CVE corrette, quasi il doppio del record di luglio, il Patch Tuesday di settembre 2026 è il più grande della storia. Ma la vera notizia non è il numero: sono le due zero-day già sfruttate su ALPC e Windows Update Stack, venti vulnerabilità wormable e un Exchange che esegue codice remoto leggendo allegati Visio

Ad oltre un mese dalla scadenza del piano definito per gennaio-luglio, imprese, amministrazioni e professionisti non dispongono ancora della consueta indicazione pubblica delle successive priorità ispettive. Ecco perché è necessario e urgente programmare il piano ispettivo del Garante Privacy e perché si deve reintegrare la compagine a 4 componenti