Over Security

PaperCut shipped a second emergency patch for CVE-2026-81578 and CVE-2026-82078 after researchers bypassed the first fix. Attacks began Aug. 26.

The Boston Scientific cyberattack disrupted operations, manufacturing and shipping, while an investigation examines unauthorized activity and device impact.

Nel caso Hugging Face, gli agenti AI hanno trattato il confine dell'ambiente di test come un ostacolo tra loro e il punteggio massimo. Ecco i precedenti e il fenomeno del Reward hacking nell'era degli agenti AI, pronti a trattare ogni confine, tecnico o procedurale, come un elemento dell'ambiente da aggirare per massimizzare il punteggio

Il direttore del PICS, Luigi Martino, spiega quali sono i cinque pilastri su cui si fonda il neonato organismo, come l'Italia può valorizzare quello che già esiste nel settore e i nodi da sciogliere per trasformare questa visione in realtà

Microsoft has confirmed that mouse settings are being reverted on Windows 11 systems after installing the KB5120998 August 2026 non-security preview update.

Anthropic says Vidar, LummaC2, StealC, RedLine, Acreed and AMOS malware are stealing Claude session tokens to hijack accounts and drain paid usage.

La recente sentenza del Tribunale di Udine non riguarda solo l'uso di WhatsApp nei rapporti di lavoro o una controversia disciplinare nata da una comunicazione attraverso un canale improprio, ma la progressiva perdita di coincidenza tra organizzazione formale e quella realmente operante. Ecco cosa mette in luce il provvedimento

Threat actors are distributing the ValleyRAT backdoor disguised as adware. We analyze the infection chain, from the malicious installer to the final payload.

Hostinger propone servizi di hosting web con backup giornalieri a soli 3,99 € al mese: ecco come ottenere lo sconto del 79% della promo.

Two Nigerian men extradited to the U.S. on Thursday have been charged with involvement in sextortion schemes that resulted in the deaths of two minor victims in Mississippi and North Carolina.

CVE-2026-77846 affects AshSqlite, allowing JSON path injection that may expose hidden fields. Learn affected versions, impact, and fixes.

Dai dati agli output, fino a plugin e agenti autonomi, la Generative AI introduce rischi che ridisegnano i confini tra provider e cliente. L'AI Shared Responsibility Model aiuta a stabilire chi deve presidiare ogni controllo e soprattutto quali responsabilità restano sempre in capo all'organizzazione

Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers a unique, AI-enhanced underground marketplace for commercializing compromised Iberian and Latin American targets.

Microsoft asked customers this week to ignore incorrect alerts that Defender Antivirus has been turned off after installing the latest Defender updates.

Praetorian develops portable Go security tools for service fingerprinting, secrets discovery, reconnaissance, credential testing and more.

The ClockworkPi uConsole is already an interesting portable Linux computer. By connecting a Proxmark3, it can also become portable RFID research for exploring and understanding contactless cards and tags, cloning them and identifying how different cards work and their security. This beginner-friendly guide explains how to install the Proxmark3 client, compile the matching firmware, connect […]

FulcrumSec claims it stole 86 GB of data from Manchester Airports Group. BleepingComputer validated one traveller's record, while samples revealed detailed customer, booking, and travel information beyond what MAG initially disclosed.

Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, as well as inject ClickFix lures.

Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage.

The latest TCE weekly roundup covers a French tax breach, Ukraine cyberattack, Oz Hair data leak, enterprise AI risks and a critical GitLab flaw.

Microsoft disclosed on Thursday that a maximum-severity remote code execution vulnerability in Entra ID, the identity service underpinning Microsoft 365,

Microsoft does a U-turn on CVE-2026-69836 Entra ID bug's "exploitation" status. Now says its not exploited.

Anthropic is permanently increasing Claude Code's standard weekly usage limits by 25% for Pro, Max, Team, and seat-based Enterprise plans, but it's not as good as it sounds.

The latest version of the Brave browser, 1.94, introduces a feature called 'Email Aliases' that allows users to generate disposable email addresses when signing up to a new service.

Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records.

A malicious Cloudflare Zaraz action on edgeupstudio[.]com loaded an ErrTraffic BW Panel bootstrap that looked up its panel address in a Polygon contract.

Dindoor is a backdoor that abuses the Deno runtime to execute malware within a target environment. Rather than shipping its own interpreter, Dindoor relies on Deno, a legitimate and widely used JavaScript and TypeScript runtime, and will install that runtime on the victim machine on demand if it is not already present. Few of its individual components are novel; what makes Dindoor effective is the combination of a signed third-party runtime performing execution, base64 encoding at every stage, and an environment check that must pass before the backdoor establishes persistence. After initial staging, the loader confirms whether the Deno runtime is present on the victim machine and, if it is not, downloads it from deno.land via curl.exe. What does not change between builds is the behavior beneath the encoding, and that is where detection must focus: deno.exe launching with a lengthy base64 argument on a host with no developer profile curl.exe reaching out to deno.land on a machine with no legitimate reason to install a JavaScript runtime a Run key directing wscript.exe to a VBScript within a subdirectory of AppData\Local a `Win32_VideoController` WMI query originating from a PowerShell process spawned by cmd.exe Binary Defense researchers developed hypothesis-based threat hunting queries around these patterns, targeting the fixed structure of Dindoor's execution chain rather than the encoded contents that change with each build. By adopting a mainstream developer runtime as its execution engine, MuddyWater gains a legitimate signed binary, a network destination few organizations have reason to block, and a script format that most detection content was never written to address.

Researchers disclosed an attack technique that smuggles malicious instructions past Grok AI and Gemini safety filters by encrypting them.