In June 2026 the IETF published RFC 10008 and gave HTTP a new method: QUERY. New HTTP methods are rare. Most engineers have not seen one added in about twenty years, so this is worth understanding before it shows up in your stack. At first, when I saw this new method, I thought, "OK, we need to support it in our WAF." But after reading the RFC... I changed my mind... Here is what QUERY does, in plain terms. It works like GET, but it can carry a request body. A client uses it to send a read-onl

American insurance company AssuranceAmerica has disclosed a data breach impacting nearly 7 million drivers after attackers gained access to its systems earlier this year.

L'ultimo Internet Organised Crime Threat Assessment di Europol descrive un'economia del crimine ormai industrializzata. Ecco i casi concreti degli ultimi dodici mesi che mostrarno quanto la nuova grammatica del conflitto sia già operativa sul territorio europeo, con lo sfaldamento della distizione fra cyber criminali per profitto e attori statali

CERT warns CVE-2026-11405 lets attackers bypass authentication on Tenda devices. No patch is available; users should apply mitigations.

Group-IB analysts examine this resurfaced Android Remote Access Trojan, demonstrating new, sophisticated and malicious functionalities including autonomous privilege abuse, expanded command-and-control capabilities, and a robust persistence stack.

Wireshark 4.6.7 patches 12 security flaws and fixes 16 bugs affecting SSH, IEEE 802.11, Catapult DCT2000, extcap and more.

Microsoft has released a security patch to address a Defender zero-day vulnerability known as "RoguePlanet," disclosed after the June 2026 Patch Tuesday.

Mount Royal University in Calgary says hackers stole and then deleted data from its file storage systems after breaching the university's network.

Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment applications.

A China-linked threat cluster has been exploiting vulnerable Roundcube servers at U.S. and Canadian universities to steal credentials and deploy backdoor malware.

A threat actor has been targeting organizations across multiple sectors with voice-based fake security requests that ask Microsoft 365 users to enroll a new Entra passkey.

Un bug nella funzione “Nascondi la mia email” espone da oltre un anno gli indirizzi reali degli utenti iCloud, mettendo in discussione una delle principali promesse di privacy di Apple. Il caso riapre il dibattito su vulnerability management, trasparenza e tutela dell’identità digitale

TrojPix conferma che la sicurezza delle reti air-gapped non dipende soltanto dall'assenza di connessioni Internet. Emissioni elettromagnetiche, malware e canali laterali possono aggirare l'isolamento fisico, ampliando il perimetro della cyber security degli ambienti più sensibili

Specops Software explains how AI is making service desk impersonation attacks more convincing, personalized, and scalable, along with practical steps organizations can take to strengthen onboarding and identity verification.

A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most recent ventures included fake intelligence companies and a now-defunct AI-based lobbying…

DuckDuckGo announced that its browser can now block most video ads on YouTube, including those shown before the video starts playing and during playback.

When we open-sourced Karna WAF, we immediately added AI Agent Skills to help agents not just use and configure Karna, but also learn how to protect web apps and APIs. Now you can ask to Claude Code to protect your web application using Karna without knowing how to do it yourself. Karna Skills are grouped in 4 different categories: configuration: tells to your AI Agent how to configure Karna and what each parameter means. deploy: instruction about how to deploy Karna via an isolated docker con

Japanese telecommunications giant KDDI says that millions of people had their email addresses and passwords exposed after attackers breached an email platform used by five internet service providers (ISPs) in the country.

Check the NIST CSF 2.0 practical guide for CISOs to close security gaps, improve threat visibility, and strengthen incident response with ANY.RUN.

L’Action Plan europeo su cyber security e AI punta a rafforzare valutazione dei modelli, gestione delle vulnerabilità, software open source e competenze. Dopo la stagione della regolazione, Bruxelles prova a costruire capacità operative e sovranità tecnologica

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) gave federal agencies until Friday to patch an actively exploited vulnerability in the Langflow visual framework for building AI agents.

La crittografia post-quantum non è una minaccia del futuro: la strategia “harvest now, decrypt later” rende urgente la transizione oggi. Con la pubblicazione degli standard NIST FIPS 203-206 nel 2024, le organizzazioni hanno ora gli strumenti per avviare la migrazione. Questa guida illustra il percorso in sei passi verso la quantum-resistance

Organizzazioni, collettivi e istituzioni fuori dal mondo occidentale si interrogano su come sfruttare le potenzialità delle intelligenze artificiali generative e svincolarsi da Big Tech. Ma il valore della sfida politica si scontra con la disparità di potere.