Over Security

Analisi sul futuro del detection engineer tra automazione IA, gestione dei log e nuove competenze nella sicurezza informatica.

Il 29 ottobre scade il termine per adeguarsi alle regole del Garante privacy sui tracking pixel nelle email. Per imprese e organizzazioni significa rivedere informative, consenso e revoca, ma anche verificare piattaforme e fornitori: il tracciamento per marketing richiede scelte consapevoli e controlli privacy by design

Advantest Corporation is notifying affected individuals that a ransomware attack earlier this year exposed their personally identifiable data.

A North Carolina musician was sentenced to 18 months in prison for collecting more than $10 million in royalties from Spotify, Apple Music, Amazon Music, and YouTube Music in a massive streaming royalty fraud scheme.

The cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure. How you prepare for agentic threats is what makes the difference during real incidents.

September 2026 cyber attack statistics: 182 incidents analyzed by motivation, attack vector, initial access, target and country, with the daily trend.

September 2026 cyber attacks infographic: 181 incidents, 73.8% cybercrime, malware leading techniques. See the key stats at a glance.

What Happened Four key UK enforcement actions have showcased the diversifying spectrum of cryptocurrency crime in the UK in 2026. This range...

L'exploit UniPwn sui robot Unitree ha dimostrato che un attacco può produrre danni fisici, non solo furto di dati. NIS2, AI Act e Cyber Resilience Act coprono pezzi del problema, ma nessuna funzione aziendale, da sola, governa l’intero rischio

Explore 5 major pain points slowing US SOC teams, from alert overload and phishing blind spots to fragmented investigations. See how to address them.

Sekoia Obtains ENS Alta Certification for the Spanish Market.

In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and included names, countries and postcodes.

Osaka Metropolitan University faces a ransomware attack that disrupted major systems, with data of at least 130,000 students and teachers.

In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023. The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach "has no impact on client securities, funds, or credentials".

Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts.

On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days.

Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket.

UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company's Snowflake environment.

A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks.

L'uso strategico dell'intelligenza artificiale trasforma le estorsioni e le negoziazioni dei moderni gruppi ransomware.

RMM platforms give MSPs privileged access across customer environments, making their security controls critical to limiting risk. Acronis outlines eight controls MSPs should test when evaluating RMM software, from patching and privileged access to recovery and tenant isolation.

بسم الله الرحمن الرحيم

Learn how affiliate brand bidding can become advertising abuse, affect branded search, and create unnecessary costs for brands.

ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware

Introduction Python 3.15 (the final release is currently scheduled for October 9, 2026) introduces a new interpreter-startup mechanism worth adding to the DFIR checklist: .start files. A .start file placed in a Python site-packages directory contains one or more references in the form package.module:callable. During normal interpreter initialization, Python resolves those references, imports the corresponding modules, and invokes the callables before control reaches the first line of user-supplied Python code. The application itself does not need to import the module and does not need to know that the .start file exists. From a security perspective, that makes .start files an interesting execution primitive. An attacker who can write to an applicable site-packages directory can arrange for code to execute whenever an affected Python interpreter starts. Depending on where the file is placed, this may affect a single virtual environment, a user’s Python installations, or a system-wide interpreter.

The ‌Federal Bureau of Investigation removed an Accenture contractor on Monday over their role in a damaging data breach that exposed sensitive personal details of thousands of bureau employees, two sources familiar with the matter told Reuters.

Shares in British clothing company ASOS dive after hackers apparently send push notification