CIA official touts agency’s Cyber Mission Center in capture of Venezuela’s Maduro
Russian suspect in bank account takeovers is extradited to US
Italian tech collective Autistici/Inventati shuts down after US terrorist designation
Microsoft releases Windows 10 KB5122878 extended security update
Microsoft has released the Windows 10 KB5122878 extended security update, which includes this month's record-breaking September 2026 Patch Tuesday fixes, along with a few bug fixes.
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
Today is Microsoft's September 2026 Patch Tuesday, with security updates released for a record-breaking 966 flaws, including two actively exploited zero-day vulnerabilities.
Windows 11 cumulative updates KB5124008 & KB5122880 released
Microsoft has released Windows 11 KB5124008 and KB5122880 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new features.
‘White hat’ hackers take $47 million bounty after $320 million crypto theft
‘White hat’ hackers take $47 million bounty after $320 million crypto theft
ShinyHunters hackers claim breach of Florida "DAVID" DMV database
The ShinyHunters extortion gang claims it breached an online platform for the Florida Department of Motor Vehicles database known as "DAVID" and stole over 200,000 records about drivers in the state.
OpenAI says ChatGPT outage causes image generation errors
OpenAI is investigating an ongoing incident causing ChatGPT image generation failures and delays when uploading files.
Robotica collaborativa e sicurezza dei Cobot: la tutela dei flussi operativi nelle linee ad alta automazione
La robotica collaborativa porta persone e macchine a condividere spazi e processi produttivi. Ma Cobot connessi, sensori e software ampliano anche il rischio cyber: proteggere reti, firmware e logiche di controllo diventa essenziale per garantire sicurezza degli operatori e continuità della produzione
August updates trigger 0xc0000409 errors on Windows Server 2016
Microsoft says the August 2026 security update may trigger 0xc0000409 errors on Windows Server 2016 systems where the Compatibility Appraiser diagnostic service is enabled.
Sycophancy nell’AI: quando l’algoritmo ci dà ragione anche se stiamo sbagliando
Cos’è la Sycophancy nell’AI e perché gli LLM tendono ad assecondare l’utente? Ecco come il bias di conferma può trasformarsi in rischio cyber e come mitigarlo
SAP warns of maximum severity 'OVERPASS' kernel vulnerability
SAP has addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in the SAP Kernel code.
Exposed Database Left 220Mn Airline Passenger, Crew Records Open to the Internet
A misconfigured Elasticsearch cluster exposed roughly 220.8 million airline passenger and crew records, including passport numbers and full itineraries,
OpenAI says GPT-6 Astra can find zero-days, but is also harder to monitor
OpenAI confirmed that GPT-6 Astra is the first model it has broadly deployed to reach the "Critical level" for cybersecurity capabilities.
Where the backlash against Flock Safety is having the biggest impact
Adobe fixes critical Magento zero-day exploited to backdoor servers
Adobe has released an emergency fix for CVE-2026-75650, an actively exploited max-severity zero-day vulnerability dubbed StyleSmuggler, that impacts multiple versions of Magento and Adobe Commerce.
Webinar: The forgotten Google Workspace access that can lead to a breach
Third-party applications connected to Google Workspace can retain access long after their original purpose is forgotten. This webinar examines how overly permissive integrations contribute to breaches and which security controls can help fast-growing companies reduce their exposure.
French prosecutors confirm arrest of suspected ZeroBytes hacker behind tax cyberattack
Cyberattack encrypts systems at Bavarian municipal utility
Hackers build AI frameworks for widescale credential theft
Threat actors are increasingly switching from AI-powered coding assistants to multi-agent frameworks that automate every stage of an attack.
Velocità delle VPN e throughput di rete: i nuovi protocolli superano i limiti di banda nella protezione endpoint
Velocità VPN e throughput, NordVPN e le prestazioni di rete garantite nell'offerta: quali sono i costi e quali sono i servizi inclusi.
Microsoft: Windows Server 2025 changes causing app crashes
Microsoft warned customers last week that they may experience application crashes on some Windows Server 2025 due to recent memory management changes.
ASCII smuggling, la nuova tecnica che elude i filtri antiphishing: come difendersi
L’ASCII smuggling esce dal perimetro della sicurezza AI e arriva nel phishing. Una campagna individuata da Microsoft usa caratteri Unicode invisibili per confondere i sistemi di rilevamento, mostrando come tecniche legate al prompt injection possano diventare strumenti per eludere le difese tradizionali
GPT-6 Astra e articolo 50 AI Act: il paradosso della trasparenza che non si può verificare
Il modello più capace mai rilasciato da OpenAI arriva mentre in Europa diventano operativi gli obblighi di trasparenza sui contenuti sintetici. Il risultato è un sistema normativo che carica il fornitore a monte e lascia disarmato il destinatario a valle. Per chi governa la sicurezza, questo cambia il modo in cui va impostato il presidio
HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures
An HVNC campaign uses fake tax documents and DocuSign lures to target LATAM organizations, enabling hidden remote access, persistence, and data theft.
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session.
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload.
CSIRT as a Service: cos’è e come gestisce gli incidenti secondo la NIS2
Con gli attacchi gravi in Italia cresciuti del 42% e le scadenze NIS2 di ottobre 2026 alle porte, cresce l'interesse per il CSIRT as a Service: un modello che esternalizza la funzione di Referente CSIRT e coordina l'incident response dal rilevamento fino alla notifica alle autorità
Servizi di ascolto e GDPR: perché il consenso non basta a proteggere i soggetti vulnerabili
Il consenso non è necessariamente la base giuridica più sicura quando si trattano i dati di persone vulnerabili. Tra categorie particolari, comunicazioni a soggetti terzi e informazioni relative a possibili reati, la liceità dei servizi di ascolto richiede scelte documentate. E nell’art. 10 GDPR emerge il vero collo di bottiglia