Over Security

ChatGPhish shows how browser-based prompt injection can manipulate ChatGPT summaries, enabling phishing, QR-code attacks, and tracking.

In January 2026, the automotive research and car-shopping platform Edmunds was listed by the ShinyHunters hacking group as having been breached. Data purportedly obtained in the incident was later published publicly and included 178k unique email addresses, usernames, passwords, IP addresses, phone numbers and vehicle-related records.

The 10 most common crypto scams in 2026, how they work, and what financial institutions can do to detect fraud earlier.

ChatGPhish shows how browser-based prompt injection can manipulate ChatGPT summaries, enabling phishing, QR-code attacks, and tracking.

Merchants face $53B in card fraud losses but lack access to compromised card data. Discover the three barriers keeping merchants in the dark — and the solution.

CBSE deploys IIT experts after OSM vulnerability claims. Security audit underway as OSM vulnerability concerns trigger portal hardening.

Part 1 of our FSB Matryoshka series. Discover the context behind Gamaredon's cyberespionage campaigns, introducing GammaPhish and GammaWorm operations.

Hackers are targeting WordPress websites running a vulnerable version of the WP Maps Pro plugin, which allows creating rogue administrator accounts without authentication.

Malware analysis is more than tools. Learn the mindset, goals, techniques, and workflows analysts need to dissect malware effectively.

In May 2026, the GTA V and CS2 cheat service Atlas Menu suffered a data breach. An attacker claimed to have gained access to all Atlas systems and published the service's database to a public GitHub repository. The incident exposed 64k unique email addresses along with usernames, IP addresses, support tickets and passwords stored as bcrypt hashes.

Palo Alto Networks is warning that hackers are now exploiting a PAN-OS GlobalProtect authentication bypass flaw, tracked as CVE-2026-0257, in attacks attempting to breach corporate networks.

A newly discovered local privilege escalation vulnerability dubbed 'CIFSwitch' in the Linux kernel could allow attackers to forge CIFS authentication key descriptions, abuse the kernel's key request mechanism, and gain root privileges.

Threat actors are abusing ChatGPT's content-sharing feature to display fake OpenAI outage pages that direct users to download malware disguised as the ChatGPT desktop application.

California Attorney General Rob Bonta filed a lawsuit against 23andMe, now Chrome Holding Co., over the company's failure to protect sensitive customer genetic and personal information.

A public spat between Microsoft and an independent security researcher reopens a long-running debate over who is responsible for securing software.

Analisi della sovranità digitale tra hardware, data center e geopolitica mondiale. Dati e scenari dal Security Summit 2026

DDoS attacks are increasingly being sold like subscription services, complete with pricing tiers, support, and reseller programs. Flare explores how the DDoS-as-a-Service market has evolved from scattered tools into polished attack platforms.

Dutch authorities have taken offline a massive botnet of 17 million devices and seized more than 200 servers at a local provider that supported the operation.

Il Q-Day al 2029 è un worst-case plausibile scenario. Claude Mythos di Anthropic ha già dimostrato di saper trovare migliaia di vulnerabilità ad alta severità in ogni sistema operativo e browser principale. Ecco i fattori geoeconomici sistemici

Quanto conta la fiducia nell'era dell'automazione, in cui spesso c'è la delega ad una macchina di quella decisione che non solo dovrebbe essere umana ma che lo rimane anche nel conto delle responsabilità? Andiamo a comprendere quanto questo elemento possa essere dirimente per i tempi a venire

Gli attacchi informatici non sono eventi tecnici isolati, ma segnali di quello che accade nel dominio cyber. Per questo motivo, al giorno d’oggi, leggere e monitorare la realtà digitale significa saper connettere quello che succede online a quello che succede nel mondo fisico, e viceversa. Ecco perché

Confronto tecnico e tariffe 2026 delle VPN per il Brasile: guida alla scelta aziendale per performance, compliance LGPD e cifratura.

Flashpoint Intelligence Requirements helps organizations operationalize Priority Intelligence Requirements (PIRs) and align intelligence activity to business priorities, operational risk, and measurable outcomes.

Google says the Chrome Device Bound Session Credentials (DBSC) security feature is now generally available and is rolling out to all users to prevent account takeovers.

The Cyber Express weekly roundup highlights the latest supply chain attacks, mobile malware, and cloud phishing.

A North Carolina man was sentenced to more than 10 years in prison for selling the personal information of over 7 million elderly Americans to Jamaican scammers.

Israeli researchers linked Iranian hackers to the LA public transport cyberattack targeting LACMTA and disrupting services.

A Google security engineer was charged with insider trading after winning $1.2 million using confidential company data to place bets on the cryptocurrency-based Polymarket decentralized prediction market.