Over Security

Cisco Talos discovered an ongoing malicious campaign since at least as early as December 2025 by a threat actor we track as “UAT-10027,” delivering a previously undisclosed backdoor dubbed “Dohdoor.”

Rivali che puntano a eroderne il dominio, startup innovative e la rincorsa cinese: il gigante fondato da Jensen Huang deve iniziare a guardarsi alle spalle

See how your SOC can accelerate monitoring, triage, and response with ANY.RUN by working inside Splunk Enterprise.

Samsung SDS’s reveals the cybersecurity threats of 2026, highlighted by AI risks, ransomware, cloud misconfigurations, phishing, and data breaches.

Il nuovo numero della rivista IEEE Computer accende un faro sulla convergenza tra reti di agenti AI, la verifica dell'identità delle macchine e la resilienza dei sistemi cognitivi. Ecco tre risposte autorevoli e scientifiche alla domanda chiave del CISO, mentre la fiducia algoritmica non sarà più un attributo implicito, ma una metrica da verificare continuamente

Il collettivo filorusso ATP28 ha sfruttato una vulnerabilità di Office contestualmente alla sua divulgazione. Sono bastate una manciata di ore per diffondere documenti pericolosi tra ministeri della Difesa, rappresentanze diplomatiche e operatori di trasporto e logistica. Siamo davanti a tecniche estemporanee oppure a una nuova normalità?

Hackers exploited Cisco SD-WAN zero-day for 3 years before detection.

As digital environments grow more difficult, age verification technologies are increasingly positioned as a foundational layer of online safety.

Hazeldenes cyberattack disrupts Australia poultry production, prompting phased recovery after the February 19 cybersecurity incident.

American manufacturer of medical devices, UFP Technologies, has disclosed that a cybersecurity incident has compromised its IT systems and data.

Error: PHP Startup: Unable to load dynamic library '../php56/ext\\gd2' --  When using apache 2.4.* the php extension php_*.dll seems to work...

The Microsoft Defender team has discovered a coordinated campaign targeting software developers through malicious repositories posing as legitimate Next.js projects and technical assessment materials, including recruiting coding tests.

Flashpoint analyzes the DarkCloud infostealer, its Visual Basic 6 evasion tactics, encryption methods, and enterprise credential theft risk.

The former boss of a U.S. hacking tools maker was jailed for selling highly sensitive software exploits to a Russian broker. This is how we first learned of his arrest, reported the story, and some of the unanswered questions we still have.

TL;DR This post is super short, nevertheless: The classic cross-DC coerce + relay to LDAPS technique, abusing a misconfigured LmCompatibilityLevel (0/1/2) to generate NTLMv1 + ESS and strip the MIC…

Cisco is warning that a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN, tracked as CVE-2026-20127, was actively exploited in zero-day attacks that allowed remote attackers to compromise controllers and add malicious rogue peers to targeted networks.

I ricercatori dell’ETH Zurich hanno dimostrato 25 attacchi concreti sui password manager Bitwarden, LastPass e Dashlane. Il modello zero-knowledge, presentato come garanzia assoluta, si rivela strutturalmente più fragile di quanto promesso. Ecco cosa significa per aziende e professionisti e come agire subito

This post will focus on an alternative method of using Kali Linux, moving beyond direct terminal command execution. Instead, we will leverage a Large Language Model (LLM) to translate “natural language” descriptions of desired actions into technical commands. Achieving this setup requires the integration of three distinct systems:

I modelli linguistici di grandi dimensioni (LLM) testimoniano potenzialità in crescita sia nel generare codice che nelle attività cyber. Ecco quali vantaggi offre Anthropic Claude Code Security e come mitigare i rischi

Google's Threat Intelligence Group (GTIG), Mandiant, and partners disrupted a global espionage campaign attributed to a suspected Chinese threat actor that used SaaS API calls to hide malicious traffic in attacks targeting telecom and government networks.

Avere attivi SPF e DMARC sulla posta elettronica non basta per bloccare le e-mail di phishing, è necessario configurarli correttamente. Perché la prevenzione da sola non basta: serve un rilevamento attivo delle credenziali compromesse

Cisco Talos is tracking the active exploitation of CVE-2026-20127, a vulnerability in Cisco Catalyst SD-WAN Controller, formerly vSmart, that allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges.

Marquis Software Solutions has filed a lawsuit against SonicWall, accusing the cybersecurity company of gross negligence and misrepresentation that allegedly led to a ransomware attack disrupting operations at 74 U.S. banks.