Over Security

The Def Con hacking conference banned hackers Pablos Holman and Vincenzo Iozzo, as well as former MIT Media Lab director Joichi Ito, from attending the annual conference after their reported connections with Jeffrey Epstein.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a critical vulnerability in multiple Honeywell CCTV products that allows unauthorized access to feeds or account hijacking.

AI assistants like Grok and Microsoft Copilot with web browsing and URL-fetching capabilities can be abused to intermediate command-and-control (C2) activity.

The Figure data breach allowed hackers to steal customer names, dates of birth, physical addresses, phone numbers, and email addresses.

Durante un’intervista in un podcast, il segretario di Stato olandese alla Difesa Gijs Tuinman ha sostenuto che un F-35 potrebbe essere “jailbreakato” “proprio come un iPhone”, nel contesto di una domanda molto concreta: cosa accadrebbe se, per ragioni politiche o strategiche, gli Stati Uniti smettessero di fornire supporto e aggiornamenti software agli alleati europei. Il …

Microsoft says an Exchange Online issue that mistakenly quarantined legitimate emails last week was triggered by faulty heuristic detection rules designed to block credential phishing campaigns.

Underground Telegram channels shared SmarterMail exploit PoCs and stolen admin credentials within days of disclosure. Flare explains how monitoring these communities reveals rapid weaponization of CVE-2026-24423 and CVE-2026-23760 tied to ransomware activity.

Tutte le istituzioni, organi, uffici e agenzie della UE sono tenute a nominare un DPO e per rafforzarne il ruolo il Garante europeo della protezione dei dati, l’EDPS, ha adottato due documenti chiave che irrobustiscono l'indipendenza di questa funzione. Vediamo i passaggi salienti

Ipotesi di compromissione della rete informatica del Ministero dell’Interno che avrebbe comportato il furto di un elenco di circa 5mila agenti Digos. Ecco cosa sappiamo, perché questo tipo di fuga dati è diversa dalle altre e come mitigare il rischio

Hackers have stolen the personal and contact information of nearly 1 million accounts after breaching the systems of Figure Technology Solutions, a self-described blockchain-native financial technology company.

Improve SOC alert enrichment with TI Lookup and Sandbox. Cut triage time, reduce false positives, boost efficiency.

The broader discussion reinforced that Responsible AI at Scale cannot rely on policy statements alone.

Microsoft says a Microsoft 365 Copilot bug has been causing the AI assistant to summarize confidential emails since late January, bypassing data loss prevention (DLP) policies that organizations rely on to protect sensitive information.

In the first half of February 2026 I collected 96 events (6.4 events/day) with a threat landscape dominated by malware with 33%, (it was 38% in the second half of last month, once again ahead of ra…

L’operatore telefonico Odido è rimasto vittima di un importate data breach: 6,2 milioni di clienti esposti, Salesforce come vettore, e autenticazione MFA bypassata. Un caso di violazione dati che è un manuale di social engineering che ogni CISO dovrebbe studiare

L’autorità per la protezione dati di Dublino apre un procedimento su X per la diffusione virale di immagini sintetiche non consensuali. Un procedimento che riapre il dibattito sulla moderazione dei contenuti, sulla tenuta del principio di privacy by design e sull’effettiva capacità del DSA di incidere sui rischi sistemici delle piattaforme

A Talos researcher used targeted emulation of the Socomec DIRIS M-70 gateway’s Modbus thread to uncover six patched vulnerabilities, showcasing efficient tools and methods for IoT security testing.

​A Glendale man was sentenced to nearly five years in federal prison for his role in a darknet drug trafficking operation that sold cocaine, methamphetamine, MDMA, and ketamine to customers across the United States.

OpenAI deployed two security features, Lockdown Mode and Elevated Risk labels, targeting prompt injection attacks that exploit AI systems' growing connectivity to external networks and applications.

Due delibere dell'Autorità nazionale anticorruzione, rafforzate ora dal parere del Garante della privacy, stabiliscono le regole per i canali di segnalazione anonima. La sicurezza digitale del segnalante è un obbligo non di facciata

Researchers of Unit 42 documented widespread exploitation of two Ivanti EPMM vulnerabilities, tracked as CVE-2026-1281 and CVE-2026-1340.

UNC6201 exploits CVE-2026-22769 in Dell RecoverPoint, deploying GRIMBOLT and SLAYSTYLE to gain root access and pivot into VMware systems.

In February 2026, data obtained from the fintech lending platform Figure was publicly posted online. The exposed data, dating back to January 2026, contained over 900k unique email addresses along with names, phone numbers, physical addresses and dates of birth. Figure confirmed the incident and attributed it to a social engineering attack in which an employee was tricked into providing access.

Amnesty International says it found evidence that a government customer of Intellexa, a sanctioned surveillance vendor, used its Predator spyware against a prominent journalist in Angola.