Over Security

Una campagna malware rilevata nel 2025 continua a fare vittime. Usa una falsa pagina di booking.com per costringere gli utenti a copiare una porzione di codice e a incollarla nella finestra di dialogo "Esegui" di Windows

La resilienza non è più solo una capacità interna, ma una linea strategica. Ecco la sua dimensione sistemica, le dipendenze critiche, la gestione del rischio dei fornitori, l’oversight sui servizi ICT critici, la concentrazione del rischio e il ruolo strategico del CdA nel disegnare l’intero ecosistema digitale in cui opera l’organizzazione

A new Internet-of-Things botnet called Kimwolf has spread to more than 2 million devices, forcing infected systems to participate in massive distributed denial-of-service (DDoS) attacks and to relay other malicious and abusive Internet traffic. Kimwolf's ability to scan the local…

Okta is warning about custom phishing kits built specifically for voice-based social engineering (vishing) attacks. BleepingComputer has learned that these kits are being used in active attacks to steal Okta SSO credentials for data theft.

The developer of the popular curl command-line utility and library announced that the project will end its HackerOne security bug bounty program at the end of this month, after being overwhelmed by low-quality AI-generated vulnerability reports.

In this week's newsletter, Bill hammers home the old adage, "Know your environment" — even throughout alert fatigue.

Hackers began exploiting an authentication bypass vulnerability in SmarterTools' SmarterMail email server and collaboration tool that allows resetting admin passwords.

The Irish government announced that it wants to pass a law that would grant police more surveillance powers, such as using spyware to fight serious crime, while aiming to protect the privacy rights of its citizens.

An operational security failure allowed researchers to recover data that the INC ransomware gang stole from a dozen U.S. organizations.

Microsoft will soon add new fraud protection features to Teams calls, warning users about external callers who attempt to impersonate trusted organizations in social engineering attacks.

EDPB ed EDPS hanno pubblicato un parere congiunto sulla proposta di Digital Omnibus AI della Commissione UE per semplificare l’attuazione dell’AI Act. Secondo le Autorità, alleggerire le regole potrebbe significare, in concreto, indebolire la tutela dei diritti. Ecco perché

EDPB ed EDPS frenano sul Digital Omnibus AI: semplificazione sì, ma non a costo dei diritti fondamentali. Criticità su dati sensibili per bias detection, registrazione sistemi e ruolo DPA nelle sandbox UE. Servono tempistiche chiare e accountability solida. Ecco i punti salienti dell’opinione congiunta

Hybrid work has driven a surge in Active Directory password resets, turning minor lockouts into major productivity drains. Specops shows why remote access, cached credentials, and security policies are fueling the spike.

Quantum computing e sicurezza: come mitigare oggi il rischio per la crittografia. Le strategie Zero Trust e post-quantum spiegate da Yaroslav Rosomakho di Zscaler

Microsoft is rolling out new artificial intelligence features with the latest updates to the Notepad and Paint apps for Windows 11 Insiders.

Intercepting OkHttp at Runtime With Frida - A Practical Guide

Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three vulnerabilities in Foxit PDF Editor, one in the Epic Games Store, and twenty-one in MedDream PACS.. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s third-party vulnerability disclosure policy.     For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org, and our latest Vulnerabi

Hackers collect $439,250 after exploiting 29 zero-day vulnerabilities on the second day of Pwn2Own Automotive 2026.

Threat advisory on scam campaigns exploiting U.S. actions in Venezuela, with malicious domains targeting merchandise, crypto, energy, and real estate.

Fortinet FortiGate devices are being targeted in automated attacks that create rogue accounts and steal firewall configuration data, according to cybersecurity company Arctic Wolf.

In linea con gli Stati Uniti che hanno vietato l’impiego di apparecchiature Huawei all’interno delle loro reti di telecomunicazione, la Commissione europea sta per presentare una nuova proposta legislativa in materia di sicurezza informatica. Ecco in cosa consiste il regime di restrizione o esclusione dei fornitori ad alto rischio

Il mondo della sanità è nel mirino di truffatori e hacker criminali. Ecco come mitigare i rischi secondo i nostri esperti

L’account Google di Andrea Galeazzi è stato rubato con la tecnica del phishing OAuth: e-mail perfetta generata da IA, link credibile, autorizzazione apparentemente legittima. In 15 secondi si perdono password, e-mail di recupero e controllo totale. E la 2FA non basta contro questo attacco. Ecco che c’è da sapere

ANY.RUN’s integration with MISP delivers real behavior, fast verdicts and ATT&CK mapping to strengthen triage, reduce MTTR, and support MSSP.

People worldwide are being targeted by a massive spam wave originating from unsecured Zendesk support systems, with victims reporting receiving hundreds of emails with strange and sometimes alarming subject lines.