Over Security

Attackers can now weaponize newly disclosed vulnerabilities far faster than most organizations can patch them. Picus Security explains how security teams can validate exploitability before a public exploit even exists.

Read-only research into an active campaign that exploits CVE-2026-26980 in Ghost CMS. Every result below comes from public GET requests. We did not exploit the flaw, did not authenticate, and did not write anything. The main scan ran on 2026-06-11. Key findings * An active campaign is exploiting CVE-2026-26980, a SQL injection in the public Content API of Ghost CMS (versions 3.24.0 to 6.19.0, fixed in 6.19.1, released February 2026). The attackers use it to plant a JavaScript loader t

Executive Summary: In June 19 2026 we received access to the contents of an internet-exposed directory, left open by the operators themselves of a campaign the press named FortiBleed. It was not a victim leak. It was the attacker command post:...

Cybercriminals are scaling fake online stores into a coordinated multinational business.

Ogni algoritmo crittografico ha i suoi punti deboli e con le tecniche giuste qualsiasi implementazione può essere compromessa. Conoscere le principali tipologie di attacchi crittografici è quindi utile per adottare le giuste contromisure. Ecco tutto quello che c’è da sapere

Phishing, BEC, and account takeover attacks continue to overwhelm security teams with alerts and investigations. This webinar explores how behavioral AI can help automate detection and response workflows, reducing alert fatigue and improving operational efficiency.

See how EvilTokens hides Microsoft 365 account takeover activity behind browser-side decryption and how in-browser data inspection reveals the full attack flow.

PreCrime Labs tracked 701+ suspicious domains impersonating Chevron, ExxonMobil & Shell. See how attackers stage energy sector phishing before it launches.

80 cyber incidents, June 1–15 2026: cybercrime 69%, malware top attack (40%), espionage 25%. Public-facing exploits and supply-chain attacks prominent.

Il rilascio della nuova release introduce modifiche strutturali. Il focus è sulla deprecation della tattica Defense Evasion (TA0005) e sulla sua sostituzione con due nuove tattiche: Stealthee e Impair Defenses. Ecco alcuni suggerimenti operativi e una guida alla migrazione

Il Disaster recovery, che è governo della crisi, deve cambiare prospettiva. Non basta più progettare il ripristino dei sistemi interni, occorre chiedersi da quali soggetti esterni dipende la capacità di recovery. Ecco perché serve un cambio di paradigma che sposta il tema dalla tecnologia alla governance delle dipendenze

Five Eyes cyber security agencies warn about AI cyber risk and urge leaders to strengthen cyber resilience.

Incident response plans aren't enough if the response can't activate when it matters. Discover seven signs your organization may need a cybersecurity services retainer to strengthen readiness, resilience, and incident response capabilities.

E-commerce is the second most targeted sector for cyberattacks in 2026. Get the 10 priorities every security team must act on.

An ongoing malware campaign is targeting WhatsApp users in multiple countries with deceptive messages that push VBScript files, leading to remote system access.

The JaredFromSubway Ethereum MEV (Maximal Extractable Value) bot suffered a $15 million loss after an attacker manipulated the opportunity-detection logic by creating fake cryptocurrency trading opportunities.

A newly disclosed FFmpeg flaw dubbed 'PixelSmash' could be exploited for remote code execution on Jellyfin servers under certain conditions, and can also trigger a denial-of-service  condition in applications like Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio.

Security firm SOCRadar says the large-scale FortiBleed campaign targeting Fortinet FortiGate devices used custom sniffers to harvest authentication secrets from compromised firewalls and steal credentials.

European offensive cybersecurity company Paradigm Shift released details of a flaw and a technique to exploit it that opens the door for hackers to unlock and break into older iPhones.

Before you sign an incident response retainer, ask about SLA definitions, scope, hidden costs, threat profile fit, and post-incident support. Here is what to look for.

Microsoft has confirmed that Windows 11 version 26H2 will be the next feature update and that devices running Windows 11 24H2 and 25H2 will be able to upgrade using a small enablement package.

A vulnerability chain dubbed AutoJack in Microsoft's AutoGen Studio interface for prototyping AI agents could let attackers manipulate an agent into executing arbitrary commands on its host system simply by visiting a malicious webpage.

File VBScript malevoli distribuiti via messaggi diretti, tramite account WhatsApp violati, abusano di software RMM legittimi per ottenere persistenza e controllo dei sistemi compromessi. Ecco come mitigare i rischi legati al social engineering su WhatsApp Desktop e Web per diffondere malware

Il Cyber Risk Assessment economico traduce il rischio cyber in numeri comprensibili al management: costi degli incidenti, perdite attese, ritorno sull'investimento in sicurezza. Questa guida illustra modelli, scenari numerici e framework operativi per quantificare l'esposizione e allocare il budget IT in modo difendibile

Il provvedimento di divieto dell'export dell’accesso ai modelli Claude Mythos 5 e Fable 5 punta il dito sul fatto che Mythos è diverso da tutto ciò che lo ha preceduto. Ecco cosa significa questo blocco, qual è il rischio di “sovranità del vendor” e quali capacità hanno attirato l’interesse delle agenzie governative per usi difensivi e offensivi

Attackers no longer need to sift through massive credential dumps. They can pay others to do it for them. Flare explores how an emerging underground market searches stolen credential databases for specific companies, domains, and accounts.