Over Security

La maggior parte dei programmi di sicurezza dà per scontato che applicazioni e agenti AI siano autorizzati dall'IT e monitorati. Ecco cosa offrono gli agenti OpenClaw ai CISO e responsabili della cyber security interessati alla visibilità unificata e a garantire che l'osservabilità degli agenti non sia isolata

Explore ANY.RUN’s highlights from Infosecurity Europe, CONFidence, and C1b3rWall 2026, including the SOC priorities shaping security operations today.

Project Glasswing e i modelli Mythos di Anthropic aprono una nuova fase della cyber sicurezza. La capacità di individuare migliaia di vulnerabilità in tempi record promette vantaggi difensivi senza precedenti, ma solleva interrogativi su sovranità digitale, sicurezza nazionale e dipendenza tecnologica europea

Mackay Sugar security incident has halted mill operations and sugarcane harvesting in Queensland, disrupting production.

This blog provides a deep-dive into SniperDz, a centralised PhaaS platform with more than 80 ready-made phishing templates impersonating over 30 global brands, and uncovers the hidden infrastructure behind this sophisticated and highly-organized fraud ecosystem.

The University of Nottingham confirmed on Wednesday that a hacking group gained access to its student records system in a breach affecting both current students and alums.

A ServiceNow flaw was exploited by threat actors to access customer instances, prompting a security update and customer notifications.

APT28, an evolution of tradecraft

Attackers are now targeting a recently patched maximum-severity flaw in Ivanti Sentry, enabling them to execute code with root privileges on Internet-exposed secure mobile gateways.

The CISA vulnerability management directive requires federal agencies to patch high-risk vulnerabilities within 72 hours to reduce cyber risk.

In June 2026, the University of Nottingham was the target of a cyber attack, later linked to a ShinyHunters "pay or leak" extortion campaign. Tens of gigabytes of data were subsequently published online and included 455k unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to academic enrolments and fee payments. In a post about the incident, the university advised that the breach affected both "current students, and alumni".

The ShinyHunters hacking gang claims to have compromised the Oracle PeopleSoft servers of more than 100 organizations, including many universities.

Attackers are actively exploiting CVE-2026-5027, a high-severity path traversal vulnerability in the AI development platform Langflow, to write arbitrary files on exposed servers.

The Miasma credential-stealing attack framework, which has recently targeted open-source ecosystems through supply-chain attacks, was briefly open-sourced on GitHub.

GitHub has announced that npm v12, expected next month, will introduce several security-focused changes aimed at blocking supply-chain attacks abusing behaviors triggered by the 'npm install' command.

Oracle PeopleSoft servers are being targeted in ongoing data theft attacks by the ShinyHunters extortion gang, which claims to have stolen data from over 100 organizations.

Cybersecurity researchers are complaining that Anthropic's new model Fable has guardrails that are too strict for any cybersecurity work.

Today is Microsoft's June 2026 Patch Tuesday, with security updates for 200 flaws, including five publicly disclosed zero-day vulnerabilities and one actively exploited in attacks.

Today is Microsoft's June 2026 Patch Tuesday, with security updates for 200 flaws, including four publicly disclosed zero-day vulnerabilities and one actively exploited in attacks.

Il Patch Tuesday di giugno 2026 è il più grande della storia di Microsoft: 206 CVE corrette, di cui 33 critiche e una in Exchange Server già sfruttata in rete. Sullo sfondo, il ricercatore Nightmare Eclipse che annuncia un nuovo attacco per il 14 giugno sfruttando due zero-day, YellowKey e GreenPlasma, delle tre corrette questo mese

The JDY botnet, a malware network previously associated with Chinese threat actors like Volt Typhoon, has significantly expanded its targeting scope and reconnaissance efforts.

Attackers are increasingly bypassing weak authentication through phishing, MFA fatigue, and service desk social engineering. Specops Software breaks down five best practices for stronger identity verification and access security.

A cybercrime group known as The Gentlemen has emerged as the second most active ransomware gang by victim count, rapidly attracting a talented pool of hackers through an aggressive recruitment strategy that promises affiliates 90 percent of any ransom paid…

Le due varianti differiscono solo per il perimetro dei controlli: l’apparato di safeguard è l’unico confine tra le capacità ordinarie e quelle offensive. Ecco il modello di minaccia associato alle capacità di agentic hacking di Claude Fable 5 e Mythos 5, le evidenze e i limiti in materia di resistenza agli universal jailbreak

Microsoft has patched an actively exploited Exchange Server vulnerability that allows threat actors to execute arbitrary JavaScript code in cross-site scripting (XSS) attacks targeting Outlook Web Access users.

Learn how threat intelligence helps SOC teams validate hypotheses, enrich hunts, reduce noise, and find threats faster.

FIFA World Cup 2026 scams target fans through fake tickets, job, and streaming sites.