Over Security

The U.S. Justice Department has seized more than 1,000 websites and blocked 1,970 domains used to stream FIFA World Cup 2026 matches without authorization.

Will AI let me spend my time at the beach while patching a critical vulnerability in one of the most used CMS in the world? Yes it will. We recently released PAI, our AI Security Agent that acts as a Senior Security Specialist for a wide range of security tasks. For our WAAP (Web Application & API Protection) service WP2Shell was the perfect test run. WP2Shell dropped Friday night (CEST). By Saturday morning we had a virtual patch live on every WordPress site behind our WAAP: one shared rule, ab

The Qilin ransomware gang is exploiting a critical PAN-OS GlobalProtect authentication bypass flaw to breach victims' networks, according to cybersecurity company Arctic Wolf.

Estée Lauder data breach is tied to an Oracle EBS flaw, exposing personal data after a Clop cyberattack. Identity monitoring offered.

Microsoft has shared manual mitigations to help IT administrators fix Windows Server Update Services (WSUS) servers affected by a known issue that causes Windows Update scans to fail or time out.

Kaspersky GReAT experts describe a new Project CAV3RN C2 module. It uses Outlook calendar for communication via Microsoft Graph and has a backup connection via DNS AAAA responses.

Free unofficial patches are available for a recently disclosed Windows zero-day flaw that allows attackers to escalate privileges on up-to-date Windows systems.

Il centro della protezione non è più il documento, ma la capacità dell’organizzazione di continuare a funzionare durante una crisi reale. Ecco come la resilienza si trasforma da esercizio teorico a capacità concreta

Discover how Kali365 targets US organizations with device code phishing, putting Microsoft 365 accounts and sensitive business data at risk.

We are presenting here our most complete analysis to date of the Pegasus spyware. This blog post builds on previous technical reports and forensic investigations by Amnesty International’s Security Lab. Significantly it also draws on previously unpublished internal NSO Group marketing material and internal technical material which was disclosed as part of a long-running civil […]

Cosmetics giant Estée Lauder is notifying customers of a data breach after hackers exploited a flaw in Oracle E-Business Suite that the company used for human resources (HR) operations.

The Ostium trading platform announced that an attacker stole $23.75 million from its liquidity provider vault last week, after compromising off-chain infrastructure used to feed prices into the protocol.

Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances.

The JadePuffer autonomous AI agent has upgraded with custom malware called EncForge that focuses on encrypting AI assets, such as training datasets, vector databases, and model checkpoints.

Researchers escaped the sandboxes in Cursor, Codex, Gemini CLI and Antigravity by having the AI agent write files that trusted host tools later run. Multiple CVEs, patches, and Google downgrading two Antigravity findings.

In November 2025, AI music generation tool Suno suffered a data breach that later came to light in July the following year. The data contained over 55M unique email addresses. Phone numbers were also present where they had been used as the sign-up method. Although representing a small portion of the corpus, the breach also included tens of thousands of Stripe records relating to purchases, containing names, physical addresses, purchase amounts and partial credit card data including the card type, expiry date and last 4 digits. The company advised that "Suno does not have access to customers' full credit card numbers in Stripe".

A technical walkthrough of the HackTheBox Paper challenge, by Andy From Italy.

Part one in our series on Mastodon, focused on gathering OSINT from the platform's users, instances and network.

You get a new case to investigate and it's a young social media user with no Facebook, no Twitter, just TikTok.

Explore the comprehensive guide by fairycn on how to master x64dbg on Windows 11, from installation to advanced debugging techniques, ensuring effective program modifications and insightful CPU disassembly analysis.

Despite being a great OSINT tool, Pastebin remains misunderstood and underutilized.

Data Breach Search Engines (DBSEs) collect and organize leaked information from data breaches, enabling OSINT investigators to access it.

This Windows Box is incredibly intriguing, featuring challenging passages and an unstable machine. Despite these difficulties, it’s an enjoyable experience with numerous exploits available.

My advice for those wishing to improve their OSINT skills is to go back to the basics, namely the intelligence cycle.

Half of every top OSINT tools list is already dead. The tools rot, the method doesn't. Build a repeatable workflow and treat every tool as disposable.

Telegram is the richest open source intel surface online. Here is how to work it in 2026, from forwarding chains to sock puppets, without getting burned.