Over Security

If the European Commission cloud breach feels familiar, it’s because the pattern is becoming more common.

Education Authority cyberattack disrupts schools in Northern Ireland, blocking access to IT systems as recovery efforts continue before exams.

The Voxbeam robocall case is built around what regulators see as a failure to follow clear compliance requirements.

An elusive hacker who went by the handle "UNKN" and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and…

Scammers are sending fake "Notice of Default" traffic violation text messages impersonating state courts across the U.S., pressuring recipients to scan a QR code that leads to a phishing site demanding a $6.99 payment while stealing personal and financial information.

Fortinet has released an emergency weekend security update for a new critical FortiClient Enterprise Management Server (EMS) vulnerability that is actively exploited in attacks.

Fortinet has released an emergency weekend security update for a new critical FortiClient Enterprise Management Server (EMS) vulnerability that is actively exploited in attacks.

Hackers are running a large-scale campaign to steal credentials in an automated way after exploiting React2Shell (CVE-2025-55182) in vulnerable Next.js apps.

The maintainers of the popular Axios HTTP client have published a detailed post-mortem describing how one of its developers was targeted by a social engineering campaign believed to have been conducted by North Korean threat actors.

A new report dubbed "BrowserGate" warns that Microsoft's LinkedIn is using hidden JavaScript scripts on its website to scan visitors' browsers for installed extensions and collect device data.

Device code phishing attacks that abuse the OAuth 2.0 Device Authorization Grant flow to hijack accounts have surged more than 37 times this year.

Mikko Hyppönen is one of the most recognizable faces of the cybersecurity industry. After fighting computer viruses, worms, and malware, for more than 35 years, he tells TechCrunch why he is now working on systems to stop killer drones.

In March 2026, the anime streaming service Crunchyroll suffered a data breach alleged to have impacted 6.8M users. The exposed data is reported to have originated from the company's Zendesk support system where "name, login name, email address, IP address, general geographic location and the contents of the support tickets" were exposed. A subset of 1.2M email addresses from an alleged 2M record dataset being sold was later provided to HIBP.

In April 2026, the music trivia platform SongTrivia2 suffered a data breach that was subsequently published to a public hacking forum. The data contained a total of 291k unique email addresses sourced from either Google OAuth logins or accounts created on the site, the latter also containing bcrypt password hashes. The data also included names, usernames and avatars.

A new report dubbed "BrowserGate" warns that Microsoft's LinkedIn is using hidden JavaScript scripts on its website to scan visitors' browsers for installed extensions and collect device data.

Telehealth giant Hims & Hers Health is warning that it suffered a data breach after support tickets were stolen from a third-party customer service platform.

In the span of just a few weeks, we have observed a dizzying array of major supply chain attacks. Prominent examples include the malicious modification of Axios, a popular HTTP client library for JavaScript, as well as cascading compromises from TeamPCP, a “chaos-as-a-service” group that injected malicious code into hijacked GitHub repositories for open-source projects, including Trivy, an open-source security scanner. The impact of these supply chain attacks can be vast. Axios receives 100 mil

L'attacco agli Uffizi risale all'inverno scorso, ma ora, pur senza danni materiali o furti, accende nuovamente i riflettori sulla sicurezza delle istituzioni culturali. Ecco perché la tutela dei musei diventa una questione di cyber resilience e sicurezza nazionale

Overview of the recent Axios NPM supply chain incident including details of the payloads delivered from actor-controlled infrastructure.

The Qilin ransomware group has claimed responsibility for an attack against Die Linke ('The Left'), forcing an IT systems outage at the political party, and threatening sensitive data leak.

CERT-EU blamed the cybercrime group TeamPCP for the recent hack on the European Commission, and said the notorious ShinyHunters gang was responsible for leaking the stolen data online.

Utilizzare un'AI in modo responsabile richiede consapevolezza e competenze che non sempre sono presenti, motivo per cui nel momento in cui c'è un fallimento "AI-driven" la responsabilità è sempre da ricercare in un elemento umano, alla fonte o altrimenti a valle

Nel mese scorso, il governo degli USA ha rilasciato un documento intitolato “President Trump’s CYBER STRATEGY  for America” che dovrebbe delineare la nuova strategia statunitense per la lotta al cybercrimine. L’obiettivo è quello di andare oltre la mera difesa tecnica e avanzare verso una trasformazione strutturale del modello di sicurezza, sempre più integrato con economia, …

Analisi tecnica dell'attacco alla supply chain di Axios su npm. Scopri le meccaniche di infezione del RAT Sapphire Sleet e le strategie di mitigazione SOC.