55
30
30
55
30
30
47
57
DDoS attacks hit record scale as 1 Tbps+ campaigns become more common
Cloudflare's H1 2026 report shows record DDoS scale, with more 1 Tbps+ attacks, multi-vector campaigns, and hacktivist surges against governments.
Cloudflare's H1 2026 DDoS Threat Report documents record-scale attacks, with a significant increase in campaigns exceeding 1 Tbps and April 2026 peaking at 6.46 trillion requests and 165 PB. Most network-layer attacks stayed small and short — 96.62% under 500 Mbps and 90.60% under 10 minutes — but multi-vector campaigns combining HTTP floods with DNS and CLDAP amplification grew. Operation Epic Fury drove 149 hacktivist DDoS claims against 110 organizations in 16 countries, hitting the government sector hardest, and Brazil overtook the US as the leading attack source country.
48
60
60
30
30
60
30
45
The 12 Best Extended Detection & Response (XDR) Platforms, Compared and Priced
Buyer's guide compares 12 XDR platforms, favoring Microsoft Defender XDR, Stellar Cyber and CrowdStrike, and warns ingestion pricing inflates costs.
The article compares 12 extended detection and response platforms, distinguishing native XDR (CrowdStrike, Palo Alto Cortex XDR, Microsoft Defender XDR, SentinelOne) from open XDR (Stellar Cyber, Arctic Wolf, Rapid7). It argues data ingestion pricing, not per-endpoint fees, is the main budget risk and should be modeled before signing. It repeats the consolidation note that Sophos acquired Secureworks for approximately $859 million in February 2025, and flags that ExtraHop is NDR rather than full XDR.
14
55
45
30
55
60
45
60
60
60
30
42
30
30
60
55
The 12 Best Mobile Threat Defense (MTD) Solutions, Compared and Priced
A comparison of 12 mobile threat defense vendors highlights Zimperium's on-device detection and notes Kaspersky's US exit and Wandera's Jamf absorption.
The buyer's guide compares 12 mobile threat defense (MTD) products, naming Zimperium best for fully on-device detection and Microsoft Defender for Endpoint as the best-value bundled option. It reminds readers that Kaspersky cannot legally be sold or updated in the US following a Commerce Department determination, and that Wandera was acquired by Jamf. Most MTD pricing is quote-based per device or per user.
12
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
Symantec and Carbon Black found DragonForce-linked hackers using Backdoor.Turn, a Go RAT tunneling C2 through Microsoft Teams TURN relays via QUIC.
Broadcom's Symantec and Carbon Black documented Backdoor.Turn, a Go-based RAT associated with the DragonForce ransomware group, deployed at a major U.S. services firm where attackers remained on the network for one to two months. The backdoor obtains an anonymous Teams visitor token from Microsoft's Skype-backed identity services, uses a legitimate Microsoft TURN relay for connection setup, and runs a QUIC session to the attacker's C2 server, so defenders see only outbound traffic to legitimate Teams servers. Initial access is suspected to involve exploiting a SQL/MS-SQL vulnerability or an access broker, followed by a PowerShell-dropped ZIP, DLL side-loading, and BYOVD evasion using a Huawei driver; the RAT is injected into DbgView64.exe after DragonForce ransomware deployment for continued access. First publicly documented TURN abuse by the group, it leverages Praetorian's Ghost Calls technique and supports command execution, network scanning, LDAP/AD search, lateral movement, and browser credential theft.
72
Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day
Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.
Help Net Security's week in review aggregates top stories: a 'City-Forum' campaign tracked by Reco has been pulling records from Salesforce and ServiceNow portals worldwide for 17 months, and Framework suffered a breach via an exploited Metabase zero-day exposing customer contact and IP data. It also covers Microsoft's August 2026 Patch Tuesday fixing 400+ flaws including exploited zero-day CVE-2026-68820, Cisco's fix for exploited firewall DoS bug CVE-2026-20349 (added to CISA KEV), and a second N-able N-central hotfix for actively exploited CVE-2026-18577. Other items include GitHub expanding Dependabot malware alerts to eight package ecosystems and EU AI Act enforcement beginning on 2 August 2026.
32
30
57
60
30
30