Search: “reporting”

US and Canadian Court Records Breached Following Thomson Reuters Incident

Thomson Reuters disclosed a breach of its C-Track court software exposing sensitive case records across Ontario courts and 11 US states.

Thomson Reuters detected unauthorized access to its C-Track case management product on June 30 and disclosed the incident on September 2. Files from three Ontario courts and appellate courts in 11 US states plus the US Virgin Islands were affected, potentially exposing names, Social Security numbers, driver's license numbers, medical information, dates of birth and health insurance data. The company said financial transaction systems were not impacted and found no evidence of misuse; the investigation into exact scope is ongoing.

Infosecurity Magazine·Sep 3, 12:00 UTC · 13d agoData breach 2 sources

Cybersecurity jobs available right now: March 10, 2026

Help Net Security's roundup lists open cybersecurity roles at BioNTech, AIG, ServiceNow and others across Europe, the Middle East and Canada.

A job-board roundup of cybersecurity openings including Associate Director Application Security at BioNTech (Germany), CISO at AIG (Israel), Cloud Security Professional at ServiceNow (Italy), and SOC/GRC, analyst, engineer and data governance roles in the UK, UAE, India, Canada and France. Roles span application security, cloud security, SOC operations, compliance and OT environments. Most listings are marked no longer accepting applications.

Help Net Security·Aug 28, 09:06 UTC · 19d agoIndustry

"Chilling" warning or overreaction? AI bioweapons report divides experts

Science article examines expert disagreement over whether a report on AI-enabled bioweapons risks is a chilling warning or an overreaction.

A Science.org article, shared on Hacker News with 20 points and 2 comments, covers expert divisions over an AI bioweapons report and whether its warnings are justified or exaggerated. The discussion reflects ongoing debate in the AI safety and biosecurity community about assessing AI's role in biological threat enhancement. Minimal detail is available from the item itself.

Hacker News · security·Sep 14, 00:07 UTC · 2d agoAI safety & securityHN 20↑ · 2 comments

New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access

University of Toronto researchers present GPUThor, a Rowhammer attack that defeats ECC on NVIDIA RTX A4000-A6000 GDDR6 GPUs and achieves host root access.

GPUThor uses non-uniform hammering to bypass Target Row Refresh and overcome SECDED ECC on NVIDIA Ampere workstation GPUs with GDDR6 memory, inducing 72,000 to 377,552 bit flips per gigabyte across RTX A6000, A5000, A4500, and A4000 cards. Triple-bit silent data corruption enables host privilege escalation to root with the IOMMU enabled, reusing GPUBreach page-table corruption techniques, and double-bit DUEs allow escalation when the IOMMU is disabled during a ~10 ms lazy-service window. The attack cut end-to-end escalation time on the A6000 from 21.9 hours to 1.1 minutes. Reported to NVIDIA, Google, Microsoft, and AWS on April 29, 2026; findings were embargoed until August 25, 2026, and no CVE identifier was assigned.

The Hacker News·Sep 8, 16:03 UTC · 8d agoResearch1

ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities

ENISA launched the CRA Single Reporting Platform, making EU manufacturers report actively exploited vulnerabilities and severe incidents through one portal.

ENISA switched on the Cyber Resilience Act's Single Reporting Platform on 11 September 2026, the same day CRA reporting obligations became binding on manufacturers. Reports require an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days (one month after notification for severe incidents). Filings go through an EU Login account with MFA, are routed to a coordinating CSIRT chosen by the manufacturer, and no API is available in the first release. Open-source software stewards fall under the same obligations from 11 December 2027.

Help Net Security·Sep 14, 12:23 UTC · 2d agoPolicy & legal

Pro-Ukraine Hacking Cat group deploying new malware against Russian targets

Kaspersky links pro-Ukraine hacktivist group Hacking Cat to Gorilla RAT and Monkey Ransomware in destructive attacks on Russian targets.

Kaspersky reports that pro-Ukraine group Hacking Cat, active since February 2024, has shifted from defacements to destructive encryption attacks, using a previously undocumented Gorilla RAT remote-access tool and Monkey Ransomware, which appends the .monkey extension to files. Initial access in some attacks came from exploited Microsoft Exchange vulnerabilities, and rapid multi-language malware variants suggest possible generative AI assistance. Shared tools like Nemo Wiper across groups including Ukrainian Cyber Alliance complicate attribution, and targets include Rosatom contractor and heating provider Donbassteploenergo.

The Record·Sep 14, 16:15 UTC · 2d agoThreat actor in the wild

EU Cyber Resilience Act to Enforce New Reporting Requirements

EU Cyber Resilience Act reporting obligations begin Friday, requiring businesses to notify serious product security incidents within 24 hours.

The EU Cyber Resilience Act's new reporting requirements take effect starting Friday. Businesses operating in the EU will have 24 hours to notify the government whenever they discover serious product security incidents.

Dark Reading·Sep 10, 07:00 UTC · 6d agoPolicy & legal

Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks

Revolut handed over KYC documents, selfies, and Bitcoin transaction histories to attackers after a fraudulent email from a genuine government domain passed authentication checks.

Revolut confirmed on September 12, 2026 that it disclosed sensitive customer KYC data to an unauthorized third party after a fraudulent information request was sent from an email account operating inside a real government agency's domain, carrying valid domain authentication credentials. The exposed data included identity documents (passports, driver's licenses), verification selfies, birth dates, contact details, IBANs, account statements, and full transaction histories including Bitcoin. Revolut discovered the fraud only after independently verifying with the agency, blocked the sender, and notified law enforcement and financial regulators, but did not disclose the number of affected customers or the agency involved. Researcher ZachXBT assessed the operation was targeted at high-net-worth users, useful for fraud, impersonation, or extortion.

Security Affairs·Sep 12, 21:05 UTC · 4d agoData breach

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 111

Security Affairs malware newsletter Round 111 roundup; the provided page text contains only cookie-consent boilerplate with no story details.

Security Affairs published Round 111 of its malware newsletter, a periodic roundup of recent malware coverage. The provided page text contains only cookie-consent language, so no specific stories, actors, or incidents can be extracted.

Security Affairs·Aug 23, 17:04 UTC · 24d agoMalware

Senate Democrats introduce bill to distribute $300 million annually to shore up water system cybersecurity

The Record·Aug 10, 15:58 UTC · Aug 10, 2026Policy & legal

Launching managed CRA Article 14 reporting for open source maintainers

EU Cyber Resilience Act Article 14 reporting obligations begin, requiring 24-hour exploit and incident reports; Patchstack launches managed compliance for open-source maintainers.

Starting 11 September 2026, EU Cyber Resilience Act Article 14 requires manufacturers and open-source stewards to report actively exploited vulnerabilities and severe security incidents to ENISA via the EU Single Reporting Platform, with a 24-hour early warning, 72-hour notification, and final reports within 14 days or one month. Patchstack launched a free managed compliance service, acting as Assigned Representative for open-source maintainers and providing a managed VDP. The obligations apply retroactively to all products available on the European market. Patchstack, which has coordinated over 50% of known WordPress ecosystem vulnerabilities, already serves more than 1,000 open-source projects.

Patchstack·Sep 11, 12:20 UTC · 5d agoPolicy & legal

Top 10 Best Enterprise Browsers in 2026

2026 enterprise browser guide ranks Island first and notes Mammoth Cyber's wind-down plus corrections to standard vendor shortlists.

An editorial guide assesses ten enterprise browser options, ranking category creator Island first for last-mile DLP and BYOD controls, followed by Palo Alto's Talon browser as a Prisma Access/SASE surface and Google Chrome Enterprise Premium for DLP on already-deployed browsers. It corrects common lists, noting SlashNext is browser-adjacent phishing and BEC defense rather than a managed browser, and that Mammoth Cyber has wound down independent operations. Microsoft Edge for Business is positioned as effectively free policy depth for Microsoft 365 estates, with Menlo Security offering an isolation-plus-browser blend.

Cyber Security News·Sep 11, 07:07 UTC · 5d agoIndustry1

New Report: AI threats are here. Why Q2 2026 signals the end of traditional patch cycles

Rapid7 Labs' Q2 2026 threat report finds vulnerability disclosures surging while AI-assisted attackers compress the time from disclosure to exploitation.

Rapid7 Labs' Quarterly Threat Landscape Report for Q2 2026 reports continued growth in vulnerability disclosures alongside attacker use of automation and AI-assisted tooling. The report argues the window between disclosure and exploitation is shrinking, eroding the value of traditional patch cycles. It recommends prioritizing exposures attackers can actually reach rather than attempting to patch everything.

Rapid7 Blog·Aug 18, 12:49 UTC · 29d agoResearch

FBI puts its cyber strategy on paper

FBI publishes its first public cybersecurity strategy, a 17-page document with four pillars prioritizing disruption of cybercrime and nation-state hackers.

The FBI released its first-ever public cybersecurity strategy, a 17-page unclassified document outlining four pillars: imposing costs on adversaries, victim support, industry collaboration, and strengthening the bureau's digital capabilities. Cyber Division assistant director Brett Leatherman said the plan builds on the Trump administration's cybersecurity strategy, a recent executive order on countering digital criminals, and a memo enabling private-industry participation in disruptive operations, and promises a faster tempo of sequenced operations after 50 such actions since the start of 2025, including the Lumma malware takedown with Microsoft. No implementation plan or timeline exists yet; threat teams targeting China, Russia, and criminal gangs will develop classified sub-strategies.

The Record·Sep 9, 15:37 UTC · 7d agoPolicy & legal

From Report to Patch, the OpenBSD Errata Process

A talk walks through the OpenBSD errata process, tracing how vulnerability reports become coordinated, tested, and published security patches.

A Lobsters-linked presentation describes the OpenBSD errata process, covering how a security report travels from initial disclosure to a published patch and errata notice. The linked page itself contains no additional technical detail beyond the title.

Lobsters · security·11:20 UTC · 12h agoResearch

Exclusive: Linux Foundation's Akrites to Go Live in September

The Linux Foundation's Akrites initiative will go live in September, accepting AI-powered vulnerability reports for open-source projects.

The Linux Foundation's Akrites initiative will become operational in September 2026, when it begins accepting AI-powered vulnerability reports for open-source projects. The launch was exclusively reported by Infosecurity Magazine. The program is aimed at handling vulnerability disclosures across the foundation's open-source ecosystem using AI capabilities.

Infosecurity Magazine·Aug 19, 15:30 UTC · 28d agoTools

The State of Cloud Risk 2026: Most Security Findings Aren’t Real Attacker Opportunities

Wiz Research's 2026 cloud risk report finds most high-severity findings lack a viable path to compromise, urging exposure-based prioritization.

Wiz Research telemetry underpins a State of Cloud Risk 2026 report arguing that the majority of high-severity security findings are not real attacker opportunities because they lack a path to compromise. The report pushes defenders to prioritize findings by exposure and exploitability rather than raw severity scores. No specific CVEs, victims, or incident counts are provided in the available text.

Wiz Blog·Aug 26, 15:01 UTC · 21d agoResearch

Hackers Can Hide Malicious AI Commands Inside Normal English to Bypass Security Filters

Check Point's PuzzleMask technique hides malicious prompts in ordinary English that fast gatekeeper models miss but high-reasoning downstream models execute.

Check Point researchers disclosed PuzzleMask, a technique concealing policy-breaking instructions in natural-language prose without encodings or invisible characters. Fast screening models classified all 23 crafted wrappers as safe, while a high-reasoning model recovered and acted on the hidden instruction in 17 of 18 tests (94.4%). The gap stems from capability imbalance between gatekeeper and target models, with defenses including paraphrasing untrusted input, stricter self-referential wording rules, and output/tool-call monitoring.

Cyber Security News·Sep 11, 07:36 UTC · 5d agoAI safety & security1

EU's Cyber Resilience Act starts the 24-hour vulnerability clock

EU Cyber Resilience Act reporting rules take effect, requiring manufacturers to disclose actively exploited vulnerabilities to ENISA within 24 hours, with fines reaching €15 million.

The Cyber Resilience Act's Article 14 mandatory reporting duties became applicable, requiring makers of products with digital elements sold in the EU — regardless of where they are based — to file an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a detailed notification within 72 hours, and a final report within 14 days of releasing a fix. Reports must be submitted through ENISA's Single Reporting Platform to the designated CSIRT, and non-compliance with these core duties can trigger fines up to €15 million or 2.5 percent of annual turnover. Manufacturers must also inform affected users of available fixes without undue delay, and most remaining CRA provisions, including mandatory SBOMs and security-by-design requirements, become applicable on December 11, 2027.

The Register · Security·Sep 11, 11:34 UTC · 5d agoPolicy & legal

Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories

Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.

Gen Digital analysts observed Amatera and Remus detections among tens of thousands of protected Windows users over three months, with Amatera targeting Cline and Continue data and Remus targeting Claude, Cursor, and OpenCode. CallbackBeaver added Cursor and Claude to its collection scope with more than 5,000 samples in 30 days, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo. The stealers harvest access and refresh tokens, prompt histories, and MCP configuration files that can expose source control, ticketing, databases, cloud resources, and sensitive project context for follow-on fraud. Many stealers add targets via remotely managed rules, meaning this is an adaptation of existing infostealers rather than a new vulnerability in the AI tools themselves.

Cyber Security News·Sep 9, 11:41 UTC · 7d agoMalware in the wild2

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

UNC3569 actively exploits one-click RCE in Tencent Sogou Input Method to deploy the GrayRabbit backdoor, patched in version 16.3.0.3498.

Gen Digital reports that China-aligned UNC3569 is actively exploiting CVE-2026-51990, a one-click RCE chain in Tencent Sogou Input Method for Windows, which has hundreds of millions of installations in China. The chain abuses unvalidated command-line argument injection via the sgbiz: URI handler, unrestricted URL navigation in a CEF-based webview, and an unsandboxed outdated Chromium 80 engine to gain code execution and install the GrayRabbit backdoor. The analyzed malware is a mature 64-bit variant with RC4-encoded C2 config supporting reverse shells, file transfer, and reflective plugin loading. Tencent patched the argument validation in version 16.3.0.3498, but the browser engine remains outdated and unsandboxed.

BleepingComputer·updated Sep 14, 11:51 UTC · 2d ago·first Sep 13, 14:26 UTC · 3d agoExploit / PoC in the wild 2 sourcesCVE-2026-519903

24th August – Threat Intelligence Report

Latvia's Road Traffic Safety Directorate (CSDD) confirmed a breach exposing payment records of 1.2 million people and 200,000 organizations.

Latvia's Road Traffic Safety Directorate (CSDD) has confirmed a data breach affecting payment records of more than 1.2 million people, roughly two-thirds of the country's population, as well as 200,000 organizations. The disclosure was highlighted in Check Point Research's weekly threat intelligence bulletin for the week of August 24, 2026. The scale of exposure makes this one of the largest confirmed breaches reported in Latvia.

Check Point Research·Aug 24, 14:07 UTC · 23d agoData breach

Florida water agency latest to confirm cyber incident as feds warn of nation

A ransomware gang hit Florida's St. Johns River Water Management District as CISA warned of IRGC-linked CyberAv3ngers attacks on exposed Unitronics water-sector PLCs.

The St. Johns River Water Management District, which oversees Florida drinking-water supply planning, confirmed suspicious activity in its IT environment and said containment measures were implemented; a ransomware gang claimed the attack and shared samples of stolen data. Separately, CISA, FBI, NSA, EPA and Israel's INCD warned that IRGC-affiliated CyberAv3ngers are actively compromising Israeli-made Unitronics Vision Series PLCs in the water sector using default credentials since at least November 22. The group, motivated by opposition to Israel-linked products, defaces controller interfaces and could cause deeper cyber-physical effects. Shadowserver found at least 539 Unitronics PLC instances still exposed online, and CNN reported fewer than 10 US water facilities faced recent attacks.

The Record·Sep 8, 00:00 UTC · 8d agoRansomware in the wild 3 sources

Emergency Department Revisit Quality Review Screening: Exploring Human Decision-Making and Artificial Intelligence Support

A retrospective study found GPT-4 over-flagged emergency department revisit cases while an LLM knowledge-graph screener achieved 83-100% positive predictive value.

In an exploratory retrospective study of 99 emergency department diagnosis pairs from a multihospital health system, clinicians and GPT-4 independently judged whether revisit pairs warranted further assessment. GPT-4 responses correlated poorly with clinicians, flagging 94% of pairs for follow-up, 4.4-13.3 times more than clinicians, though prompt engineering was minimal. An algorithm leveraging an LLM-populated knowledge graph (KGA) achieved 83-100% positive predictive value against at least one clinician rater, suggesting LLM-based screening could broaden revisit quality review without substantially increasing reviewer workload.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 16:37 UTC · 7d agoAI research1

DoppelCart fraud network uses 119,000 fake shops to steal credit cards

DoppelCart, the largest documented fake-shop network, runs 119,000 domains impersonating 44,182 brands to steal payment card details via WebSocket-connected checkout pages.

German cybersecurity startup Nebty discovered DoppelCart, a network of more than 119,000 fake e-commerce domains, mostly in the .SHOP TLD, that harvest payment card details through fraudulent checkout pages. Over 105,000 shops remain active, impersonating 44,182 brands with discounts of up to 65%, and 96% of confirmed shops share identical build files resolving to 27 commerce backends. Checkout code exfiltrates card numbers, expiration dates, CVVs, cardholder names, contact details, and even bank one-time codes to attacker C2 over WebSockets in real time, potentially bypassing bank security controls. The network surpasses BogusBazaar, the previously largest documented fake-shop cluster with 75,000 sites and an estimated 850,000 fraudulent transactions.

BleepingComputer·Sep 8, 20:35 UTC · 8d agoPhishing & fraud

Berlin investigates new data leak after hackers publish stolen login credentials

Berlin investigates a fresh leak after Rhysida hackers published stolen login credentials; the city refuses to pay the ransom demand.

Berlin confirmed hackers published additional stolen data, including login credentials, from a mid-August cyberattack on two city ministries responsible for urban development/housing and transport/climate. The Rhysida ransomware group claimed the breach in late August, saying it stole 5.79 TB of data including contracts, emails, passwords and classified information; Berlin acknowledged an extortion demand but refused to pay. Berlin's data protection regulator said the leak includes personal data on public employees and possibly residents, such as names, addresses, dates of birth and bank information. Germany's BSI separately linked the campaign to the TerminalFix fake-CAPTCHA technique and the LoremIpsumLoader/AxolotLoader malware tied to financially motivated Rhysida-associated hackers, days before Berlin's Sept. 20 election.

The Record·Sep 7, 11:50 UTC · 9d agoRansomware in the wild1

Companies may be measuring phishing resilience the wrong way

Pistachio's 2026 report analyzing 648 organizations finds click rates alone mislead; combining clicks, credential submission, and reporting better measures phishing resilience.

Pistachio's Phishing Behaviour Report 2026 analyzed 648 organizations and 123,692 users across 354,962 simulations between June 1, 2025 and May 31, 2026. It found click and credential-submission rates rose during the first six months of training before declining, and from the six-month peak to the 12-month stage clicks fell 27% while credential leaks dropped 41%. The report-to-click ratio increased from 1.3 at three months to 1.8 at 12 months, framing employees as an active detection channel. Departmental analysis showed Construction had the highest cumulative click rate (41.31%) and Health the lowest report rate (13.17%), supporting more targeted training.

Help Net Security·Sep 11, 05:00 UTC · 5d agoPhishing & fraud

CISA: WatchGuard RCE flaw now exploited in ransomware attacks

CISA confirms ransomware gangs are exploiting critical unauthenticated RCE CVE-2025-14733 in WatchGuard Firebox firewalls, with roughly 9,000 devices still unpatched.

CVE-2025-14733 is an out-of-bounds write in WatchGuard Fireware OS allowing unauthenticated remote code execution, exploitable on firewalls configured for IKEv2 VPN and potentially even after the configuration was deleted if a static branch-office VPN peer remains. WatchGuard released patches in December and confirmed in-the-wild exploitation; Shadowserver found over 115,000 exposed Fireboxes at the time, with nearly 9,000 still unpatched after nine months. CISA added the flaw to its Known Exploited Vulnerabilities catalog in December under BOD 22-01 and on Thursday confirmed ransomware gangs are now exploiting it, without providing campaign details. WatchGuard serves more than 250,000 small and mid-sized companies through 17,000+ security resellers and service providers.

BleepingComputer·Sep 10, 09:10 UTC · 6d agoExploit / PoC in the wildCVE-2025-14733CVE-2022-23176CVE-2025-9242

Thomson Reuters reveals breach that exposed U.S. and Canadian court records

Thomson Reuters disclosed a C-Track breach exposing court records and personal data across at least 12 US states, US Virgin Islands, and Canada.

Thomson Reuters discovered unauthorized activity in its C-Track court case management platform on June 30, 2026, tracing the intrusion to March 2026. Affected systems include Ontario's three courts, Wyoming's entire state judiciary, and appellate and supreme courts across at least 12 US states plus the US Virgin Islands. Exposed records may include names, Social Security numbers, driver's license numbers, medical information, dates of birth, and health insurance details, with some sealed court information possibly affected. The company is offering 12 months of free credit monitoring and reports no evidence of fraud so far; attribution and access method remain unknown.

Help Net Security·Sep 3, 00:00 UTC · 13d agoData breach

Seattle Times and Newsday sue OpenAI and Microsoft for infringement

The Seattle Times and Newsday sued OpenAI and Microsoft for copyright infringement, seeking destruction of datasets and models trained on their journalism.

The Seattle Times and Newsday allege OpenAI used their journalism as training data without permission and that its chatbots reproduce passages of their reporting, seeking destruction of copies of their works, training datasets, and AI models that incorporate them. Microsoft is named as co-defendant because Copilot is built on OpenAI technology. The suit follows similar actions by The New York Times, Ziff Davis, Merriam-Webster, Encyclopedia Britannica, and nearly 400 local newspapers.

The Verge · AI·Sep 6, 23:36 UTC · 10d agoAI policy1

CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate

CISA and partners issue a joint advisory pressing organizations toward transparent breach notification and incident response as cyber outages escalate.

Dark Reading reports on a new joint government advisory led by CISA that signals a regulatory shift. The advisory presses organizations to adopt more transparent breach notification protocols and incident response practices. The guidance comes as cyber outages escalate and reflects growing government expectation of disclosure over spin.

Dark Reading·Sep 11, 18:44 UTC · 5d agoPolicy & legal1

UBoatRAT Navigates East Asia

Unit 42 discovers UBoatRAT, a new custom RAT targeting South Korean and video-game industry personnel, delivered via Google Drive with GitHub-based C2 and BITS persistence.

Unit 42 identified UBoatRAT, a new custom remote access trojan first found in May 2017, whose initial version used a public Hong Kong blog service and a compromised Japanese web server for command and control. The latest variants target personnel or organizations related to South Korea or the video games industry, are delivered through Google Drive, and masquerade as Microsoft Word, Excel, or folder icons. The RAT checks for virtualization software and domain join, retrieves its C2 address from a Base64-encoded string in a GitHub-hosted file, uses a custom XOR-encrypted C2 protocol, and maintains persistence via Windows Background Intelligent Transfer Service (BITS) jobs that survive reboots.

Palo Alto Unit 42·Aug 17, 12:55 UTC · Aug 17, 2026Malware in the wild1

Security Affairs newsletter Round 591 by Pierluigi Paganini

Security Affairs general newsletter Round 591 aggregates recent security news; the provided page text contains only cookie-consent boilerplate.

This general Security Affairs newsletter (Round 591 by Pierluigi Paganini, international edition) aggregates recent cybersecurity news. The provided page text contains only cookie-consent language, so the specific covered stories are unknown.

Security Affairs·Aug 23, 08:29 UTC · 24d agoIndustry

Ferrari denies data breach and ransomware attack following gang’s online claims

The Record·Aug 5, 00:00 UTC · Aug 5, 2026Ransomware

6 Months on Alert: Get H1 2026 Cyber Risk Report for SOCs and MSSPs

ANY.RUN's H1 2026 report details 15 threat trends including 437% growth in fake CAPTCHA phishing and 90.7% rise in Adobe infrastructure abuse.

The report draws on interactive sandbox submissions from over 700,000 analysts and 16,000 SOC teams between January and June 2026. Attacks abusing Adobe infrastructure grew 90.7% versus H2 2025 while RMM-related attacks rose 26.5%, and custom fake CAPTCHA phishing grew 437% from Q1 to Q2 2026. ANY.RUN argues static IOCs are losing effectiveness as dead drop resolvers hide the final C2 until execution.

ANY.RUN·Sep 15, 09:05 UTC · 1d agoResearch

More than half of AI

CyberScoop·Aug 7, 17:10 UTC · Aug 7, 2026Exploit / PoC

Credential Risk Report

Enzoic's 2026 Credential Risk Report finds 85% of professionals cite compromised credentials as a primary attack path, yet only 19% monitor continuously.

The 2026 Credential Risk Report from Enzoic examines where credential security programs fall short across detection, monitoring, and response. It argues that MFA and point-in-time password screening do not fully address credential exposure. The report advocates shifting from reactive password controls toward a continuous credential defense model with automated remediation.

Help Net Security·Aug 18, 00:00 UTC · 29d agoIndustry

Expanding AI access and cyber defense for federal, state, local, and tribal governments

OpenAI and GSA agreed to provide ChatGPT to federal, state, local, and tribal governments with $0 licenses, 50% off usage, and cyber-defense access.

OpenAI for Government and the U.S. General Services Administration announced a 27-month agreement (October 1, 2026 through December 31, 2028) waiving the $15 per-user monthly license fee and cutting usage costs 50% for federal, state, local, and tribal agencies. More than one million government employees already have ChatGPT access, with eligibility extending across a roughly 23 million-person U.S. public-sector workforce. Every verified government entity is approved for Daybreak Blue cyber-defender access at 50% off, with Daybreak Red available for vulnerability research, exploit validation, and red teaming at standard pricing. The deal builds on the $1 billion Daybreak for Frontline Defenders commitment announced the prior week.

OpenAI News·updated Sep 10, 18:25 UTC · 6d ago·first Sep 10, 07:00 UTC · 6d agoAI industry 3 sources1

What the AI Warning Letter Completely Missed

Opinion piece argues the recent AI warning letter identifies a risk window but omits which actors pose risks and who can mitigate.

This Dark Reading commentary critiques a recent AI warning letter for correctly identifying an approaching risk window while failing to name who is coming through it or who will close it. The piece is brief opinion commentary on AI risk discourse rather than a technical report.

Dark Reading·Sep 3, 17:23 UTC · 13d agoAI safety & security

Delta investigates in-flight Wi-Fi spoofing on post

A passenger on Delta flight 591 allegedly spoofed the airline's in-flight Wi-Fi with a rogue access point, prompting an FBI and FAA investigation.

Delta Airlines is investigating an incident on flight 591 from Las Vegas to Atlanta in which a passenger reportedly created a rogue Wi-Fi network named 'Delta WiFi Fast' to steal sensitive passenger data. The cabin crew deactivated the aircraft's Wi-Fi for roughly 30 minutes, and Delta says flight safety and aircraft operating systems were never affected. The FBI's Atlanta office and the FAA acknowledged awareness of the incident, which bears hallmarks of an evil twin attack involving spoofed login portals and credential harvesting. DEF CON organizers said this year's conference in Las Vegas also suffered multiple similar deauthentication Wi-Fi attacks.

CyberScoop·Aug 11, 21:35 UTC · Aug 11, 2026Phishing & fraud in the wild