3+ day, 2+ hour ago   (1244+ words) Unpatched software remains one of the most exploited entry points in real-world breaches, and patch management solutions is the discipline that closes that window before attackers reach it. The right tool depends heavily on your size and estate: a lean…...

3+ day, 2+ hour ago   (1025+ words) Application control flips the endpoint security model from “block known bad” to “allow only known good” a deny-by-default posture that stops ransomware, living-off-the-land attacks, and unapproved software before they run. It is one of the most effective controls available, but also…...

3+ day, 2+ hour ago   (417+ words) The activity, observed since May 2026, relies heavily on social engineering. Victims may receive a phone call, SMS message, or Microsoft Teams message from someone impersonating the organization’s IT helpdesk. The attacker claims that the user must urgently update a passkey,…...

2+ day, 23+ hour ago   (399+ words) Instead of sending victims to a hosted credential-harvesting page, the attackers generate the phishing page directly inside the victim’s browser using a blob URL. This technique makes detection harder because the phishing page does not exist as a normal internet-accessible…...

3+ day, 4+ hour ago   (229+ words) A rapidly adopted exploit kit, dubbed BlueMoon, chains Chrome and Microsoft Windows zero-days to compromise targets in espionage-focused phishing campaigns. Most observed activity has been linked to China-aligned clusters, although researchers cautioned that the toolkit cannot yet be attributed exclusively…...

3+ day, 23+ hour ago   (408+ words) Microsoft has released security updates for CVE-2026-69449, a Windows BitLocker remote code execution vulnerability caused by a heap-based buffer overflow. The issue, could allow an authorized attacker to execute malicious code on affected Windows systems and, in certain network scenarios,…...

5+ day, 4+ hour ago   (398+ words) Mathspace, a mathematics learning platform used by schools in Australia and New Zealand, has disclosed a data breach affecting 1,079,819 students, parents or guardians, teachers, and employees. The incident stemmed from the exploitation of a critical vulnerability in a self-hosted Metabase…...

5+ day, 22+ hour ago   (423+ words) Microsoft has announced plans to fully retire Manifest V2 (MV2) browser extension support in Microsoft Edge by early 2027, completing a transition to the more restrictive Manifest V3 (MV3) extension platform. The move is intended to improve browser security and performance by imposing stricter permission…...

5+ day, 21+ hour ago   (225+ words) ConnectWise said it is developing a permanent fix and will assign a CVE identifier after its cloud-environment rollout. While technical details of the vulnerability, including its root cause, attack requirements, impact severity, and potential exploitation scenarios, have not yet been…...

6+ day, 42+ min ago   (365+ words) Cybersecurity researchers have uncovered a fake Minecraft optimisation mod that steals browser passwords, payment-card data, cookies, Discord information, and system details while giving attackers remote control over infected Windows PCs. The malicious Java Archive (JAR) pretends to be Lithium Extras…...