Cybersecurity

Vulnerabilities, attacks, threats, security tools, cloud security, and identity.

40 Articles

Cybersecurity

SafePal Data Breach Affects Approximately 39,798 Customers, Information Offered for Sale on Criminal Forum

SafePal warned that order data belonging to approximately 39,798 customers was leaked following the exploitation of a flaw in the order-tracking function, while an attacker claims to be offering the data for sale. According to the company, the incident did not include wallet keys, recovery phrases, or payment data.

2026-08-16

Cybersecurity

AmnesiaStealer Malware Allows Attackers to Remotely Control macOS Browser Sessions

Jamf discovered a new information-stealing malware targeting macOS users through ClickFix campaigns. It can copy Chromium profiles and run them in a hidden browser, allowing the attacker to control the user’s authenticated sessions. In addition to stealing browser data, the malware collects passwords, cryptocurrency wallets, Keychain data, and other files.

2026-08-16

Cybersecurity

CHERI Redefines Pointer Security to Build Fine-Grained Software Isolation

David Chisnall explains how the CHERI architecture uses hardware capabilities to protect pointers and enforce memory bounds and permissions, providing spatial and temporal security for software written in C and C++ without extensive rewriting. The presentation connects this mechanism to the possibility of building precise isolation between system components while directly sharing data structures instead of relying entirely on traditional RPC mechanisms.

2026-08-16

Cybersecurity

Evooo1Bot Malware Network Turns Routers into Traffic Relay Nodes

Researchers have identified a new Mirai-based malicious network targeting internet-connected gateway devices and turning them into SOCKS5 nodes for relaying traffic, with capabilities for stealing credentials and conducting DDoS attacks. Evooo1Bot exploits known vulnerabilities in multiple devices and products and uses advanced stealth and persistence mechanisms.

2026-08-15

Cybersecurity

Cloudflare Enables One-Click Protection for Workers Applications Through Access

Cloudflare has launched new tools to connect Access policies directly to Workers applications, enforcing authentication before any request reaches the application code, regardless of the domain or URL used. The company also enables an account-level policy to protect existing and future applications by default.

2026-08-14

Cybersecurity

Critical SAP Commerce Cloud Vulnerability Targeted Three Days After Patching

Defused confirmed that attackers began targeting a remote code execution vulnerability in SAP Commerce Cloud, despite the absence of a public proof of concept and SAP not officially announcing that it was being actively exploited. SAP urged its customers and partners to install the security update immediately.

2026-08-14

Cybersecurity

Shell Investigates Potential Security Incident After Clop Claims Theft of 89 Gigabytes of Data

Shell confirmed that it is investigating a potential security incident after the Clop group claimed to have stolen 89 gigabytes of its data, including engineering drawings and project plans. The claim is part of attacks that exploited a critical vulnerability in the PTC Windchill and FlexPLM platforms to access data belonging to several organizations.

2026-08-14

Cybersecurity

Cloudflare Makes Certificate Transparency Monitoring Available to All Users and Reduces Duplicate Renewal Alerts

Certificate Transparency Monitoring is now generally available after Cloudflare began filtering certificates it issues or manages on behalf of customers, so alerts focus on unexpected external certificates. The service is available on all plans at no additional cost, with improved email messages and the ability to enable it from the dashboard.

2026-08-13

Cybersecurity

Apple Sends New Threat Notifications to Users Targeted by Mercenary Spyware in 110 Countries

Apple confirmed sending a new batch of threat notifications on August 13 to users targeted by mercenary spyware attacks, noting that these alerts are based on high-confidence indicators. The company does not link this batch to any specific spyware program or particular government entity.

2026-08-13

Cybersecurity

Akira Attackers Disable EDR Systems via Safe Mode and Steal Data Without Encrypting It

A partner of the Akira ransomware operation exploited an exposed SonicWall VPN device without multifactor authentication to access the victim’s network, then disabled security tools by rebooting the system into Safe Mode. The attackers successfully stole data and credentials in less than five hours, but the ransomware payload failed to encrypt files because of memory-related errors.

2026-08-13

Cybersecurity

Jewelbug Group Hacks Email Accounts of 15 Government Entities Alongside Cryptocurrency Scams

Symantec revealed that the Jewelbug group, also known as Earth Alux and REF7707, conducted an espionage campaign targeting government email accounts in the Middle East, alongside extensive activity defrauding cryptocurrency users. The attacks relied on compromising a shared email-hosting platform, planting malware, and stealing cookies and sensitive data.

2026-08-13

Cybersecurity

Tools for Removing Watermarks from AI-Generated Text Spread Without Evidence of Effectiveness

Within days of Anthropic announcing the activation of invisible watermarks in text produced by Claude, a group of open-source projects and commercial services emerged claiming to bypass these watermarks. However, these claims cannot currently be verified, as Anthropic has not published the watermarking mechanism or a tool to detect it.

2026-08-13

Cybersecurity

United States Allows Private Companies to Conduct Offensive Cyber Operations Under Government Oversight

The Trump administration has announced a policy allowing private companies that meet specific requirements to conduct surveillance and disruptive attacks against criminal gangs and international hackers under a program managed by the federal government. The mechanism is not yet fully operational, and it may face legal challenges as well as diplomatic and security concerns.

2026-08-13

Cybersecurity

Cloudflare Report: Hyperscale DDoS Attacks Exceeding 1 Terabit per Second Surge 519% in the First Half of 2026

Cloudflare recorded a sharp rise in distributed denial-of-service attacks during the first half of 2026, mitigating 935 attacks that exceeded 1 terabit per second in intensity, with an increase of 519% between the first and second quarters. The report points to a shift in focus from botnet floods to reflection and amplification attacks, particularly through DNS and CLDAP, with the landscape affected by geopolitical tensions.

2026-08-11

Cybersecurity

GitHub Expands Malware Alerts from npm to Eight Package Ecosystems

The GitHub Advisory Database now imports malicious package data from the OpenSSF repository, enabling Dependabot to issue alerts across eight package ecosystems instead of being limited to npm. The new system relies on automated validation, source tracking, import limits, and rollback capabilities to protect the database from incorrect or compromised data.

2026-08-06

Cybersecurity

Cloudflare Launches WriteGuard in Private Beta to Control MCP Server Permissions

Cloudflare announced the availability of WriteGuard in a private beta for MCP server gateways, aiming to provide precise control over actions performed by AI-powered agents, attribute operations to their owners, and provide a centralized audit trail. The tool is designed to prevent dangerous changes before they are executed, without relying exclusively on client settings or agent instructions.

2026-08-05

Cybersecurity

Cloudflare Classified as a “Visionary” in Gartner’s 2026 SASE and SSE Reports

Cloudflare announced that Gartner classified it as a “Visionary” in both the 2026 Magic Quadrant for SASE Platforms and the Security Service Edge report, explaining that, in its view, the assessment reflects its direction toward a unified architecture for managing connectivity and security.

2026-08-05

Cybersecurity

Microsoft Analysis of the ChainDrop Attack: Self-Propagating Worm Infects More Than 400 npm Packages

Microsoft Threat Intelligence analyzed a widespread attack on the npm supply chain in which a credential-stealing worm was hidden inside more than 400 packages published by different entities. The malware collects developer and CI/CD environment secrets, then uses npm and GitHub tokens to republish malicious versions and open additional propagation paths.

2026-08-04