Tools

Agentic pentesting is the sharpest edge of offensive security today, but it leaves critical gaps. Here's where those blind spots are and how to address them.

Breach notices are revealing less than ever. Here's how to interpret vague notifications and take meaningful action to protect yourself.

The Wazza phishkit targets banking, manufacturing, and government sectors across the US, Europe, and Australia using a multi-stage routing chain to evade detect

A teenager suspected of leading ShinyHunters was detained in Jordan while extorting a former Boeing subsidiary, and is now cooperating with the FBI.

A phishing platform impersonates AI chatbot ad products to steal credentials and MFA codes via browser-in-the-browser attacks targeting agency ad accounts.

UNC6240 is mass-exploiting CVE-2026-35273 in Oracle PeopleSoft by URL-encoding requests to bypass WAF rules, deploying web shells and backdoors across multiple

Vectra AI announced Ascent, a global partner program built to help customers address AI-driven security threats through expertise, services, and joint capabilit

AI agents can locate vulnerabilities with only a vague description of a bug. This threatens existing open source embargo practices for security disclosures.

ESET researchers discovered a technique that uses a decoy comment to trigger LLM safety guardrails and halt AI-assisted malware analysis before it reaches malic

Threat actors call employees on personal devices, steal Microsoft credentials, then use the Graph API to quietly exfiltrate corporate data at scale.

Microsoft's September Patch Tuesday fixes 974 vulnerabilities—its largest ever. Two actively exploited zero-days and 113 critical flaws are included.

A breach at Trezor's shipping provider ShipMonk has grown to affect 81,000 customers after the provider failed to delete data as contractually required.