Microsoft says it's testing a fix for the widespread Outlook issues that have led to email delays and failures.

Fake MyChart texts and emails are targeting patients for personal information and passwords. Here's how to spot the phishing scam.

A ransomware group gained access to a computer system containing information about targets of investigations by the Bureau of Alcohol, Tobacco, ​Firearms and Explosives, a spokesperson for the U.S. ag...

ServiceNow released security patches for three new maximum-severity AI Platform vulnerabilities that can be exploited in code injection, SQL injection, and privilege escalation attacks.

After Microsoft retired its grant program, which offered nonprofits its services for free, some organizations report losing all their data without receiving adequate warnings from the tech giant.

Microsoft has confirmed that a critical remote code execution flaw in Entra ID, its cloud-based identity and access management platform.

U.S. healthcare IT company CareCloud disclosed that the data breach incident it suffered earlier this year has impacted more than 3.7 million individuals.

Hackers associated with the Russian threat group Sandworm have been targeting system administrators and IT professionals through fake job offers since at least May.

Attackers pivoted through a private cellular APN to shut a turbine and water treatment system at a Polish CHP plant serving 50,000 residents.

Mozilla revokes a Firefox and Thunderbird Linux signing subkey after an unencrypted copy landed in a private repository.

A phishing email that appeared to come from a real business client led an employee to change payment information, and police say the mistake ultimately ... Read More

The article provides an overview of the penetration testing process and how to perform a pen test against your app running in Azure infrastructure.

Learn how to prepare for the retirement of Microsoft provided SMS and Voice authentication in Microsoft Entra ID and migrate users to passkeys.

Two municipal water systems in New Jersey were targeted in cyberattacks in the last week, widely thought to be the work of Iran, the state said Wednesday.

Microsoft has cut off Whiteboard for personal accounts, retired Copilot Podcasts, and now Deep Research is being replaced by a Microsoft 365 Premium feature. Free Copilot is shrinking fast, and the be...

A nine-year-old race condition vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges.

OSINT toolkit for IP, phone, and username tracking https://t.co/KzzhqXT9dH https://t.co/t8Td3oI0w0

Microsoft says it has disrupted a malware-signing-as-a-service (MSaaS) operation that abused the company's Artifact Signing service to generate fraudulent code-signing certificates used by ransomware ...

VECT 2.0 destroys files over 131KB due to nonce flaw, launched December 2025, making ransom payments useless.

A proof-of-concept (PoC) exploit has been publicly released for a newly disclosed vulnerability in Microsoft's Snipping Tool that allows attackers to silently steal users' Net-NTLM credential hashes b...

The China-backed threat group is targeting AWS, Google, Azure, and Alibaba cloud environments and using typosquatting to obscure C2 communication.

A systemic numbness to cyberattacks has exposed the U.S. economy and its institutions to ever-widening threats. Retired four-star military officials worry the worst day in cyber is yet to come.

The U.S. Federal Bureau of Investigation (FBI) confirmed on Thursday that it's investigating a breach that affected systems used to manage surveillance and wiretap warrants.

Gobuster is a free opensource tool used to brute force URLs, discovering available files and directories in web sites. It can also discover DNS subdomains.

Threat actors are targeting technology, manufacturing, and financial organizations in campaigns that combine device code phishing and voice phishing (vishing) to abuse the OAuth 2.0 Device Authorizati...

Sandworm's DynoWiper malware targeted Poland's energy infrastructure in failed attack

Argus is a comprehensive Python-based toolkit designed for reconnaissance tasks in cybersecurity. The developers recently released version 2.0, expanding it to include 135 modules.

CISA has closed 10 emergency cybersecurity directives issued between 2019 and 2024 after required actions were completed and enforced under BOD 22-01.

There has been speculation about the cause of a BGP anomaly observed in Venezuela on January 2. We take a look at BGP route leaks, and dive into what the data suggests caused the anomaly in question.

The European Space Agency (ESA) has confirmed a cybersecurity breach impacting external servers used for collaborative engineering, with hackers claiming access to source code, credentials, and intern...

IBM urged customers to patch a critical authentication bypass vulnerability in its API Connect enterprise platform that could allow attackers to access apps remotely.

A new MacSync macOS stealer spreads via a signed, notarized fake installer, bypassing Apple Gatekeeper before Apple revoked the certificate.

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

More than 10,000 Docker Hub container images expose data that should be protected, including live credentials to production systems, CI/CD databases, or LLM model keys.

Microsoft says Windows PowerShell now warns when running scripts that use the Invoke-WebRequest cmdlet to download web content, aiming to prevent potentially risky code from executing.

Attacks against CVE-2025-55182, which began almost immediately after public disclosure, have increased as more threat actors take advantage of the flaw.

Marquis was struck with ransomware

Warning: What happens on your Android, doesn’t stay on your Android — not if it's a work phone.

An advanced threat actor exploited the critical vulnerabilities "Citrix Bleed 2" (CVE-2025-5777) in NetScaler ADC and Gateway, and CVE-2025-20337 affecting Cisco Identity Service Engine (ISE) as zero-...

Researchers have uncovered a dangerous attack vector targeting Active Directory Sites, a critical yet often overlooked component of enterprise network infrastructure.

Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362 | Read more hacking news on The Hacker News cybersecurity news website and learn how to protect against cyberattacks and...

Device code phishing abuses the OAuth device flow, and Google and Azure produce strikingly different attack surfaces. Register for Huntress Labs' Live Hack to learn about attack techniques, defensive ...

Three myths debunked in one warning from America's Cyber Defense Agency, CISA: Ransomware is not dead. Windows is not the only attack surface. Linux can be exploited.

This blog post describes how electronic passports work, the threats within their threat model, and how they protect against those threats using cryptography. It also discusses the implications of usin...