Breaches, vulnerabilities and the people cleaning up after them. Reporting for defenders, not for panic.
The Clop ransomware operation confirmed its data leak portal was compromised via a path traversal vulnerability in Grav CMS that went unpatched on their server. Grav has now backported the fix to its legacy 1.7 branch after months of protection only in version 2.x.
The Cybersecurity and Infrastructure Security Agency has added multiple flaws to its Known Exploited Vulnerabilities catalog, including critical authentication and authorization bypasses in WSO2 and Adobe Commerce that are already being weaponized in the wild.
As AI agents proliferate in production environments, SOC 2's foundational assumptions about identity and access control no longer hold. The framework risks becoming obsolete without explicit guidance on treating agents as a distinct identity class.
Cloudflare has released Turnstile Spin, an agent-guided implementation tool that simplifies deploying its privacy-first challenge system across frontend and backend code without requiring manual integration work.
A Kosovar man has admitted to creating and managing Rydox, an illegal online platform that trafficked in stolen credentials, financial data, and hacking tools across thousands of transactions before law enforcement shut it down.
The cryptocurrency exchange discovered unauthorized transfers from hot and warm wallets Thursday evening and has suspended withdrawals while investigating with law enforcement and security firms.
A fresh variant of the Swift-based MacSync stealer has begun leveraging public iCloud calendar events to distribute updated malware components, while introducing a new Objective-C backdoor that impersonates macOS Finder.
Azul has launched an AI-powered assistant that queries live Java runtime data to surface security and licensing issues as they occur, moving beyond static reports that lose accuracy immediately after generation.
