<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
     xmlns:dc="http://purl.org/dc/elements/1.1/"
     xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
     xmlns:admin="http://webns.net/mvcb/"
     xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
     xmlns:content="http://purl.org/rss/1.0/modules/content/"
     xmlns:media="http://search.yahoo.com/mrss/">
<channel>
<title>Latest News on Technology, Cryptocurrency, AI, and Cyber Security &#45; : Cyber Security</title>
<link>https://block385.com/rss/category/cybernews</link>
<description>Latest News on Technology, Cryptocurrency, AI, and Cyber Security &#45; : Cyber Security</description>
<dc:language>en</dc:language>
<dc:rights>2026 Block385.com</dc:rights>

<item>
<title>Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited</title>
<link>https://block385.com/week-in-review-axios-npm-supply-chain-compromise-critical-forticlient-ems-bugs-exploited</link>
<guid>https://block385.com/week-in-review-axios-npm-supply-chain-compromise-critical-forticlient-ems-bugs-exploited</guid>
<description><![CDATA[ Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Financial groups lay out a plan to fight AI identity attacks Generative AI tools have brought the cost of deepfake production low enough that criminals and state-sponsored actors now use them routinely against financial institutions. A joint paper from the American Bankers Association, the Better Identity Coalition, and the Financial Services Sector Coordinating Council lays out the scale of the … More →
The post Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/07/16184416/week-in-review2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 05 Apr 2026 13:00:15 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Week, review:, Axios, npm, supply, chain, compromise, critical, FortiClient, EMS, bugs, exploited</media:keywords>
</item>

<item>
<title>36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants</title>
<link>https://block385.com/36-malicious-npm-packages-exploited-redis-postgresql-to-deploy-persistent-implants</link>
<guid>https://block385.com/36-malicious-npm-packages-exploited-redis-postgresql-to-deploy-persistent-implants</guid>
<description><![CDATA[ Cybersecurity researchers have discovered 36 malicious packages in the npm registry that are disguised as Strapi CMS plugins but come with different payloads to facilitate Redis and PostgreSQL exploitation, deploy reverse shells, harvest credentials, and drop a persistent implant.
&quot;Every package contains three files (package.json, index.js, postinstall.js), has no description, repository, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9axxKrcvcFkL99SIB2AlrcEW2RIZ1Ff8PollH7XYSWrYSOgoPXKlF5rsdgyr9BSWVUa5oP07faI_DvxNyUk_rpuz5i2xuiEdlU-e929rCWpkLjDGRs4EBjzfBWQRJVtrWNtR-EKvWsR-PPO-Yfei5ONMyumlI12R7OHmIrsyzJtB5SJRTCSuKiyJQnTfK/s1600/database.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 05 Apr 2026 08:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Malicious, npm, Packages, Exploited, Redis, PostgreSQL, Deploy, Persistent, Implants</media:keywords>
</item>

<item>
<title>Fortinet Patches Actively Exploited CVE&#45;2026&#45;35616 in FortiClient EMS</title>
<link>https://block385.com/fortinet-patches-actively-exploited-cve-2026-35616-in-forticlient-ems</link>
<guid>https://block385.com/fortinet-patches-actively-exploited-cve-2026-35616-in-forticlient-ems</guid>
<description><![CDATA[ Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the wild.
The vulnerability, tracked as CVE-2026-35616 (CVSS score: 9.1), has been described as a pre-authentication API access bypass leading to privilege escalation.
&quot;An improper access control vulnerability [CWE-284] in FortiClient EMS may allow an ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh61_DDvLhdLZ8tHMrmQ8XlQ1vWwnEk-2lmYFnjw_1ZvJ4IUB4G7ffXU8pSd7JDknP0bqyaVVOTb1HJ62ujlQ_zfG3Lc7XMtLKUuZTO6v4jgrdqon90wrix6EaQNKtou3yz7Txf3ni5JOVn-D1-OcHB7e-UDxQI2ifZOBHAeDwFBnwAfanSeFn8EyP8oilj/s1600/fortinet.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 05 Apr 2026 08:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fortinet, Patches, Actively, Exploited, CVE-2026-35616, FortiClient, EMS</media:keywords>
</item>

<item>
<title>FortiClient EMS zero&#45;day exploited, emergency hotfixes available (CVE&#45;2026&#45;35616)</title>
<link>https://block385.com/forticlient-ems-zero-day-exploited-emergency-hotfixes-available-cve-2026-35616</link>
<guid>https://block385.com/forticlient-ems-zero-day-exploited-emergency-hotfixes-available-cve-2026-35616</guid>
<description><![CDATA[ Defused Cyber has spotted a critical Fortinet FortiClient Endpoint Management Server (EMS) zero-day vulnerability (CVE-2026-35616) being exploited in the wild. This time around, the confirmation of active exploitation came almost immediately from Fortinet, as well. “Fortinet has observed [CVE-2026-35616] to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6,” the company stated in a security advisory published on Saturday. About CVE-2026-35616 On Monday, Defused Cyber … More →
The post FortiClient EMS zero-day exploited, emergency hotfixes available (CVE-2026-35616) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/21163736/fortinet-man-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Sat, 04 Apr 2026 19:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FortiClient, EMS, zero-day, exploited, emergency, hotfixes, available, CVE-2026-35616</media:keywords>
</item>

<item>
<title>Inconsistent Privacy Labels Don&amp;apos;t Tell Users What They Are Getting</title>
<link>https://block385.com/inconsistent-privacy-labels-dont-tell-users-what-they-are-getting</link>
<guid>https://block385.com/inconsistent-privacy-labels-dont-tell-users-what-they-are-getting</guid>
<description><![CDATA[ Data privacy labels are a great idea for mobile apps, but the current versions just aren&#039;t good enough. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt41107f0839743052/69d0356a4d3fefd8f0031c47/mobile-privacy-aphithana-chitmongkolthong-alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 04 Apr 2026 01:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Inconsistent, Privacy, Labels, Dont, Tell, Users, What, They, Are, Getting</media:keywords>
</item>

<item>
<title>Apple Breaks Precedent, Patches DarkSword for iOS 18</title>
<link>https://block385.com/apple-breaks-precedent-patches-darksword-for-ios-18</link>
<guid>https://block385.com/apple-breaks-precedent-patches-darksword-for-ios-18</guid>
<description><![CDATA[ Even organizations with users unwilling or unable to adopt iOS 26 can now protect themselves from a severe mobile OS-cracking tool. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7015711bd72ffc83/69cff44a7535beaa9fb4616c/Apple_progress_bar-JENYA-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 21:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Breaks, Precedent, Patches, DarkSword, for, iOS</media:keywords>
</item>

<item>
<title>China&#45;Linked TA416 Targets European Governments with PlugX and OAuth&#45;Based Phishing</title>
<link>https://block385.com/china-linked-ta416-targets-european-governments-with-plugx-and-oauth-based-phishing</link>
<guid>https://block385.com/china-linked-ta416-targets-european-governments-with-plugx-and-oauth-based-phishing</guid>
<description><![CDATA[ A China-aligned threat actor has set its sights on European government and diplomatic organizations since mid-2025, following a two-year period of minimal targeting in the region.
The campaign has been attributed to TA416, a cluster of activity that overlaps with DarkPeony, RedDelta, Red Lich, SmugX, UNC6384, and Vertigo Panda.
&quot;This TA416 activity included multiple ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgi-dKCldJqtZI1CocMVxHNKusU5tcnMKjx7mzG9EfehvGacnTy4tsTfZLMfhyphenhyphenC5W210OxrxijBNAP8UumXAZH15ZSOM4x8xb9VTIHxN1HCouzROU0pn7sCJki9zJOkk9_8SRns73KxO1KvxUY4YgKGbbme6ZcKdbt4cqSHUkG5WQQPgDDTx_OLRbms35Dv/s1600/chinese-hackers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>China-Linked, TA416, Targets, European, Governments, with, PlugX, and, OAuth-Based, Phishing</media:keywords>
</item>

<item>
<title>Microsoft Details Cookie&#45;Controlled PHP Web Shells Persisting via Cron on Linux Servers</title>
<link>https://block385.com/microsoft-details-cookie-controlled-php-web-shells-persisting-via-cron-on-linux-servers</link>
<guid>https://block385.com/microsoft-details-cookie-controlled-php-web-shells-persisting-via-cron-on-linux-servers</guid>
<description><![CDATA[ Threat actors are increasingly using HTTP cookies as a control channel for PHP-based web shells on Linux servers and to achieve remote code execution, according to findings from the Microsoft Defender Security Research Team.
&quot;Instead of exposing command execution through URL parameters or request bodies, these web shells rely on threat actor-supplied cookie values to gate execution, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_2zEf8l08MTElI1sGlJPVVWtscud2RAXdsivOvcby3pO4NUWMBioT3FNaFL7Bw0GeEqnX_WqY10FVqXhVNBTOrl0UMPoyun7AvshwpvfJIdfdJ0yJ1V2mz7ZHQDE9motXuuW6urvTJYu0kLGvpZf10Qx1hNeobD4YV25tJY9nvNoW9Sqd8nSsWK7NWQP0/s1600/php-linux.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Details, Cookie-Controlled, PHP, Web, Shells, Persisting, via, Cron, Linux, Servers</media:keywords>
</item>

<item>
<title>Windows Security app gets Secure Boot certificate status indicators as 2026 expiration approaches</title>
<link>https://block385.com/windows-security-app-gets-secure-boot-certificate-status-indicators-as-2026-expiration-approaches</link>
<guid>https://block385.com/windows-security-app-gets-secure-boot-certificate-status-indicators-as-2026-expiration-approaches</guid>
<description><![CDATA[ Microsoft’s Secure Boot certificates, issued in 2011, are approaching expiration in 2026. To help IT administrators track whether devices have received replacement certificates, Microsoft has added new status indicators to the Windows Security app, under Device security &gt; Secure Boot. Updated 2023 certificates are being delivered automatically through Windows Update to consumer devices and some business devices. The new app indicators show whether a given device has received those updates, what its current certificate state … More →
The post Windows Security app gets Secure Boot certificate status indicators as 2026 expiration approaches appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/11132343/windows-1500-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 19:00:31 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Windows, Security, app, gets, Secure, Boot, certificate, status, indicators, 2026, expiration, approaches</media:keywords>
</item>

<item>
<title>Cisco IMC auth bypass vulnerability allows attackers to alter user passwords (CVE&#45;2026&#45;20093)</title>
<link>https://block385.com/cisco-imc-auth-bypass-vulnerability-allows-attackers-to-alter-user-passwords-cve-2026-20093</link>
<guid>https://block385.com/cisco-imc-auth-bypass-vulnerability-allows-attackers-to-alter-user-passwords-cve-2026-20093</guid>
<description><![CDATA[ Cisco has fixed ten vulnerabilities affecting its Integrated Management Controller (IMC), the most critical of which (CVE-2026-20093) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system as Admin. Cisco ICM riddled with vulnerabilities Cisco Integrated Management Controller is a built-in hardware management system used in Cisco servers. It allows administrators to remotely control, monitor, and troubleshoot a server, even if the operating system isn’t running. (That’s because Cisco IMC … More →
The post Cisco IMC auth bypass vulnerability allows attackers to alter user passwords (CVE-2026-20093) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/01/23130953/cisco-1500-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 19:00:15 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cisco, IMC, auth, bypass, vulnerability, allows, attackers, alter, user, passwords, CVE-2026-20093</media:keywords>
</item>

<item>
<title>Blast Radius of TeamPCP Attacks Expands Amid Hacker Infighting</title>
<link>https://block385.com/blast-radius-of-teampcp-attacks-expands-amid-hacker-infighting</link>
<guid>https://block385.com/blast-radius-of-teampcp-attacks-expands-amid-hacker-infighting</guid>
<description><![CDATA[ As organizations disclose breaches tied to TeamPCP&#039;s supply chain attacks, ShinyHunters and Lapsus$ are getting involved, taking credit, and creating a murky situation for enterprises. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt521dd4163ce7b43a/69cfd9e44d3fef6aef031bbc/breaches_hirunlaowisit_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 19:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Blast, Radius, TeamPCP, Attacks, Expands, Amid, Hacker, Infighting</media:keywords>
</item>

<item>
<title>Claude Source Code Leak Highlights Big Supply Chain Missteps</title>
<link>https://block385.com/claude-source-code-leak-highlights-big-supply-chain-missteps</link>
<guid>https://block385.com/claude-source-code-leak-highlights-big-supply-chain-missteps</guid>
<description><![CDATA[ Or, why the software supply chain should be treated as critical infrastructure with guardrails built in at every layer. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltdceec94ca4ee78d7/69cede0b5553ec3f3ca007ad/AI-powered-software-supply-chain-Summit_Art_Creations-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 19:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Source, Code, Leak, Highlights, Big, Supply, Chain, Missteps</media:keywords>
</item>

<item>
<title>Picking Up &amp;apos;Skull Vibrations&amp;apos;? Could Be XR Headset Authentication</title>
<link>https://block385.com/picking-up-skull-vibrations-could-be-xr-headset-authentication</link>
<guid>https://block385.com/picking-up-skull-vibrations-could-be-xr-headset-authentication</guid>
<description><![CDATA[ &quot;Skull vibration harmonics generated by vital signs&quot; can be used to sign in to VR, AR, and MR headsets, according to emerging research. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt673e9c40508ebe1e/69cecafa5c46194cc718a313/Skull_painting_Peter_Horree_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 17:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Picking, Skull, Vibrations, Could, Headset, Authentication</media:keywords>
</item>

<item>
<title>Source Code Leaks Highlight Lack of Supply Chain Oversight</title>
<link>https://block385.com/source-code-leaks-highlight-lack-of-supply-chain-oversight</link>
<guid>https://block385.com/source-code-leaks-highlight-lack-of-supply-chain-oversight</guid>
<description><![CDATA[ Or, why the software supply chain should be treated as critical infrastructure with guardrails built in at every layer. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltdceec94ca4ee78d7/69cede0b5553ec3f3ca007ad/AI-powered-software-supply-chain-Summit_Art_Creations-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 17:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Source, Code, Leaks, Highlight, Lack, Supply, Chain, Oversight</media:keywords>
</item>

<item>
<title>Chainguard Unveils Factory 2.0 to Automate Hardening the Software Supply Chain</title>
<link>https://block385.com/chainguard-unveils-factory-20-to-automate-hardening-the-software-supply-chain</link>
<guid>https://block385.com/chainguard-unveils-factory-20-to-automate-hardening-the-software-supply-chain</guid>
<description><![CDATA[ The rebuilt Chainguard platform adds deeper security designed to continuously reconcile open-source artifacts across containers, libraries, Actions and skills. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc232543381a9006f/693207a41ab840449642b8fb/factory-robots-assemble-batteries-IM_Imagery-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 17:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Chainguard, Unveils, Factory, 2.0, Automate, Hardening, the, Software, Supply, Chain</media:keywords>
</item>

<item>
<title>CrowdStrike Next&#45;Gen SIEM Can Now Ingest Microsoft Defender Telemetry</title>
<link>https://block385.com/crowdstrike-next-gen-siem-can-now-ingest-microsoft-defender-telemetry</link>
<guid>https://block385.com/crowdstrike-next-gen-siem-can-now-ingest-microsoft-defender-telemetry</guid>
<description><![CDATA[ Once CrowdStrike’s nemesis, Microsoft is now a collaborator. A shared interest in Formula 1 helped thaw the years-long fierce rivalry. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0bdf16aa665784b3/689f7412dc6d053d5644680d/edr_MauriceNorbert_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CrowdStrike, Next-Gen, SIEM, Can, Now, Ingest, Microsoft, Defender, Telemetry</media:keywords>
</item>

<item>
<title>UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack</title>
<link>https://block385.com/unc1069-social-engineering-of-axios-maintainer-led-to-npm-supply-chain-attack</link>
<guid>https://block385.com/unc1069-social-engineering-of-axios-maintainer-led-to-npm-supply-chain-attack</guid>
<description><![CDATA[ The maintainer of the Axios npm package has confirmed that the supply chain compromise was the result of a highly-targeted social engineering campaign orchestrated by North Korean threat actors tracked as UNC1069.
Maintainer Jason Saayman said the attackers tailored their social engineering efforts &quot;specifically to me&quot; by first approaching him under the guise of the founder of a ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzgZRu55MSbdanW8-1PyCciQIyWUcB9Dv4WhQQEELGJqahN5q7MyrDJKQ77e-9-fNetZJZiaJKERrgMWTGcQ-4TKhzhWE6veQp5w3wxhUnjq3NPMifbpdn1VLYpx5nngu4GsgPknNfAV8CNTGq_L_PBri4s3xz4hp8yt7OPin9Q-Kq_xcBNqzbgHx5SkrU/s1600/supplychain.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>UNC1069, Social, Engineering, Axios, Maintainer, Led, npm, Supply, Chain, Attack</media:keywords>
</item>

<item>
<title>Why Third&#45;Party Risk Is the Biggest Gap in Your Clients&amp;apos; Security Posture</title>
<link>https://block385.com/why-third-party-risk-is-the-biggest-gap-in-your-clients-security-posture</link>
<guid>https://block385.com/why-third-party-risk-is-the-biggest-gap-in-your-clients-security-posture</guid>
<description><![CDATA[ The next major breach hitting your clients probably won&#039;t come from inside their walls. It&#039;ll come through a vendor they trust, a SaaS tool their finance team signed up for, or a subcontractor nobody in IT knows about. That&#039;s the new attack surface, and most organizations are underprepared for it.
Cynomi&#039;s new guide, Securing the Modern Perimeter: The Rise of Third-Party ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVOZWf-jO2_HykRTz3eVXj5HliZeT5oLJzIB9b4aX4fX_0nV9zUgCHL_WU9qxq7Uipi77Sf7I0DfRNGpmI0DwAZTusda6siewFmPGUnLjPIrsUDwagoy7PyaUlpR6anmdXp3OoTMB5aYEBlwKUt_zqRF0rxNQLub2TFqfqitAQdKXMA0ZPBwEV2hzJr1I/s1600/cynomi.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, Third-Party, Risk, the, Biggest, Gap, Your, Clients, Security, Posture</media:keywords>
</item>

<item>
<title>Claude Code source leak exploited to spread malware</title>
<link>https://block385.com/claude-code-source-leak-exploited-to-spread-malware</link>
<guid>https://block385.com/claude-code-source-leak-exploited-to-spread-malware</guid>
<description><![CDATA[ A source code leak involving Anthropic’s Claude Code tool quickly escalated into a cybersecurity threat, as attackers seized on the exposed files to lure developers into downloading malware disguised as “unlocked” versions of the software. Leaked Claude Code source code used as lure On March 31, 2026, Anthropic accidentally exposed online the source code of its Claude Code tool. The leak was detected by security researcher Chaofan Shou, whose post on X drew widespread attention. … More →
The post Claude Code source leak exploited to spread malware appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11083747/malware-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 13:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Code, source, leak, exploited, spread, malware</media:keywords>
</item>

<item>
<title>New SparkCat Variant in iOS, Android Apps Steals Crypto Wallet Recovery Phrase Images</title>
<link>https://block385.com/new-sparkcat-variant-in-ios-android-apps-steals-crypto-wallet-recovery-phrase-images</link>
<guid>https://block385.com/new-sparkcat-variant-in-ios-android-apps-steals-crypto-wallet-recovery-phrase-images</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a new version of the SparkCat malware on the Apple App Store and Google Play Store, more than a year after the trojan was discovered targeting both the mobile operating systems.
The malware has been found to conceal itself within seemingly benign apps, such as enterprise messengers and food delivery services, while ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2s09d3X9qYABLHP5v1u9iyjRN5p28u6xvnL0qkKR1-s1CsqtIDAWeQCFKQ9S4Mde1ueUmzcjNA9SAzWN-lDWwbmTmmlwbbLkyKx-EJc2-bjhKlEsChsp3iZ6watrZ4I8LJdL_p0vatW4NrXntcs6_xdReGEQJMUCgfAFo-ZfCy_jDsxEZgPMx1T9e1e0L/s1600/mobile-wallet-seed.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, SparkCat, Variant, iOS, Android, Apps, Steals, Crypto, Wallet, Recovery, Phrase, Images</media:keywords>
</item>

<item>
<title>Drift Loses $285 Million in Durable Nonce Social Engineering Attack Linked to DPRK</title>
<link>https://block385.com/drift-loses-285-million-in-durable-nonce-social-engineering-attack-linked-to-dprk</link>
<guid>https://block385.com/drift-loses-285-million-in-durable-nonce-social-engineering-attack-linked-to-dprk</guid>
<description><![CDATA[ Solana-based decentralized exchange Drift has confirmed that attackers drained about $285 million from the platform during a security incident that took place on April 1, 2026.
&quot;Earlier today, a malicious actor gained unauthorized access to Drift Protocol through a novel attack involving durable nonces, resulting in a rapid takeover of Drift’s Security Council administrative powers,&quot; the&amp; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUiYsLIirEMJ6RmQKL7LnI8V0CmqL2qggZITpbnhuDXgXPAsXZ7cGv1KBjp1VBfeBVjUHypgPIC1DENjD735MO9gZQVPZO_xI424cuWoRowXBNflIs3rteCoCpdMPeTo5y2-I67CKALepuLYF-OfTplaTVBtextDcgCTW81sGmhT710Uu-37ouNh6MJjfk/s1600/drift-1.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Drift, Loses, 285, Million, Durable, Nonce, Social, Engineering, Attack, Linked, DPRK</media:keywords>
</item>

<item>
<title>Which messaging app takes the most limited approach to permissions on Android?</title>
<link>https://block385.com/which-messaging-app-takes-the-most-limited-approach-to-permissions-on-android</link>
<guid>https://block385.com/which-messaging-app-takes-the-most-limited-approach-to-permissions-on-android</guid>
<description><![CDATA[ Messaging apps handle sensitive conversations, contacts, and media, and their behavior on a device varies in ways that affect privacy. An analysis of Android versions of Messenger, Signal, and Telegram shows that differences in permissions, background activity, and system exposure shape how much data each app can access and how often it communicates. Permissions define access to device and user data The three apps take different approaches. Telegram has the lowest total number of permissions … More →
The post Which messaging app takes the most limited approach to permissions on Android? appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05111353/mobile-apps-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 11:00:59 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Which, messaging, app, takes, the, most, limited, approach, permissions, Android</media:keywords>
</item>

<item>
<title>Microsoft releases open&#45;source toolkit to govern autonomous AI agents</title>
<link>https://block385.com/microsoft-releases-open-source-toolkit-to-govern-autonomous-ai-agents</link>
<guid>https://block385.com/microsoft-releases-open-source-toolkit-to-govern-autonomous-ai-agents</guid>
<description><![CDATA[ AI agents can book travel, execute financial transactions, write and run code, and manage infrastructure without human intervention at each step. Frameworks like LangChain, AutoGen, CrewAI, and Azure AI Foundry Agent Service have made this kind of autonomy straightforward to deploy. The governance infrastructure to match that autonomy has lagged behind. Microsoft released the Agent Governance Toolkit to address that gap. What the toolkit contains The Agent Governance Toolkit is a seven-package system available in … More →
The post Microsoft releases open-source toolkit to govern autonomous AI agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/03060530/agent-governance-toolkit-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 11:00:43 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, releases, open-source, toolkit, govern, autonomous, agents</media:keywords>
</item>

<item>
<title>Trivy supply chain attack enabled European Commission cloud breach</title>
<link>https://block385.com/trivy-supply-chain-attack-enabled-european-commission-cloud-breach</link>
<guid>https://block385.com/trivy-supply-chain-attack-enabled-european-commission-cloud-breach</guid>
<description><![CDATA[ CERT-EU confirmed that ShinyHunters are behind the recent breach of the cloud infrastructure underpinning websites of the European Commission, and that they stole and subsequently leaked approximately 340 GB of data. “Analysis of the published dataset has so far confirmed the presence of personal data, including lists of names, last names, usernames, and email addresses, predominantly from the European Commission’s websites but potentially pertaining to users across multiple Union entities,” European Union’s CERT said. “The … More →
The post Trivy supply chain attack enabled European Commission cloud breach appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/03083348/eu-stars-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 11:00:29 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Trivy, supply, chain, attack, enabled, European, Commission, cloud, breach</media:keywords>
</item>

<item>
<title>APERION releases SmartFlow SDK for secure, on&#45;prem AI governance without cloud reliance</title>
<link>https://block385.com/aperion-releases-smartflow-sdk-for-secure-on-prem-ai-governance-without-cloud-reliance</link>
<guid>https://block385.com/aperion-releases-smartflow-sdk-for-secure-on-prem-ai-governance-without-cloud-reliance</guid>
<description><![CDATA[ APERION launched SmartFlow SDK, providing a secure, on-premises path for enterprises migrating away from compromised cloud-based AI gateways. The launch coincides with a 200% increase in web traffic since the March 24 LiteLLM supply chain attack that compromised an estimated 36% of all cloud environments. LiteLLM was the victim of a supply chain attack in which the threat actor group TeamPCP compromised the most widely used open-source LLM proxy in the Python ecosystem through a … More →
The post APERION releases SmartFlow SDK for secure, on-prem AI governance without cloud reliance appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 11:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>APERION, releases, SmartFlow, SDK, for, secure, on-prem, governance, without, cloud, reliance</media:keywords>
</item>

<item>
<title>New infosec products of the month: March 2026</title>
<link>https://block385.com/new-infosec-products-of-the-month-march-2026</link>
<guid>https://block385.com/new-infosec-products-of-the-month-march-2026</guid>
<description><![CDATA[ Here’s a look at the most interesting products from the past month, featuring releases from Beazley, Bonfy.AI, Mend.io, Mimecast, NinjaOne, Novee, Intel 471, Singulr AI, Stellar Cyber, Teleport, and Vicarius. Beazley Exposure Management platform identifies external exposures and prioritizes cyber risk Beazley Security has announced its Exposure Management product, which delivers continuous, automated discovery and intelligence-driven exposure notifications to help security teams accelerate risk mitigation in an era where AI-assisted attackers have compressed the time … More →
The post New infosec products of the month: March 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/28092100/infosec-month-1200.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 07:00:44 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, infosec, products, the, month:, March, 2026</media:keywords>
</item>

<item>
<title>Click, wait, repeat: Digital trust erodes one login at a time</title>
<link>https://block385.com/click-wait-repeat-digital-trust-erodes-one-login-at-a-time</link>
<guid>https://block385.com/click-wait-repeat-digital-trust-erodes-one-login-at-a-time</guid>
<description><![CDATA[ Sign-up forms that drag on, login steps that repeat, and access requests that take longer than expected have become a normal part of using digital services. These moments rarely stand out on their own, and over time they influence how people judge the systems they rely on. The 2026 Thales Digital Trust Index reflects that environment, where trust is built or lost through everyday interactions. Most consumers have encountered problems when using websites or apps, … More →
The post Click, wait, repeat: Digital trust erodes one login at a time appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 07:00:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Click, wait, repeat:, Digital, trust, erodes, one, login, time</media:keywords>
</item>

<item>
<title>AWS, Wasabi, Cloudflare, and Backblaze go head&#45;to&#45;head in new cloud storage test</title>
<link>https://block385.com/aws-wasabi-cloudflare-and-backblaze-go-head-to-head-in-new-cloud-storage-test</link>
<guid>https://block385.com/aws-wasabi-cloudflare-and-backblaze-go-head-to-head-in-new-cloud-storage-test</guid>
<description><![CDATA[ Cloud storage buyers rarely get vendor-provided performance data that includes the vendor’s own weak spots. Backblaze’s Q1 2026 Performance Stats report, attempts to do exactly that, sharing benchmark results for Backblaze B2, AWS S3, Cloudflare R2, and Wasabi Object Storage across US-East and EU-Central regions, and including results where Backblaze’s own rate limits affected the numbers. The report is the second in a quarterly series. Backblaze publishes its full methodology and states that tests run … More →
The post AWS, Wasabi, Cloudflare, and Backblaze go head-to-head in new cloud storage test appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/08/15142441/cloud-data-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 03:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AWS, Wasabi, Cloudflare, and, Backblaze, head-to-head, new, cloud, storage, test</media:keywords>
</item>

<item>
<title>Not Toying Around: Hasbro Attack May Take &amp;apos;Weeks&amp;apos; to Remediate</title>
<link>https://block385.com/not-toying-around-hasbro-attack-may-take-weeks-to-remediate</link>
<guid>https://block385.com/not-toying-around-hasbro-attack-may-take-weeks-to-remediate</guid>
<description><![CDATA[ The company&#039;s 8-K filing notes &quot;unauthorized access&quot; and that it&#039;s activated business continuity plans and taken some systems offline. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltb4eb373845e02c10/69cec4d10268bec52dd83c55/Operation-Kerry_Taylor-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Not, Toying, Around:, Hasbro, Attack, May, Take, Weeks, Remediate</media:keywords>
</item>

<item>
<title>Security Bosses Are All&#45;In on AI. Here&amp;apos;s Why</title>
<link>https://block385.com/security-bosses-are-all-in-on-ai-heres-why</link>
<guid>https://block385.com/security-bosses-are-all-in-on-ai-heres-why</guid>
<description><![CDATA[ CISOs are bullish on AI and have big plans to roll out future tools. We talk to Reddit CISO Frederick Lee and leading analyst Dave Gruber about how AI is working out in the real world, as well as its future promise. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0469f94bd17817ff/6642699959fdc64aa5f9c5fa/dark-reading-confidential-logo-sq.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Security, Bosses, Are, All-In, AI., Heres, Why</media:keywords>
</item>

<item>
<title>Hackers Exploit CVE&#45;2025&#45;55182 to Breach 766 Next.js Hosts, Steal Credentials</title>
<link>https://block385.com/hackers-exploit-cve-2025-55182-to-breach-766-nextjs-hosts-steal-credentials</link>
<guid>https://block385.com/hackers-exploit-cve-2025-55182-to-breach-766-nextjs-hosts-steal-credentials</guid>
<description><![CDATA[ A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services (AWS) secrets, shell command history, Stripe API keys, and GitHub tokens at scale.
Cisco Talos has attributed the operation to a threat cluster it tracks as ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8T48UROZtSjRXtkxVcNT2VmXbB1texWQPAqLbm06uwmJ8VsYFb_HeXOnZx9uz9QL-LB3aWdwcLm9TbuRler7w7jjXJlL_tQweQualaW4XEVav7Ysulqx_CJyc9a0P1dO1a69W_eQhroxV1LA_p5VB9T38Xubc3zXHgwd-4sAAc2whuv4ElnC5WtFSn7SH/s1600/nextjs.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 22:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hackers, Exploit, CVE-2025-55182, Breach, 766, Next.js, Hosts, Steal, Credentials</media:keywords>
</item>

<item>
<title>New Red Hat subscription simplifies long&#45;term enterprise Linux support</title>
<link>https://block385.com/new-red-hat-subscription-simplifies-long-term-enterprise-linux-support</link>
<guid>https://block385.com/new-red-hat-subscription-simplifies-long-term-enterprise-linux-support</guid>
<description><![CDATA[ Red Hat has announced Red Hat Enterprise Linux Extended Life Cycle Premium, a new subscription that provides a predictable 14-year life cycle for major Red Hat Enterprise Linux releases. This stand-alone subscription consolidates extended support, simplifying the management of multiple support streams. It helps organizations maintain their most sensitive, change-averse workloads on a single, hardened foundation for more than a decade. As enterprises deploy full-scale production, the underlying infrastructure relies on consistency. Frequent minor release … More →
The post New Red Hat subscription simplifies long-term enterprise Linux support appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 19:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Red, Hat, subscription, simplifies, long-term, enterprise, Linux, support</media:keywords>
</item>

<item>
<title>OpenSSH 10.3 patches five security bugs and drops legacy rekeying support</title>
<link>https://block385.com/openssh-103-patches-five-security-bugs-and-drops-legacy-rekeying-support</link>
<guid>https://block385.com/openssh-103-patches-five-security-bugs-and-drops-legacy-rekeying-support</guid>
<description><![CDATA[ OpenSSH 10.3 shipped carrying five security fixes alongside feature additions and a set of behavior changes that will break compatibility with older SSH implementations that do not support rekeying. Rekeying compatibility removed SSH clients and servers that lack rekeying support will fail when they attempt to interoperate with OpenSSH going forward. The project removed the bug-compatibility code that previously allowed such implementations to keep working. Deployments running non-standard or legacy SSH software should verify rekeying … More →
The post OpenSSH 10.3 patches five security bugs and drops legacy rekeying support appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2019/06/09094033/openssh.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 19:00:23 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenSSH, 10.3, patches, five, security, bugs, and, drops, legacy, rekeying, support</media:keywords>
</item>

<item>
<title>Software supply chain hacks trigger wave of intrusions, data theft</title>
<link>https://block385.com/software-supply-chain-hacks-trigger-wave-of-intrusions-data-theft</link>
<guid>https://block385.com/software-supply-chain-hacks-trigger-wave-of-intrusions-data-theft</guid>
<description><![CDATA[ After linking the Axios npm supply chain attack to North Korean hackers, Google researchers warned that “hundreds of thousands of stolen secrets could potentially be circulating” as a result of this and the Trivy, KICS, LiteLLM, and Telnyx supply chain attacks (linked to TeamPCP). “This could enable further software supply chain attacks, software as a service (SaaS) environment compromises (leading to downstream customer compromises), ransomware and extortion events, and cryptocurrency theft over the near term,” … More →
The post Software supply chain hacks trigger wave of intrusions, data theft appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/27170627/pressure-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 19:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Software, supply, chain, hacks, trigger, wave, intrusions, data, theft</media:keywords>
</item>

<item>
<title>RSAC 2026: AI Dominates, But Community Remains Key to Security</title>
<link>https://block385.com/rsac-2026-ai-dominates-but-community-remains-key-to-security</link>
<guid>https://block385.com/rsac-2026-ai-dominates-but-community-remains-key-to-security</guid>
<description><![CDATA[ As AI took center stage at this year&#039;s conference, experts debated automation, oversight and the evolving role of human intelligence in cybersecurity — despite the US government&#039;s notable absence. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7c4a998794182807/69cdf0ad19dc583a4e26ec0f/conference1800_sebastien_bonaime_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 19:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>RSAC, 2026:, Dominates, But, Community, Remains, Key, Security</media:keywords>
</item>

<item>
<title>Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise</title>
<link>https://block385.com/cisco-patches-98-cvss-imc-and-ssm-flaws-allowing-remote-system-compromise</link>
<guid>https://block385.com/cisco-patches-98-cvss-imc-and-ssm-flaws-allowing-remote-system-compromise</guid>
<description><![CDATA[ Cisco has released updates to address a critical security flaw in the Integrated Management Controller (IMC) that, if successfully exploited, could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system with elevated privileges.
The vulnerability, tracked as CVE-2026-20093, carries a CVSS score of 9.8 out of a maximum of 10.0.
&quot;This ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjH6wuST9R8voZTpCC-v5LSwd4O7vlbuRDhXMzcSw9iu0k2JvFOao-3Jr2o9iCs0jqX3pIqHvcYo_n-5Ad80WXeQXKV_DTgJUN0A6nl9f73BA1U0wRoZBqgySfDR6Uk7KD8jXzw2BFLGvusf-96qsINw9jT4PnglZohYM2VhSsdHcpw-cl6vwAekfE-KD_H/s1600/cisco-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 18:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cisco, Patches, 9.8, CVSS, IMC, and, SSM, Flaws, Allowing, Remote, System, Compromise</media:keywords>
</item>

<item>
<title>Geopolitics, AI, and Cybersecurity: Insights From RSAC 2026</title>
<link>https://block385.com/geopolitics-ai-and-cybersecurity-insights-from-rsac-2026</link>
<guid>https://block385.com/geopolitics-ai-and-cybersecurity-insights-from-rsac-2026</guid>
<description><![CDATA[ AI-driven threats, global leadership shifts, and the future of cybersecurity in a rapidly evolving landscape were among the discussions at RSAC 2026 Conference. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt52c682d1b06fcea2/69cc3ebb4642d5670041150e/quantum_computing1800_jvphoto_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 17:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Geopolitics, AI, and, Cybersecurity:, Insights, From, RSAC, 2026</media:keywords>
</item>

<item>
<title>Bank Trojan &amp;apos;Casbaneiro&amp;apos; Worms Through Latin America</title>
<link>https://block385.com/bank-trojan-casbaneiro-worms-through-latin-america</link>
<guid>https://block385.com/bank-trojan-casbaneiro-worms-through-latin-america</guid>
<description><![CDATA[ Augmented Marauder&#039;s multipronged banking-Trojan cyber campaigns are targeting Spanish speakers, evading detection, and replicating rapidly. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt16cb4a90b4357a88/69cd468c610d0ab0477bd007/Worm_carnival_ride-Hugo_Oliveira-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 17:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bank, Trojan, Casbaneiro, Worms, Through, Latin, America</media:keywords>
</item>

<item>
<title>ThreatsDay Bulletin: Pre&#45;Auth Chains, Android Rootkits, CloudTrail Evasion &amp;amp; 10 More Stories</title>
<link>https://block385.com/threatsday-bulletin-pre-auth-chains-android-rootkits-cloudtrail-evasion-10-more-stories</link>
<guid>https://block385.com/threatsday-bulletin-pre-auth-chains-android-rootkits-cloudtrail-evasion-10-more-stories</guid>
<description><![CDATA[ The latest ThreatsDay Bulletin is basically a cheat sheet for everything breaking on the internet right now. No corporate fluff or boring lectures here, just a quick and honest look at the messy reality of keeping systems safe this week.
Things are moving fast. The list includes researchers chaining small bugs together to create massive backdoors, old software flaws ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEht9hzOUmn8npVxC_AyWUe1DLsv1VkWHox2PmDxZnVuG_XnQt7R5l7CZHlYu9m9BcwAib4L0j0x877sDuCF2shmSH3ef0Me-m0sbKDtu-ZEw5RLqLGNsjGJ0o-b_CuKtFg86fMFb-GKVBud7S8PfpsoL4HCqEZypO1NcWfx6ljXcUhC5O4GIjRbhRcG-fIi/s1600/threatsday.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ThreatsDay, Bulletin:, Pre-Auth, Chains, Android, Rootkits, CloudTrail, Evasion, More, Stories</media:keywords>
</item>

<item>
<title>Tracking drones with the 5G tower down the street</title>
<link>https://block385.com/tracking-drones-with-the-5g-tower-down-the-street</link>
<guid>https://block385.com/tracking-drones-with-the-5g-tower-down-the-street</guid>
<description><![CDATA[ Drone detection in cities is expensive. Dedicated radar installations are cost-prohibitive at scale, cameras have limited range and stop working well at night, and LiDAR systems have the same cost problem as radar. A group of researchers at the University of Science and Technology of China spent the past year working on a different approach: using 5G-Advanced base stations that are already in the ground to do the job instead. The 5G-A base station Active … More →
The post Tracking drones with the 5G tower down the street appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/21184245/drone-tech.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 15:01:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tracking, drones, with, the, tower, down, the, street</media:keywords>
</item>

<item>
<title>Trust, friction, and ROI: A CISO’s take on making security work for the business</title>
<link>https://block385.com/trust-friction-and-roi-a-cisos-take-on-making-security-work-for-the-business</link>
<guid>https://block385.com/trust-friction-and-roi-a-cisos-take-on-making-security-work-for-the-business</guid>
<description><![CDATA[ In this Help Net Security interview, John O’Rourke, CISO at PPG, talks about what it means for security to drive business value. He explains how mature security programs reduce friction in sales cycles and M&amp;A processes, and how trust is built over time. O’Rourke also addresses how buyer sophistication has raised the bar for suppliers, why less-regulated industries lag behind their more-regulated counterparts, and which companies will benefit from foundational security investments. The interview covers … More →
The post Trust, friction, and ROI: A CISO’s take on making security work for the business appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/01171141/john_orourke-2-ppg.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 15:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Trust, friction, and, ROI:, CISO’s, take, making, security, work, for, the, business</media:keywords>
</item>

<item>
<title>TrueConf zero&#45;day vulnerability exploited to target government networks</title>
<link>https://block385.com/trueconf-zero-day-vulnerability-exploited-to-target-government-networks</link>
<guid>https://block385.com/trueconf-zero-day-vulnerability-exploited-to-target-government-networks</guid>
<description><![CDATA[ Suspected China-nexus attackers have leveraged a zero-day vulnerability (CVE-2026-3502) in the TrueConf client application to distribute malware within government networks in Southeast Asia, Check Point researchers discovered. Malicious client update attack chain (Source: Check Point) Trusted update mechanism turned into attack vector TrueConf is a videoconferencing platform designed to run on private local networks (LANs) without internet access, which makes it attractive to government departments, defense institutions, and critical infrastructure operators. Consequently, the solution is … More →
The post TrueConf zero-day vulnerability exploited to target government networks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/25153046/malware-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 15:00:18 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TrueConf, zero-day, vulnerability, exploited, target, government, networks</media:keywords>
</item>

<item>
<title>DarkSword exploit forces Apple to loosen its patching policy</title>
<link>https://block385.com/darksword-exploit-forces-apple-to-loosen-its-patching-policy</link>
<guid>https://block385.com/darksword-exploit-forces-apple-to-loosen-its-patching-policy</guid>
<description><![CDATA[ Apple has extended security updates to a wider range of devices still running iOS 18, aiming to protect users from the DarkSword exploit kit. This is not the first time Apple has backported fixes for older devices based on vulnerability severity. Allowing iOS 18 users to receive patches without upgrading to iOS 26, however, signals a shift in its long-standing security approach following the discovery of the DarkSword and Coruna exploit kits. When iOS 26 … More →
The post DarkSword exploit forces Apple to loosen its patching policy appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/20114617/apple1.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 15:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DarkSword, exploit, forces, Apple, loosen, its, patching, policy</media:keywords>
</item>

<item>
<title>Ransomware Will Hit Hospitals. Rehearsals Are Key to Defense</title>
<link>https://block385.com/ransomware-will-hit-hospitals-rehearsals-are-key-to-defense</link>
<guid>https://block385.com/ransomware-will-hit-hospitals-rehearsals-are-key-to-defense</guid>
<description><![CDATA[ A chief medical information officer provided a peek into what hospitals face when they inevitably suffer a ransomware attack—whether it leads to short or long-term outages. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt9b5b97c6c5a88d9c/655f53bc09902b040ae06301/hospital_hack_Oleckii_Mach_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 15:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ransomware, Will, Hit, Hospitals., Rehearsals, Are, Key, Defense</media:keywords>
</item>

<item>
<title>Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners</title>
<link>https://block385.com/researchers-uncover-mining-operation-using-iso-lures-to-spread-rats-and-crypto-miners</link>
<guid>https://block385.com/researchers-uncover-mining-operation-using-iso-lures-to-spread-rats-and-crypto-miners</guid>
<description><![CDATA[ A financially motivated operation codenamed REF1695 has been observed leveraging fake installers to deploy remote access trojans (RATs) and cryptocurrency miners since November 2023.
&quot;Beyond cryptomining, the threat actor monetizes infections through CPA (Cost Per Action) fraud, directing victims to content locker pages under the guise of software registration,&quot; Elastic ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpKoZinOy6MS9s0nTi1TV12H46KUmgkxu0kGinPE7yyq7Vpo9lmmcz30e5ve0yCk2T0ETCedeV6aXs0iEjI1rOykcXwBPa2a11yb75bjgjad7WKkKgsUAv0lO1tuZ8vVnYZtuiUHKqwM6Z6bxGtheJIhuWW5W6lKjo0FaHZf7ewPO_SFuKAjPKMh_sqDB2/s1600/monero.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, Uncover, Mining, Operation, Using, ISO, Lures, Spread, RATs, and, Crypto, Miners</media:keywords>
</item>

<item>
<title>The State of Trusted Open Source Report</title>
<link>https://block385.com/the-state-of-trusted-open-source-report</link>
<guid>https://block385.com/the-state-of-trusted-open-source-report</guid>
<description><![CDATA[ In December 2025, we shared the first-ever The State of Trusted Open Source report, featuring insights from our product data and customer base on open source consumption across our catalog of container image projects, versions, images, language libraries, and builds. These insights shed light on what teams pull, deploy, and maintain day to day, alongside the vulnerabilities and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5yI578d17vaAxuCMW2SLrz3ibI4ibSfdDCfum-B3VZ0Ukyd79Eue2VR8ofUCBpISSXsL8biYdRFyuMm78T6PTU7U1w_6jJK3qV7ohPRSt3NGDTtAkseitLCaEZVHqcVIhFZABPlyAP8KPV-JMlnlq42Flgl7lB2Rs5hkIQYVYtc0Z15Yd0WKaYSu7CLM/s1600/devsecops.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, State, Trusted, Open, Source, Report</media:keywords>
</item>

<item>
<title>WhatsApp Alerts 200 Users After Fake iOS App Installed Spyware; Italian Firm Faces Action</title>
<link>https://block385.com/whatsapp-alerts-200-users-after-fake-ios-app-installed-spyware-italian-firm-faces-action</link>
<guid>https://block385.com/whatsapp-alerts-200-users-after-fake-ios-app-installed-spyware-italian-firm-faces-action</guid>
<description><![CDATA[ Meta-owned messaging platform WhatsApp said it alerted about 200 users who were tricked into installing a bogus version of its iOS app that was infected with spyware.
According to reports from Italian newspaper La Repubblica and news agency ANSA, the vast majority of the targets are located in Italy. It&#039;s assessed that the threat actors behind the activity used social engineering ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH1Qe0E88MYHp7xg6ApE5TypZK__02tmUnhvX60svA9npwirnTJbAb-Wl4rvLo3gq3kX1l9JUXDgXZJ0yPGNZlUo8n5DG1-pqONNFQIA2epqNdU7tNGZSJPJCthWLHtnDdO8jWQ5YzwY7TWUn_9SJP5pu0vHX2i3-L0zM5dZscSR4wAUPWAN1fm-3zgOGE/s1600/whatsapp-alert.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>WhatsApp, Alerts, 200, Users, After, Fake, iOS, App, Installed, Spyware, Italian, Firm, Faces, Action</media:keywords>
</item>

<item>
<title>Apple Expands iOS 18.7.7 Update to More Devices to Block DarkSword Exploit</title>
<link>https://block385.com/apple-expands-ios-1877-update-to-more-devices-to-block-darksword-exploit</link>
<guid>https://block385.com/apple-expands-ios-1877-update-to-more-devices-to-block-darksword-exploit</guid>
<description><![CDATA[ Apple on Wednesday expanded the availability of iOS 18.7.7 and iPadOS 18.7.7 to a broader range of devices to protect users from the risk posed by a recently disclosed exploit kit known as DarkSword.
&quot;We enabled the availability of iOS 18.7.7 for more devices on April 1, 2026, so users with Automatic Updates turned on can automatically receive important security ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOPIq2XjzxLFTE4iwZWuKsLifOBVn0sVZv2vDEl0D3eXsyiW8ePJH7ukb29zq7gb7-7fJy8WjCRC5e-sYoMLXT4ZE-12llaj0H76qjygPmEl7cuGiC4jrLaMdDX5M55YsuYhdtbn8k5gCosH-JwHU3H-b7ho_5Lvg4pjoKf2Lz39lOumTGuxldWK1YQvfJ/s1600/apple-update.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 10:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Expands, iOS, 18.7.7, Update, More, Devices, Block, DarkSword, Exploit</media:keywords>
</item>

<item>
<title>Your customer passed authentication. So why are they sending money to a scammer?</title>
<link>https://block385.com/your-customer-passed-authentication-so-why-are-they-sending-money-to-a-scammer</link>
<guid>https://block385.com/your-customer-passed-authentication-so-why-are-they-sending-money-to-a-scammer</guid>
<description><![CDATA[ In this Help Net Security video, Lenny Gusel, Head of Fraud Solutions in North America at Feedzai, explains how customer identity and access management has converged with digital fraud detection, and why treating them as separate systems creates real risk. The core idea is continuous, contextual trust. Where traditional IAM grants access at a single point in time, fraud systems track behavior throughout an entire session, reading device signals, network context, and how a user … More →
The post Your customer passed authentication. So why are they sending money to a scammer? appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/25153040/fraud-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 07:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, customer, passed, authentication., why, are, they, sending, money, scammer</media:keywords>
</item>

<item>
<title>Microsoft adds high&#45;volume email sending to Exchange Online</title>
<link>https://block385.com/microsoft-adds-high-volume-email-sending-to-exchange-online</link>
<guid>https://block385.com/microsoft-adds-high-volume-email-sending-to-exchange-online</guid>
<description><![CDATA[ Organizations that rely on Exchange Online for internal communications have long needed a way to send large volumes of automated messages, such as payroll notifications, IT alerts, and security advisories, without running into the sending limits designed for person-to-person email. Microsoft has addressed that with the general availability of High Volume Email (HVE) in Exchange Online. What High Volume Email does HVE is a tenant-native capability built for application-to-person messaging within an organization. It uses … More →
The post Microsoft adds high-volume email sending to Exchange Online appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/03/28180944/exchange-hands.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 07:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, adds, high-volume, email, sending, Exchange, Online</media:keywords>
</item>

<item>
<title>LatAm&amp;apos;s Self&#45;Taught Cyber Talent Overlooked Amid Cyberattack Glut</title>
<link>https://block385.com/latams-self-taught-cyber-talent-overlooked-amid-cyberattack-glut</link>
<guid>https://block385.com/latams-self-taught-cyber-talent-overlooked-amid-cyberattack-glut</guid>
<description><![CDATA[ A newly released study exclusively shared with Dark Reading details the unique circumstances that make up Latin America&#039;s labor pool, and why organizations may want to expand their talent search. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt966676b376c5678d/69cd3771d8123450aa850b8c/help_wanted_sign_Thomas_Kyhn_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>LatAms, Self-Taught, Cyber, Talent, Overlooked, Amid, Cyberattack, Glut</media:keywords>
</item>

<item>
<title>Google&amp;apos;s Vertex AI Is Over&#45;Privileged. That&amp;apos;s a Problem</title>
<link>https://block385.com/googles-vertex-ai-is-over-privileged-thats-a-problem</link>
<guid>https://block385.com/googles-vertex-ai-is-over-privileged-thats-a-problem</guid>
<description><![CDATA[ Palo Alto Networks researchers show how attackers could exploit AI agents on Google&#039;s Vertex AI to steal data and break into restricted cloud infrastructure. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4e41a8645f65857e/69cc23a696a9929cb14154a7/agent_Krot_Studio_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 21:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Googles, Vertex, Over-Privileged., Thats, Problem</media:keywords>
</item>

<item>
<title>CERT&#45;UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails</title>
<link>https://block385.com/cert-ua-impersonation-campaign-spread-agewheeze-malware-to-1-million-emails</link>
<guid>https://block385.com/cert-ua-impersonation-campaign-spread-agewheeze-malware-to-1-million-emails</guid>
<description><![CDATA[ The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new phishing campaign in which the cybersecurity agency itself was impersonated to distribute a remote administration tool known as AGEWHEEZE.
As part of the attacks, the threat actors, tracked as UAC-0255, sent emails on March 26 and 27, 2026, posing as CERT-UA to distribute a password-protected ZIP archive ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4SwwNEiRJL3-C8lgR_Sj7XKNGuxhA-uAdcUZBQRRzmC16xbgg4bYkHTBz2VTfXOle8Su66hHz8vDXIOOQ2nFXlNo8wOIVWYGmVW-c9X4Luqx1-qFCiLmOMzUzwW8T5g0S73q4sr66bEAhjy9BrGmiz_pj52J3ug92X8hO5gMR6j9v_Fg8Iqu8lzqczge3/s1600/cert.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 20:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CERT-UA, Impersonation, Campaign, Spread, AGEWHEEZE, Malware, Million, Emails</media:keywords>
</item>

<item>
<title>Cybercriminals take aim at Hasbro, weeks of recovery ahead</title>
<link>https://block385.com/cybercriminals-take-aim-at-hasbro-weeks-of-recovery-ahead</link>
<guid>https://block385.com/cybercriminals-take-aim-at-hasbro-weeks-of-recovery-ahead</guid>
<description><![CDATA[ Hasbro, an American toy maker with more than 5,000 employees, confirmed a cyberattack and proactively took certain systems offline. The intrusion was detected on March 28, and the company promptly activated its incident response protocols. The company said the investigation is ongoing with support from third-party cybersecurity professionals as it works to determine the scope of the incident, while business continuity measures remain in place to support order processing, shipping, and other operations. “The need … More →
The post Cybercriminals take aim at Hasbro, weeks of recovery ahead appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/01172151/hasbro-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 19:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybercriminals, take, aim, Hasbro, weeks, recovery, ahead</media:keywords>
</item>

<item>
<title>Cyberattacks Intensify Pressure on Latin American Governments</title>
<link>https://block385.com/cyberattacks-intensify-pressure-on-latin-american-governments</link>
<guid>https://block385.com/cyberattacks-intensify-pressure-on-latin-american-governments</guid>
<description><![CDATA[ Cyber threats across Latin America are increasingly targeting government systems, from disruptive attacks in Puerto Rico to a surge of probes against Colombia’s health sector. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd944c0c271c1a53c/69cc3b692ac613751c3f5b90/colombia-flag-tech-HTGanzo-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 19:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cyberattacks, Intensify, Pressure, Latin, American, Governments</media:keywords>
</item>

<item>
<title>Venom Stealer MaaS Platform Commoditizes ClickFix Attacks</title>
<link>https://block385.com/venom-stealer-maas-platform-commoditizes-clickfix-attacks</link>
<guid>https://block385.com/venom-stealer-maas-platform-commoditizes-clickfix-attacks</guid>
<description><![CDATA[ A new service on the cybercrime market provides automated capabilities to create persistent information-stealing social engineering attacks. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt9b317f5ffbb0f24e/69ccf217d3f84532a9e458ab/snake_Gerry_Pearce_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 19:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Venom, Stealer, MaaS, Platform, Commoditizes, ClickFix, Attacks</media:keywords>
</item>

<item>
<title>CIS Benchmarks March 2026 Update</title>
<link>https://block385.com/cis-benchmarks-march-2026-update</link>
<guid>https://block385.com/cis-benchmarks-march-2026-update</guid>
<description><![CDATA[ The following CIS Benchmarks and CIS Build Kits have been updated or recently released. The Center for Internet Security has highlighted the major updates below. Each Benchmark and Build Kit includes a changelog that references all changes. Updated CIS Benchmarks overview CIS Microsoft Windows 11 Enterprise Benchmark v5.0.0 CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.0 CIS Apache Cassandra 5.0 Benchmark v1.1.0 CIS Apache Cassandra 4.1 Benchmark v1.2.0 CIS Apache Cassandra 4.0 Benchmark v1.3.0 CIS Microsoft … More →
The post CIS Benchmarks March 2026 Update appeared first on Help Net Security. ]]></description>
<enclosure url="https://www.cisecurity.org/-/jssmedia/project/cisecurity/cisecurity/data/media/img/insights_images/blog_post_img/2026/03/benchmarks-2.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 17:00:42 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CIS, Benchmarks, March, 2026, Update</media:keywords>
</item>

<item>
<title>Exabeam expands ABA to detect AI agent threats across ChatGPT, Copilot, and Gemini</title>
<link>https://block385.com/exabeam-expands-aba-to-detect-ai-agent-threats-across-chatgpt-copilot-and-gemini</link>
<guid>https://block385.com/exabeam-expands-aba-to-detect-ai-agent-threats-across-chatgpt-copilot-and-gemini</guid>
<description><![CDATA[ Exabeam has announced the expansion of Exabeam Agent Behavior Analytics (ABA). Without direct visibility into how employees use AI assistants, what they query, what data they share, how frequently they interact, and from where, organizations cannot establish a baseline for normal AI behavior, investigate potential misuse, or detect emerging agentic insider threats. New support to detect agent behavior in OpenAI ChatGPT and Microsoft Copilot, alongside existing visibility into Google Gemini, transforms these agentic services into … More →
The post Exabeam expands ABA to detect AI agent threats across ChatGPT, Copilot, and Gemini appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 17:00:29 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Exabeam, expands, ABA, detect, agent, threats, across, ChatGPT, Copilot, and, Gemini</media:keywords>
</item>

<item>
<title>North Korean hackers linked to Axios npm supply chain compromise</title>
<link>https://block385.com/north-korean-hackers-linked-to-axios-npm-supply-chain-compromise</link>
<guid>https://block385.com/north-korean-hackers-linked-to-axios-npm-supply-chain-compromise</guid>
<description><![CDATA[ The software supply chain attack that resulted in the compromise of npm packages of Axios, an extremely popular HTTP client library, is believed to be the work of financially-motivated North Korean attackers. Links to UNC1069 On March 31, 2026, unknown attackers managed to publish two backdoored Axios npm packages after gaining access to a maintainer’s npm account. The malicious versions introduced a hidden dependency containing a post-install script, and this script executed automatically during installation … More →
The post North Korean hackers linked to Axios npm supply chain compromise appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/24203710/north_korea-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 17:00:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>North, Korean, hackers, linked, Axios, npm, supply, chain, compromise</media:keywords>
</item>

<item>
<title>Microsoft Warns of WhatsApp&#45;Delivered VBS Malware Hijacking Windows via UAC Bypass</title>
<link>https://block385.com/microsoft-warns-of-whatsapp-delivered-vbs-malware-hijacking-windows-via-uac-bypass</link>
<guid>https://block385.com/microsoft-warns-of-whatsapp-delivered-vbs-malware-hijacking-windows-via-uac-bypass</guid>
<description><![CDATA[ Microsoft is calling attention to a new campaign that has leveraged WhatsApp messages to distribute malicious Visual Basic Script (VBS) files.
The activity, beginning in late February 2026, leverages these scripts to initiate a multi-stage infection chain for establishing persistence and enabling remote access. It&#039;s currently not known what lures the threat actors use to trick users into ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgq1lOqG2e9eetuSt3ne59NkxH-r0lCjnTmodLlbXt29w5AH_utoClwW1RfvpY5rC7vqb1rVBR4ApELx1ROFvmuMpPpk_9R7tshflL0WwPRuD25vu1gzaFuuldwTzAbcb1m7y7TBsTLr863BQhLHdJGwRUmVzuLayR1gTnkmG_XCraID8EuzUzeeVLtgp7p/s1600/whatsapp-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Warns, WhatsApp-Delivered, VBS, Malware, Hijacking, Windows, via, UAC, Bypass</media:keywords>
</item>

<item>
<title>Block the Prompt, Not the Work: The End of &amp;quot;Doctor No&amp;quot;</title>
<link>https://block385.com/block-the-prompt-not-the-work-the-end-of-doctor-no</link>
<guid>https://block385.com/block-the-prompt-not-the-work-the-end-of-doctor-no</guid>
<description><![CDATA[ There is a character that keeps appearing in enterprise security departments, and most CISOs know exactly who that is. It doesn’t build. It doesn’t enable. Its entire function is to say &quot;No.&quot;
No to ChatGPT.
No to DeepSeek.
No to the file-sharing tool the product team swears by.
For years, this looked like security. But in 2026, &quot;Doctor No&quot; is no longer just a management headache &amp; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvlo2Z4APlfxw_Y81FpX62ySlxihctfAGwiT0WYd1bPrdk5sMFO8w7__xRzVqn9vYqFpE4TSS80iuNQZ9SgcR4Hz8f6WYFhD5OaoRmY-sD20cYox6Tx-_xbhiawEh0cy3YNvv9iD75BIsW5NNA8tafY4inhGtFBer5pan0xjr-vyLZmHyIFHc-LaTNcMZC/s1600/red.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Block, the, Prompt, Not, the, Work:, The, End, Doctor, No</media:keywords>
</item>

<item>
<title>Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures</title>
<link>https://block385.com/casbaneiro-phishing-targets-latin-america-and-europe-using-dynamic-pdf-lures</link>
<guid>https://block385.com/casbaneiro-phishing-targets-latin-america-and-europe-using-dynamic-pdf-lures</guid>
<description><![CDATA[ A multi-pronged phishing campaign is targeting Spanish-speaking users in organizations across Latin America and Europe to deliver Windows banking trojans like Casbaneiro (aka Metamorfo) via another malware called Horabot.
The activity has been attributed to a Brazilian cybercrime threat actor tracked as Augmented Marauder and Water Saci. The e-crime group was first documented by Trend Micro in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpJd0tgZX0EzqjxkNOrJsyGRUV4N21qsJC30j2VYYargUXl2tPz_BidXWWmAG9Wfb5f683WOOle2CElerewagtzAAI8sbcJ9XrCbtgcSRtWF-itSYXH4hbTKvOIrjW9PKSgqi00rOrFCHRWzkWaWmP0qPH0vjrJ2LbbcXgl9aQv3n3tzcT45pdSPMcP54S/s1600/pdf-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Casbaneiro, Phishing, Targets, Latin, America, and, Europe, Using, Dynamic, PDF, Lures</media:keywords>
</item>

<item>
<title>New Chrome Zero&#45;Day CVE&#45;2026&#45;5281 Under Active Exploitation — Patch Released</title>
<link>https://block385.com/new-chrome-zero-day-cve-2026-5281-under-active-exploitation-patch-released</link>
<guid>https://block385.com/new-chrome-zero-day-cve-2026-5281-under-active-exploitation-patch-released</guid>
<description><![CDATA[ Google on Thursday released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild.
The high-severity vulnerability, CVE-2026-5281 (CVSS score: N/A), concerns a use-after-free bug in Dawn, an open-source and cross-platform implementation of the WebGPU standard.
&quot;Use-after-free in Dawn in Google Chrome prior ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyWMOJn1hR_Pua9p7XXWPbTqgrYvXyaNEXlnlLUQ0duD4P-W9fGyvbuprkiN0IMEE5_2vzt5mc603V4l_G5eH5KpKFgmk-lARuEXxcQVIgCNb-NPJghF3wvF9Wf8mF3kEJUY0TA6a3aBDw87MC9RivwM9ZVRfLRpwwNqaP67cU8nvtO8RKGsi5OsFIgSVn/s1600/chrome-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Chrome, Zero-Day, CVE-2026-5281, Under, Active, Exploitation, —, Patch, Released</media:keywords>
</item>

<item>
<title>Google fixes Chrome zero&#45;day with in&#45;the&#45;wild exploit (CVE&#45;2026&#45;5281)</title>
<link>https://block385.com/google-fixes-chrome-zero-day-with-in-the-wild-exploit-cve-2026-5281</link>
<guid>https://block385.com/google-fixes-chrome-zero-day-with-in-the-wild-exploit-cve-2026-5281</guid>
<description><![CDATA[ Google has fixed 21 vulnerabilities affecting its popular Chrome browser, among them a zero-day (CVE-2026-5281) with an in-the-wild exploit. About CVE-2026-5281 As per usual, information about the fixed zero-day is limited, and there’s no details about the exploit (or how/if it’s being used by attackers). CVE-2026-5281’s official description says it’s a use-after-free (UAF) vulnerability in Dawn, an open-source and cross-platform implementation of the WebGPU standard that’s used in Chromium and Chromium-based browsers. The vulnerability affects … More →
The post Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/23114819/google_chrome-3-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 15:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, fixes, Chrome, zero-day, with, in-the-wild, exploit, CVE-2026-5281</media:keywords>
</item>

<item>
<title>The Forgotten Endpoint: Security Risks of Dormant Devices</title>
<link>https://block385.com/the-forgotten-endpoint-security-risks-of-dormant-devices</link>
<guid>https://block385.com/the-forgotten-endpoint-security-risks-of-dormant-devices</guid>
<description><![CDATA[ Technology Talk: That forgotten notebook holds plenty of secrets to enterprise access. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt276c235ceefbedff/68a726ba354427802eb7e425/Headset_on_laptop_(1800)_Brian_Jackson_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Forgotten, Endpoint:, Security, Risks, Dormant, Devices</media:keywords>
</item>

<item>
<title>Are We Training AI Too Late?</title>
<link>https://block385.com/are-we-training-ai-too-late</link>
<guid>https://block385.com/are-we-training-ai-too-late</guid>
<description><![CDATA[ Ask the Expert: Cybersecurity teams need to expand their field of view to include new, unique threat sources, rather than relying on past, proven threat actors. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3e1142f17df77fe0/69ccf95619dc583b9126e8a4/teach-AI-besjunior-AdobeStock_290088902CP.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Are, Training, Too, Late</media:keywords>
</item>

<item>
<title>3 Reasons Attackers Are Using Your Trusted Tools Against You (And Why You Don’t See It Coming)</title>
<link>https://block385.com/3-reasons-attackers-are-using-your-trusted-tools-against-you-and-why-you-dont-see-it-coming</link>
<guid>https://block385.com/3-reasons-attackers-are-using-your-trusted-tools-against-you-and-why-you-dont-see-it-coming</guid>
<description><![CDATA[ For years, cybersecurity has followed a familiar model: block malware, stop the attack. Now, attackers are moving on to what’s next.
Threat actors now use malware less frequently in favor of what’s already inside your environment, including abusing trusted tools, native binaries, and legitimate admin utilities to move laterally, escalate privileges, and persist without raising alarms. Most ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnuThJU5o7fpNxZwlNpyZFxPX9Y7rDp2TF2zUrPTRMhLEcnv7UQfdVgoAJ5gh8-JpgNvnJOG5dbOABLCmemzmYazgTwPTxScbn9vlwlCouNIuKZvmaeE3mcza5ceAfKBfpkbeAUKcOd9eZoBWXgjEvuDAORSPICahRqIz4g0BkwD84YZwB547OHBLsoZs/s1600/main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Reasons, Attackers, Are, Using, Your, Trusted, Tools, Against, You, And, Why, You, Don’t, See, Coming</media:keywords>
</item>

<item>
<title>Egnyte expands Content Cloud with AI Governance and built&#45;in Assistant</title>
<link>https://block385.com/egnyte-expands-content-cloud-with-ai-governance-and-built-in-assistant</link>
<guid>https://block385.com/egnyte-expands-content-cloud-with-ai-governance-and-built-in-assistant</guid>
<description><![CDATA[ Egnyte has announced two major additions to the Egnyte Content Cloud: AI Safeguards, which give organizations granular control over how AI interacts with sensitive content, and an AI Assistant that acts as a built-in collaborator across Egnyte workspaces. AI Safeguards As organizations accelerate AI adoption, ungoverned access to sensitive content by AI systems represents a growing and underappreciated risk. Egnyte’s AI Safeguards addresses this directly by embedding AI controls into the same platform that already … More →
The post Egnyte expands Content Cloud with AI Governance and built-in Assistant appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 11:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Egnyte, expands, Content, Cloud, with, Governance, and, built-in, Assistant</media:keywords>
</item>

<item>
<title>Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069</title>
<link>https://block385.com/google-attributes-axios-npm-supply-chain-attack-to-north-korean-group-unc1069</link>
<guid>https://block385.com/google-attributes-axios-npm-supply-chain-attack-to-north-korean-group-unc1069</guid>
<description><![CDATA[ Google has formally attributed the supply chain compromise of the popular Axios npm package to a financially motivated North Korean threat activity cluster tracked as UNC1069.
&quot;We have attributed the attack to a suspected North Korean threat actor we track as UNC1069,&quot; John Hultquist, chief analyst at Google Threat Intelligence Group (GTIG), told The Hacker News in a statement.
&quot;North Korean ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4u0-_Mq5eI-6nWqV9d-E4BTvsdeDTEcK8Bo7pHnANyD6m8b8d5dPcx86sb1P-PjfLce84hgNF8ja8y2tvnYjlmvE4VGzyvAyGqd6TGOxYei3Oz-F_IvVEDxAvamRe4acysr0FqtfWgbLbDhBQxy6ovy2_V47P2d-1qDZig0pcPPnxTCEGfTzKnUXnJEgU/s1600/axios-northkorea.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Attributes, Axios, npm, Supply, Chain, Attack, North, Korean, Group, UNC1069</media:keywords>
</item>

<item>
<title>Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms</title>
<link>https://block385.com/claude-code-source-leaked-via-npm-packaging-error-anthropic-confirms</link>
<guid>https://block385.com/claude-code-source-leaked-via-npm-packaging-error-anthropic-confirms</guid>
<description><![CDATA[ Anthropic on Tuesday confirmed that internal code for its popular artificial intelligence (AI) coding assistant, Claude Code, had been inadvertently released due to a human error.
&quot;No sensitive customer data or credentials were involved or exposed,&quot; an Anthropic spokesperson said in a statement shared with CNBC News. &quot;This was a release packaging issue caused by human error, not a security ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj39e4BXzk1M6BK7XEJcfogVbdwnYJjie08kNTAeW5T46Tn8UvbbaYGrrEpgw1Pa4IpJYeGe8AR7T_UCp4_vWYTcG-c5DY0HNlHW-8SbYkscVvjAKjKR3gHmlWAQONEx8kg_ANVfOr8OsQ7uTm-XWHW1PNfusxBj-Tn2kn-V2EedPykA3ESB66doPXxGzT8/s1600/claude-code.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Code, Source, Leaked, via, npm, Packaging, Error, Anthropic, Confirms</media:keywords>
</item>

<item>
<title>Mimecast makes enterprise email security deployable in minutes</title>
<link>https://block385.com/mimecast-makes-enterprise-email-security-deployable-in-minutes</link>
<guid>https://block385.com/mimecast-makes-enterprise-email-security-deployable-in-minutes</guid>
<description><![CDATA[ Most organizations running Microsoft 365 rely on native email controls as their primary line of defense. According to Mimecast research, 38% of organizations depend exclusively on those native controls for collaboration security, and 64% say those controls are insufficient against the threat landscape. Ranjan Singh, Chief Product and Technology Officer at Mimecast, outlines how the company’s API-based approach delivers protection on par with a traditional Secure Email Gateway without requiring infrastructure changes, and why that … More →
The post Mimecast makes enterprise email security deployable in minutes appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/31081147/ranjan_singh-2-mimecast.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 09:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mimecast, makes, enterprise, email, security, deployable, minutes</media:keywords>
</item>

<item>
<title>Malware detectors trained on one dataset often stumble on another</title>
<link>https://block385.com/malware-detectors-trained-on-one-dataset-often-stumble-on-another</link>
<guid>https://block385.com/malware-detectors-trained-on-one-dataset-often-stumble-on-another</guid>
<description><![CDATA[ Machine learning models built to catch malware on Windows systems are typically evaluated on data that closely resembles their training set. In practice, the malware arriving on enterprise endpoints looks different, comes from different sources, and in many cases has been deliberately obfuscated to evade detection. A study from researchers at the Polytechnic of Porto tests what happens when that gap is made explicit, and the results have direct implications for organizations relying on static … More →
The post Malware detectors trained on one dataset often stumble on another appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/07/09065945/eyes.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 07:00:20 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Malware, detectors, trained, one, dataset, often, stumble, another</media:keywords>
</item>

<item>
<title>Financial groups lay out a plan to fight AI identity attacks</title>
<link>https://block385.com/financial-groups-lay-out-a-plan-to-fight-ai-identity-attacks</link>
<guid>https://block385.com/financial-groups-lay-out-a-plan-to-fight-ai-identity-attacks</guid>
<description><![CDATA[ Generative AI tools have brought the cost of deepfake production low enough that criminals and state-sponsored actors now use them routinely against financial institutions. A joint paper from the American Bankers Association, the Better Identity Coalition, and the Financial Services Sector Coordinating Council lays out the scale of the problem and calls on federal and state policymakers to act across various areas. Deepfake incidents in the fintech sector increased 700% in 2023 compared to 2022. … More →
The post Financial groups lay out a plan to fight AI identity attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/28162754/face-glitch-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 07:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Financial, groups, lay, out, plan, fight, identity, attacks</media:keywords>
</item>

<item>
<title>Axios NPM Package Compromised in Precision Attack</title>
<link>https://block385.com/axios-npm-package-compromised-in-precision-attack</link>
<guid>https://block385.com/axios-npm-package-compromised-in-precision-attack</guid>
<description><![CDATA[ The NPM package for Axios, a popular JavaScript HTTP client library, was briefly compromised this week, possibly by North Korean threat actors. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt284d08f3234710b6/69cc29efc0030f6e262faa34/bullseye_chris_brignell_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 01:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Axios, NPM, Package, Compromised, Precision, Attack</media:keywords>
</item>

<item>
<title>Crypto industry may be running out of time to prepare for quantum attacks</title>
<link>https://block385.com/crypto-industry-may-be-running-out-of-time-to-prepare-for-quantum-attacks</link>
<guid>https://block385.com/crypto-industry-may-be-running-out-of-time-to-prepare-for-quantum-attacks</guid>
<description><![CDATA[ Google’s latest research suggests the cryptocurrency industry may have less time than expected to prepare for quantum computing. In a whitepaper, Google examines risks to elliptic curve cryptography, the system securing most blockchain networks. The researchers revisit earlier assumptions about how difficult it would be for a quantum computer to break these protections, concluding that the required resources may be lower than previously estimated. “To share this research responsibly, we engaged with the U.S. government … More →
The post Crypto industry may be running out of time to prepare for quantum attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/06/17145137/quantum_computing-1500-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 23:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Crypto, industry, may, running, out, time, prepare, for, quantum, attacks</media:keywords>
</item>

<item>
<title>Google&amp;apos;s Vertex AI Has an Over&#45;Privileged Problem</title>
<link>https://block385.com/googles-vertex-ai-has-an-over-privileged-problem</link>
<guid>https://block385.com/googles-vertex-ai-has-an-over-privileged-problem</guid>
<description><![CDATA[ Palo Alto researchers show how attackers could exploit AI agents on Google&#039;s Vertex AI to steal data and break into restricted cloud infrastructure. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4e41a8645f65857e/69cc23a696a9929cb14154a7/agent_Krot_Studio_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Googles, Vertex, Has, Over-Privileged, Problem</media:keywords>
</item>

<item>
<title>TeamPCP Breaches Cloud, SaaS Instances With Stolen Credentials</title>
<link>https://block385.com/teampcp-breaches-cloud-saas-instances-with-stolen-credentials</link>
<guid>https://block385.com/teampcp-breaches-cloud-saas-instances-with-stolen-credentials</guid>
<description><![CDATA[ The threat group&#039;s shift to speedy attacks on AWS, Azure, and SaaS instances shows organizations need to respond quickly to compromised credentials. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc0adc75ba38320bc/69cc20666d4b6c62a6224f3a/cloud_RanczAndrei_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TeamPCP, Breaches, Cloud, SaaS, Instances, With, Stolen, Credentials</media:keywords>
</item>

<item>
<title>Android Developer Verification Rollout Begins Ahead of September Enforcement</title>
<link>https://block385.com/android-developer-verification-rollout-begins-ahead-of-september-enforcement</link>
<guid>https://block385.com/android-developer-verification-rollout-begins-ahead-of-september-enforcement</guid>
<description><![CDATA[ Google on Monday said it&#039;s officially rolling out Android developer verification to all developers to combat the problem of bad actors distributing harmful apps while &quot;hiding behind anonymity.&quot;
The development comes ahead of a planned verification mandate that goes into effect in Brazil, Indonesia, Singapore, and Thailand this September, before it expands globally next year.
As part of this ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipVNIw-uYi9MySm3LytKQD-PQgAh4NdQleZDyr_EC4zBRuNzOf2qjlvwgPMg8qsq1sopzgKv1gOlJuQCEs9dq8jwQVdonLibQPm_hJX8ZzOwfgyF6cuoixyotcpY-CvQp3E8fBAzqDRbWmfaCzuc96CH5FwzH7FJaaiVgYjgoC-x6RZOlgfHxFuwqQeq7G/s1600/android-dev.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 22:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Android, Developer, Verification, Rollout, Begins, Ahead, September, Enforcement</media:keywords>
</item>

<item>
<title>TrueConf Zero&#45;Day Exploited in Attacks on Southeast Asian Government Networks</title>
<link>https://block385.com/trueconf-zero-day-exploited-in-attacks-on-southeast-asian-government-networks</link>
<guid>https://block385.com/trueconf-zero-day-exploited-in-attacks-on-southeast-asian-government-networks</guid>
<description><![CDATA[ A high-severity security flaw in the TrueConf client video conferencing software has been exploited in the wild as a zero-day as part of a campaign targeting government entities in Southeast Asia dubbed TrueChaos.
The vulnerability in question is CVE-2026-3502 (CVSS score: 7.8), a lack of integrity check when fetching application update code, allowing an attacker to distribute a tampered update, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYf7jS0dDRAhfWGLbRiA4eQt-Q3BL8gcG_bDoNQ1dfcZt3Ike4qAlE9lUiSH__y3kdi-MI2kfu-O-PdDf6iCov7VIVBPEkRVJOhx88uNgXTuI-rztvbwFXE9BKwJEsNSKux0yynwxlsDMCzCwyngLOSxWTAZjDFYKvpjyEsnPbRYbGtmC6zGmrMpP-SnqA/s1600/trueconf.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 20:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TrueConf, Zero-Day, Exploited, Attacks, Southeast, Asian, Government, Networks</media:keywords>
</item>

<item>
<title>DoControl provides security coverage for Google Gemini Gems</title>
<link>https://block385.com/docontrol-provides-security-coverage-for-google-gemini-gems</link>
<guid>https://block385.com/docontrol-provides-security-coverage-for-google-gemini-gems</guid>
<description><![CDATA[ DoControl announced new capabilities that provide visibility, monitoring, and automated control for Google Gemini Gems, a newly introduced feature within Google Gemini that enables teams to create customizable AI GPTs. With this launch, DoControl is the first platform to provide comprehensive security coverage for Google Gemini Gems, ensuring organizations can safely adopt this new technology without compromising control over their data. Addressing the next wave of AI security risk Google Gemini Gems are customizable GPTs … More →
The post DoControl provides security coverage for Google Gemini Gems appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:34 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DoControl, provides, security, coverage, for, Google, Gemini, Gems</media:keywords>
</item>

<item>
<title>Codenotary AgentMon monitors agentic AI activity and behavior</title>
<link>https://block385.com/codenotary-agentmon-monitors-agentic-ai-activity-and-behavior</link>
<guid>https://block385.com/codenotary-agentmon-monitors-agentic-ai-activity-and-behavior</guid>
<description><![CDATA[ Codenotary launched AgentMon, an enterprise-grade monitoring designed specifically for agentic networks, providing organizations with real-time visibility into the security, performance and cost of AI-driven agents operating across the enterprise. As adoption of AI accelerates, agentic systems, semi-autonomous software agents that act on behalf of users and applications, are becoming embedded across business operations. The market for AI agents expected to grow at a 45% CAGR over the next five years, reports consulting firm BCG. AgentMon … More →
The post Codenotary AgentMon monitors agentic AI activity and behavior appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Codenotary, AgentMon, monitors, agentic, activity, and, behavior</media:keywords>
</item>

<item>
<title>Amazon sends AI agents into pen testing and DevOps</title>
<link>https://block385.com/amazon-sends-ai-agents-into-pen-testing-and-devops</link>
<guid>https://block385.com/amazon-sends-ai-agents-into-pen-testing-and-devops</guid>
<description><![CDATA[ Amazon’s latest AI capabilities bring on-demand penetration testing through the AWS Security Agent, alongside the AWS DevOps Agent. “These agents are changing the way we secure and operate software. AWS Security Agent compresses penetration testing timelines from 2-6 weeks to 1-2 days. AWS DevOps agent gives teams 3–5x faster incident resolution so they can spend less time on incident resolution and more time innovating”, said Swami Sivasubramanian, VP, AI Amazon Web Services. AWS Security Agent … More →
The post Amazon sends AI agents into pen testing and DevOps appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/12/09102531/aws-1500-key2.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:22 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Amazon, sends, agents, into, pen, testing, and, DevOps</media:keywords>
</item>

<item>
<title>Pondurance MDR Essentials uses autonomous SOC to tackle AI&#45;driven attacks</title>
<link>https://block385.com/pondurance-mdr-essentials-uses-autonomous-soc-to-tackle-ai-driven-attacks</link>
<guid>https://block385.com/pondurance-mdr-essentials-uses-autonomous-soc-to-tackle-ai-driven-attacks</guid>
<description><![CDATA[ Pondurance announced MDR Essentials, MDR Essentials, an MDR service providing an autonomous SOC that reduces the time from threat detection to containment by 90%. Threat actors today use AI to attack at machine-speed, making it difficult for traditional cybersecurity solutions to accurately detect and contain cyber threats before they can become breaches. A recent paper from PwC notes that “in AI-driven SOCs, threats can be blocked in seconds, autonomously.” Pondurance’s MDR Essentials with the Kanati … More →
The post Pondurance MDR Essentials uses autonomous SOC to tackle AI-driven attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Pondurance, MDR, Essentials, uses, autonomous, SOC, tackle, AI-driven, attacks</media:keywords>
</item>

<item>
<title>AI and Quantum Are Forcing a Rethink of Digital Trust</title>
<link>https://block385.com/ai-and-quantum-are-forcing-a-rethink-of-digital-trust</link>
<guid>https://block385.com/ai-and-quantum-are-forcing-a-rethink-of-digital-trust</guid>
<description><![CDATA[ In a conversation with Dark Reading’s Terry Sweeney, DigiCert CEO Amit Sinha explains how AI-driven identities and quantum threats are reshaping the foundations of digital trust. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>and, Quantum, Are, Forcing, Rethink, Digital, Trust</media:keywords>
</item>

<item>
<title>AI&#45;Driven Code Surge Is Forcing a Rethink of AppSec</title>
<link>https://block385.com/ai-driven-code-surge-is-forcing-a-rethink-of-appsec</link>
<guid>https://block385.com/ai-driven-code-surge-is-forcing-a-rethink-of-appsec</guid>
<description><![CDATA[ In a conversation with Dark Reading’s Terry Sweeney, Black Duck CEO Jason Schmitt explains how AI is reshaping application security and why it must evolve to keep pace. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AI-Driven, Code, Surge, Forcing, Rethink, AppSec</media:keywords>
</item>

<item>
<title>Iran Deploys &amp;apos;Pseudo&#45;Ransomware,&amp;apos; Revives Pay2Key Operations</title>
<link>https://block385.com/iran-deploys-pseudo-ransomware-revives-pay2key-operations</link>
<guid>https://block385.com/iran-deploys-pseudo-ransomware-revives-pay2key-operations</guid>
<description><![CDATA[ Iranian APTs are blurring the lines between state-sponsored and cybercriminal activities to target high-impact US organizations. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltea953d17d8a9625a/69cb9dbb871fcd599c9b5bc4/muhammadtoqeer-iran-cyber-flag-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Iran, Deploys, Pseudo-Ransomware, Revives, Pay2Key, Operations</media:keywords>
</item>

<item>
<title>Rethinking Vulnerability Management Strategies for Mid&#45;Market Security</title>
<link>https://block385.com/rethinking-vulnerability-management-strategies-for-mid-market-security</link>
<guid>https://block385.com/rethinking-vulnerability-management-strategies-for-mid-market-security</guid>
<description><![CDATA[ Intruder&#039;s Chris Wallis argues mid-market teams should prioritize CVE remediation speed over vulnerability counts, while expanding defenses beyond CVEs to include attack surface management. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Rethinking, Vulnerability, Management, Strategies, for, Mid-Market, Security</media:keywords>
</item>

<item>
<title>Android developers just got a new verification layer</title>
<link>https://block385.com/android-developers-just-got-a-new-verification-layer</link>
<guid>https://block385.com/android-developers-just-got-a-new-verification-layer</guid>
<description><![CDATA[ To help prevent malicious actors from spreading harmful apps while hiding behind anonymity, Google is rolling out developer verification to all Android developers. The company is also introducing app registration, which links apps to verified developer identities. Developers can still choose where to distribute their apps (Source: Google) Developers can begin completing verification now through the Android Developer Console and Play Console, ahead of user-facing changes scheduled for later this year. Developers who distribute apps … More →
The post Android developers just got a new verification layer appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/31115330/android-verification.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:01:35 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Android, developers, just, got, new, verification, layer</media:keywords>
</item>

<item>
<title>Axios npm packages backdoored in supply chain attack</title>
<link>https://block385.com/axios-npm-packages-backdoored-in-supply-chain-attack</link>
<guid>https://block385.com/axios-npm-packages-backdoored-in-supply-chain-attack</guid>
<description><![CDATA[ An unknown attacker has compromised the GitHub and npm accounts of the main developer of Axios, a widely used HTTP client library, and published npm packages backdoored with a malicious dependency that triggered the installation of droppers and remote access trojans. How the attack unfolded On March 30, 2026, with an account using a separate throwaway ProtonMail address, the attacker published on NPM a trojanized copy of the popular crypto-js JavaScript library of crypto standards. … More →
The post Axios npm packages backdoored in supply chain attack appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/09082404/npm-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:01:31 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Axios, npm, packages, backdoored, supply, chain, attack</media:keywords>
</item>

<item>
<title>Apple counters ClickFix attacks with macOS Terminal warning</title>
<link>https://block385.com/apple-counters-clickfix-attacks-with-macos-terminal-warning</link>
<guid>https://block385.com/apple-counters-clickfix-attacks-with-macos-terminal-warning</guid>
<description><![CDATA[ Apple has added a new security feature in macOS Tahoe 26.4 that warns users before they enter commands in Terminal that could cause harm. The goal is to stop ClickFix attacks, a social engineering trick that gets users to run malicious commands themselves. According to ESET, ClickFix activity jumped by more than 500% in the first half of 2025, making it the second-most common attack vector after phishing. The ClickFix tactic takes its name from … More →
The post Apple counters ClickFix attacks with macOS Terminal warning appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/20114620/apple2.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:01:26 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, counters, ClickFix, attacks, with, macOS, Terminal, warning</media:keywords>
</item>

<item>
<title>Windows 11 gets a rebuilt console engine with regex search, Sixel images and a 10x speed boost</title>
<link>https://block385.com/windows-11-gets-a-rebuilt-console-engine-with-regex-search-sixel-images-and-a-10x-speed-boost</link>
<guid>https://block385.com/windows-11-gets-a-rebuilt-console-engine-with-regex-search-sixel-images-and-a-10x-speed-boost</guid>
<description><![CDATA[ Microsoft released Windows 11 Insider Preview Build 29558.1000 to the Canary Channel, part of the optional 29500 build series. The build carries a set of changes focused on the Windows Console, a handful of bug fixes, and small improvements to Settings and disk utilities. A rebuilt console The bulk of this build centers on the Windows Console, which is part of the open-source Windows Terminal project on GitHub. Microsoft is pulling accumulated contributions from that … More →
The post Windows 11 gets a rebuilt console engine with regex search, Sixel images and a 10x speed boost appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/31144435/windows11-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:01:18 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Windows, gets, rebuilt, console, engine, with, regex, search, Sixel, images, and, 10x, speed, boost</media:keywords>
</item>

<item>
<title>Download: 2026 SANS Identity Threats &amp;amp; Defenses Survey</title>
<link>https://block385.com/download-2026-sans-identity-threats-defenses-survey</link>
<guid>https://block385.com/download-2026-sans-identity-threats-defenses-survey</guid>
<description><![CDATA[ New research from the 2026 SANS Identity Threats &amp; Defenses Survey shows that 55% of organizations experienced an identity-related compromise last year, while 26% reported MFA fatigue as a factor in identity attacks. Download the report to learn: Why identity compromises remain common How attackers abuse authentication systems using valid credentials Where organizations struggle to detect and contain identity threats Download the full report to see how identity attacks are evolving.
The post Download: 2026 SANS Identity Threats &amp; Defenses Survey appeared first on Help Net Security. ]]></description>
<enclosure url="https://resources.enzoic.com/hs-fs/hubfs/SANS-1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:01:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Download:, 2026, SANS, Identity, Threats, Defenses, Survey</media:keywords>
</item>

<item>
<title>New Bitdefender assessment helps organizations identify and eliminate hidden internal attack paths</title>
<link>https://block385.com/new-bitdefender-assessment-helps-organizations-identify-and-eliminate-hidden-internal-attack-paths</link>
<guid>https://block385.com/new-bitdefender-assessment-helps-organizations-identify-and-eliminate-hidden-internal-attack-paths</guid>
<description><![CDATA[ Bitdefender has announced the Bitdefender Internal Attack Surface Assessment, a complimentary evaluation that helps organizations identify and reduce hidden internal cyber risks caused by unnecessary user access to applications, tools, and operating system utilities commonly exploited in attacks. The assessment provides organizations with a data-driven view of their internal attack surface and offers actionable guidance to help prioritize and remediate exposure. Businesses face growing challenges defending against Living-Off-the-Land (LOTL), fileless, and other non-malware attack techniques, … More →
The post New Bitdefender assessment helps organizations identify and eliminate hidden internal attack paths appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:00:54 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Bitdefender, assessment, helps, organizations, identify, and, eliminate, hidden, internal, attack, paths</media:keywords>
</item>

<item>
<title>Hacker stripped more than $50 million from Uranium crypto exchange, spent it on trading cards</title>
<link>https://block385.com/hacker-stripped-more-than-50-million-from-uranium-crypto-exchange-spent-it-on-trading-cards</link>
<guid>https://block385.com/hacker-stripped-more-than-50-million-from-uranium-crypto-exchange-spent-it-on-trading-cards</guid>
<description><![CDATA[ US prosecutors have charged a Maryland man in connection with two hacks of the Uranium Finance cryptocurrency exchange that led to losses exceeding $50 million. Jonathan Spalletta, also known as “Cthulhon” and “Jspalletta,” is accused of abusing vulnerabilities in Uranium Finance smart contracts to siphon assets from the platform. If convicted, he could face up to 10 years in prison for computer fraud and 20 years for money laundering. “As alleged, Jonathan Spalletta repeatedly hacked … More →
The post Hacker stripped more than $50 million from Uranium crypto exchange, spent it on trading cards appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/16112525/crypto_scams.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:00:41 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hacker, stripped, more, than, 50, million, from, Uranium, crypto, exchange, spent, trading, cards</media:keywords>
</item>

<item>
<title>Foxit flags hidden security risks in PDFs with new tool</title>
<link>https://block385.com/foxit-flags-hidden-security-risks-in-pdfs-with-new-tool</link>
<guid>https://block385.com/foxit-flags-hidden-security-risks-in-pdfs-with-new-tool</guid>
<description><![CDATA[ Foxit Software introduced a new capability designed to uncover hidden security risks inside PDFs as part of its latest PDF Editor 2026.1 release for Windows and macOS. The update is led by PDF Action Inspector, a new tool that proactively scans documents for embedded JavaScript and self-modifying behaviors — threats that can bypass redaction, expose sensitive data, or alter document output without detection. As organizations rely on PDFs to share critical infrastructure, these risks have … More →
The post Foxit flags hidden security risks in PDFs with new tool appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:00:26 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Foxit, flags, hidden, security, risks, PDFs, with, new, tool</media:keywords>
</item>

<item>
<title>EvilTokens ramps up device code phishing targeting Microsoft 365 users</title>
<link>https://block385.com/eviltokens-ramps-up-device-code-phishing-targeting-microsoft-365-users</link>
<guid>https://block385.com/eviltokens-ramps-up-device-code-phishing-targeting-microsoft-365-users</guid>
<description><![CDATA[ Security researchers report a notable increase in device code phishing activity aimed at Microsoft 365 users, and have attributed this rise to the availability of EvilTokens, a new, specialized phishing toolkit that’s being offered as-a-service via Telegram. What is device code phishing? Device code phishing is a type of attack where attackers trick users into logging into their account by using a real authentication flow, then steal their access and refresh tokens. Microsoft provides the … More →
The post EvilTokens ramps up device code phishing targeting Microsoft 365 users appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/08/08143621/microsoft-365-phishing.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>EvilTokens, ramps, device, code, phishing, targeting, Microsoft, 365, users</media:keywords>
</item>

<item>
<title>Black Hat USA</title>
<link>https://block385.com/black-hat-usa</link>
<guid>https://block385.com/black-hat-usa</guid>
<description><![CDATA[  ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt89877e9bb04a9e15/69c6ee0e1eae740fa6bfca88/623600_BHUS26_Web_Ads_One_Liner_300x250.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Black, Hat, USA</media:keywords>
</item>

<item>
<title>Vertex AI Vulnerability Exposes Google Cloud Data and Private Artifacts</title>
<link>https://block385.com/vertex-ai-vulnerability-exposes-google-cloud-data-and-private-artifacts</link>
<guid>https://block385.com/vertex-ai-vulnerability-exposes-google-cloud-data-and-private-artifacts</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed a security &quot;blind spot&quot; in Google Cloud&#039;s Vertex AI platform that could allow artificial intelligence (AI) agents to be weaponized by an attacker to gain unauthorized access to sensitive data and compromise an organization&#039;s cloud environment.
According to Palo Alto Networks Unit 42, the issue relates to how the Vertex AI permission model can be misused ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLtnrJRJvkUE-IMtV6DuDmg7t1XhaGyItG6cXmd2cz0-3sd8fgZi5jHZE9valO1-CdJjGcqkkeHxNPM2Y7lLK0lrtJXOEwXscylBbYfyCXtvvAfGeFR5Q7Zwv0Mxsg-iiEjbaN2junJWYJmJmUEBuFDjRXH_X9gYYwR4Jyu-79dMfL1MQPLpKU6O6PtN_R/s1600/google-vertex.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 16:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vertex, Vulnerability, Exposes, Google, Cloud, Data, and, Private, Artifacts</media:keywords>
</item>

<item>
<title>The AI Arms Race – Why Unified Exposure Management Is Becoming a Boardroom Priority</title>
<link>https://block385.com/the-ai-arms-race-why-unified-exposure-management-is-becoming-a-boardroom-priority</link>
<guid>https://block385.com/the-ai-arms-race-why-unified-exposure-management-is-becoming-a-boardroom-priority</guid>
<description><![CDATA[ The cybersecurity landscape is accelerating at an unprecedented rate. What is emerging is not simply a rise in the number of vulnerabilities or tools, but a dramatic increase in speed. Speed of attack, speed of exploitation, and speed of change across modern environments.
This is the defining challenge of the new era of digital warfare: the weaponization of Artificial Intelligence. Threat actors ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1pgefAVGqPo1F0pVFtbxdewmfgaNvrqH-R-BydTTpenzbOZGvoJMA7wwiXzhDBcxvhEm91tK9CsPBiB24g7WHylYCzuO8XI9tCraDla-ePrNFsli1YYrtjQr6dxN7mQHbuw57EtS1mrUeS3GfNYCuM-7s1MDbW5oUS2tY0kkV8_TNP3jDKPPgUXSJTr8/s1600/ai-power.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 16:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Arms, Race, –, Why, Unified, Exposure, Management, Becoming, Boardroom, Priority</media:keywords>
</item>

<item>
<title>Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains</title>
<link>https://block385.com/silver-fox-expands-asia-cyber-campaign-with-atlascross-rat-and-fake-domains</link>
<guid>https://block385.com/silver-fox-expands-asia-cyber-campaign-with-atlascross-rat-and-fake-domains</guid>
<description><![CDATA[ Chinese-speaking users are the target of an active campaign that uses typosquatted domains impersonating trusted software brands to deliver a previously undocumented remote access trojan named AtlasCross RAT.
&quot;The operation covers VPN clients, encrypted messengers, video conferencing tools, cryptocurrency trackers, and e-commerce applications, with eleven confirmed delivery domains impersonating ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgQmoJ2iwUTLR-DicdD0xa7_oYXgpGalL3L_-4LyX9YMApiotQC-omFlhdcQByUQat1YJdd7ElMqhp8FDYpoaljcvVmCFPXS4yRRh0_KnKa6FgqoEpiaKHJhoecKKap1MgoPWw1a6H7LfJrYo9m_YXqh3BaoES1tPEmuCbgO3snV34jtkrK7j8t4Qk30jj/s1600/cyberattacks-asia.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 16:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Silver, Fox, Expands, Asia, Cyber, Campaign, with, AtlasCross, RAT, and, Fake, Domains</media:keywords>
</item>

<item>
<title>Google Drive now detects ransomware and helps restore affected files</title>
<link>https://block385.com/google-drive-now-detects-ransomware-and-helps-restore-affected-files</link>
<guid>https://block385.com/google-drive-now-detects-ransomware-and-helps-restore-affected-files</guid>
<description><![CDATA[ To help organizations minimize the impact of malware attacks on personal computers, Google launched ransomware detection and file restoration in beta in September 2025. These features are now generally available. End user alert in Drive for desktop when ransomware is detected (Source: Google) “Compared to the beta version, we can now detect more types of ransomware encryption and do so faster. Our latest AI model detects 14× more infections, providing broader protection,” the company said … More →
The post Google Drive now detects ransomware and helps restore affected files appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/31093230/google-drive-ransomware-recovery.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 13:00:45 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Drive, now, detects, ransomware, and, helps, restore, affected, files</media:keywords>
</item>

<item>
<title>Rspamd 4.0.0 ships memory savings, a new scan protocol, and a required migration step</title>
<link>https://block385.com/rspamd-400-ships-memory-savings-a-new-scan-protocol-and-a-required-migration-step</link>
<guid>https://block385.com/rspamd-400-ships-memory-savings-a-new-scan-protocol-and-a-required-migration-step</guid>
<description><![CDATA[ The open-source spam filtering platform Rspamd released version 4.0.0, delivering infrastructure changes across its scan protocol, memory model, hash storage, and configuration system. Several of the changes are breaking, and at least one requires a migration step before upgrade. A new scan protocol The release introduces a /checkv3 endpoint that replaces HTTP headers with structured JSON or msgpack for metadata transport. The new endpoint uses multipart/form-data for requests and multipart/mixed for responses, supports per-part zstd … More →
The post Rspamd 4.0.0 ships memory savings, a new scan protocol, and a required migration step appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/10/02095747/rspamd-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 13:00:32 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Rspamd, 4.0.0, ships, memory, savings, new, scan, protocol, and, required, migration, step</media:keywords>
</item>

<item>
<title>Intel puts its data center performance knowledge on GitHub</title>
<link>https://block385.com/intel-puts-its-data-center-performance-knowledge-on-github</link>
<guid>https://block385.com/intel-puts-its-data-center-performance-knowledge-on-github</guid>
<description><![CDATA[ Intel engineers have published a centralized repository of data center performance knowledge on GitHub, giving practitioners direct access to tuning guides, configuration recommendations, and optimization recipes that previously required hunting across forums and scattered documentation. The repository, called Optimization Zone, is open-source and publicly accessible at GitHub. It covers software, workloads, performance analysis tools, and hardware configurations for Intel architectures. Built from customer feedback Intel engineers say the content grew from recurring questions and problems … More →
The post Intel puts its data center performance knowledge on GitHub appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/31120620/intel-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 13:00:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Intel, puts, its, data, center, performance, knowledge, GitHub</media:keywords>
</item>

<item>
<title>Axios Supply Chain Attack Pushes Cross&#45;Platform RAT via Compromised npm Account</title>
<link>https://block385.com/axios-supply-chain-attack-pushes-cross-platform-rat-via-compromised-npm-account</link>
<guid>https://block385.com/axios-supply-chain-attack-pushes-cross-platform-rat-via-compromised-npm-account</guid>
<description><![CDATA[ The popular HTTP client known as Axios has suffered a supply chain attack after two newly published versions of the npm package introduced a malicious dependency.
Versions 1.14.1 and 0.30.4 of Axios have been found to inject &quot;plain-crypto-js&quot; version 4.2.1 as a fake dependency.
According to StepSecurity, the two versions were published using the compromised npm credentials of the primary Axios ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdY8iKA7o-K-4HkIjPMiBRWAn5vCvSNDu1sm09t10vWMzXO6cIblLHQyu1no-KBhq4W7EWS03zqvI4n_k9mYWCDsCVoiX4cwsV9T862WTq1yGb6VkX1ZGTa7MKZE43llbF9n2Py1mC2yhCIfRlXGkvya_NQ9lX7vZ32YW8pHZlw1dPZcI9eCrgysiWqSSR/s1600/Axios-attack.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Axios, Supply, Chain, Attack, Pushes, Cross-Platform, RAT, via, Compromised, npm, Account</media:keywords>
</item>

<item>
<title>The art of making technical risk make sense to executives</title>
<link>https://block385.com/the-art-of-making-technical-risk-make-sense-to-executives</link>
<guid>https://block385.com/the-art-of-making-technical-risk-make-sense-to-executives</guid>
<description><![CDATA[ In this Help Net Security video, Jay Miller, CISO at Paessler, explains how security leaders can communicate technical risk to executives and board members in terms they understand. The focus is on business impact: financial loss, compliance fines, reputation damage, and productivity. Miller walks through three principles: describe impact in plain language, come prepared with data and a clear narrative, and be transparent about what happened and what still needs fixing. He uses real examples, … More →
The post The art of making technical risk make sense to executives appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/01/16143628/ciso-1500-3.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 09:00:25 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, art, making, technical, risk, make, sense, executives</media:keywords>
</item>

<item>
<title>Why I’m done calling humans the weakest link</title>
<link>https://block385.com/why-im-done-calling-humans-the-weakest-link</link>
<guid>https://block385.com/why-im-done-calling-humans-the-weakest-link</guid>
<description><![CDATA[ Cybersecurity has long suffered from a people problem, but not in the way we often hear about. As industry that is based on enabling communication across the globe via the internet and many types of devices, many of us practitioners are very bad at communicating to people. A primary example is the phrase “humans are the weakest link” which is well known phrase in our industry. This phrase implies that if it were not for … More →
The post Why I’m done calling humans the weakest link appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/02154535/identity-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 09:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, I’m, done, calling, humans, the, weakest, link</media:keywords>
</item>

<item>
<title>Cybersecurity jobs available right now: March 31, 2026</title>
<link>https://block385.com/cybersecurity-jobs-available-right-now-march-31-2026</link>
<guid>https://block385.com/cybersecurity-jobs-available-right-now-march-31-2026</guid>
<description><![CDATA[ Android Malware Research Director Alice | Israel | On-site – View job details As an Android Malware Research Director, you will establish operational processes, workflows, and quality standards for the team, while integrating the function into existing infrastructure. You will act as the primary client interface, managing relationships, presenting research findings, and ensuring client satisfaction. Cloud Information Security Engineer HedgeServ | Ireland | Hybrid – View job details As a Cloud Information Security Engineer, you … More →
The post Cybersecurity jobs available right now: March 31, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11140410/cybersecurity_jobs-4-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 07:00:23 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybersecurity, jobs, available, right, now:, March, 31, 2026</media:keywords>
</item>

<item>
<title>Hottest cybersecurity open&#45;source tools of the month: March 2026</title>
<link>https://block385.com/hottest-cybersecurity-open-source-tools-of-the-month-march-2026</link>
<guid>https://block385.com/hottest-cybersecurity-open-source-tools-of-the-month-march-2026</guid>
<description><![CDATA[ Presented here is a curated selection of noteworthy open-source cybersecurity solutions that have drawn recognition for their ability to enhance security postures across diverse settings. BlacksmithAI: Open-source AI-powered penetration testing framework BlacksmithAI is an open-source penetration testing framework that uses multiple AI agents to execute different stages of a security assessment lifecycle. BlacksmithAI runs as a hierarchical system in which an orchestrator coordinates task execution across specialized agents. mquire: Open-source Linux memory forensics tool Linux … More →
The post Hottest cybersecurity open-source tools of the month: March 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/09/09085108/open-source_cybersec_tools-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 07:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hottest, cybersecurity, open-source, tools, the, month:, March, 2026</media:keywords>
</item>

<item>
<title>AI&#45;Powered &amp;apos;DeepLoad&amp;apos; Malware Steals Credentials, Evades Detection</title>
<link>https://block385.com/ai-powered-deepload-malware-steals-credentials-evades-detection</link>
<guid>https://block385.com/ai-powered-deepload-malware-steals-credentials-evades-detection</guid>
<description><![CDATA[ The massive amount of junk code that hides the malware&#039;s logic from security scans was almost certainly generated by AI, researchers say. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd7991d1fb5c4ce7a/69cadd3f7edf53802a560b21/obfuscate_Grenar_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 01:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AI-Powered, DeepLoad, Malware, Steals, Credentials, Evades, Detection</media:keywords>
</item>

<item>
<title>F5 BIG&#45;IP Vulnerability Reclassified as RCE, Under Exploitation</title>
<link>https://block385.com/f5-big-ip-vulnerability-reclassified-as-rce-under-exploitation</link>
<guid>https://block385.com/f5-big-ip-vulnerability-reclassified-as-rce-under-exploitation</guid>
<description><![CDATA[ CVE-2025-53521 was initially disclosed in October as a high-severity denial-of-service (DoS) flaw, but new information has revealed the bug is actually much more dangerous. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt785465f8bc714950/69caef686b45b775670507cc/f5_SOPAImagesLimited_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 01:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>BIG-IP, Vulnerability, Reclassified, RCE, Under, Exploitation</media:keywords>
</item>

<item>
<title>Fortinet BIG&#45;IP Vulnerability Reclassified as RCE, Under Exploitation</title>
<link>https://block385.com/fortinet-big-ip-vulnerability-reclassified-as-rce-under-exploitation</link>
<guid>https://block385.com/fortinet-big-ip-vulnerability-reclassified-as-rce-under-exploitation</guid>
<description><![CDATA[ CVE-2025-53521 was initially disclosed in October as a high-severity denial-of-service (DoS) flaw, but new information has revealed the bug is actually much more dangerous. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt73055c0402a34817/69cac108ccfbe565fcf46617/fortinet_DannyNebraska_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 23:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fortinet, BIG-IP, Vulnerability, Reclassified, RCE, Under, Exploitation</media:keywords>
</item>

<item>
<title>Manufacturing and Healthcare Share Struggles with Passwords</title>
<link>https://block385.com/manufacturing-and-healthcare-share-struggles-with-passwords</link>
<guid>https://block385.com/manufacturing-and-healthcare-share-struggles-with-passwords</guid>
<description><![CDATA[ The two key economic sectors struggle with security for a reason: Many insiders view access management as a roadblock, while attackers see it as a way in. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltfeef2e04a3809da9/69caa596264d1e7cab110238/2BXKGWT.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 23:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Manufacturing, and, Healthcare, Share, Struggles, with, Passwords</media:keywords>
</item>

<item>
<title>OpenAI Patches ChatGPT Data Exfiltration Flaw and Codex GitHub Token Vulnerability</title>
<link>https://block385.com/openai-patches-chatgpt-data-exfiltration-flaw-and-codex-github-token-vulnerability</link>
<guid>https://block385.com/openai-patches-chatgpt-data-exfiltration-flaw-and-codex-github-token-vulnerability</guid>
<description><![CDATA[ A previously unknown vulnerability in OpenAI ChatGPT allowed sensitive conversation data to be exfiltrated without user knowledge or consent, according to new findings from Check Point.
&quot;A single malicious prompt could turn an otherwise ordinary conversation into a covert exfiltration channel, leaking user messages, uploaded files, and other sensitive content,&quot; the cybersecurity company said in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSleuSc-PdTH7u0CSOLasljqQ-HO4A5sIqzvVeeVlGlqynCVYSdgU1c-7zoVavi1OADQiN3-_KS93PbMbmc4daNULqCXV21ChjnRUvqXIPT9mnLRCmbHdVy0YeaMnRuzGBAo8JoJPE5Wnzl3Sf0b_3d1-OV6VB3PKhKy_olGs9mi1YLIOJnAl7uQkYkdjI/s1600/cpr.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 22:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI, Patches, ChatGPT, Data, Exfiltration, Flaw, and, Codex, GitHub, Token, Vulnerability</media:keywords>
</item>

<item>
<title>Storm Brews Over Critical, No&#45;Click Telegram Flaw</title>
<link>https://block385.com/storm-brews-over-critical-no-click-telegram-flaw</link>
<guid>https://block385.com/storm-brews-over-critical-no-click-telegram-flaw</guid>
<description><![CDATA[ The vulnerability, which is allegedly triggered by a corrupted sticker in the messaging app, received a 9.8 CVSS score, but Telegram denies it exists. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt40cf7580a2e25f90/69ca6e49750cbc5170c0018c/telegram_Pitor_Adamowicz_Alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 21:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Storm, Brews, Over, Critical, No-Click, Telegram, Flaw</media:keywords>
</item>

<item>
<title>DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials</title>
<link>https://block385.com/deepload-malware-uses-clickfix-and-wmi-persistence-to-steal-browser-credentials</link>
<guid>https://block385.com/deepload-malware-uses-clickfix-and-wmi-persistence-to-steal-browser-credentials</guid>
<description><![CDATA[ A new campaign has leveraged the ClickFix social engineering tactic as a way to distribute a previously undocumented malware loader referred to as DeepLoad.
&quot;It likely uses AI-assisted obfuscation and process injection to evade static scanning, while credential theft starts immediately and captures passwords and sessions even if the primary loader is blocked,&quot; ReliaQuest researchers Thassanai ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2icgdVOmzM5pZsm88HvvmzcWKRBBXvG94z4fSZMEVPzb7GDoJ_MGDckeaK2dYVEoId5bhMbBtB0bTc0xWJshdOQ-fJEUH5nPIo028Cpm1bmmR1Qlrv5M6atg6oMz0wc0hX4phKfXivitHkWqMiE_Rl7PaD0qIrGMyaq9D_QwAMm62Bw5iaMBlHvwAnIa_/s1600/deepload.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 20:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DeepLoad, Malware, Uses, ClickFix, and, WMI, Persistence, Steal, Browser, Credentials</media:keywords>
</item>

<item>
<title>Coro launches MCP capabilities to simplify security operations through AI workflows</title>
<link>https://block385.com/coro-launches-mcp-capabilities-to-simplify-security-operations-through-ai-workflows</link>
<guid>https://block385.com/coro-launches-mcp-capabilities-to-simplify-security-operations-through-ai-workflows</guid>
<description><![CDATA[ Coro has announced new Model Context Protocol (MCP) capabilities that extend its AI-driven security platform beyond the Coro interface, allowing users to access, analyze, and take action on security data directly from tools like ChatGPT, Claude, and other AI environments. Coro enables teams to interact with and act on security data without switching tools or navigating complex dashboards, which is important for organizations increasingly relying on AI assistants to manage daily workflows. Coro’s MCP integration … More →
The post Coro launches MCP capabilities to simplify security operations through AI workflows appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 19:00:42 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Coro, launches, MCP, capabilities, simplify, security, operations, through, workflows</media:keywords>
</item>

<item>
<title>Diligent automates time&#45;consuming steps in third&#45;party reviews</title>
<link>https://block385.com/diligent-automates-time-consuming-steps-in-third-party-reviews</link>
<guid>https://block385.com/diligent-automates-time-consuming-steps-in-third-party-reviews</guid>
<description><![CDATA[ Diligent launched of Third-Party Risk Intel, an agentic due diligence and intelligence solution that automates the most time-consuming steps of third-party reviews, delivering up to 80% time savings for compliance, legal, and procurement teams. The launch builds on the company’s recent acquisition of 3rdRisk, an AI-native third-party risk management solution that gives organizations a near real-time view of their external ecosystem, how critical vendors are performing, and what that means for their overall risk posture. … More →
The post Diligent automates time-consuming steps in third-party reviews appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 19:00:34 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Diligent, automates, time-consuming, steps, third-party, reviews</media:keywords>
</item>

<item>
<title>TeamPCP’s attack spree slows, but threat escalates with ransomware pivot</title>
<link>https://block385.com/teampcps-attack-spree-slows-but-threat-escalates-with-ransomware-pivot</link>
<guid>https://block385.com/teampcps-attack-spree-slows-but-threat-escalates-with-ransomware-pivot</guid>
<description><![CDATA[ TeamPCP’s destructive run of supply chain breaches has stopped, for now: it has been three days since the group published malicious versions of Telnyx’s SDK on PyPI, and there haven’t been reports of new open-source project compromises. Partnership with emerging RaaS operation “The prior operational cadence was aggressive – a new target every 1-3 days (Trivy [on] March 19, CanisterWorm [on] March 20-22, Checkmarx [on] March 23, LiteLLM [on] March 24, Telnyx [on] March 27),” … More →
The post TeamPCP’s attack spree slows, but threat escalates with ransomware pivot appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/06180224/digital-supply-chain-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 19:00:20 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TeamPCP’s, attack, spree, slows, but, threat, escalates, with, ransomware, pivot</media:keywords>
</item>

<item>
<title>RSAC 2026 is back, and the certificate automation gap is impossible to ignore</title>
<link>https://block385.com/rsac-2026-is-back-and-the-certificate-automation-gap-is-impossible-to-ignore</link>
<guid>https://block385.com/rsac-2026-is-back-and-the-certificate-automation-gap-is-impossible-to-ignore</guid>
<description><![CDATA[ RSAC 2026 Conference marked a return to form, more vibrant and better attended than any show I can recall over the past decade. The audience was distinctly international, with strong representation from North America, Europe and Latin America, and it was refreshing to see the energy and overall vibe of the show return to what I remember from RSA at its peak. As expected, hot topics centered on how AI is transforming cybersecurity, alongside growing … More →
The post RSAC 2026 is back, and the certificate automation gap is impossible to ignore appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/02/17183613/discussion-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 19:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>RSAC, 2026, back, and, the, certificate, automation, gap, impossible, ignore</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More</title>
<link>https://block385.com/weekly-recap-telecom-sleeper-cells-llm-jailbreaks-apple-forces-uk-age-checks-and-more</link>
<guid>https://block385.com/weekly-recap-telecom-sleeper-cells-llm-jailbreaks-apple-forces-uk-age-checks-and-more</guid>
<description><![CDATA[ Some weeks are loud. This one was quieter but not in a good way. Long-running operations are finally hitting courtrooms, old attack methods are showing up in new places, and research that stopped being theoretical right around the time defenders stopped paying attention.
There&#039;s a bit of everything this week. Persistence plays, legal wins, influence ops, and at least one thing that looks boring ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2e5F9xrNGflqGG3Z7UcoPHMKZnF1j1FJBpwnPfV0MBCUweDKegb97Kcry4OK2kQgx0bQ91Lhem0BdasOpiN9UoKz7rNTAVgBuJzbM9jCaF4APqUsXlkiZfbC35xNWAd0z7T0qZoTN3GdVW9exy7BcEIjV64hinG5pxmbX69KdF_u7qXUpuEZZX_R8vaMP/s1600/recapss.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 16:30:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>⚡, Weekly, Recap:, Telecom, Sleeper, Cells, LLM, Jailbreaks, Apple, Forces, U.K., Age, Checks, and, More</media:keywords>
</item>

<item>
<title>3 SOC Process Fixes That Unlock Tier 1 Productivity</title>
<link>https://block385.com/3-soc-process-fixes-that-unlock-tier-1-productivity</link>
<guid>https://block385.com/3-soc-process-fixes-that-unlock-tier-1-productivity</guid>
<description><![CDATA[ What is really slowing Tier 1 down: the threat itself or the process around it? In many SOCs, the biggest delays do not come from the threat alone. They come from fragmented workflows, manual triage steps, and limited visibility early in the investigation. Fixing those process gaps can help Tier 1 move faster, reduce unnecessary escalations, and improve how the entire SOC responds under pressure ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFh5EaxE3C26MNKxziPoKvAK16f1ctGNYf_S1E7IY1tfyazizZwtmHaqHaTHSqBwWAMtENhtk5K1GzWLRln80K-vm2S9lkVeE3tpfQeVTaptm_T8kNoeCFLDbJLKMwqNsmD9y2iUDnLUJw4b6BQpST8M5h3dk7yRGyBcrl29nD8rw045i5roI91mRrEQs/s1600/soc.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 16:30:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SOC, Process, Fixes, That, Unlock, Tier, Productivity</media:keywords>
</item>

<item>
<title>Second data breach at European Commission this year leaves open questions over resilience</title>
<link>https://block385.com/second-data-breach-at-european-commission-this-year-leaves-open-questions-over-resilience</link>
<guid>https://block385.com/second-data-breach-at-european-commission-this-year-leaves-open-questions-over-resilience</guid>
<description><![CDATA[ The European Commission confirmed that a cyberattack impacted cloud infrastructure hosting its web presence on the Europa.eu platform. Authorities said the cyberattack was discovered on 24 March, and early findings from the ongoing investigation suggest data were taken from the affected websites.There is no indication that the Commission’s internal systems were compromised. “The Commission’s swift response ensured the incident was contained and risk mitigation measures were implemented to protect services and data, without disrupting the … More →
The post Second data breach at European Commission this year leaves open questions over resilience appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/21142123/eu-people-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 15:00:37 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Second, data, breach, European, Commission, this, year, leaves, open, questions, over, resilience</media:keywords>
</item>

<item>
<title>Critical Fortinet FortiClient EMS bug under active attack (CVE&#45;2026&#45;21643)</title>
<link>https://block385.com/critical-fortinet-forticlient-ems-bug-under-active-attack-cve-2026-21643</link>
<guid>https://block385.com/critical-fortinet-forticlient-ems-bug-under-active-attack-cve-2026-21643</guid>
<description><![CDATA[ A critical SQL injection vulnerability (CVE-2026-21643) in Fortinet FortiClient Endpoint Management Server (EMS), a management server for FortiClient endpoint agents on various platforms, is under active exploitation. The warning comes from Defused Cyber, which helps organizations deploy honeypots/fake assets, and uses them as well to capture real attack attempts and exploits and provide early warning threat intelligence. “Currently marked as not exploited on CISA and other Known Exploited Vulnerabilities (KEV) lists, [CVE-2026-21643] has seen first … More →
The post Critical Fortinet FortiClient EMS bug under active attack (CVE-2026-21643) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/01/16140047/fortinet-1500-3.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 15:00:29 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, Fortinet, FortiClient, EMS, bug, under, active, attack, CVE-2026-21643</media:keywords>
</item>

<item>
<title>IPVanish Threat Protection Pro blocks malicious activity before they reach the user</title>
<link>https://block385.com/ipvanish-threat-protection-pro-blocks-malicious-activity-before-they-reach-the-user</link>
<guid>https://block385.com/ipvanish-threat-protection-pro-blocks-malicious-activity-before-they-reach-the-user</guid>
<description><![CDATA[ IPVanish launched Threat Protection Pro, a new feature for Windows and macOS that is designed to provide always-on digital security. Threat Protection Pro is powered by cybersecurity technology from VIPRE, bringing over 25 years of threat intelligence and security expertise into the IPVanish app to deliver advanced, real-time protection against malicious websites, downloads, ads, and trackers, regardless of whether the VPN connection is active. This launch marks the latest advancement in IPVanish’s evolution as a … More →
The post IPVanish Threat Protection Pro blocks malicious activity before they reach the user appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 15:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>IPVanish, Threat, Protection, Pro, blocks, malicious, activity, before, they, reach, the, user</media:keywords>
</item>

<item>
<title>The State of Secrets Sprawl 2026: 9 Takeaways for CISOs</title>
<link>https://block385.com/the-state-of-secrets-sprawl-2026-9-takeaways-for-cisos</link>
<guid>https://block385.com/the-state-of-secrets-sprawl-2026-9-takeaways-for-cisos</guid>
<description><![CDATA[ Secrets sprawl isn&#039;t slowing down: in 2025, it accelerated faster than most security teams anticipated. GitGuardian&#039;s State of Secrets Sprawl 2026 report analyzed billions of commits across public GitHub and uncovered 29 million new hardcoded secrets in 2025 alone, a 34% increase year over year and the largest single-year jump ever recorded.
This year&#039;s findings reveal three core trends: AI has ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4tVpFBDvdU-vz8vM1T6SJZwd3AiySFqEyonUutxGPNimXEqTVOKN-pCI_lF5Ti2GngFUPtEphVI4Qep03CBciF7NhaWEIKYdDfkVY-VleTTcqYJvcMTKrd-EJ4kh2zLk3cY7pqqxI7bfEghuxGAV7lwUPjTD6nTa5dKj5e8_RJD9UjHn12015puG8P4o/s1600/key.gif" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 14:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, State, Secrets, Sprawl, 2026:, Takeaways, for, CISOs</media:keywords>
</item>

<item>
<title>Android 17 tweaks location privacy with one&#45;time access</title>
<link>https://block385.com/android-17-tweaks-location-privacy-with-one-time-access</link>
<guid>https://block385.com/android-17-tweaks-location-privacy-with-one-time-access</guid>
<description><![CDATA[ Google introduced a suite of location privacy features in Android 17 Beta 3 to give users more control and provide developers with tools for data minimization and product safety. Location button overview Android 17 introduces a new UI element called the location button, designed for one-time access to precise location. This feature supports common tasks that do not require persistent or background access, such as finding nearby places or tagging content. Users can customize location … More →
The post Android 17 tweaks location privacy with one-time access appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/16083000/android-17-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 13:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Android, tweaks, location, privacy, with, one-time, access</media:keywords>
</item>

<item>
<title>Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels</title>
<link>https://block385.com/russian-ctrl-toolkit-delivered-via-malicious-lnk-files-hijacks-rdp-via-frp-tunnels</link>
<guid>https://block385.com/russian-ctrl-toolkit-delivered-via-malicious-lnk-files-hijacks-rdp-via-frp-tunnels</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a remote access toolkit of Russian-origin that&#039;s distributed via malicious Windows shortcut (LNK) files that are disguised as private key folders.
The CTRL toolkit, according to Censys, is custom-built using .NET and includes various executables&quot; to facilitate credential phishing, keylogging, Remote Desktop Protocol (RDP) hijacking, and reverse tunneling ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh05CEOtp0cIlsi1qDK4HRH2PPOFyvB5jca65pAQVsnCfBHZ-wRGt0s8VhvzO_l-4Q9H_xGKQsO_efVGzJ46ElLQNaq_FEp6wPUou4aqTvEKMPlEEGOTyEtISTj0VkC5QmO38HuxWehNDTUkdvCVCCp-GrIPWJyFt4dTLp1TIbqW8hAiVEJ-vxnoKUexR6-/s1600/ctrl-ctrl.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 12:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Russian, CTRL, Toolkit, Delivered, via, Malicious, LNK, Files, Hijacks, RDP, via, FRP, Tunnels</media:keywords>
</item>

<item>
<title>SystemRescue 13 updates its kernel to Linux 6.18 LTS, adds new recovery tools</title>
<link>https://block385.com/systemrescue-13-updates-its-kernel-to-linux-618-lts-adds-new-recovery-tools</link>
<guid>https://block385.com/systemrescue-13-updates-its-kernel-to-linux-618-lts-adds-new-recovery-tools</guid>
<description><![CDATA[ Bootable Linux recovery environments occupy a specific niche in the systems administration and incident response toolkit. SystemRescue, an Arch-based live distribution built for repairing unbootable systems and recovering data from damaged drives, has shipped version 13.00 with a new long-term supported kernel, updated storage tools, and several additions to its command-line toolset. Kernel and storage updates The release moves to Linux 6.18.20, the current long-term supported kernel series. For a recovery distribution that needs to … More →
The post SystemRescue 13 updates its kernel to Linux 6.18 LTS, adds new recovery tools appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/31164614/linux-1500-1-patch.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 11:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SystemRescue, updates, its, kernel, Linux, 6.18, LTS, adds, new, recovery, tools</media:keywords>
</item>

<item>
<title>Three China&#45;Linked Clusters Target Southeast Asian Government in 2025 Cyber Campaign</title>
<link>https://block385.com/three-china-linked-clusters-target-southeast-asian-government-in-2025-cyber-campaign</link>
<guid>https://block385.com/three-china-linked-clusters-target-southeast-asian-government-in-2025-cyber-campaign</guid>
<description><![CDATA[ Three threat activity clusters aligned with China have targeted a government organization in Southeast Asia as part of what has been described as a &quot;complex and well-resourced operation.&quot;
The campaigns have led to the deployment of various malware families, including HIUPAN (aka USBFect, MISTCLOAK, or U2DiskWatch), PUBLOAD, EggStremeFuel (aka RawCookie), EggStremeLoader (aka Gorem RAT), MASOL ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMVmr08UFvUwMkDRW62724LCJu5Z774vza7r8UADDdCZcBFNJTeJ9WPFkt4BLIknMuCpLYow39D0rgDkTkftiSLBxtPsG3YW6Y7CRiPRxye2Con9Z1lP77VcDv2PA4UJ4PP6nNSCLX0cOKLKJOTCnVerXQ4w5we9s3rMTBbUMMX2hZBB5MLu5t4Ll3YFPe/s1600/chinese-hackers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 10:30:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Three, China-Linked, Clusters, Target, Southeast, Asian, Government, 2025, Cyber, Campaign</media:keywords>
</item>

<item>
<title>ShipSec Studio brings open&#45;source workflow orchestration to security operations</title>
<link>https://block385.com/shipsec-studio-brings-open-source-workflow-orchestration-to-security-operations</link>
<guid>https://block385.com/shipsec-studio-brings-open-source-workflow-orchestration-to-security-operations</guid>
<description><![CDATA[ Security teams have long relied on a mix of shell scripts, cron jobs, and loosely connected tools to chain reconnaissance and vulnerability scanning work together. ShipSec Studio, an open-source security workflow automation platform from ShipSec AI, aims to replace that arrangement with a dedicated orchestration layer built specifically for security operations. What the platform does ShipSec Studio provides a visual, no-code workflow builder that lets operators connect security tools into automated pipelines without writing glue … More →
The post ShipSec Studio brings open-source workflow orchestration to security operations appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/27153056/shipsec_studio-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 09:00:26 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ShipSec, Studio, brings, open-source, workflow, orchestration, security, operations</media:keywords>
</item>

<item>
<title>Why risk alone doesn’t get you to yes</title>
<link>https://block385.com/why-risk-alone-doesnt-get-you-to-yes</link>
<guid>https://block385.com/why-risk-alone-doesnt-get-you-to-yes</guid>
<description><![CDATA[ I have been in security rooms for years, from military operations centers to corporate boardrooms. In all those years I can tell you that the hardest mission that most security leaders will face is not identifying a threat, but getting someone to act on it. We’re trained to see exposure before they are identified by others. We continually assess likely threats, evaluate impact, and design controls to prevent disruption long before it reaches operations or … More →
The post Why risk alone doesn’t get you to yes appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/04/31145118/ciso-search-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 09:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, risk, alone, doesn’t, get, you, yes</media:keywords>
</item>

<item>
<title>Don’t count on government guidance after a smart home breach</title>
<link>https://block385.com/dont-count-on-government-guidance-after-a-smart-home-breach</link>
<guid>https://block385.com/dont-count-on-government-guidance-after-a-smart-home-breach</guid>
<description><![CDATA[ People are filling their homes with internet-connected cameras, speakers, locks, and routers. When one of those devices is compromised, the next steps are often unclear. Researchers reviewing government cybersecurity advice in 11 countries found that most guidance focuses on prevention, leaving households with limited support after a breach. The analysis covers Australia, Austria, Canada, Finland, France, Germany, Japan, New Zealand, Singapore, the United Kingdom, and the United States. Prevention advice is widely available Government agencies … More →
The post Don’t count on government guidance after a smart home breach appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/03/19124945/smart_home-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 07:00:22 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Don’t, count, government, guidance, after, smart, home, breach</media:keywords>
</item>

<item>
<title>Breaking out: Can AI agents escape their sandboxes?</title>
<link>https://block385.com/breaking-out-can-ai-agents-escape-their-sandboxes</link>
<guid>https://block385.com/breaking-out-can-ai-agents-escape-their-sandboxes</guid>
<description><![CDATA[ Container sandboxes are part of routine AI agent testing and deployment. Agents use them to run code, edit files, and interact with system resources without direct access to the host. The SandboxEscapeBench benchmark, developed by researchers at the University of Oxford and the AI Security Institute, evaluates whether an agent with shell access can escape a container and reach the host system. Evaluation architecture and scenario taxonomy (Source: AI Security Institute) What SandboxEscapeBench measures SandboxEscapeBench … More →
The post Breaking out: Can AI agents escape their sandboxes? appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/27095223/ai_agents-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 07:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Breaking, out:, Can, agents, escape, their, sandboxes</media:keywords>
</item>

<item>
<title>Week in review: NIST updates DNS security guidance, compromised LiteLLM PyPI packages</title>
<link>https://block385.com/week-in-review-nist-updates-dns-security-guidance-compromised-litellm-pypi-packages</link>
<guid>https://block385.com/week-in-review-nist-updates-dns-security-guidance-compromised-litellm-pypi-packages</guid>
<description><![CDATA[ Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: NIST updates its DNS security guidance for the first time in over a decade DNS infrastructure underpins nearly every network connection an organization makes, yet security configurations for it have gone largely unrevised at the federal guidance level for more than twelve years. NIST published SP 800-81r3, the Secure Domain Name System Deployment Guide, superseding a version that dates to … More →
The post Week in review: NIST updates DNS security guidance, compromised LiteLLM PyPI packages appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/07/16184227/week-in-review.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 29 Mar 2026 11:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Week, review:, NIST, updates, DNS, security, guidance, compromised, LiteLLM, PyPI, packages</media:keywords>
</item>

<item>
<title>Iran&#45;Linked Hackers Breach FBI Director’s Personal Email, Hit Stryker With Wiper Attack</title>
<link>https://block385.com/iran-linked-hackers-breach-fbi-directors-personal-email-hit-stryker-with-wiper-attack</link>
<guid>https://block385.com/iran-linked-hackers-breach-fbi-directors-personal-email-hit-stryker-with-wiper-attack</guid>
<description><![CDATA[ Threat actors with ties to Iran successfully broke into the personal email account of Kash Patel, the director of the U.S. Federal Bureau of Investigation (FBI), and leaked a cache of photos and other documents to the internet.
Handala Hack Team, which carried out the breach, said on its website that Patel &quot;will now find his name among the list of successfully hacked victims.&quot; In a statement ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgB5PedpQX_DQaCrJ76V6gQtAUKvDiV1udgR3vPrPp8k7dcP8jACbAPITTEwRpl7dS05Dz_hYFlt2v4H6KTukko0Sg8vRZpDGgWNbGzVqQDwcntdMVmhb3x5v0q3d0gRcbedgOxZLiVeiDCaxb8TNO8dEaE7Bn54TCqxKvbb7Ct_5Wxsxx5WSn2bqEIJqB4/s1600/iran-hacking.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 28 Mar 2026 19:30:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Iran-Linked, Hackers, Breach, FBI, Director’s, Personal, Email, Hit, Stryker, With, Wiper, Attack</media:keywords>
</item>

<item>
<title>Attackers are exploiting RCE vulnerability in BIG&#45;IP APM systems (CVE&#45;2025&#45;53521)</title>
<link>https://block385.com/attackers-are-exploiting-rce-vulnerability-in-big-ip-apm-systems-cve-2025-53521</link>
<guid>https://block385.com/attackers-are-exploiting-rce-vulnerability-in-big-ip-apm-systems-cve-2025-53521</guid>
<description><![CDATA[ A critical unauthenticated remote code execution vulnerability (CVE-2025-53521) in F5’s BIG-IP Access Policy Manager (APM) solution is under active exploitation, the US Cybersecurity and Infrastructure Security Agency warned on Friday. CISA added the flaw to its Known Exploited Vulnerabilities catalog after F5 updated the related security advisory, The advisory was initially published on October 15, 2025, when F5 confirmed a data breach that resulted in a “highly sophisticated nation-state threat actor” accessing – among other … More →
The post Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/15161132/f5-logo-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Sat, 28 Mar 2026 12:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Attackers, are, exploiting, RCE, vulnerability, BIG-IP, APM, systems, CVE-2025-53521</media:keywords>
</item>

<item>
<title>Citrix NetScaler Under Active Recon for CVE&#45;2026&#45;3055 (CVSS 9.3) Memory Overread Bug</title>
<link>https://block385.com/citrix-netscaler-under-active-recon-for-cve-2026-3055-cvss-93-memory-overread-bug</link>
<guid>https://block385.com/citrix-netscaler-under-active-recon-for-cve-2026-3055-cvss-93-memory-overread-bug</guid>
<description><![CDATA[ A recently disclosed critical security flaw impacting Citrix NetScaler ADC and NetScaler Gateway is witnessing active reconnaissance activity, according to Defused Cyber and watchTowr.
The vulnerability, CVE-2026-3055 (CVSS score: 9.3), refers to a case of insufficient input validation leading to memory overread, which an attacker could exploit to leak potentially sensitive information.
Per ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwI3gfUe4wDxvIuUsVXUVcyiZ6TWg7HIh7UgKbWXN8e5p6VbJM5hHvR0gCKbVRD3tx311R5b9TWnt0OrLNfpoSBrP1tv06PBWrUXtwzAZAvHVHo8a1uZXzqZBDkpCeGgHWI9tRrk39_n_YZgO7CeX6MXHo4kFSu_lFd5ZmAuiTdrg-x8w0svB3lF-2U1LV/s1600/citrix-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 28 Mar 2026 11:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Citrix, NetScaler, Under, Active, Recon, for, CVE-2026-3055, CVSS, 9.3, Memory, Overread, Bug</media:keywords>
</item>

<item>
<title>TA446 Deploys DarkSword iOS Exploit Kit in Targeted Spear&#45;Phishing Campaign</title>
<link>https://block385.com/ta446-deploys-darksword-ios-exploit-kit-in-targeted-spear-phishing-campaign</link>
<guid>https://block385.com/ta446-deploys-darksword-ios-exploit-kit-in-targeted-spear-phishing-campaign</guid>
<description><![CDATA[ Proofpoint has disclosed details of a targeted email campaign in which threat actors with ties to Russia are leveraging the recently disclosed DarkSword exploit kit to target iOS devices.
The activity has been attributed with high confidence to the Russian state-sponsored threat group known as TA446, which is also tracked by the broader cybersecurity community under the monikers Callisto, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAX955shB28AQ8BgXC9lMJBSEWWtw5FVp3L9rxuVnBSsDMpj5Ssjh7cqxd7eJI_bES6b82XDHvxrH0U_cyEXwbS05QkUbSDPzP8ZGcjy2QD2-gY9utPDfcJ6EBO-nk3VayGUBUnesxmmGOH-AanOtkxxhPGyZ-5azN_kzflpKoqfW7U2m35ookIyuEYvFo/s1600/iphone-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 28 Mar 2026 11:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TA446, Deploys, DarkSword, iOS, Exploit, Kit, Targeted, Spear-Phishing, Campaign</media:keywords>
</item>

<item>
<title>CISA Adds CVE&#45;2025&#45;53521 to KEV After Active F5 BIG&#45;IP APM Exploitation</title>
<link>https://block385.com/cisa-adds-cve-2025-53521-to-kev-after-active-f5-big-ip-apm-exploitation</link>
<guid>https://block385.com/cisa-adds-cve-2025-53521-to-kev-after-active-f5-big-ip-apm-exploitation</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical security flaw impacting F5 BIG-IP Access Policy Manager (APM) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerability in question is CVE-2025-53521 (CVSS v4 score: 9.3), which could allow a threat actor to achieve remote code execution.
&quot;When a ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOCtHFfd9TZrhTa9APggVpivUkp_7HLw49145Q93B-76BiG0kkbGOPgViPII25Inn9b8710FjsB1sG716DO1Qh3ikSV88oqwdhSCJ7V2FTWgPq1xaA_UqMVwIEi4zmLnAmXQmbdG2fWAVBx6H_OiHqCOzghwBkuQYy4mYUCIdIyBi54ojbF3rc_OGIPlGc/s1600/f5.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 28 Mar 2026 09:30:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Adds, CVE-2025-53521, KEV, After, Active, BIG-IP, APM, Exploitation</media:keywords>
</item>

<item>
<title>TA446 Deploys Leaked DarkSword iOS Exploit Kit in Targeted Spear&#45;Phishing Campaign</title>
<link>https://block385.com/ta446-deploys-leaked-darksword-ios-exploit-kit-in-targeted-spear-phishing-campaign</link>
<guid>https://block385.com/ta446-deploys-leaked-darksword-ios-exploit-kit-in-targeted-spear-phishing-campaign</guid>
<description><![CDATA[ Proofpoint has disclosed details of a targeted email campaign in which threat actors with ties to Russia are leveraging the recently disclosed DarkSword exploit kit to target iOS devices.
The activity has been attributed with high confidence to the Russian state-sponsored threat group known as TA446, which is also tracked by the broader cybersecurity community under the monikers Callisto, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAX955shB28AQ8BgXC9lMJBSEWWtw5FVp3L9rxuVnBSsDMpj5Ssjh7cqxd7eJI_bES6b82XDHvxrH0U_cyEXwbS05QkUbSDPzP8ZGcjy2QD2-gY9utPDfcJ6EBO-nk3VayGUBUnesxmmGOH-AanOtkxxhPGyZ-5azN_kzflpKoqfW7U2m35ookIyuEYvFo/s1600/iphone-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 28 Mar 2026 09:30:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TA446, Deploys, Leaked, DarkSword, iOS, Exploit, Kit, Targeted, Spear-Phishing, Campaign</media:keywords>
</item>

<item>
<title>Coruna, DarkSword &amp;amp;amp; Democratizing Nation&#45;State Exploit Kits</title>
<link>https://block385.com/coruna-darksword-democratizing-nation-state-exploit-kits</link>
<guid>https://block385.com/coruna-darksword-democratizing-nation-state-exploit-kits</guid>
<description><![CDATA[ Nation-state malware is being sold on the Dark Web and leaked to GitHub; and ordinary organizations might not stand much of a chance of defending themselves. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0213b59cc64318b8/69c58fe61ccd12702311c1d5/iPhone_lock-Nedim_Bajramovic-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 20:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Coruna, DarkSword, &amp;amp, Democratizing, Nation-State, Exploit, Kits</media:keywords>
</item>

<item>
<title>Apple Sends Lock Screen Alerts to Outdated iPhones Over Active Web&#45;Based Exploits</title>
<link>https://block385.com/apple-sends-lock-screen-alerts-to-outdated-iphones-over-active-web-based-exploits</link>
<guid>https://block385.com/apple-sends-lock-screen-alerts-to-outdated-iphones-over-active-web-based-exploits</guid>
<description><![CDATA[ Apple is now sending Lock Screen notifications to iPhones and iPads running older versions of iOS and iPadOS to alert users of web-based attacks and urge them to install the update.
The development was first reported by MacRumors.
&quot;Apple is aware of attacks targeting out-of-date iOS software, including the version on your iPhone. Install this critical update to protect your iPhone,&quot; the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiN7dxzt-3rxkQ1A-6Sd9EzxINF3V70WAx4hsUUNPofdWcCO6hp0vEHavIsQsCUyXY7hOUOk7kDGIt2zN__gnigtzyYJyc31aiwpivHd4GEMPh0CHZHIBm58PtiyDXn7XNzI4hoZzmqVpErPty3VvEoyZCC4heyU0FE0uvM8_Ad_mWtXpSj5bcLIcTBwLNi/s1600/apple.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 19:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Sends, Lock, Screen, Alerts, Outdated, iPhones, Over, Active, Web-Based, Exploits</media:keywords>
</item>

<item>
<title>TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files</title>
<link>https://block385.com/teampcp-pushes-malicious-telnyx-versions-to-pypi-hides-stealer-in-wav-files</link>
<guid>https://block385.com/teampcp-pushes-malicious-telnyx-versions-to-pypi-hides-stealer-in-wav-files</guid>
<description><![CDATA[ TeamPCP, the threat actor behind the supply chain attack targeting Trivy, KICS, and litellm, has now compromised the telnyx Python package by pushing two malicious versions to steal sensitive data.
The two versions, 4.87.1 and 4.87.2, published to the Python Package Index (PyPI) repository on March 27, 2026, concealed their credential harvesting capabilities within a .WAV file. Users are ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1CMUCCEUOX5JczcW-qUC2Bw8_3GmKNoLItyUq-AeuCUvFrJJL0t6aW5EhyJzNT5OyQJulbqwy847fK_EEBieTmTHEKn33suBcHss0AflwRWkPdmqT7FUbX5Rahkwz09g0Fw2GDZr00dAqHeEouzWvFVKMLgNshyO2HQ6QcD5qtbNu59djr1cdm0iV_ksj/s1600/wave.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 19:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TeamPCP, Pushes, Malicious, Telnyx, Versions, PyPI, Hides, Stealer, WAV, Files</media:keywords>
</item>

<item>
<title>China Upgrades the Backdoor It Uses to Spy on Telcos Globally</title>
<link>https://block385.com/china-upgrades-the-backdoor-it-uses-to-spy-on-telcos-globally</link>
<guid>https://block385.com/china-upgrades-the-backdoor-it-uses-to-spy-on-telcos-globally</guid>
<description><![CDATA[ Chinese APT Red Menshen&#039;s super-advanced BPFdoor malware defeats traditional cybersecurity protections. All telcos can do, really, is try hunting it down. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4407524c34b171a7/69c6a9ff1eae74c299bfc9f9/Telecom_mast-Steven_May-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 18:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>China, Upgrades, the, Backdoor, Uses, Spy, Telcos, Globally</media:keywords>
</item>

<item>
<title>Wartime Usage of Compromised IP Cameras Highlight Their Danger</title>
<link>https://block385.com/wartime-usage-of-compromised-ip-cameras-highlight-their-danger</link>
<guid>https://block385.com/wartime-usage-of-compromised-ip-cameras-highlight-their-danger</guid>
<description><![CDATA[ The list of countries exploiting internet-connected cameras to give them eye&#039;s inside their adversaries&#039; borders continues to expand, with Russia, Iran, Israel, Ukraine, and the United States all using the tactic. What should companies look out for? ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt9222cdaff4968ccb/69c6999dbe732d1b716236af/urban-cctv-cameras-pixinoo-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 18:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Wartime, Usage, Compromised, Cameras, Highlight, Their, Danger</media:keywords>
</item>

<item>
<title>Open VSX Bug Let Malicious VS Code Extensions Bypass Pre&#45;Publish Security Checks</title>
<link>https://block385.com/open-vsx-bug-let-malicious-vs-code-extensions-bypass-pre-publish-security-checks</link>
<guid>https://block385.com/open-vsx-bug-let-malicious-vs-code-extensions-bypass-pre-publish-security-checks</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a now-patched bug impacting Open VSX&#039;s pre-publish scanning pipeline to cause the tool to allow a malicious Microsoft Visual Studio Code (VS Code) extension to pass the vetting process and go live in the registry.
&quot;The pipeline had a single boolean return value that meant both &#039;no scanners are configured&#039; and &#039;all scanners failed to run,&#039;&quot; Koi ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxyuzdQgdhyphenhyphenfWqx9GyfXC7_Bop28GdU7Bvyj3ZEvEBm8HbchBOMZFiLIGHSVFM9OdfCaKJSyAZzY3F3soB37-VtKEcY_KShCnzB2D-t8DJ5mbSl4MlbMgCV8uSMf9LaTds8vn_rccuiUIzq0mC5lxYK7HstyftiOEqYGCJC8PP5sCF_UariwUHXuvqYXkt/s1600/open-code.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 17:30:14 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Open, VSX, Bug, Let, Malicious, Code, Extensions, Bypass, Pre-Publish, Security, Checks</media:keywords>
</item>

<item>
<title>TeamPCP strikes again: Backdoored Telnyx PyPI package delivers malware</title>
<link>https://block385.com/teampcp-strikes-again-backdoored-telnyx-pypi-package-delivers-malware</link>
<guid>https://block385.com/teampcp-strikes-again-backdoored-telnyx-pypi-package-delivers-malware</guid>
<description><![CDATA[ TeamPCP continues is supply chain compromise rampage, with telnyx on PyPI being the latest maliciously modified package. What happened? Telnyx is a widely used software development kit (SDK) for the Telnyx AI Voice Agent service. According to Endor Labs researchers, attackers backdoored the legitimate SDK code and published versions 4.87.1 and 4.87.2 of the package on the Python Package Index (PyPI), one shortly after the other. The malicious code wasn’t functional in the first version … More →
The post TeamPCP strikes again: Backdoored Telnyx PyPI package delivers malware appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/12/09104425/malicious_package5-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 16:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TeamPCP, strikes, again:, Backdoored, Telnyx, PyPI, package, delivers, malware</media:keywords>
</item>

<item>
<title>Infrastructure Attacks With Physical Consequences Down 25%</title>
<link>https://block385.com/infrastructure-attacks-with-physical-consequences-down-25</link>
<guid>https://block385.com/infrastructure-attacks-with-physical-consequences-down-25</guid>
<description><![CDATA[ Operational technology (OT) at industrial and critical infrastructure sites seem to have been benefitting from a lull in ransomware, and hackers&#039; relative ignorance of OT systems. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf8fa280b66af47f9/69b46fd523ae84adeeda18cc/Down_stairs-Javier_Soto_Vazquez-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 16:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Infrastructure, Attacks, With, Physical, Consequences, Down, 25</media:keywords>
</item>

<item>
<title>How Organizations Can Use Mistakes to Level Up Their Security Programs</title>
<link>https://block385.com/how-organizations-can-use-mistakes-to-level-up-their-security-programs</link>
<guid>https://block385.com/how-organizations-can-use-mistakes-to-level-up-their-security-programs</guid>
<description><![CDATA[ Organizations repeatedly expose ports, reuse passwords, and skip patches, creating security gaps that attackers exploit for breaches. An industry veteran outlines ways to fix these common mistakes. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6ac910152ed10683/654e39aef2b339040ac3fde5/make-mistake-Antonio-Guillem-Fern%C3%A1ndez-alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 16:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, Organizations, Can, Use, Mistakes, Level, Their, Security, Programs</media:keywords>
</item>

<item>
<title>AitM Phishing Targets TikTok Business Accounts Using Cloudflare Turnstile Evasion</title>
<link>https://block385.com/aitm-phishing-targets-tiktok-business-accounts-using-cloudflare-turnstile-evasion</link>
<guid>https://block385.com/aitm-phishing-targets-tiktok-business-accounts-using-cloudflare-turnstile-evasion</guid>
<description><![CDATA[ Threat actors are using adversary-in-the-middle (AitM) phishing pages to seize control of TikTok for Business accounts in a new campaign, according to a report from Push Security.
Business accounts associated with social media platforms are a lucrative target, as they can be weaponized by bad actors for malvertising and distributing malware.
&quot;TikTok has been historically abused to distribute ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9MSv7TxvzRXdcpb_tW0hSC0Jq5_7-VYEhbddL8im1K25nOcjSr0T3_Y2f9zG8Q9l7K3U_zOXBKWgnHAO9rWvYG9158OKLKcZif_lq7e5fpqwxrW3IdPWzgTko6ogQSQg77hmiWszgf3OOT7baBY8vI8XcPt0h8R_0p7oBX2WmVQUSgsJXfPQmCzOGTMX9/s1600/tiktok-b.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 15:30:15 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AitM, Phishing, Targets, TikTok, Business, Accounts, Using, Cloudflare, Turnstile, Evasion</media:keywords>
</item>

<item>
<title>Bearlyfy Hits Russian Firms with Custom GenieLocker Ransomware</title>
<link>https://block385.com/bearlyfy-hits-russian-firms-with-custom-genielocker-ransomware</link>
<guid>https://block385.com/bearlyfy-hits-russian-firms-with-custom-genielocker-ransomware</guid>
<description><![CDATA[ A pro-Ukrainian group called Bearlyfy has been attributed to more than 70 cyber attacks targeting Russian companies since it first surfaced in the threat landscape in January 2025, with recent attacks leveraging a custom Windows ransomware strain codenamed GenieLocker.
&quot;Bearlyfy (also known as Labubu) operates as a dual-purpose group aimed at inflicting maximum damage upon Russian businesses; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJa_h_fZ55AqNWxz1cuJLjlOtmxDcBXqTxZ8URxFwRfQ1OsNpcQKZOafbe7MxL72WZ3c7ashklJn4nlUj6FD87PPAznL0bzBhlpRIpUTtHqluiAjZBZgMEPTvwPyBeSrsnrSTnmbuPTwpQQDl2xLHPpynscV2zy7sk_SMU3u_gNkbzAaoT16Lr8SZXQgJs/s1600/russian-ransomware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 15:30:15 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bearlyfy, Hits, Russian, Firms, with, Custom, GenieLocker, Ransomware</media:keywords>
</item>

<item>
<title>We Are At War</title>
<link>https://block385.com/we-are-at-war</link>
<guid>https://block385.com/we-are-at-war</guid>
<description><![CDATA[ Rising geopolitical tensions are reflected (or in some cases preceded) by cyber operations, while technology itself has become politicized. Let’s admit it: we are in the middle of it. 
Introduction: One tech power to rule them all is a thing of the past 
The relative safety, peace and prosperity that much of the world has enjoyed since 1945 was not accidental. It emerged from the ashes ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiaOP8SQvGcKjVqTcrOQdTQqpsDiPV47qdwzHqpxth6iyxLDSHoBNBKHVyh5LUzM1W2LdABzaDP6TjMektIuSiYhTXirHygMx_0Yh8dwpmREVfKUWPUiqRefYDptyZ3NG0Xa0X5aI6xJV0GsNoFM6Akna2z1pQ3Wre9V9aqjEpOwrn-tbkTiRaKFw3vE74/s1600/orange.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 13:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Are, War</media:keywords>
</item>

<item>
<title>Ajax data breach exposed season tickets, supporter bans open to tampering</title>
<link>https://block385.com/ajax-data-breach-exposed-season-tickets-supporter-bans-open-to-tampering</link>
<guid>https://block385.com/ajax-data-breach-exposed-season-tickets-supporter-bans-open-to-tampering</guid>
<description><![CDATA[ AFC Ajax, the Dutch football club from Amsterdam, disclosed that an unknown hacker gained access to parts of its IT systems and obtained the email addresses of a few hundred people. The hack exploited vulnerabilities in Ajax’s app and website, including exposed APIs and shared access keys. The club stated that names, email addresses, and dates of birth were accessed for fewer than 20 individuals subject to a stadium ban. An RTL journalist, who was … More →
The post Ajax data breach exposed season tickets, supporter bans open to tampering appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/08/06130532/sport.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 12:00:33 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ajax, data, breach, exposed, season, tickets, supporter, bans, open, tampering</media:keywords>
</item>

<item>
<title>CISA sounds alarm on Langflow RCE, Trivy supply chain compromise after rapid exploitation</title>
<link>https://block385.com/cisa-sounds-alarm-on-langflow-rce-trivy-supply-chain-compromise-after-rapid-exploitation</link>
<guid>https://block385.com/cisa-sounds-alarm-on-langflow-rce-trivy-supply-chain-compromise-after-rapid-exploitation</guid>
<description><![CDATA[ The US Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-33017, a recently disclosed code injection vulnerability in Langflow, an open-source framework for building AI agents and workflows, and CVE-2026-33634, an embedded malicious code vulnerability in Aqua Security’s Trivy security scanner. Their addition to the catalog means that US federal civilian agencies are required to address the flaws within their networks by April 8 and 9, … More →
The post CISA sounds alarm on Langflow RCE, Trivy supply chain compromise after rapid exploitation appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/12/19144000/cisa-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 12:00:16 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, sounds, alarm, Langflow, RCE, Trivy, supply, chain, compromise, after, rapid, exploitation</media:keywords>
</item>

<item>
<title>Google Sets 2029 Deadline for Quantum&#45;Safe Cryptography</title>
<link>https://block385.com/google-sets-2029-deadline-for-quantum-safe-cryptography</link>
<guid>https://block385.com/google-sets-2029-deadline-for-quantum-safe-cryptography</guid>
<description><![CDATA[ The post-quantum future may be coming sooner than you think, as Google plans to have PQC migration in place by 2029. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltdee69c559f0e21b7/69c58b734754ce06f0ac8aaa/lock_on_laptop_Ales_Utouka_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 12:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Sets, 2029, Deadline, for, Quantum-Safe, Cryptography</media:keywords>
</item>

<item>
<title>Bearlyfy Hits 70+ Russian Firms with Custom GenieLocker Ransomware</title>
<link>https://block385.com/bearlyfy-hits-70-russian-firms-with-custom-genielocker-ransomware</link>
<guid>https://block385.com/bearlyfy-hits-70-russian-firms-with-custom-genielocker-ransomware</guid>
<description><![CDATA[ A pro-Ukrainian group called Bearlyfy has been attributed to more than 70 cyber attacks targeting Russian companies since it first surfaced in the threat landscape in January 2025, with recent attacks leveraging a custom Windows ransomware strain codenamed GenieLocker.
&quot;Bearlyfy (also known as Labubu) operates as a dual-purpose group aimed at inflicting maximum damage upon Russian businesses; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJa_h_fZ55AqNWxz1cuJLjlOtmxDcBXqTxZ8URxFwRfQ1OsNpcQKZOafbe7MxL72WZ3c7ashklJn4nlUj6FD87PPAznL0bzBhlpRIpUTtHqluiAjZBZgMEPTvwPyBeSrsnrSTnmbuPTwpQQDl2xLHPpynscV2zy7sk_SMU3u_gNkbzAaoT16Lr8SZXQgJs/s1600/russian-ransomware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 11:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bearlyfy, Hits, 70, Russian, Firms, with, Custom, GenieLocker, Ransomware</media:keywords>
</item>

<item>
<title>LangChain, LangGraph Flaws Expose Files, Secrets, Databases in Widely Used AI Frameworks</title>
<link>https://block385.com/langchain-langgraph-flaws-expose-files-secrets-databases-in-widely-used-ai-frameworks</link>
<guid>https://block385.com/langchain-langgraph-flaws-expose-files-secrets-databases-in-widely-used-ai-frameworks</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed three security vulnerabilities impacting LangChain and LangGraph that, if successfully exploited, could expose filesystem data, environment secrets, and conversation history.
Both LangChain and LangGraph are open-source frameworks that are used to build applications powered by Large Language Models (LLMs). LangGraph is built on the foundations of ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkhroYg33geYKogEf838RfX0FRNjBX23ucPFzrxtbtf2CyTxoGZZ4RbTArZX672fygWxhNN2MOX-SXaPzWJPOeRTrnLCzYzQZ2e-7HO98AIbj-wEXbrPWSwzIOW2NbNhpWfayHyPYHyJGTRxZmDCHhR_qk79vyb29q1_p-hBCWvY2GsAPu0296IOlq_uQv/s1600/langchain.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 11:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>LangChain, LangGraph, Flaws, Expose, Files, Secrets, Databases, Widely, Used, Frameworks</media:keywords>
</item>

<item>
<title>AI frenzy feeds credential chaos, secrets leak through code, tools, and infrastructure</title>
<link>https://block385.com/ai-frenzy-feeds-credential-chaos-secrets-leak-through-code-tools-and-infrastructure</link>
<guid>https://block385.com/ai-frenzy-feeds-credential-chaos-secrets-leak-through-code-tools-and-infrastructure</guid>
<description><![CDATA[ Code keeps moving through pipelines, and credentials continue to surface alongside it. GitGuardian’s State of Secrets Sprawl 2026 puts the count at 28.65 million new hardcoded secrets in public GitHub commits in 2025, extending a multi-year rise in exposed access keys, tokens, and passwords. Public and internal repositories that contain at least one secret (Source: GitGuardian) Exposure is spreading beyond code The problem no longer exists only in public repositories, since internal environments carry a … More →
The post AI frenzy feeds credential chaos, secrets leak through code, tools, and infrastructure appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/03/17090616/leaked_secrets-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 08:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>frenzy, feeds, credential, chaos, secrets, leak, through, code, tools, and, infrastructure</media:keywords>
</item>

<item>
<title>Tails 7.6 ships automatic Tor bridge retrieval and a new password manager</title>
<link>https://block385.com/tails-76-ships-automatic-tor-bridge-retrieval-and-a-new-password-manager</link>
<guid>https://block385.com/tails-76-ships-automatic-tor-bridge-retrieval-and-a-new-password-manager</guid>
<description><![CDATA[ Tails 7.6 is out, and for users operating on networks that block Tor, the most consequential addition is built-in bridge retrieval. The Tor Connection assistant can now detect when a direct connection to Tor is restricted and automatically request bridges suited to the user’s region. The request goes through the Tor Project’s Moat API, and the connection to that API is disguised via domain fronting, making it appear as traffic to an ordinary website. Previously, … More →
The post Tails 7.6 ships automatic Tor bridge retrieval and a new password manager appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2022/10/19082014/tails-os.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 02:00:28 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tails, 7.6, ships, automatic, Tor, bridge, retrieval, and, new, password, manager</media:keywords>
</item>

<item>
<title>Top product launches at RSAC 2026</title>
<link>https://block385.com/top-product-launches-at-rsac-2026</link>
<guid>https://block385.com/top-product-launches-at-rsac-2026</guid>
<description><![CDATA[ RSAC 2026 showcased a wave of innovation, with vendors unveiling technologies poised to redefine cybersecurity. From AI-powered defense to breakthroughs in identity protection, this year’s conference delivered a glimpse into the future. Here are the most interesting products that caught our attention, and could shape what’s next. Astrix advances AI agent security platform to govern shadow and enterprise agents Astrix Security has revealed a major expansion of its AI agent security platform, covering every layer … More →
The post Top product launches at RSAC 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/22150612/rsac-2026-solutions.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 02:00:19 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Top, product, launches, RSAC, 2026</media:keywords>
</item>

<item>
<title>Make OpenAI’s models misbehave and earn a reward</title>
<link>https://block385.com/make-openais-models-misbehave-and-earn-a-reward</link>
<guid>https://block385.com/make-openais-models-misbehave-and-earn-a-reward</guid>
<description><![CDATA[ OpenAI’s public Safety Bug Bounty program focuses on AI abuse and safety risks across its products. The goal is to support safe and secure systems and reduce the risk of misuse that could lead to harm. This program complements the Security Bug Bounty. It accepts reports of abuse and safety risks that do not meet the criteria for a security vulnerability. Submissions are reviewed by teams from both programs based on scope and ownership. Safety … More →
The post Make OpenAI’s models misbehave and earn a reward appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05155719/openai-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 27 Mar 2026 02:00:07 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Make, OpenAI’s, models, misbehave, and, earn, reward</media:keywords>
</item>

<item>
<title>Is the FCC&amp;apos;s Router Ban the Wrong Fix?</title>
<link>https://block385.com/is-the-fccs-router-ban-the-wrong-fix</link>
<guid>https://block385.com/is-the-fccs-router-ban-the-wrong-fix</guid>
<description><![CDATA[ The agency put foreign-made consumer routers on its list of prohibited communications devices, but the ban could create more problems down the road. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltfed473879eac0c64/69c5741d4d1a6e092936c342/router_SOLDATOOFF_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 22:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>the, FCCs, Router, Ban, the, Wrong, Fix</media:keywords>
</item>

<item>
<title>Automotive Cybersecurity Threats Grow in Era of Connected, Autonomous Vehicles</title>
<link>https://block385.com/automotive-cybersecurity-threats-grow-in-era-of-connected-autonomous-vehicles</link>
<guid>https://block385.com/automotive-cybersecurity-threats-grow-in-era-of-connected-autonomous-vehicles</guid>
<description><![CDATA[ More than a decade since the 2015 Jeep hack, the cybersecurity of vehicles remains of the utmost importance. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0545789d5e2ff1e7/698ce0c84229558aa7937805/car-Henrik5000-iStock_15613460_MEDIUM.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 22:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Automotive, Cybersecurity, Threats, Grow, Era, Connected, Autonomous, Vehicles</media:keywords>
</item>

<item>
<title>Critical Flaw in Langflow AI Platform Under Attack</title>
<link>https://block385.com/critical-flaw-in-langflow-ai-platform-under-attack</link>
<guid>https://block385.com/critical-flaw-in-langflow-ai-platform-under-attack</guid>
<description><![CDATA[ Threats actors pounced on the code injection vulnerability within hours of its disclosure, demonstrating that organizations have little time to address critical bugs. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt33f11a57d8c3c758/69c57c3448710a1256697560/agents_CagkanSayin_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 22:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, Flaw, Langflow, Platform, Under, Attack</media:keywords>
</item>

<item>
<title>China&#45;Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks</title>
<link>https://block385.com/china-linked-red-menshen-uses-stealthy-bpfdoor-implants-to-spy-via-telecom-networks</link>
<guid>https://block385.com/china-linked-red-menshen-uses-stealthy-bpfdoor-implants-to-spy-via-telecom-networks</guid>
<description><![CDATA[ A long-term and ongoing campaign attributed to a China-nexus threat actor has embedded itself in telecom networks to conduct espionage against government networks.
The strategic positioning activity, which involves implanting and maintaining stealthy access mechanisms within critical environments, has been attributed to Red Menshen, a threat cluster that&#039;s also tracked as Earth Bluecrow, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDsXRdaBMsOY-JUezvB02i5xzt_pSMJYGGGmt3ujh5C7VDZ7YLODicjiwDHF0vR9Y6P7XfPJJ-sIzu3aElQOfOExYn15O9tjCrOubY531cg1hKVN7U1aGCq5avhsEBdxu0qCTuwgXQEHS4mkHExgUQbsR8iU2CS7fBZAlTyXlD9o0hmU0oJ8jCip_fok4G/s1600/tower-hack.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 19:30:14 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>China-Linked, Red, Menshen, Uses, Stealthy, BPFDoor, Implants, Spy, via, Telecom, Networks</media:keywords>
</item>

<item>
<title>Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in Recent Mass Attacks</title>
<link>https://block385.com/coruna-ios-kit-reuses-2023-triangulation-exploit-code-in-recent-mass-attacks</link>
<guid>https://block385.com/coruna-ios-kit-reuses-2023-triangulation-exploit-code-in-recent-mass-attacks</guid>
<description><![CDATA[ The kernel exploit for two security vulnerabilities used in the recently uncovered Apple iOS exploit kit known as Coruna is an updated version of the same exploit that was used in the Operation Triangulation campaign back in 2023, according to new findings from Kaspersky.
&quot;When Coruna was first reported, the public evidence wasn&#039;t sufficient to link its code to Triangulation — shared ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqfaEjph6_gMDAtZu968xynsgU3AggksTWUUL37NpNq6eQdTXMgQcv4JLSpNNMHSFGkKoHV6K7vmqLZ7bXIkXrHB5jF98F_sN48HDQo0nligJdOjeJ5lOzlUFrVzCKwt2MZDSsOVdfmCAaJV5ofwJN_5yIpTSpAFaZ9GrrytaoivkIr27YA0xqj1DzmbPx/s1600/coruna.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 19:30:14 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Coruna, iOS, Kit, Reuses, 2023, Triangulation, Exploit, Code, Recent, Mass, Attacks</media:keywords>
</item>

<item>
<title>How Organizations Can Use Blunders to Level Up Their Security Programs</title>
<link>https://block385.com/how-organizations-can-use-blunders-to-level-up-their-security-programs</link>
<guid>https://block385.com/how-organizations-can-use-blunders-to-level-up-their-security-programs</guid>
<description><![CDATA[ The industry highlights how organizations repeatedly make common security mistakes but one session during RSAC detailed ways to avoid them. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6ac910152ed10683/654e39aef2b339040ac3fde5/make-mistake-Antonio-Guillem-Fern%C3%A1ndez-alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 18:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, Organizations, Can, Use, Blunders, Level, Their, Security, Programs</media:keywords>
</item>

<item>
<title>Researchers release tool to detect stealthy BPFDoor implants in critical infrastructure networks</title>
<link>https://block385.com/researchers-release-tool-to-detect-stealthy-bpfdoor-implants-in-critical-infrastructure-networks</link>
<guid>https://block385.com/researchers-release-tool-to-detect-stealthy-bpfdoor-implants-in-critical-infrastructure-networks</guid>
<description><![CDATA[ Telecommunications providers around the world have been dealing with the burrowing efforts of the China-linked APTs for many years now. To help them identify hard-to-detect implants used by the China-based group dubbed Red Menshen, Rapid7 researchers have released a scanning script. BPFdoor US, Canadian, European and Asian telcos have been repeatedly hit by the infamous Salt Typhoon group in the past few years. Red Menshen has been previously observed using the BPFDoor implant/backdoor when targeting … More →
The post Researchers release tool to detect stealthy BPFDoor implants in critical infrastructure networks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/30134538/linux_malware_1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 16:00:25 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, release, tool, detect, stealthy, BPFDoor, implants, critical, infrastructure, networks</media:keywords>
</item>

<item>
<title>Second RedLine infostealer operator ends up in US  custody</title>
<link>https://block385.com/second-redline-infostealer-operator-ends-up-in-us-custody</link>
<guid>https://block385.com/second-redline-infostealer-operator-ends-up-in-us-custody</guid>
<description><![CDATA[ Hambardzum Minasyan, an Armenian man extradited to the United States, is accused of conspiring with others to develop and operate the RedLine infostealer malware used to steal sensitive data, including login credentials, from victims’ computers. Minasyan is charged with conspiracy to commit access device fraud, conspiracy to violate the Computer Fraud and Abuse Act, and conspiracy to commit money laundering. If convicted, he faces up to 10 years in prison on the access device fraud … More →
The post Second RedLine infostealer operator ends up in US  custody appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/02/04132836/cybercrime-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 16:00:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Second, RedLine, infostealer, operator, ends, custody</media:keywords>
</item>

<item>
<title>AI&#45;Powered Dependency Decisions Introduce, Ignore Security Bugs</title>
<link>https://block385.com/ai-powered-dependency-decisions-introduce-ignore-security-bugs</link>
<guid>https://block385.com/ai-powered-dependency-decisions-introduce-ignore-security-bugs</guid>
<description><![CDATA[ AI models often hallucinate or make costly mistakes when tasked with recommending software versions, upgrade paths, and security fixes — leading to significant technical debt. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte4e3f40909d9ab40/69c43d3477205d7b6cf25910/hallucinations_BakhtiarZein_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 16:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AI-Powered, Dependency, Decisions, Introduce, Ignore, Security, Bugs</media:keywords>
</item>

<item>
<title>Why a &amp;apos;Near&#45;Miss&amp;apos; Database Is Key to Improving Information Sharing</title>
<link>https://block385.com/why-a-near-miss-database-is-key-to-improving-information-sharing-4991</link>
<guid>https://block385.com/why-a-near-miss-database-is-key-to-improving-information-sharing-4991</guid>
<description><![CDATA[ Organizations disclose attack details, though information may be limited, following a breach, but what if they did the same with close calls? ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3f4e5dfde3293085/64f17dc3598d8097415a9af7/confusion-Andriy-Popov-alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 16:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, Near-Miss, Database, Key, Improving, Information, Sharing</media:keywords>
</item>

<item>
<title>Claude Extension Flaw Enabled Zero&#45;Click XSS Prompt Injection via Any Website</title>
<link>https://block385.com/claude-extension-flaw-enabled-zero-click-xss-prompt-injection-via-any-website</link>
<guid>https://block385.com/claude-extension-flaw-enabled-zero-click-xss-prompt-injection-via-any-website</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed a vulnerability in Anthropic&#039;s Claude Google Chrome Extension that could have been exploited to trigger malicious prompts simply by visiting a web page.
The flaw &quot;allowed any website to silently inject prompts into that assistant as if the user wrote them,&quot; Koi Security researcher Oren Yomtov said in a report shared with The Hacker News. &quot;No clicks, no ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvKbsVkCFVvziyQ564TDmmBjGzy6lzKUcC_rmt-GZWOiCshA_YGAhsMjib7OhvNS_8OX6micW6hWSY4lWh6IoGcyy_tCywr9Tr-qhyI4Wau32zV80zS3OJRVnbSZtHQqWO-RvoznJ34HjG6M5CDlKIXXTyAuZvVS235fZ9juweln5KS77w1w80Jk113rAW/s1600/claude.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 15:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Extension, Flaw, Enabled, Zero-Click, XSS, Prompt, Injection, via, Any, Website</media:keywords>
</item>

<item>
<title>Masters of Imitation: How Hackers and Art Forgers Perfect the Art of Deception</title>
<link>https://block385.com/masters-of-imitation-how-hackers-and-art-forgers-perfect-the-art-of-deception</link>
<guid>https://block385.com/masters-of-imitation-how-hackers-and-art-forgers-perfect-the-art-of-deception</guid>
<description><![CDATA[ Unmasking impostors is something the art world has faced for decades, and there are valuable lessons from the works of Elmyr de Hory that can apply to the world of defensive cybersecurity. During the 1960s, de Hory gained infamy as a premier forger, passing off counterfeit masterworks of Picasso, Matisse, and Renoir to unsuspecting collectors and renowned museums. Over the next several decades, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicYccGrhSqLyV14fb0UKZKIns-G-9cU181ytP5rPJvhMDJLPbmBBgiTIBALloFdEy_87wloWgNeE3zCfQEYoS7uPOLec7Uk40LT9KFOiov2psTWX4XIabr-UJql5ILHDQn0o8Tc8H7PwJSF9y8Yh3hR_iolMcCXBpGxgcwFtPAbYDtzXo26DZspMORcKs/s1600/core.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 15:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Masters, Imitation:, How, Hackers, and, Art, Forgers, Perfect, the, Art, Deception</media:keywords>
</item>

<item>
<title>ThreatsDay Bulletin: PQC Push, AI Vuln Hunting, Pirated Traps, Phishing Kits &amp;amp; 20 More Stories</title>
<link>https://block385.com/threatsday-bulletin-pqc-push-ai-vuln-hunting-pirated-traps-phishing-kits-20-more-stories</link>
<guid>https://block385.com/threatsday-bulletin-pqc-push-ai-vuln-hunting-pirated-traps-phishing-kits-20-more-stories</guid>
<description><![CDATA[ Some weeks in security feel loud. This one feels sneaky. Less big dramatic fireworks, more of that slow creeping sense that too many people are getting way too comfortable abusing things they probably shouldn’t even be touching.
There’s a little bit of everything in this one, too. Weird delivery tricks, old problems coming back in slightly worse forms, shady infrastructure doing ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOuz5FhCwEEsebWV1fHdF2VE-lnNBee6FrzMYsTdEODBsw07F76vTo3-UJKUz7QENWIUU_J7IdNj2vlhZbbdL5Chz6Vt6SyEbIwH-vw3J76SlUT02eZwbGHG5egcJNFeaKBd3sdLrp7egajwLniaeBMwZdXAMv3la2Ywzxin4gLiZK6lHbdPSzUDFCuWHF/s1600/tday-main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 15:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ThreatsDay, Bulletin:, PQC, Push, Vuln, Hunting, Pirated, Traps, Phishing, Kits, More, Stories</media:keywords>
</item>

<item>
<title>Mission to smuggle $170 million worth of AI tech to China collapsed for three men</title>
<link>https://block385.com/mission-to-smuggle-170-million-worth-of-ai-tech-to-china-collapsed-for-three-men</link>
<guid>https://block385.com/mission-to-smuggle-170-million-worth-of-ai-tech-to-china-collapsed-for-three-men</guid>
<description><![CDATA[ Three individuals, Stanley Yi Zheng, Matthew Kelly, and Tommy Shad English, have been charged with conspiracy to commit smuggling and export control violations after allegedly attempting to procure millions of dollars’ worth of restricted computer chips from a California-based hardware company. In October 2023, Tommy Shad English, claiming to represent a Thailand-based company, ordered 750 computer servers worth about $170 million from a U.S. hardware firm, including 600 with export-controlled chips that require a license … More →
The post Mission to smuggle $170 million worth of AI tech to China collapsed for three men appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/02/16114335/usa-doj-1400-1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 14:00:17 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mission, smuggle, 170, million, worth, tech, China, collapsed, for, three, men</media:keywords>
</item>

<item>
<title>GitHub jumps on the bandwagon and will use your data to train AI</title>
<link>https://block385.com/github-jumps-on-the-bandwagon-and-will-use-your-data-to-train-ai</link>
<guid>https://block385.com/github-jumps-on-the-bandwagon-and-will-use-your-data-to-train-ai</guid>
<description><![CDATA[ GitHub updated how it uses data to improve AI-powered coding assistance. Starting April 24, interaction data from Copilot Free, Pro, and Pro+ users may be used to train and improve GitHub’s models unless users opt out. Copilot Business and Copilot Enterprise users are not included in this change. Users who have already opted out do not need to take further action, as their preferences remain in place. If users choose to participate, GitHub may use … More →
The post GitHub jumps on the bandwagon and will use your data to train AI appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/07/18100110/github-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 14:00:07 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GitHub, jumps, the, bandwagon, and, will, use, your, data, train</media:keywords>
</item>

<item>
<title>Intermediaries Driving Global Spyware Market Expansion</title>
<link>https://block385.com/intermediaries-driving-global-spyware-market-expansion</link>
<guid>https://block385.com/intermediaries-driving-global-spyware-market-expansion</guid>
<description><![CDATA[ Third-party resellers and brokers foil transparency efforts and allow spyware to spread despite government restrictions, a study finds. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc550fe7dded72166/69c43489cd7376a927669888/intermediary-between-two-groups-Andrii_Yalanskyi-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 14:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Intermediaries, Driving, Global, Spyware, Market, Expansion</media:keywords>
</item>

<item>
<title>Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in New Mass Attacks</title>
<link>https://block385.com/coruna-ios-kit-reuses-2023-triangulation-exploit-code-in-new-mass-attacks</link>
<guid>https://block385.com/coruna-ios-kit-reuses-2023-triangulation-exploit-code-in-new-mass-attacks</guid>
<description><![CDATA[ The kernel exploit for two security vulnerabilities used in the recently uncovered Apple iOS exploit kit known as Coruna is an updated version of the same exploit that was used in the Operation Triangulation campaign back in 2023, according to new findings from Kaspersky.
&quot;When Coruna was first reported, the public evidence wasn&#039;t sufficient to link its code to Triangulation — shared ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqfaEjph6_gMDAtZu968xynsgU3AggksTWUUL37NpNq6eQdTXMgQcv4JLSpNNMHSFGkKoHV6K7vmqLZ7bXIkXrHB5jF98F_sN48HDQo0nligJdOjeJ5lOzlUFrVzCKwt2MZDSsOVdfmCAaJV5ofwJN_5yIpTSpAFaZ9GrrytaoivkIr27YA0xqj1DzmbPx/s1600/coruna.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 13:30:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Coruna, iOS, Kit, Reuses, 2023, Triangulation, Exploit, Code, New, Mass, Attacks</media:keywords>
</item>

<item>
<title>[Webinar] Stop Guessing. Learn to Validate Your Defenses Against Real Attacks</title>
<link>https://block385.com/webinar-stop-guessing-learn-to-validate-your-defenses-against-real-attacks</link>
<guid>https://block385.com/webinar-stop-guessing-learn-to-validate-your-defenses-against-real-attacks</guid>
<description><![CDATA[ Most teams have security tools in place. Alerts are firing, dashboards look clean, threat intel is flowing in. On the surface, everything feels under control.
But one question usually stays unanswered: Would your defenses actually stop a real attack?
That’s where things get shaky. A control exists, so it’s assumed to work. A detection rule is active, so it’s expected to catch something. But very ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCypzkb6uvHuNx6LKknUqtvQFoqsr6aalztDeBKT1aaUASzfjZMZAZqExx1k0w5iKWl08lx3MxbM_FwWxAvBdZODEerioaMp8OHVvhSjC8VL3uAW9_NMniMl_niggBVhVMdDFu2324YyhW5TrK4fua1PXlrb0DweOULvNgi5mlQUZUct_dIX3OePrfqks/s1600/validate.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 13:30:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Webinar, Stop, Guessing., Learn, Validate, Your, Defenses, Against, Real, Attacks</media:keywords>
</item>

<item>
<title>Google races to secure encryption before quantum threats arrive</title>
<link>https://block385.com/google-races-to-secure-encryption-before-quantum-threats-arrive</link>
<guid>https://block385.com/google-races-to-secure-encryption-before-quantum-threats-arrive</guid>
<description><![CDATA[ Google is preparing for the quantum era, a turning point in digital security, with a 2029 timeline for post-quantum cryptography (PQC) migration. Security professionals warn that current encryption could be broken by large-scale quantum computers in the coming years. This risk is already relevant due to store-now-decrypt-later attacks. Google says organizations should adopt NIST-developed PQC standards before large-scale, fault-tolerant quantum computers become a reality. “That’s why we’ve adjusted our threat model to prioritize PQC migration … More →
The post Google races to secure encryption before quantum threats arrive appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/08/17144846/google-1500-2.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 12:00:30 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, races, secure, encryption, before, quantum, threats, arrive</media:keywords>
</item>

<item>
<title>Reddit declares war on bad bot activity</title>
<link>https://block385.com/reddit-declares-war-on-bad-bot-activity</link>
<guid>https://block385.com/reddit-declares-war-on-bad-bot-activity</guid>
<description><![CDATA[ Reddit is introducing changes to support interactions between people. The company is taking a bottom-up approach to help users understand when they are engaging with another person unless an account is labeled otherwise. Reddit plans to verify that users are human without requiring disclosure of real-world identity. How does it work Verified profiles for brands, publishers, and creators launched in late 2025 to help their content gain acceptance in relevant communities. The next step is … More →
The post Reddit declares war on bad bot activity appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/19140600/reddit-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 12:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Reddit, declares, war, bad, bot, activity</media:keywords>
</item>

<item>
<title>AI SOC vendors are selling a future that production deployments haven’t reached yet</title>
<link>https://block385.com/ai-soc-vendors-are-selling-a-future-that-production-deployments-havent-reached-yet</link>
<guid>https://block385.com/ai-soc-vendors-are-selling-a-future-that-production-deployments-havent-reached-yet</guid>
<description><![CDATA[ Vendors selling AI-powered security operations platforms have built their pitches around a consistent set of promises: autonomous threat investigation, dramatic reductions in analyst workload, and an accelerating path toward humanless operations. Practitioners buying and deploying those platforms describe something different. A report by Anton Chuvakin, Security Advisor at Google Cloud’s Office of the CISO, and Oliver Rochford, co-founder of Aunoo AI, draws on more than 30 vendor briefings, public practitioner commentary from Reddit and Discord, … More →
The post AI SOC vendors are selling a future that production deployments haven’t reached yet appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/19120036/ai-hand-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 10:00:19 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SOC, vendors, are, selling, future, that, production, deployments, haven’t, reached, yet</media:keywords>
</item>

<item>
<title>DataBahn brings AI&#45;driven intelligence into the security pipeline</title>
<link>https://block385.com/databahn-brings-ai-driven-intelligence-into-the-security-pipeline</link>
<guid>https://block385.com/databahn-brings-ai-driven-intelligence-into-the-security-pipeline</guid>
<description><![CDATA[ DataBahn.ai has announced Autonomous In-Stream Data Intelligence (AIDI), a new operating model for security data pipelines in which data is continuously interpreted, validated, and acted on in real time as it flows. Building on its AI-native foundation, DataBahn advances the pipeline from intelligent data preparation to an active system of in-stream decision-making, enabling organizations to detect issues earlier, adapt dynamically and ensure data is trusted before it reaches downstream systems. DataBahn is also introducing the … More →
The post DataBahn brings AI-driven intelligence into the security pipeline appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/07/11203450/data_analytics3.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 10:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DataBahn, brings, AI-driven, intelligence, into, the, security, pipeline</media:keywords>
</item>

<item>
<title>WebRTC Skimmer Bypasses CSP to Steal Payment Data from E&#45;Commerce Sites</title>
<link>https://block385.com/webrtc-skimmer-bypasses-csp-to-steal-payment-data-from-e-commerce-sites</link>
<guid>https://block385.com/webrtc-skimmer-bypasses-csp-to-steal-payment-data-from-e-commerce-sites</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a new payment skimmer that uses WebRTC data channels as a means to receive payloads and exfiltrate data, effectively bypassing security controls.
&quot;Instead of the usual HTTP requests or image beacons, this malware uses WebRTC data channels to load its payload and exfiltrate stolen payment data,&quot; Sansec said in a report published this week.
The attack, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDIJhct-gQspWhgoCYGYYTokFv7FUIEMJqaILu_8IfMO3siPXFxR9g6eek-vKmgpFFO5QKCLBvl7pK8gFOGf8ZQuR6wVxOeBOxDm43bCBdmLDhPTyIGhoFssJGBUn9in_jfKwIvcyf9TERfomsZOjcPs4CKnYsYyW_jLaX3jbgm-LT4TORzq4g3ik0cB10/s1600/cards.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 09:30:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>WebRTC, Skimmer, Bypasses, CSP, Steal, Payment, Data, from, E-Commerce, Sites</media:keywords>
</item>

<item>
<title>Unbreakable Enterprise Kernel 8.2 ships with confidential computing support, XFS live repair</title>
<link>https://block385.com/unbreakable-enterprise-kernel-82-ships-with-confidential-computing-support-xfs-live-repair</link>
<guid>https://block385.com/unbreakable-enterprise-kernel-82-ships-with-confidential-computing-support-xfs-live-repair</guid>
<description><![CDATA[ Many enterprise Linux deployments rely on hardware-level memory isolation to protect sensitive workloads from co-tenants and compromised hypervisors. Oracle’s Unbreakable Enterprise Kernel 8.2 (UEK 8.2) extends that capability on Oracle Linux with support for Intel Trust Domain Extensions, along with a set of file system and memory management changes intended to reduce downtime and improve diagnostic visibility. UEK 8.2 is based on the mainline long-term stable Linux 6.12 kernel and carries the release number 6.12.0-200. … More →
The post Unbreakable Enterprise Kernel 8.2 ships with confidential computing support, XFS live repair appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/20142404/oracle-linux-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 08:00:41 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Unbreakable, Enterprise, Kernel, 8.2, ships, with, confidential, computing, support, XFS, live, repair</media:keywords>
</item>

<item>
<title>Who owns AI agent access? At most companies, nobody knows</title>
<link>https://block385.com/who-owns-ai-agent-access-at-most-companies-nobody-knows</link>
<guid>https://block385.com/who-owns-ai-agent-access-at-most-companies-nobody-knows</guid>
<description><![CDATA[ AI agents are operating across production enterprise environments at scale, and the identity infrastructure managing their access has not kept up with their deployment. A January 2026 survey of 228 IT and security professionals, conducted by the Cloud Security Alliance, finds that the majority of organizations have AI agents active in core systems, with fragmented ownership of how those agents authenticate and what they can access. Agents are embedded in production systems Task-automation agents are … More →
The post Who owns AI agent access? At most companies, nobody knows appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/06/25090250/ai_agent-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 08:00:33 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Who, owns, agent, access, most, companies, nobody, knows</media:keywords>
</item>

<item>
<title>Your facilities run on fragile supply chains and nobody wants to admit it</title>
<link>https://block385.com/your-facilities-run-on-fragile-supply-chains-and-nobody-wants-to-admit-it</link>
<guid>https://block385.com/your-facilities-run-on-fragile-supply-chains-and-nobody-wants-to-admit-it</guid>
<description><![CDATA[ In this Help Net Security interview, Christa Dodoo, Global Chair at IFMA, discusses how facility managers are managing supply chain risk in critical building systems. She explains how sourcing, localized redundancy, and flexible infrastructure design are being integrated into resilience planning. Dodoo also shares practical approaches such as regional vendor networks, alternative contracts, and strategic inventory to maintain continuity during disruptions. Supply chains for critical building systems, HVAC components, fire suppression materials, access control hardware, … More →
The post Your facilities run on fragile supply chains and nobody wants to admit it appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/24143253/christa_dodoo-2-ifma.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 08:00:21 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, facilities, run, fragile, supply, chains, and, nobody, wants, admit</media:keywords>
</item>

<item>
<title>A nearly undetectable LLM attack needs only a handful of poisoned samples</title>
<link>https://block385.com/a-nearly-undetectable-llm-attack-needs-only-a-handful-of-poisoned-samples</link>
<guid>https://block385.com/a-nearly-undetectable-llm-attack-needs-only-a-handful-of-poisoned-samples</guid>
<description><![CDATA[ Prompt engineering has become a standard part of how large language models are deployed in production, and it introduces an attack surface most organizations have not yet addressed. Researchers have developed and tested a prompt-based backdoor attack method, called ProAttack, that achieves attack success rates approaching 100% on multiple text classification benchmarks without altering sample labels or injecting external trigger words. A defense paradigm for mitigating backdoor attacks through LoRA-based fine-tuning of language models (Source: … More →
The post A nearly undetectable LLM attack needs only a handful of poisoned samples appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/05103603/ai_vs_human.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 08:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>nearly, undetectable, LLM, attack, needs, only, handful, poisoned, samples</media:keywords>
</item>

<item>
<title>At RSAC, the EU Leads While US Officials Are Sidelined</title>
<link>https://block385.com/at-rsac-the-eu-leads-while-us-officials-are-sidelined</link>
<guid>https://block385.com/at-rsac-the-eu-leads-while-us-officials-are-sidelined</guid>
<description><![CDATA[ While US government sits out this year, EU officials are on the ground in San Francisco leading the conversations on today&#039;s top cybersecurity challenges. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltb35ee8873789c8f7/69c449c675d6b1b7bb6bf41e/US_and_EU_Dragon_Claws_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 26 Mar 2026 00:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>RSAC, the, Leads, While, Officials, Are, Sidelined</media:keywords>
</item>

<item>
<title>LeakBase Admin Arrested in Russia Over Massive Stolen Credential Marketplace</title>
<link>https://block385.com/leakbase-admin-arrested-in-russia-over-massive-stolen-credential-marketplace</link>
<guid>https://block385.com/leakbase-admin-arrested-in-russia-over-massive-stolen-credential-marketplace</guid>
<description><![CDATA[ The alleged administrator of the LeakBase cybercrime forum has been arrested by Russian law enforcement authorities, state media reported Thursday.
According to TASS and MVD Media, a news website linked to the Russian Interior Ministry, the suspect is a resident of the city of Taganrog. The suspect is said to have been detained for creating and managing a criminal site that allowed stolen ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjj9UqvCgUXI-P9n0pHIj0a2d6gtlUe5ioSOzReAYnBthLWrwGhD0B9EKIlrrhiA8gsF61npoVKP8y1HftTKWD9xgTg0qBOHw2N3qn0Gak0BUAV9Jt2s8BmhzR9cLjOE5ynzKm8obB3G-fECJQ3bN1G8GVv2wgyKkLZ5JpYQKUyuVtTa2z27pHL9IN-th1k/s1600/leakbase.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 19:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>LeakBase, Admin, Arrested, Russia, Over, Massive, Stolen, Credential, Marketplace</media:keywords>
</item>

<item>
<title>Botnet operator behind $14 million in ransomware extortion payments gets 24 months behind bars</title>
<link>https://block385.com/botnet-operator-behind-14-million-in-ransomware-extortion-payments-gets-24-months-behind-bars</link>
<guid>https://block385.com/botnet-operator-behind-14-million-in-ransomware-extortion-payments-gets-24-months-behind-bars</guid>
<description><![CDATA[ A Russian national has been sentenced to 24 months in prison after admitting he managed a botnet used to launch ransomware attacks against dozens of U.S. companies. The judge also imposed a $100,000 fine and ordered him to forfeit $1.6 million linked to the scheme. Court records show that from 2017 to 2021, Ilya Angelov, 40, of Tolyatti, Russia, who used the aliases “milan” and “okart,” co-managed a Russia-based cybercrime group tracked by the FBI … More →
The post Botnet operator behind $14 million in ransomware extortion payments gets 24 months behind bars appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/07/29101917/jail-prison.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 18:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Botnet, operator, behind, 14, million, ransomware, extortion, payments, gets, months, behind, bars</media:keywords>
</item>

<item>
<title>Blame Game: Why Public Cyber Attribution Carries Risks</title>
<link>https://block385.com/blame-game-why-public-cyber-attribution-carries-risks</link>
<guid>https://block385.com/blame-game-why-public-cyber-attribution-carries-risks</guid>
<description><![CDATA[ Publicly accusing an entity of a cyberattack could have negative consequences that organizations should consider before taking the plunge. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltbbe33d71e28ff223/69c3e7ff61dacc035fd0cad3/Attribution_rule_book_designer491_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 18:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Blame, Game:, Why, Public, Cyber, Attribution, Carries, Risks</media:keywords>
</item>

<item>
<title>Phishers Pose as Palo Alto Networks&amp;apos; Recruiters for Months in Job Scam</title>
<link>https://block385.com/phishers-pose-as-palo-alto-networks-recruiters-for-months-in-job-scam</link>
<guid>https://block385.com/phishers-pose-as-palo-alto-networks-recruiters-for-months-in-job-scam</guid>
<description><![CDATA[ A series of campaigns that began in August aim to defraud job candidates, using psychological tactics and data scraped from LinkedIn profiles. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blta383f95ada672aca/69c3c4983a227b9b4df06359/Jobs_(1800)_Panther_Media_GmbH_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 18:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Phishers, Pose, Palo, Alto, Networks, Recruiters, for, Months, Job, Scam</media:keywords>
</item>

<item>
<title>GlassWorm Malware Uses Solana Dead Drops to Deliver RAT and Steal Browser, Crypto Data</title>
<link>https://block385.com/glassworm-malware-uses-solana-dead-drops-to-deliver-rat-and-steal-browser-crypto-data</link>
<guid>https://block385.com/glassworm-malware-uses-solana-dead-drops-to-deliver-rat-and-steal-browser-crypto-data</guid>
<description><![CDATA[ Cybersecurity researchers have flagged a new evolution of the GlassWorm campaign that delivers a multi-stage framework capable of comprehensive data theft and installing a remote access trojan (RAT), which deploys an information-stealing Google Chrome extension masquerading as an offline version of Google Docs.
&quot;It logs keystrokes, dumps cookies and session tokens, captures screenshots, and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvLAu4RdpX-vvdNOKVtvqBhpnDMoSdpatgQ3X32zeCmcAhOUZxJo37kHAf-0sBO3tTY8Pc6i4Jr9CWHwZ1nR7ikRy86CVMizlgDH40OF0kr3P7otHCE9-3ghivGFG1bBoRrWsW-gD-OAqt7DI6pRuPA_NtnUkoQbW_FPB1NdgNmQwdhiFLqiWo1dHnsu2P/s1600/main-s.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 17:30:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GlassWorm, Malware, Uses, Solana, Dead, Drops, Deliver, RAT, and, Steal, Browser, Crypto, Data</media:keywords>
</item>

<item>
<title>DigiCert Document Trust Manager enhancements improve document security and compliance</title>
<link>https://block385.com/digicert-document-trust-manager-enhancements-improve-document-security-and-compliance</link>
<guid>https://block385.com/digicert-document-trust-manager-enhancements-improve-document-security-and-compliance</guid>
<description><![CDATA[ DigiCert has announced enhancements to its Document Trust Manager solution to help organisations combat rising document fraud, simplify global compliance, and strengthen trust in digital transactions in the age of AI. Unlike traditional signing tools that require separate regional or departmental infrastructure to meet standards such as AATL and eIDAS, Document Trust Manager centralises signing assurance management in a single solution.     The surge in generative AI and digital transformation has dramatically increased the … More →
The post DigiCert Document Trust Manager enhancements improve document security and compliance appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 16:00:20 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DigiCert, Document, Trust, Manager, enhancements, improve, document, security, and, compliance</media:keywords>
</item>

<item>
<title>Vorlon adds forensics and response to secure AI agents</title>
<link>https://block385.com/vorlon-adds-forensics-and-response-to-secure-ai-agents</link>
<guid>https://block385.com/vorlon-adds-forensics-and-response-to-secure-ai-agents</guid>
<description><![CDATA[ Vorlon has unveiled AI Agent Flight Recorder and AI Agent Action Center, adding forensics and coordinated response to secure enterprise agentic ecosystems and close a key security gap. The agentic ecosystem contains SaaS applications, AI agents, API integrations, non-human identities, and the sensitive data flows connecting them. It’s become the fastest-growing attack surface in the enterprise, moves at machine speed, and most organizations lack adequate supervision. The Agentic Ecosystem Security Gap: 2026 CISO Report, a … More →
The post Vorlon adds forensics and response to secure AI agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/29221650/ai-forensics.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 16:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vorlon, adds, forensics, and, response, secure, agents</media:keywords>
</item>

<item>
<title>SANS: Top 5 Most Dangerous New Attack Techniques to Watch</title>
<link>https://block385.com/sans-top-5-most-dangerous-new-attack-techniques-to-watch</link>
<guid>https://block385.com/sans-top-5-most-dangerous-new-attack-techniques-to-watch</guid>
<description><![CDATA[ For the first time, SANS Institute&#039;s five top attack techniques all have one thing in common – AI. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc5b7ebf765a3de26/69c3069dcf4b0937b7412d06/AI_button_phitoon_promkunpitak_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 16:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SANS:, Top, Most, Dangerous, New, Attack, Techniques, Watch</media:keywords>
</item>

<item>
<title>Why a &amp;apos;Near Miss&amp;apos; Database Is Key to Improving Information Sharing</title>
<link>https://block385.com/why-a-near-miss-database-is-key-to-improving-information-sharing</link>
<guid>https://block385.com/why-a-near-miss-database-is-key-to-improving-information-sharing</guid>
<description><![CDATA[ Organizations disclose attack details, though information may be limited, following a breach, but what if they did the same with close calls? ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3f4e5dfde3293085/64f17dc3598d8097415a9af7/confusion-Andriy-Popov-alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 16:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, Near, Miss, Database, Key, Improving, Information, Sharing</media:keywords>
</item>

<item>
<title>Ex&#45;NSA Directors Discuss &amp;apos;Red Line&amp;apos; for Offensive Cyberattacks</title>
<link>https://block385.com/ex-nsa-directors-discuss-red-line-for-offensive-cyberattacks</link>
<guid>https://block385.com/ex-nsa-directors-discuss-red-line-for-offensive-cyberattacks</guid>
<description><![CDATA[ Four former NSA chiefs representing a near-complete history of US Cyber Command debated and discussed the role of offensive cyber in the government. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltba60c0dd556d976d/69c36d2546de0c75e0fbcc67/NSA_panel_Alexander_Culafi.JPEG" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 16:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ex-NSA, Directors, Discuss, Red, Line, for, Offensive, Cyberattacks</media:keywords>
</item>

<item>
<title>Njordium AI blocks fake invoices and fraudulent payments</title>
<link>https://block385.com/njordium-ai-blocks-fake-invoices-and-fraudulent-payments</link>
<guid>https://block385.com/njordium-ai-blocks-fake-invoices-and-fraudulent-payments</guid>
<description><![CDATA[ Njordium Cyber Group has launched its new AI Fraud Detection Module, a self-learning AI engine integrated into the recently released Vendor Management System (VMS). The module instantly detects and neutralises fake invoices, phantom services or products, and inflated pricing. Fully transparent and compliant with the EU AI Act, it delivers a regulator-aligned solution to Europe’s growing invoice fraud problem. According to the Expert Group on Public Economics (ESO) report Svarta siffror (2026:1), Sweden’s criminal economy … More →
The post Njordium AI blocks fake invoices and fraudulent payments appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 14:00:43 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Njordium, blocks, fake, invoices, and, fraudulent, payments</media:keywords>
</item>

<item>
<title>Akamai Brand Guardian detects and removes AI&#45;driven brand impersonation</title>
<link>https://block385.com/akamai-brand-guardian-detects-and-removes-ai-driven-brand-impersonation</link>
<guid>https://block385.com/akamai-brand-guardian-detects-and-removes-ai-driven-brand-impersonation</guid>
<description><![CDATA[ Akamai has introduced Akamai Brand Guardian, an evolution of Brand Protector that uses AI to identify and manage brand impersonation at scale. Scammers are exploiting the widespread availability of generative AI to deploy sophisticated fake websites and digital identities in seconds, making it nearly impossible for businesses to keep pace using manual discovery methods. For companies in sectors like financial services, retail, and healthcare, these fraudulent sites threaten digital integrity, which often leads to lost … More →
The post Akamai Brand Guardian detects and removes AI-driven brand impersonation appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 14:00:37 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Akamai, Brand, Guardian, detects, and, removes, AI-driven, brand, impersonation</media:keywords>
</item>

<item>
<title>LiteLLM PyPI packages compromised in expanding TeamPCP supply chain attacks</title>
<link>https://block385.com/litellm-pypi-packages-compromised-in-expanding-teampcp-supply-chain-attacks</link>
<guid>https://block385.com/litellm-pypi-packages-compromised-in-expanding-teampcp-supply-chain-attacks</guid>
<description><![CDATA[ A slew of supply chain attacks against popular open source tools and packages appears to have been orchestrated by TeamPCP, a cybercriminal group that rose to prominence in late 2025. The latest victim of the group is BerryAI’s popular LiteLLM library, a unified interface that makes it easier for apps to switch between various LLMs: on March 24, TeamPCP uploaded two compromised versions (1.82.7 and 1.82.8) on PyPI that included a credential stealer and a … More →
The post LiteLLM PyPI packages compromised in expanding TeamPCP supply chain attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/12/19144006/supply_chain_1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 14:00:25 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>LiteLLM, PyPI, packages, compromised, expanding, TeamPCP, supply, chain, attacks</media:keywords>
</item>

<item>
<title>Gemini picks up criminal activity buried in dark web noise</title>
<link>https://block385.com/gemini-picks-up-criminal-activity-buried-in-dark-web-noise</link>
<guid>https://block385.com/gemini-picks-up-criminal-activity-buried-in-dark-web-noise</guid>
<description><![CDATA[ To help teams make faster and more accurate decisions on emerging threats, Google has introduced a dark web intelligence capability in Google Threat Intelligence. Powered by Gemini, the feature analyzes millions of dark web events each day and surfaces threats relevant to an organization’s operations. “Instead of requiring your team to manually input and update keywords, our new dark web intelligence capability uses Gemini to autonomously build an organizational profile that is specific to your … More →
The post Gemini picks up criminal activity buried in dark web noise appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/03/19124947/dark_web-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 14:00:15 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Gemini, picks, criminal, activity, buried, dark, web, noise</media:keywords>
</item>

<item>
<title>AI&#45;Native Security Is a Must to Counter AI&#45;Based Attacks</title>
<link>https://block385.com/ai-native-security-is-a-must-to-counter-ai-based-attacks</link>
<guid>https://block385.com/ai-native-security-is-a-must-to-counter-ai-based-attacks</guid>
<description><![CDATA[ Attacks by artificial intelligence agents are a reality. Experts at Nvidia&#039;s GTC conference say defenders need to use the same tools to fight them off. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6da71c7236b44e30/694ae29f19b0239070b0480f/AI_brain_sleepyellow_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 14:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AI-Native, Security, Must, Counter, AI-Based, Attacks</media:keywords>
</item>

<item>
<title>CSA Launches CSAI Foundation for AI Security</title>
<link>https://block385.com/csa-launches-csai-foundation-for-ai-security</link>
<guid>https://block385.com/csa-launches-csai-foundation-for-ai-security</guid>
<description><![CDATA[ Cloud Security Alliance creates dedicated nonprofit to govern autonomous AI agent ecosystems through risk intelligence and certification ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltb9b937f8191f7db1/68373d80713d870ca9cf4bdf/AI_(1800)_imageBROKER.com_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 14:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CSA, Launches, CSAI, Foundation, for, Security</media:keywords>
</item>

<item>
<title>The Kill Chain Is Obsolete When Your AI Agent Is the Threat</title>
<link>https://block385.com/the-kill-chain-is-obsolete-when-your-ai-agent-is-the-threat</link>
<guid>https://block385.com/the-kill-chain-is-obsolete-when-your-ai-agent-is-the-threat</guid>
<description><![CDATA[ In September 2025, Anthropic disclosed that a state-sponsored threat actor used an AI coding agent to execute an autonomous cyber espionage campaign against 30 global targets. The AI handled 80-90% of tactical operations on its own, performing reconnaissance, writing exploit code, and attempting lateral movement at machine speed.
This incident is worrying, but there&#039;s a scenario that should ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIxwugQQz3vBJ2pK2wCB_DYKIxoDHo60x7SHE5WQonARyDulZoAc7X7LDiThunfB_Q60swcE_gAMuqSwHykOcGvFnU3TRlGMbIiYJvAuJAStlKGb8m6wjPeQx62PsOMzAaF6RfDaK6G8sPzgMfzNOu1KZZ5AEUnjq5G9NusUMnMo5EEpIQWN9DyajDuCs/s1600/reco.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 13:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Kill, Chain, Obsolete, When, Your, Agent, the, Threat</media:keywords>
</item>

<item>
<title>Russian Hacker Sentenced to 2 Years for TA551 Botnet&#45;Driven Ransomware Attacks</title>
<link>https://block385.com/russian-hacker-sentenced-to-2-years-for-ta551-botnet-driven-ransomware-attacks</link>
<guid>https://block385.com/russian-hacker-sentenced-to-2-years-for-ta551-botnet-driven-ransomware-attacks</guid>
<description><![CDATA[ The U.S. Department of Justice (DoJ) said a Russian national has been sentenced to two years in prison for managing a botnet that was used to launch ransomware attacks against U.S. companies.
Ilya Angelov, 40, of Tolyatti, Russia, was also fined $100,000. Angelov, who went by the online aliases &quot;milan&quot; and &quot;okart,&quot; is said to have co-managed a Russia-based cybercriminal group known as TA551 (aka ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSFQsR3JgSCA44WGyYmcmFuACIlDkUDxOnRar3b3B-JHXTZq_dxARV6GEM5gvclJQktlfwnU88fV1Gzcr3HO7EJHoeE5kYA262Vv0SlCB6XPuyAiTSas8Iw0Ca5QkvnGaduv0Dt9euHjKn6A6lYWAHkpXPjbBRdmV1piwxsILM8wcfgT6mjtgQeEB4BUk/s1600/ransomware-russia.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 13:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Russian, Hacker, Sentenced, Years, for, TA551, Botnet-Driven, Ransomware, Attacks</media:keywords>
</item>

<item>
<title>Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse</title>
<link>https://block385.com/device-code-phishing-hits-340-microsoft-365-orgs-across-five-countries-via-oauth-abuse</link>
<guid>https://block385.com/device-code-phishing-hits-340-microsoft-365-orgs-across-five-countries-via-oauth-abuse</guid>
<description><![CDATA[ Cybersecurity researchers are calling attention to an active device code phishing campaign that&#039;s targeting Microsoft 365 identities across more than 340 organizations in the U.S., Canada, Australia, New Zealand, and Germany.
The activity, per Huntress, was first spotted on February 19, 2026, with subsequent cases appearing at an accelerated pace since then. Notably, the campaign leverages ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifvDHwUAT0Y5sILbpMYi15pftc8kD-oPKrtaUucJ0PLeFRnxKsA14uMC3zCpTPZwj0w7GBTqFQCMfmwzzy_tv-RYTVBijk_x2KWzKkS68n9QfolIhr2B3rSMTGJWg3qt9ZbTYWDiyHmKNT6yD47XPMyS2aj8DF_lyKGKKGWfIsohBlWJvjS_Z3j_XqMZQ/s1600/ms-phish-kit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 13:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Device, Code, Phishing, Hits, 340, Microsoft, 365, Orgs, Across, Five, Countries, via, OAuth, Abuse</media:keywords>
</item>

<item>
<title>Anthropic trims action approval loop, lets Claude Code make the call</title>
<link>https://block385.com/anthropic-trims-action-approval-loop-lets-claude-code-make-the-call</link>
<guid>https://block385.com/anthropic-trims-action-approval-loop-lets-claude-code-make-the-call</guid>
<description><![CDATA[ Auto mode is a new permissions feature in the Claude Code system that allows the AI to make approval decisions on a user’s behalf while safeguards review actions before execution. The feature is available on Team plans and requires administrator approval before use, with support for Enterprise and API users expected soon. It runs on newer models such as Claude Sonnet 4.6 and Claude Opus 4.6, and excludes older versions and third party platforms. By … More →
The post Anthropic trims action approval loop, lets Claude Code make the call appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/11120918/anthropic-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 12:00:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Anthropic, trims, action, approval, loop, lets, Claude, Code, make, the, call</media:keywords>
</item>

<item>
<title>Microsoft hands Entra ID users new option for MFA</title>
<link>https://block385.com/microsoft-hands-entra-id-users-new-option-for-mfa</link>
<guid>https://block385.com/microsoft-hands-entra-id-users-new-option-for-mfa</guid>
<description><![CDATA[ Organizations rely on MFA to enforce identity checks before granting access to systems and services. Microsoft has made external MFA generally available in Microsoft Entra ID, expanding support for third-party identity providers. Configure external MFA in Microsoft Entra ID (Source: Microsoft) External MFA supports organizations that use third-party MFA solutions to meet regulatory or business requirements, handle scenarios such as mergers and acquisitions, or maintain a consistent MFA approach within Microsoft Entra ID. Built on … More →
The post Microsoft hands Entra ID users new option for MFA appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/06/12183518/microsoft_entra_id.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 12:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, hands, Entra, users, new, option, for, MFA</media:keywords>
</item>

<item>
<title>Your security stack looks fine from the dashboard and that’s the problem</title>
<link>https://block385.com/your-security-stack-looks-fine-from-the-dashboard-and-thats-the-problem</link>
<guid>https://block385.com/your-security-stack-looks-fine-from-the-dashboard-and-thats-the-problem</guid>
<description><![CDATA[ One in five enterprise endpoints is operating outside a protected and enforceable state on any given day, according to device telemetry collected across tens of millions of corporate PCs. That figure, drawn from Absolute Security’s 2026 Resilience Risk Index, has barely moved in a year, even as organizations continue to add security tools and increase spending. The report, which draws on multi-year endpoint telemetry alongside external research, finds that the gap between security deployment and … More →
The post Your security stack looks fine from the dashboard and that’s the problem appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/24081916/downtime-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 10:01:53 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, security, stack, looks, fine, from, the, dashboard, and, that’s, the, problem</media:keywords>
</item>

<item>
<title>Why your phishing simulations aren’t building a security culture</title>
<link>https://block385.com/why-your-phishing-simulations-arent-building-a-security-culture</link>
<guid>https://block385.com/why-your-phishing-simulations-arent-building-a-security-culture</guid>
<description><![CDATA[ Security culture isn’t built by phishing simulations. In this Help Net Security video, Dan Potter, VP of Cyber Resilience at Immersive, argues that annual training videos and quarterly phishing tests happen in calm, controlled settings that tell us nothing about how people perform when a real incident hits. Real attacks trigger anxiety, cognitive narrowing, and hesitation. People fixate on the loudest problem in the room, lose sight of the bigger picture, and slow down when … More →
The post Why your phishing simulations aren’t building a security culture appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/07/18123155/phishing_simulations-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 10:01:46 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, your, phishing, simulations, aren’t, building, security, culture</media:keywords>
</item>

<item>
<title>You don’t have to choose between BAS or automated pentesting, you shouldn’t</title>
<link>https://block385.com/you-dont-have-to-choose-between-bas-or-automated-pentesting-you-shouldnt</link>
<guid>https://block385.com/you-dont-have-to-choose-between-bas-or-automated-pentesting-you-shouldnt</guid>
<description><![CDATA[ There’s a debate making the rounds in security circles that sounds reasonable on the surface but falls apart under operational scrutiny: Which is better, breach and attack simulation (BAS) or automated penetration testing (APT)? Security vendors have stoked this debate for obvious reasons, with some even explicitly arguing that automated pentesting should replace BAS entirely. But for practitioners responsible for defending an organization, this framing is the problem. It represents a coverage regression disguised as … More →
The post You don’t have to choose between BAS or automated pentesting, you shouldn’t appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/02/07153034/breach-attack-1400.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 10:01:37 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>You, don’t, have, choose, between, BAS, automated, pentesting, you, shouldn’t</media:keywords>
</item>

<item>
<title>Training an AI agent to attack LLM applications like a real adversary</title>
<link>https://block385.com/training-an-ai-agent-to-attack-llm-applications-like-a-real-adversary</link>
<guid>https://block385.com/training-an-ai-agent-to-attack-llm-applications-like-a-real-adversary</guid>
<description><![CDATA[ Most enterprise software development teams now ship AI-powered applications faster than traditional penetration testing can keep up with. A security team with 500 applications may test each one once a year, or less. In the time between tests, the underlying models, integrations, and behaviors can change, with no corresponding security review. Novee launched a product it calls AI Red Teaming for LLM Applications, an AI pentesting agent built specifically to probe LLM-powered software. The company … More →
The post Training an AI agent to attack LLM applications like a real adversary appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/20105115/ai-faces-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 10:01:24 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Training, agent, attack, LLM, applications, like, real, adversary</media:keywords>
</item>

<item>
<title>HPE enhances security to support AI and distributed enterprise environments</title>
<link>https://block385.com/hpe-enhances-security-to-support-ai-and-distributed-enterprise-environments</link>
<guid>https://block385.com/hpe-enhances-security-to-support-ai-and-distributed-enterprise-environments</guid>
<description><![CDATA[ HPE has unveiled new security innovations designed to help organizations scale distributed operations, reduce cyber risk, and maintain consistent governance as AI adoption accelerates across the enterprise. To help enterprises securely adopt AI and turn resilience into a core business capability, HPE is introducing the HPE Juniper Networking SRX400 Series Firewalls, an expanded hybrid mesh security architecture, and resilience-centered enhancements to extend consistent protection across cloud, core and edge environments. “In the AI era, security … More →
The post HPE enhances security to support AI and distributed enterprise environments appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/22151120/firewall-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 10:01:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>HPE, enhances, security, support, and, distributed, enterprise, environments</media:keywords>
</item>

<item>
<title>Google’s TurboQuant cuts AI memory use without losing accuracy</title>
<link>https://block385.com/googles-turboquant-cuts-ai-memory-use-without-losing-accuracy</link>
<guid>https://block385.com/googles-turboquant-cuts-ai-memory-use-without-losing-accuracy</guid>
<description><![CDATA[ Large language models carry a persistent scaling problem. As context windows grow, the memory required to store key-value (KV) caches expands proportionally, consuming GPU memory and slowing inference. A team at Google Research has developed three compression algorithms: TurboQuant, PolarQuant, and Quantized Johnson-Lindenstrauss (QJL). All three are designed to compress those caches aggressively without degrading model output quality. The overhead problem in vector quantization Vector quantization has long been used to compress the high-dimensional numerical … More →
The post Google’s TurboQuant cuts AI memory use without losing accuracy appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/21130045/google-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 10:01:00 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google’s, TurboQuant, cuts, memory, use, without, losing, accuracy</media:keywords>
</item>

<item>
<title>Barracuda strengthens cyber resilience with BarracudaONE platform updates</title>
<link>https://block385.com/barracuda-strengthens-cyber-resilience-with-barracudaone-platform-updates</link>
<guid>https://block385.com/barracuda-strengthens-cyber-resilience-with-barracudaone-platform-updates</guid>
<description><![CDATA[ Barracuda Networks has announced advancements to the BarracudaONE cybersecurity platform and Barracuda Partner Success Program. The latest innovations strengthen cyber resilience across email, network access and generative AI usage, while the enhanced partner program delivers new benefits, incentives and tools that help partners accelerate growth and profitability. “Email and identity‑based attacks are intensifying at an unprecedented pace, and generative AI is introducing an entirely new layer of risk,” said Rohit Ghai, Chief Executive Officer at … More →
The post Barracuda strengthens cyber resilience with BarracudaONE platform updates appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 10:00:42 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Barracuda, strengthens, cyber, resilience, with, BarracudaONE, platform, updates</media:keywords>
</item>

<item>
<title>Tenable Hexa AI automates exposure management and security workflows</title>
<link>https://block385.com/tenable-hexa-ai-automates-exposure-management-and-security-workflows</link>
<guid>https://block385.com/tenable-hexa-ai-automates-exposure-management-and-security-workflows</guid>
<description><![CDATA[ Tenable has revealed Tenable Hexa AI, the agentic AI engine of the Tenable One Exposure Management Platform that automates security workflows and transforms exposure intelligence into coordinated action to reduce cyber risk. AI-powered cyberattacks, rapid vulnerability discovery and the explosion of AI-driven tools are expanding the attack surface faster than security teams can keep up. At the same time, security operations now involve a growing mix of humans, automation and AI agents operating across fragmented … More →
The post Tenable Hexa AI automates exposure management and security workflows appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/02/20120146/agentic_ai-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 10:00:32 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tenable, Hexa, automates, exposure, management, and, security, workflows</media:keywords>
</item>

<item>
<title>Spur Intelligence delivers deeper visibility into anonymized infrastructure</title>
<link>https://block385.com/spur-intelligence-delivers-deeper-visibility-into-anonymized-infrastructure</link>
<guid>https://block385.com/spur-intelligence-delivers-deeper-visibility-into-anonymized-infrastructure</guid>
<description><![CDATA[ Spur Intelligence has announced new enhancements to its IP intelligence platform, designed to give security and fraud teams deeper visibility into anonymized infrastructure and enable informed, real-time decisions on risky user sessions. New capabilities include AI service identification, a policy API for real-time session decisions, and enhanced geographic infrastructure insights. AI service tagging in the Spur IP context object As AI-driven automation and anonymization technologies proliferate across the internet, organizations face growing challenges in distinguishing … More →
The post Spur Intelligence delivers deeper visibility into anonymized infrastructure appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 10:00:20 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Spur, Intelligence, delivers, deeper, visibility, into, anonymized, infrastructure</media:keywords>
</item>

<item>
<title>Codenotary introduces AgentX for autonomous Linux infrastructure security</title>
<link>https://block385.com/codenotary-introduces-agentx-for-autonomous-linux-infrastructure-security</link>
<guid>https://block385.com/codenotary-introduces-agentx-for-autonomous-linux-infrastructure-security</guid>
<description><![CDATA[ Codenotary has announced the availability of AgentX, an autonomous platform designed to manage, secure, and protect large-scale Linux infrastructure in the cloud or on-premises through coordinated networks of AI agents. AgentX introduces a new approach to infrastructure operations by allowing distributed AI agents to collaborate, automating security enforcement, operational tasks, and lifecycle management while maintaining full permissions control and governance for administrators. AgentX continuously reviews configurations, user roles, and security controls across servers, clusters, and … More →
The post Codenotary introduces AgentX for autonomous Linux infrastructure security appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 10:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Codenotary, introduces, AgentX, for, autonomous, Linux, infrastructure, security</media:keywords>
</item>

<item>
<title>FCC Bans New Foreign&#45;Made Routers Over Supply Chain and Cyber Risk Concerns</title>
<link>https://block385.com/fcc-bans-new-foreign-made-routers-over-supply-chain-and-cyber-risk-concerns</link>
<guid>https://block385.com/fcc-bans-new-foreign-made-routers-over-supply-chain-and-cyber-risk-concerns</guid>
<description><![CDATA[ The U.S. Federal Communications Commission (FCC) said on Monday that it was banning the import of new, foreign-made consumer routers, citing &quot;unacceptable&quot; risks to cyber and national security.
The action was designed to safeguard Americans and the underlying communications networks the country relies on, FCC Chairman Brendan Carr said in a post on X. The development means that new models of ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCWdGgQ4RKWsSD83uBmdU0Vfi3E1vEi1qS7ImOYUXa9S6eDs5ShKP0tz3sZL5FPdt6lzwG4scb7HQPjGnsdPDFNWxZ2k8yK-whH4uU9_Ez3Nt5178ETgKceu4LpAPntUZZ7utBkHBd261B5Ltt2weQVT94qjY4wcRRGfSpv1sAZLjAVDc_oSNMPiISo4dU/s1600/routers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 09:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FCC, Bans, New, Foreign-Made, Routers, Over, Supply, Chain, and, Cyber, Risk, Concerns</media:keywords>
</item>

<item>
<title>TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 via Trivy CI/CD Compromise</title>
<link>https://block385.com/teampcp-backdoors-litellm-versions-18271828-via-trivy-cicd-compromise</link>
<guid>https://block385.com/teampcp-backdoors-litellm-versions-18271828-via-trivy-cicd-compromise</guid>
<description><![CDATA[ TeamPCP, the threat actor behind the recent compromises of Trivy and KICS, has now compromised a popular Python package named litellm, pushing two malicious versions containing a credential harvester, a Kubernetes lateral movement toolkit, and a persistent backdoor.
Multiple security vendors, including Endor Labs and JFrog, revealed that litellm versions 1.82.7 and 1.82.8 were published on March ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj52VkG6lfgHeRYSGJwB7xAkCm5_4uKyAUtZ3NiyGrlOTFU_zejzA3uU0HPKiFCCvp1PSXhtiSqTROkqIvJ3kur9VTYMRRQRV4M9_0p2PVw28DxOUbH_3CnZBgsLtiv3_0BBmyP792ONBzcl_yEwteI6uQ2GkLkj59el1hZwmHJEyZLo5wwLgbr5rEDi-r6/s1600/litellm.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 09:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TeamPCP, Backdoors, LiteLLM, Versions, 1.82.7–1.82.8, via, Trivy, CICD, Compromise</media:keywords>
</item>

<item>
<title>Iran Hacktivists Make Noise but Have Little Impact on War</title>
<link>https://block385.com/iran-hacktivists-make-noise-but-have-little-impact-on-war</link>
<guid>https://block385.com/iran-hacktivists-make-noise-but-have-little-impact-on-war</guid>
<description><![CDATA[ Iran-aligned groups are trying to make their mark in the Gulf, but the results have fallen short of remarkable. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltbb0fdc008e2181e3/69c2be0c15fb25e392a6c708/Iran-Skorzewiak-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 08:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Iran, Hacktivists, Make, Noise, but, Have, Little, Impact, War</media:keywords>
</item>

<item>
<title>Kali Linux 2026.1 ships BackTrack mode, eight new tools, and a kernel upgrade to 6.18</title>
<link>https://block385.com/kali-linux-20261-ships-backtrack-mode-eight-new-tools-and-a-kernel-upgrade-to-618</link>
<guid>https://block385.com/kali-linux-20261-ships-backtrack-mode-eight-new-tools-and-a-kernel-upgrade-to-618</guid>
<description><![CDATA[ Penetration testers running Kali Linux have a new release to work with. Version 2026.1 delivers the annual theme refresh, a new BackTrack-inspired mode in kali-undercover, eight tools added to the network repositories, a kernel bump to 6.18, and several Kali NetHunter changes. 2026 theme refresh Each year’s first Kali release brings a visual overhaul, and 2026.1 follows that pattern. The new theme covers the boot menu, installer, login display, and desktop, along with a fresh … More →
The post Kali Linux 2026.1 ships BackTrack mode, eight new tools, and a kernel upgrade to 6.18 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/25055853/kali-login-1400.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 06:00:05 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Kali, Linux, 2026.1, ships, BackTrack, mode, eight, new, tools, and, kernel, upgrade, 6.18</media:keywords>
</item>

<item>
<title>Checkmarx KICS Code Scanner Targeted in Widening Supply Chain Hit</title>
<link>https://block385.com/checkmarx-kics-code-scanner-targeted-in-widening-supply-chain-hit</link>
<guid>https://block385.com/checkmarx-kics-code-scanner-targeted-in-widening-supply-chain-hit</guid>
<description><![CDATA[ TeamPCP is the likely cyber threat actor behind attacks on Trivy, Checkmarx&#039;s KICS and VS Code plug-ins, and the LiteLLM AI library — and all signs point to more attacks to come. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc695e46616cc03ae/69c2f4e89279f2162fe82972/sschain_ImageFlow_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 00:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Checkmarx, KICS, Code, Scanner, Targeted, Widening, Supply, Chain, Hit</media:keywords>
</item>

<item>
<title>How AI Coding Tools Crushed the Endpoint Security Fortress</title>
<link>https://block385.com/how-ai-coding-tools-crushed-the-endpoint-security-fortress</link>
<guid>https://block385.com/how-ai-coding-tools-crushed-the-endpoint-security-fortress</guid>
<description><![CDATA[ Security vendors have spent years building up defenses around the endpoint, but one researcher says AI coding tools have brought the walls down. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blteb95272b2303ce6d/69c19c25ce26fd1445111e7f/castle_PictorialPressLtd_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 25 Mar 2026 00:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, Coding, Tools, Crushed, the, Endpoint, Security, Fortress</media:keywords>
</item>

<item>
<title>TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 Likely via Trivy CI/CD Compromise</title>
<link>https://block385.com/teampcp-backdoors-litellm-versions-18271828-likely-via-trivy-cicd-compromise</link>
<guid>https://block385.com/teampcp-backdoors-litellm-versions-18271828-likely-via-trivy-cicd-compromise</guid>
<description><![CDATA[ TeamPCP, the threat actor behind the recent compromises of Trivy and KICS, has now compromised a popular Python package named litellm, pushing two malicious versions containing a credential harvester, a Kubernetes lateral movement toolkit, and a persistent backdoor.
Multiple security vendors, including Endor Labs and JFrog, revealed that litellm versions 1.82.7 and 1.82.8 were published on ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmubYXPf6QmmyAgoyu58-O141BOTc-D3aKKUtKXg1IFX6pn4Wav7yspHRPiWKScygEd1vsHmeH5zQLjwG38pOlDggYgjBN7MzUTrb_3jQv_lXum7s7PXGo8aqvSws4QEkrC587wgBhgF5tmPEmhK_OCeTLm8YlcWxyw2-nQMiM9VS8VdC22-tDkVM5MEsb/s1600/lite.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 21:30:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TeamPCP, Backdoors, LiteLLM, Versions, 1.82.7–1.82.8, Likely, via, Trivy, CICD, Compromise</media:keywords>
</item>

<item>
<title>Tax Search Ads Deliver ScreenConnect Malware Using Huawei Driver to Disable EDR</title>
<link>https://block385.com/tax-search-ads-deliver-screenconnect-malware-using-huawei-driver-to-disable-edr</link>
<guid>https://block385.com/tax-search-ads-deliver-screenconnect-malware-using-huawei-driver-to-disable-edr</guid>
<description><![CDATA[ A large-scale malvertising campaign active since January 2026 has been observed targeting U.S.-based individuals searching for tax-related documents to serve rogue installers for ConnectWise ScreenConnect that drop a tool named HwAudKiller to blind security programs using the bring your own vulnerable driver (BYOVD) technique.
&quot;The campaign abuses Google Ads to serve rogue ScreenConnect ( ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHstwfvuhTqeOC7VWnSCBcxuxkGXQo_98_9hK16L_vSpzSRSYHXlBOeg2O61FYeF2rcfwnXFxzQHEkDyXYB6C_GtMIB-qEfIM_K3vMu-C_OHBNk5eOdwofhao0How3UZLVM1bQ4R5MzrGMSpIk74c_b0UI8ri7Itube7MGnrwEEoEHy-kOq1unklYy9zR5/s1600/tax-docs.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 19:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tax, Search, Ads, Deliver, ScreenConnect, Malware, Using, Huawei, Driver, Disable, EDR</media:keywords>
</item>

<item>
<title>Hackers Use Fake Resumes to Steal Enterprise Credentials and Deploy Crypto Miner</title>
<link>https://block385.com/hackers-use-fake-resumes-to-steal-enterprise-credentials-and-deploy-crypto-miner</link>
<guid>https://block385.com/hackers-use-fake-resumes-to-steal-enterprise-credentials-and-deploy-crypto-miner</guid>
<description><![CDATA[ An ongoing phishing campaign is targeting French-speaking corporate environments with fake resumes that lead to the deployment of cryptocurrency miners and information stealers.
&quot;The campaign uses highly obfuscated VBScript files disguised as resume/CV documents, delivered through phishing emails,&quot; Securonix researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee said in a report shared ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbL1vWsuHhVXpRJ6YeAB7bUhrZmz7Ba3LRQ7MsrXsIVCXfxCMUs4nedbI26D5FpMqQ0uL6APhIlu12GJdDMWZ9AbGiz7qu5gUinMjsmh6yxiuqZvUzSrzj7Iy-Ax4UoCl1BZAGb6kRE_XPaTbmKHK6zTvsRWWeNcrhh4toMR5Fi2o4et0H938i6UPN1r8M/s1600/malware-resume.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 19:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hackers, Use, Fake, Resumes, Steal, Enterprise, Credentials, and, Deploy, Crypto, Miner</media:keywords>
</item>

<item>
<title>Uncle Sam closes the door on all new foreign&#45;made routers</title>
<link>https://block385.com/uncle-sam-closes-the-door-on-all-new-foreign-made-routers</link>
<guid>https://block385.com/uncle-sam-closes-the-door-on-all-new-foreign-made-routers</guid>
<description><![CDATA[ The US Federal Communications Commission (FCC) has imposed a ban on all new routers manufactured overseas being imported into and sold within the United States.
The post Uncle Sam closes the door on all new foreign-made routers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/07/13141257/usa-flag.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 18:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Uncle, Sam, closes, the, door, all, new, foreign-made, routers</media:keywords>
</item>

<item>
<title>GitHub &amp;apos;OpenClaw Deployer&amp;apos; Repo Delivers Trojan Instead</title>
<link>https://block385.com/github-openclaw-deployer-repo-delivers-trojan-instead</link>
<guid>https://block385.com/github-openclaw-deployer-repo-delivers-trojan-instead</guid>
<description><![CDATA[ An AI-assisted campaign is spreading more than 300 poisoned packages for diverse assets ranging from developer tools to game cheats. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt748b478fe328b680/69c27f8c6afcd051e98ebac7/openclaw_Koshiro_K_shutterstock.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 18:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GitHub, OpenClaw, Deployer, Repo, Delivers, Trojan, Instead</media:keywords>
</item>

<item>
<title>Novee introduces autonomous AI red teaming to hunt LLM vulnerabilities</title>
<link>https://block385.com/novee-introduces-autonomous-ai-red-teaming-to-hunt-llm-vulnerabilities</link>
<guid>https://block385.com/novee-introduces-autonomous-ai-red-teaming-to-hunt-llm-vulnerabilities</guid>
<description><![CDATA[ Novee today introduced AI Red Teaming for LLM Applications for its AI penetration testing platform, designed to uncover security vulnerabilities in LLM-powered applications before attackers can exploit them. Enterprises are deploying AI-enabled software, from customer-facing chatbots to internal copilots and autonomous agents, and security teams are now facing a new class of risks, including prompt injection, jailbreak attempts, data exfiltration, and manipulation of agent behavior that traditional pentesting tools were never designed to detect. Unlike … More →
The post Novee introduces autonomous AI red teaming to hunt LLM vulnerabilities appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/19123949/novee-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 16:00:42 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Novee, introduces, autonomous, red, teaming, hunt, LLM, vulnerabilities</media:keywords>
</item>

<item>
<title>Darktrace expands MSSP offering with AI&#45;driven managed email security</title>
<link>https://block385.com/darktrace-expands-mssp-offering-with-ai-driven-managed-email-security</link>
<guid>https://block385.com/darktrace-expands-mssp-offering-with-ai-driven-managed-email-security</guid>
<description><![CDATA[ Darktrace has launched its managed security service for MSSPs, enabling partners to deliver AI-native email security with real-time detection, investigation, and response across the email ecosystem. The launch is supported by updates to the Darktrace Defenders Partner Program designed to provide flexibility and scalability for partners at every stage of their services maturity, helping them expand security offerings and deliver AI-native protection to customers around the world. Email threats continue to grow in sophistication as … More →
The post Darktrace expands MSSP offering with AI-driven managed email security appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/25130053/email-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 16:00:40 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Darktrace, expands, MSSP, offering, with, AI-driven, managed, email, security</media:keywords>
</item>

<item>
<title>Russian initial access broker helped ransomware gangs extort millions, sentenced to 81 months</title>
<link>https://block385.com/russian-initial-access-broker-helped-ransomware-gangs-extort-millions-sentenced-to-81-months</link>
<guid>https://block385.com/russian-initial-access-broker-helped-ransomware-gangs-extort-millions-sentenced-to-81-months</guid>
<description><![CDATA[ A Russian citizen, Aleksei Volkov, was sentenced to 81 months in prison for helping ransomware groups carry out attacks causing over $9 million in actual losses and over $24 million in intended losses, after being arrested in Italy and extradited to the United States where he pleaded guilty. According to prosecutors, Volkov was an initial access broker who found vulnerabilities in computer networks, gained unauthorized access, and sold that access to other cybercriminals. Volkov’s co-conspirators … More →
The post Russian initial access broker helped ransomware gangs extort millions, sentenced to 81 months appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/08/13155432/prison.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 16:00:39 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Russian, initial, access, broker, helped, ransomware, gangs, extort, millions, sentenced, months</media:keywords>
</item>

<item>
<title>Mimecast expands Incydr with runtime data security for AI and human risk</title>
<link>https://block385.com/mimecast-expands-incydr-with-runtime-data-security-for-ai-and-human-risk</link>
<guid>https://block385.com/mimecast-expands-incydr-with-runtime-data-security-for-ai-and-human-risk</guid>
<description><![CDATA[ Mimecast has announced a major expansion of its Incydr offering with new data security capabilities and a preview of the Agent Risk Center. These enhancements deliver runtime data security through a unified approach to detect, govern, and remediate data exposure in real time, whether driven by employees or agents acting on their behalf. Eighty percent of Fortune 500 companies now run active AI agents, yet only 14% have full security approval for them1. Enterprise data … More →
The post Mimecast expands Incydr with runtime data security for AI and human risk appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/24145510/mimecast-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 16:00:34 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mimecast, expands, Incydr, with, runtime, data, security, for, and, human, risk</media:keywords>
</item>

<item>
<title>Critical NetScaler ADC, Gateway flaw may soon be exploited (CVE&#45;2026&#45;3055)</title>
<link>https://block385.com/critical-netscaler-adc-gateway-flaw-may-soon-be-exploited-cve-2026-3055</link>
<guid>https://block385.com/critical-netscaler-adc-gateway-flaw-may-soon-be-exploited-cve-2026-3055</guid>
<description><![CDATA[ Citrix has fixed two vulnerabilities in NetScaler ADC and NetScaler Gateway, with the more serious flaw (CVE-2026-3055) potentially allowing attackers to extract active session tokens from the memory of affected devices. Anil Shetty, senior VP of Engineering with Cloud Software Group (Citrix’s parent company), stated on Saturday that Cloud Software Group “is not aware of any unmitigated exploit available for either CVE 2026-3055 or CVE 2026-4368.” Still, as both vulnerabilities can be exploited in low-complexity … More →
The post Critical NetScaler ADC, Gateway flaw may soon be exploited (CVE-2026-3055) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/07/08172050/netscaler-1500-red.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 16:00:27 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, NetScaler, ADC, Gateway, flaw, may, soon, exploited, CVE-2026-3055</media:keywords>
</item>

<item>
<title>The AI safety conversation is focused on the wrong layer</title>
<link>https://block385.com/the-ai-safety-conversation-is-focused-on-the-wrong-layer</link>
<guid>https://block385.com/the-ai-safety-conversation-is-focused-on-the-wrong-layer</guid>
<description><![CDATA[ Organizations have spent years accumulating fragmented identity systems: too many roles, too many credentials, too many disconnected tools. For a workforce of humans, that fragmentation was manageable. Humans log in, log out, and make decisions slowly enough that gaps in control rarely turned into immediate incidents. AI agents operate differently. “AI agents change that completely,” said Ev Kontsevoy, CEO of Teleport. “Now you’re introducing non-deterministic actors that don’t sleep, don’t follow predictable paths, and can … More →
The post The AI safety conversation is focused on the wrong layer appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/10/29154423/ai-brain-1500-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 16:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, safety, conversation, focused, the, wrong, layer</media:keywords>
</item>

<item>
<title>How a Large Bank Uses AI Digital Twins for Threat Hunting</title>
<link>https://block385.com/how-a-large-bank-uses-ai-digital-twins-for-threat-hunting</link>
<guid>https://block385.com/how-a-large-bank-uses-ai-digital-twins-for-threat-hunting</guid>
<description><![CDATA[ JPMorgan Chase uses digital fingerprints and digital twins to spot online attackers and malicious behaviors while also reducing pesky false alerts. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt1acc930cb26e92e3/680ab0f295c12a06ef9cf474/digital-twin-hands-Ole_CNX-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 16:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, Large, Bank, Uses, Digital, Twins, for, Threat, Hunting</media:keywords>
</item>

<item>
<title>AiStrike cuts alert noise with Continuous Detection Engineering</title>
<link>https://block385.com/aistrike-cuts-alert-noise-with-continuous-detection-engineering</link>
<guid>https://block385.com/aistrike-cuts-alert-noise-with-continuous-detection-engineering</guid>
<description><![CDATA[ AiStrike has launched Continuous Detection Engineering, a capability that transforms how security operations teams manage detections, shifting from reactive alert triage to proactive, intelligence-driven optimization. The detection quality gap Security teams today are overwhelmed by alerts, but the root cause is not volume, it’s detection quality. AiStrike’s analysis across enterprise environments revealed that: More than 80% of alerts lead to dead ends Fewer than 20% of detection rules ever trigger alerts Under 5% of rules … More →
The post AiStrike cuts alert noise with Continuous Detection Engineering appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/12/15105916/ai-hand-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 14:00:39 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AiStrike, cuts, alert, noise, with, Continuous, Detection, Engineering</media:keywords>
</item>

<item>
<title>Protos AI delivers agent&#45;driven threat intelligence without vendor lock&#45;in</title>
<link>https://block385.com/protos-ai-delivers-agent-driven-threat-intelligence-without-vendor-lock-in</link>
<guid>https://block385.com/protos-ai-delivers-agent-driven-threat-intelligence-without-vendor-lock-in</guid>
<description><![CDATA[ Protos Labs has announced the launch of a freemium edition of Protos AI, a platform that deploys specialized AI agents augmenting cyber threat intelligence (CTI) analyst teams by executing structured investigations from planning to reporting. The new tier enables security teams to operationalize AI-driven investigations without committing to closed vendor ecosystems or overhauling existing security stacks. As AI adoption accelerates across cybersecurity, many organizations face a gap between experimentation and practical implementation. ISC2’s 2024 Cybersecurity … More →
The post Protos AI delivers agent-driven threat intelligence without vendor lock-in appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/16113804/person-computer-red-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 14:00:36 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Protos, delivers, agent-driven, threat, intelligence, without, vendor, lock-in</media:keywords>
</item>

<item>
<title>Check Point unveils AI Defense Plane to govern and secure enterprise AI systems</title>
<link>https://block385.com/check-point-unveils-ai-defense-plane-to-govern-and-secure-enterprise-ai-systems</link>
<guid>https://block385.com/check-point-unveils-ai-defense-plane-to-govern-and-secure-enterprise-ai-systems</guid>
<description><![CDATA[ Check Point has announced the Check Point AI Defense Plane, a unified AI security control plane designed to help enterprises govern how AI is connected, deployed, and operated across the business. As AI systems move from assistants to autonomous actors that access data, invoke tools, and take action, the AI Defense Plane provides the intelligence layer needed to secure these systems. “The enterprise is entering the agentic era. AI is no longer limited to generating … More →
The post Check Point unveils AI Defense Plane to govern and secure enterprise AI systems appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/25125026/ai-genai-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 14:00:33 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Check, Point, unveils, Defense, Plane, govern, and, secure, enterprise, systems</media:keywords>
</item>

<item>
<title>NVIDIA puts GPU orchestration in community hands</title>
<link>https://block385.com/nvidia-puts-gpu-orchestration-in-community-hands</link>
<guid>https://block385.com/nvidia-puts-gpu-orchestration-in-community-hands</guid>
<description><![CDATA[ GPU-accelerated AI workloads now run on Kubernetes in the large majority of enterprise environments. Managing those workloads at scale has required specialized tooling that, until now, remained under vendor control. NVIDIA moved to change that at KubeCon Europe in Amsterdam this week, donating its Dynamic Resource Allocation (DRA) Driver for GPUs to the Cloud Native Computing Foundation (CNCF). The transfer shifts ownership of the driver from NVIDIA to the broader Kubernetes project community. Developers across … More →
The post NVIDIA puts GPU orchestration in community hands appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/24122745/nvidia-kubernetes-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 14:00:29 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NVIDIA, puts, GPU, orchestration, community, hands</media:keywords>
</item>

<item>
<title>Microsoft details AI prompt abuse techniques targeting AI assistants</title>
<link>https://block385.com/microsoft-details-ai-prompt-abuse-techniques-targeting-ai-assistants</link>
<guid>https://block385.com/microsoft-details-ai-prompt-abuse-techniques-targeting-ai-assistants</guid>
<description><![CDATA[ Prompt abuse occurs when crafted inputs manipulate an AI system into producing unintended behavior, such as attempting to access sensitive information or overriding built-in safety instructions. Prompt injection is also recognized as one of the top risks in the 2025 OWASP guidance for LLM applications. “Detecting abuse is challenging because it exploits natural language, such as subtle differences in phrasing, which can manipulate AI behavior while leaving little or no obvious trace. Without proper logging … More →
The post Microsoft details AI prompt abuse techniques targeting AI assistants appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/19191021/microsoft-security-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 14:00:24 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, details, prompt, abuse, techniques, targeting, assistants</media:keywords>
</item>

<item>
<title>32% of top&#45;exploited vulnerabilities are over a decade old</title>
<link>https://block385.com/32-of-top-exploited-vulnerabilities-are-over-a-decade-old</link>
<guid>https://block385.com/32-of-top-exploited-vulnerabilities-are-over-a-decade-old</guid>
<description><![CDATA[ Exploitation timelines continued to compress in enterprise environments, with newly disclosed flaws reaching active use almost immediately and older weaknesses remaining active years after disclosure. (Source: Cisco Talos) Findings from Cisco Talos’ 2025 Year in Review show how attackers combined rapid weaponization with long-term exposure spanning infrastructure, identity systems, and user workflows. Top-targeted vulnerabilities show speed and persistence Newly disclosed vulnerabilities moved into active exploitation with little delay. React2Shell became the most targeted vulnerability of … More →
The post 32% of top-exploited vulnerabilities are over a decade old appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/25153031/cybercrime-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 14:00:19 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>32, top-exploited, vulnerabilities, are, over, decade, old</media:keywords>
</item>

<item>
<title>Detectify uncovers hidden assets and risks across entire IP ranges</title>
<link>https://block385.com/detectify-uncovers-hidden-assets-and-risks-across-entire-ip-ranges</link>
<guid>https://block385.com/detectify-uncovers-hidden-assets-and-risks-across-entire-ip-ranges</guid>
<description><![CDATA[ Detectify has launched IP Range Scanning, enabling continuous discovery and monitoring of entire IP address blocks to help security teams identify forgotten assets and hidden risks before attackers exploit them. Many organizations are sitting on forgotten IP addresses that have become entry points for cyberattacks. While millions have been spent securing public-facing websites, legacy tools can miss large parts of the attack surface due to noise and stale data. Detectify’s research shows how serious this … More →
The post Detectify uncovers hidden assets and risks across entire IP ranges appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/09/14190228/internet-global2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 14:00:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Detectify, uncovers, hidden, assets, and, risks, across, entire, ranges</media:keywords>
</item>

<item>
<title>Microsoft Proposes Better Identity, Guardrails for AI Agents</title>
<link>https://block385.com/microsoft-proposes-better-identity-guardrails-for-ai-agents</link>
<guid>https://block385.com/microsoft-proposes-better-identity-guardrails-for-ai-agents</guid>
<description><![CDATA[ Companies need better controls to manage key threats rising from the growth of agentic AI. These new features provide a starting point. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt534e2f0ca2719343/69c1a44f0737d5426418aa1c/human-AI-fingers-touching-nuclear_lily-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 14:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Proposes, Better, Identity, Guardrails, for, Agents</media:keywords>
</item>

<item>
<title>Ghost Campaign Uses 7 npm Packages to Steal Crypto Wallets and Credentials</title>
<link>https://block385.com/ghost-campaign-uses-7-npm-packages-to-steal-crypto-wallets-and-credentials</link>
<guid>https://block385.com/ghost-campaign-uses-7-npm-packages-to-steal-crypto-wallets-and-credentials</guid>
<description><![CDATA[ Cybersecurity researchers have uncovered a new set of malicious npm packages that are designed to steal cryptocurrency wallets and sensitive data.
The activity is being tracked by ReversingLabs as the Ghost campaign. The list of identified packages, all published by a user named mikilanjillo, is below -

react-performance-suite
react-state-optimizer-core
react-fast-utilsa
ai-fast-auto-trader ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlh6CuYJhvsInqih03x9cvHFvmbF-F8DFJF_Y9VQMslT9g5yp_jhDewDUjcvUlAMzyKbfOHz0eMdFqHdIGwbtOY0MOHDGr_lA1TraO34SwYiKrieNnOQsAo5DbKhpJCp2X60_0epyBiBDs-KRgFjhR0QEPMmTRBCvJCiiQaJg7MaRCLf3EHcrIdluUrmJ-/s1600/1000062391.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 13:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ghost, Campaign, Uses, npm, Packages, Steal, Crypto, Wallets, and, Credentials</media:keywords>
</item>

<item>
<title>5 Learnings from the First&#45;Ever Gartner Market Guide for Guardian Agents</title>
<link>https://block385.com/5-learnings-from-the-first-ever-gartner-market-guide-for-guardian-agents</link>
<guid>https://block385.com/5-learnings-from-the-first-ever-gartner-market-guide-for-guardian-agents</guid>
<description><![CDATA[ On February 25, 2026, Gartner published its inaugural Market Guide for Guardian Agents, marking an important milestone for this emerging category. For those unfamiliar with the various Gartner report types, “a Market Guide defines a market and explains what clients can expect it to do in the short term. With the focus on early, more chaotic markets, a Market Guide does not rate or position ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNlBFOfxbwROPKI6W1sccbKKW4Dx3IGIQi1AnDrQqKxY1xaVxZv9gip61deVh8UNN1xLX6l3fOEm8pKGrHLSddhT8WS7w70a5FDT3eyew3xxDjCOC8QCYK7hERW2ILTYMfS9Giq4asN2G4SvYITRiVeqlZcN53LG8OG7hkQ5C6J8bAVokCe0a0oBkuNMlS/s1600/Cover-v1.gif" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 13:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Learnings, from, the, First-Ever, Gartner, Market, Guide, for, Guardian, Agents</media:keywords>
</item>

<item>
<title>TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials</title>
<link>https://block385.com/teampcp-hacks-checkmarx-github-actions-using-stolen-ci-credentials</link>
<guid>https://block385.com/teampcp-hacks-checkmarx-github-actions-using-stolen-ci-credentials</guid>
<description><![CDATA[ Two more GitHub Actions workflows have become the latest to be compromised by credential-stealing malware by a threat actor known as TeamPCP, the cloud-native cybercriminal operation also behind the Trivy supply chain attack.
The workflows, both maintained by the supply chain security company Checkmarx, are listed below -

checkmarx/ast-github-action
checkmarx/kics-github-action

Cloud security ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhs6mMRIch1O4gn0txxM6yMSRtvi7D0xmBbphFA0WJimqGO4k48KNvAbF_-an7swi-N0ZHOB2jt1WtJQjubozx7WzJH6Kr0CA0rCkP4TNUHR2NkC8NS6RaJDF9WUyZeyzUIG1NQtK_Betxs3h0gaxKqHMs7laaHTVXSiCMo-vbS_owFokGrDqN9NG7jdwRf/s1600/git-check.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 13:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TeamPCP, Hacks, Checkmarx, GitHub, Actions, Using, Stolen, Credentials</media:keywords>
</item>

<item>
<title>The Hidden Cost of Cybersecurity Specialization: Losing Foundational Skills</title>
<link>https://block385.com/the-hidden-cost-of-cybersecurity-specialization-losing-foundational-skills</link>
<guid>https://block385.com/the-hidden-cost-of-cybersecurity-specialization-losing-foundational-skills</guid>
<description><![CDATA[ Cybersecurity has changed fast. Roles are more specialized, and tooling is more advanced. On paper, this should make organizations more secure. But in practice, many teams struggle with the same basic problems they faced years ago: unclear risk priorities, misaligned tooling decisions, and difficulty explaining security issues in terms the business understands. 
These challenges do not ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQpYFvavgLT2A2jdfoBL7Wp9ezuo1HDTIJiE8s2Pa5KXH-TOCWZqUGhcg6xb2WBpXtHUpH-tqYI3zUXmr-rWNM_crdZHIda5PaWdxskk39iOZqxz0ltvvh-VenOPTRqpUxX8J2uLL86_eljgWE-AOZPbm7OSrhsj23k7usKY2BTvHDTsscJ8GyQClclZA/s1600/cloud-network.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 13:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Hidden, Cost, Cybersecurity, Specialization:, Losing, Foundational, Skills</media:keywords>
</item>

<item>
<title>GitHub just made it much harder to ship a vulnerable pull request</title>
<link>https://block385.com/github-just-made-it-much-harder-to-ship-a-vulnerable-pull-request</link>
<guid>https://block385.com/github-just-made-it-much-harder-to-ship-a-vulnerable-pull-request</guid>
<description><![CDATA[ GitHub is expanding its application security capabilities with AI-powered security detections designed to identify risks earlier in the development process, with public preview planned for early Q2. The update is intended to improve code scanning, secret detection, and dependency analysis within repositories hosted on the platform. The company said the new detections are designed to complement its existing CodeQL engine, which remains in use for semantic analysis of supported languages. Static analysis continues to play … More →
The post GitHub just made it much harder to ship a vulnerable pull request appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/23113957/github-green-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 12:00:48 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GitHub, just, made, much, harder, ship, vulnerable, pull, request</media:keywords>
</item>

<item>
<title>Cisco builds security framework for safe enterprise adoption of AI agents</title>
<link>https://block385.com/cisco-builds-security-framework-for-safe-enterprise-adoption-of-ai-agents</link>
<guid>https://block385.com/cisco-builds-security-framework-for-safe-enterprise-adoption-of-ai-agents</guid>
<description><![CDATA[ Cisco has introduced solutions to address AI security issues and remove a top barrier to agent adoption. By establishing trusted identities, enforcing strict zero trust Access controls, hardening agents before deployment, enforcing guardrails at runtime, and giving SOC teams the tools to stop threats at machine speed, Cisco is building security into the foundation of the emerging AI economy. “AI agents aren’t just making existing work faster; they’re a new workforce of co-workers that dramatically … More →
The post Cisco builds security framework for safe enterprise adoption of AI agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/08092225/ai-agent-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 12:00:47 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cisco, builds, security, framework, for, safe, enterprise, adoption, agents</media:keywords>
</item>

<item>
<title>Dell expands security stack with quantum&#45;ready protections and AI threat detection</title>
<link>https://block385.com/dell-expands-security-stack-with-quantum-ready-protections-and-ai-threat-detection</link>
<guid>https://block385.com/dell-expands-security-stack-with-quantum-ready-protections-and-ai-threat-detection</guid>
<description><![CDATA[ Dell Technologies has introduced new security by design and cyber resilience capabilities to help organizations secure, detect and recover from next-generation threats. The enhancements address emerging risks from quantum computing and AI by hardening device foundations, strengthening cyber resilience when incidents occur and extending threat detection into AI data platforms. Why it matters AI is creating more valuable data and giving attackers new ways to move faster. Quantum computing will accelerate that shift by weakening … More →
The post Dell expands security stack with quantum-ready protections and AI threat detection appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/08/05195646/dell-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 12:00:45 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Dell, expands, security, stack, with, quantum-ready, protections, and, threat, detection</media:keywords>
</item>

<item>
<title>ZeroTier Quantum brings quantum&#45;resistant security to high&#45;performance global networking</title>
<link>https://block385.com/zerotier-quantum-brings-quantum-resistant-security-to-high-performance-global-networking</link>
<guid>https://block385.com/zerotier-quantum-brings-quantum-resistant-security-to-high-performance-global-networking</guid>
<description><![CDATA[ ZeroTier has launched ZeroTier Quantum, a software-defined networking platform designed for data center–level performance and built with quantum-resistant cryptography aligned with NIST and NSA CNSA 2.0 standards. Organizations operate far beyond network boundaries, autonomous devices, machines, vehicles, agents, and infrastructure span continents, oceans, and remote environments, constantly transmitting sensitive data that must stay secure. At the same time, AI leverage and quantum computing are ushering in a new class of risk: encrypted data captured today … More →
The post ZeroTier Quantum brings quantum-resistant security to high-performance global networking appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/05/23131508/servers-cloud.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 12:00:43 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ZeroTier, Quantum, brings, quantum-resistant, security, high-performance, global, networking</media:keywords>
</item>

<item>
<title>Coro automates security operations with end&#45;to&#45;end threat detection and response</title>
<link>https://block385.com/coro-automates-security-operations-with-end-to-end-threat-detection-and-response</link>
<guid>https://block385.com/coro-automates-security-operations-with-end-to-end-threat-detection-and-response</guid>
<description><![CDATA[ Coro has expanded AI-driven security operations capabilities that automate the full lifecycle of threat detection and response, enabling organizations to identify, investigate, and remediate security incidents without manual intervention. The announcement builds on Coro’s intrinsic use of AI across its platform and introduces deeper automation across security workflows, including cross-module response actions and SOC-level task execution. Over the past year, 92.3% of all security tickets generated globally on the Coro platform were automatically handled and … More →
The post Coro automates security operations with end-to-end threat detection and response appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 12:00:40 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Coro, automates, security, operations, with, end-to-end, threat, detection, and, response</media:keywords>
</item>

<item>
<title>Zenity advances context&#45;aware security for AI agents</title>
<link>https://block385.com/zenity-advances-context-aware-security-for-ai-agents</link>
<guid>https://block385.com/zenity-advances-context-aware-security-for-ai-agents</guid>
<description><![CDATA[ Zenity has unveiled continuous, contextual security for AI agents, a new approach that transforms how enterprise AI systems are secured and sets the foundation for Guardian Agents. According to Gartner, “Guardian Agents represent the next evolution in AI governance, shifting from passive monitoring to active, real-time protection of AI systems.” Zenity’s continuous, contextual security delivers the foundational capabilities required to enable this shift. AI agent risk doesn’t emerge in a single moment. It develops over … More →
The post Zenity advances context-aware security for AI agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/08/28142151/agentic-ai-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 12:00:33 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Zenity, advances, context-aware, security, for, agents</media:keywords>
</item>

<item>
<title>Tuskira replaces centralized detection model with real&#45;time, distributed approach</title>
<link>https://block385.com/tuskira-replaces-centralized-detection-model-with-real-time-distributed-approach</link>
<guid>https://block385.com/tuskira-replaces-centralized-detection-model-with-real-time-distributed-approach</guid>
<description><![CDATA[ Tuskira has released its Federated Detection Engine, a new capability within its Agentic SecOps platform that enables real-time threat detection across cloud, identity, endpoint, network, SaaS, infrastructure, and legacy SIEM environments, without relying on centralized logging. Detection engineering still depends on centralized log architectures and manual rule authoring. That model is expensive to scale, slow to adapt, and increasingly misaligned with how modern attacks move across distributed environments. Tuskira takes a different approach by bringing … More →
The post Tuskira replaces centralized detection model with real-time, distributed approach appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/05/31190412/world.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 12:00:26 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tuskira, replaces, centralized, detection, model, with, real-time, distributed, approach</media:keywords>
</item>

<item>
<title>Lumu enhances Defender to detect compromise across network, cloud, endpoint, and identity</title>
<link>https://block385.com/lumu-enhances-defender-to-detect-compromise-across-network-cloud-endpoint-and-identity</link>
<guid>https://block385.com/lumu-enhances-defender-to-detect-compromise-across-network-cloud-endpoint-and-identity</guid>
<description><![CDATA[ Lumu has upgraded its Lumu Defender NDR solution, extending Continuous Compromise Assessment beyond the network to include endpoints, cloud environments, and user behavior for unified visibility. The past year marks a strategic shift in attack methods, with threat actors pivoting from high-profile malware to increasingly sophisticated, stealth-based tactics. The increase of AI-driven security attacks, attackers using legitimate tools instead of malware, and attackers quietly using cloud applications for exfiltration, creates more opportunities for criminals to … More →
The post Lumu enhances Defender to detect compromise across network, cloud, endpoint, and identity appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/12/27182945/magnify-1500-eye.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 12:00:19 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Lumu, enhances, Defender, detect, compromise, across, network, cloud, endpoint, and, identity</media:keywords>
</item>

<item>
<title>SecurityScorecard automates third&#45;party risk management with TITAN AI</title>
<link>https://block385.com/securityscorecard-automates-third-party-risk-management-with-titan-ai</link>
<guid>https://block385.com/securityscorecard-automates-third-party-risk-management-with-titan-ai</guid>
<description><![CDATA[ SecurityScorecard has introduced TITAN AI to automate third-party risk management, replacing manual processes with continuous, AI-driven intelligence. TITAN AI is built on top of SecurityScorecard’s Ratings and TPRM platform with AI-driven technology and enhanced threat intelligence, delivering a powerful solution built for the demands of today’s risk landscape. With TITAN AI, organizations will be able to automate the majority of the work traditionally required to manage vendor risk. TPRM, security, and risk teams will reclaim … More →
The post SecurityScorecard automates third-party risk management with TITAN AI appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/11/20125121/cyber_resilience.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 12:00:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SecurityScorecard, automates, third-party, risk, management, with, TITAN</media:keywords>
</item>

<item>
<title>GitHub&#45;hosted malware campaign uses split payload to evade detection</title>
<link>https://block385.com/github-hosted-malware-campaign-uses-split-payload-to-evade-detection</link>
<guid>https://block385.com/github-hosted-malware-campaign-uses-split-payload-to-evade-detection</guid>
<description><![CDATA[ A large-scale malware delivery campaign has been targeting developers, gamers, and general users through fake tools hosted on GitHub, Netskope researchers have warned. These “lures” are highly polished and appear legitimate, occasionally mimicking real projects, thus making them difficult to distinguish from safe software. A dual-component trojan is delivered Netskope threat researchers first discovered a trojanized GitHub repository ostensibly offering a Docker image of the OpenClaw AI assistant. The repo was very convincing. “The README … More →
The post GitHub-hosted malware campaign uses split payload to evade detection appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/06102419/github-danger.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 12:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GitHub-hosted, malware, campaign, uses, split, payload, evade, detection</media:keywords>
</item>

<item>
<title>Hadrian unveils Nova, enabling continuous, AI&#45;powered offensive security testing</title>
<link>https://block385.com/hadrian-unveils-nova-enabling-continuous-ai-powered-offensive-security-testing</link>
<guid>https://block385.com/hadrian-unveils-nova-enabling-continuous-ai-powered-offensive-security-testing</guid>
<description><![CDATA[ Hadrian has announced the launch of its agentic penetration testing solution, Nova. Built as an extension of its core external exposure management platform, Nova delivers on-demand pentesting without the delays or operational disruption typical of human-led engagements. By autonomously replicating the methodologies of offensive security professionals, Nova enables organizations to identify and respond to emerging, AI-driven threats with greater speed, precision, and confidence. “AI-driven automation now allows attackers to weaponize vulnerabilities at machine speed and … More →
The post Hadrian unveils Nova, enabling continuous, AI-powered offensive security testing appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 10:00:41 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hadrian, unveils, Nova, enabling, continuous, AI-powered, offensive, security, testing</media:keywords>
</item>

<item>
<title>Relyance AI’s Lyo addresses data security gaps in autonomous systems</title>
<link>https://block385.com/relyance-ais-lyo-addresses-data-security-gaps-in-autonomous-systems</link>
<guid>https://block385.com/relyance-ais-lyo-addresses-data-security-gaps-in-autonomous-systems</guid>
<description><![CDATA[ Relyance AI has announced the commercial availability of Lyo, an autonomous data defense engineer that monitors and secures how AI agents interact with enterprise data. Lyo emerges at an inflection point for the cybersecurity industry as autonomous AI agents spread across enterprise environments, gaining access to sensitive data, triggering workflows, provisioning infrastructure, and calling APIs at machine speed. The challenge is no longer locating sensitive data, but understanding how it is being used in real … More →
The post Relyance AI’s Lyo addresses data security gaps in autonomous systems appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/05/31190531/visualization.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 10:00:39 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Relyance, AI’s, Lyo, addresses, data, security, gaps, autonomous, systems</media:keywords>
</item>

<item>
<title>Palo Alto Networks’ Prisma AIRS 3.0 closes visibility gaps in autonomous AI systems</title>
<link>https://block385.com/palo-alto-networks-prisma-airs-30-closes-visibility-gaps-in-autonomous-ai-systems</link>
<guid>https://block385.com/palo-alto-networks-prisma-airs-30-closes-visibility-gaps-in-autonomous-ai-systems</guid>
<description><![CDATA[ Palo Alto Networks has advanced its AI security platform with Prisma AIRS 3.0, securing the agentic AI lifecycle and enabling enterprises to move from observation to safe autonomous execution. The shift toward an AI-powered enterprise introduces systemic security challenges, ranging from unmanaged shadow AI to the critical new frontiers of agentic identity, runtime security, and automated governance. While many enterprises monitor what AI says, they remain blind to what AI does. Prisma AIRS 3.0 closes … More →
The post Palo Alto Networks’ Prisma AIRS 3.0 closes visibility gaps in autonomous AI systems appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 10:00:34 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Palo, Alto, Networks’, Prisma, AIRS, 3.0, closes, visibility, gaps, autonomous, systems</media:keywords>
</item>

<item>
<title>RSA ID Plus Sovereign Deployment delivers full&#45;stack identity for  high&#45;risk environments</title>
<link>https://block385.com/rsa-id-plus-sovereign-deployment-delivers-full-stack-identity-for-high-risk-environments</link>
<guid>https://block385.com/rsa-id-plus-sovereign-deployment-delivers-full-stack-identity-for-high-risk-environments</guid>
<description><![CDATA[ RSA has unveiled RSA ID Plus Sovereign Deployment, a high-assurance identity solution built for organizations requiring continuous availability, data sovereignty, and resilience against advanced threats. RSA ID Plus Sovereign Deployment is the next evolution in RSA ID Plus, the identity and access management (IAM) security platform featuring complete multi-factor authentication (MFA), SSO, and access capabilities. RSA ID Plus Sovereign Deployment features a new “deploy anywhere” capability that allows government agencies, financial services, critical infrastructure, and … More →
The post RSA ID Plus Sovereign Deployment delivers full-stack identity for  high-risk environments appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/09/12150859/identity-face-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 10:00:22 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>RSA, Plus, Sovereign, Deployment, delivers, full-stack, identity, for, high-risk, environments</media:keywords>
</item>

<item>
<title>GitHub leans on hybrid detection model to expand vulnerability coverage</title>
<link>https://block385.com/github-leans-on-hybrid-detection-model-to-expand-vulnerability-coverage</link>
<guid>https://block385.com/github-leans-on-hybrid-detection-model-to-expand-vulnerability-coverage</guid>
<description><![CDATA[ GitHub is expanding its application security capabilities with AI-powered security detections designed to identify risks earlier in the development process, with public preview planned for early Q2. The update is intended to improve code scanning, secret detection, and dependency analysis within repositories hosted on the platform. The company said the new detections are designed to complement its existing CodeQL engine, which remains in use for semantic analysis of supported languages. Static analysis continues to play … More →
The post GitHub leans on hybrid detection model to expand vulnerability coverage appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/23113957/github-green-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 10:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GitHub, leans, hybrid, detection, model, expand, vulnerability, coverage</media:keywords>
</item>

<item>
<title>U.S. Sentences Russian Hacker to 6.75 Years for Role in $9M Ransomware Damage</title>
<link>https://block385.com/us-sentences-russian-hacker-to-675-years-for-role-in-9m-ransomware-damage</link>
<guid>https://block385.com/us-sentences-russian-hacker-to-675-years-for-role-in-9m-ransomware-damage</guid>
<description><![CDATA[ A 26-year-old Russian citizen has been sentenced in the U.S. to 6.75 years (81 months) in prison for his role in assisting major cybercrime groups, including the Yanluowang ransomware crew, in conducting numerous attacks against U.S. companies and other organizations.
According to the U.S. Department of Justice (DoJ), Aleksei Olegovich Volkov facilitated dozens of ransomware attacks across the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiwErtmK3J6s3ZBAWrZmJFdn-SsFPTX_zrl0bvQ9n-ZCC1ENEur-h3l19pl6UP2D2HOJPXbanjebnde0RSf2-ER98dzy3FUdTBcM8OzdWmcc3hXf7ZEq7nlF13RMlR7WYNGwjxKF6stgY-oBOa8aUjxYb7wEyi6oEUZTHUFnGX4zmAjumNGhIUXscatWTn/s1600/ransomware-hacker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 09:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>U.S., Sentences, Russian, Hacker, 6.75, Years, for, Role, 9M, Ransomware, Damage</media:keywords>
</item>

<item>
<title>Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks</title>
<link>https://block385.com/citrix-urges-patching-critical-netscaler-flaw-allowing-unauthenticated-data-leaks</link>
<guid>https://block385.com/citrix-urges-patching-critical-netscaler-flaw-allowing-unauthenticated-data-leaks</guid>
<description><![CDATA[ Citrix has released security updates to address two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical flaw that could be exploited to leak sensitive data from the application.
The vulnerabilities are listed below -

CVE-2026-3055 (CVSS score: 9.3) - Insufficient input validation leading to memory overread
CVE-2026-4368 (CVSS score: 7.7) - Race condition leading to user ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMCnGCq_DsAE40JVqQy2HjOcbqucRBcpx0JOpEQM9SZplWbse_yzvfQGRG8Uux9NVkQhQrHYzTIlb3b58b47kkLOfIBcxeaMVT7SlUjBSr3URnME7qL5P3ZqJgVw3bGX0NY_hYsvhAbTTJ7PZk-mmpl949AALvrsV0JkZEQD82ah-B2jlOBz-oGC-P4xaY/s1600/citrix.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 09:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Citrix, Urges, Patching, Critical, NetScaler, Flaw, Allowing, Unauthenticated, Data, Leaks</media:keywords>
</item>

<item>
<title>Cybersecurity jobs available right now: March 24, 2026</title>
<link>https://block385.com/cybersecurity-jobs-available-right-now-march-24-2026</link>
<guid>https://block385.com/cybersecurity-jobs-available-right-now-march-24-2026</guid>
<description><![CDATA[ Application Security Analyst Alignerr | USA | Remote – View job details As an Application Security Analyst, you will review and analyze application security scenarios across code, APIs, and system behavior. You will classify vulnerabilities such as authentication flaws, injection risks, and business logic issues, and evaluate secure coding practices and remediation strategies. You will also help create and validate security-focused reasoning datasets that train AI to accurately assess application risks. Application Security Engineer E.ON … More →
The post Cybersecurity jobs available right now: March 24, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11140416/cybersecurity_jobs-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 08:00:40 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybersecurity, jobs, available, right, now:, March, 24, 2026</media:keywords>
</item>

<item>
<title>Product showcase: Cross&#45;platform and third&#45;party endpoint patching with Action1</title>
<link>https://block385.com/product-showcase-cross-platform-and-third-party-endpoint-patching-with-action1</link>
<guid>https://block385.com/product-showcase-cross-platform-and-third-party-endpoint-patching-with-action1</guid>
<description><![CDATA[ Keeping endpoints patched is one of the more annoying chores in IT operations. Action1 is a cloud-based autonomous endpoint management platform that addresses this challenge head-on, covering third-party apps and OS updates (Windows, macOS, and now Linux) from a single, centralized console. Built as a SaaS solution, it requires no on-premises infrastructure, no VPN tunnels, and no complex firewall rules — endpoints simply reach out to the Action1 cloud service. The result is a platform … More →
The post Product showcase: Cross-platform and third-party endpoint patching with Action1 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/23090549/action1-endpoint-patch-management.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 08:00:31 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Product, showcase:, Cross-platform, and, third-party, endpoint, patching, with, Action1</media:keywords>
</item>

<item>
<title>Attackers are handing off access in 22 seconds, Mandiant finds</title>
<link>https://block385.com/attackers-are-handing-off-access-in-22-seconds-mandiant-finds</link>
<guid>https://block385.com/attackers-are-handing-off-access-in-22-seconds-mandiant-finds</guid>
<description><![CDATA[ Exploits remain the leading entry point for attackers for the sixth consecutive year, according to Mandiant’s M-Trends 2026 report, which draws on more than 500,000 hours of incident response work conducted in 2025. The data shows attackers speeding up their internal hand-offs, shifting away from email phishing, and targeting backup and virtualization infrastructure with greater precision. Initial infection vector 2025 (Source: Mandiant) Voice phishing surges as email phishing continues to decline Voice phishing climbed to … More →
The post Attackers are handing off access in 22 seconds, Mandiant finds appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/05/15161411/botnet.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 08:00:20 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Attackers, are, handing, off, access, seconds, Mandiant, finds</media:keywords>
</item>

<item>
<title>Measuring security performance in real&#45;time, not once a quarter</title>
<link>https://block385.com/measuring-security-performance-in-real-time-not-once-a-quarter</link>
<guid>https://block385.com/measuring-security-performance-in-real-time-not-once-a-quarter</guid>
<description><![CDATA[ Most organizations have invested heavily in security products over the past decade. The assumption embedded in that spending is that more tools equal better protection. Tim Nan, CEO of digiDations, says that assumption is the most persistent misconception he encounters when working with security leaders across industries. “Adversaries don’t operate on averages,” Nan says. “They only need one path that works. The issue isn’t whether your defenses work most of the time. It’s whether they … More →
The post Measuring security performance in real-time, not once a quarter appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/21074031/tim_nan-2-digidations.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 08:00:07 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Measuring, security, performance, real-time, not, once, quarter</media:keywords>
</item>

<item>
<title>Ransomware&amp;apos;s New Era: Moving at AI Speed</title>
<link>https://block385.com/ransomwares-new-era-moving-at-ai-speed</link>
<guid>https://block385.com/ransomwares-new-era-moving-at-ai-speed</guid>
<description><![CDATA[ Threat actors bypass security tools and use AI to launch faster ransomware attacks that exploit valid credentials and target data ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc88c79f37cbb1f97/69c1f6135a8781ad34dc3f65/halcyon-who-benefits-from-ai.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 06:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ransomwares, New, Era:, Moving, Speed</media:keywords>
</item>

<item>
<title>AI in the SOC: What Could Go Wrong?</title>
<link>https://block385.com/ai-in-the-soc-what-could-go-wrong</link>
<guid>https://block385.com/ai-in-the-soc-what-could-go-wrong</guid>
<description><![CDATA[ Two cybersecurity leaders tested out AI in their respective SOCs for six months — and here&#039;s what they learned. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3b30cd90466d23d5/69c1a4abe1907d29d08f0f4c/Question_mark_blocks_HAKINMHAN_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 00:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>the, SOC:, What, Could, Wrong</media:keywords>
</item>

<item>
<title>Trivy Supply Chain Attack Targets CI/CD Secrets</title>
<link>https://block385.com/trivy-supply-chain-attack-targets-cicd-secrets</link>
<guid>https://block385.com/trivy-supply-chain-attack-targets-cicd-secrets</guid>
<description><![CDATA[ A threat actor used the open source security tool to deploy an infostealer into CI/CD workflows and steal cloud credentials, SSH keys, tokens, and other sensitive secrets. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt56a20b542c082472/69c1a720f5bbfd6de1b8a688/supplychain_ImageFlow_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 00:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Trivy, Supply, Chain, Attack, Targets, CICD, Secrets</media:keywords>
</item>

<item>
<title>CISOs Debate Human Role in AI&#45;Powered Security</title>
<link>https://block385.com/cisos-debate-human-role-in-ai-powered-security</link>
<guid>https://block385.com/cisos-debate-human-role-in-ai-powered-security</guid>
<description><![CDATA[ The idea of a &quot;human in the loop&quot; in AI deployment was challenged during a security executive panel at the RSAC 2026 Conference this week. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt654ea4d6d54b8adf/69c1a3571190c79717853685/AI_vs_human_robert_hyrons_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 24 Mar 2026 00:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISOs, Debate, Human, Role, AI-Powered, Security</media:keywords>
</item>

<item>
<title>North Korean Hackers Abuse VS Code Auto&#45;Run Tasks to Deploy StoatWaffle Malware</title>
<link>https://block385.com/north-korean-hackers-abuse-vs-code-auto-run-tasks-to-deploy-stoatwaffle-malware</link>
<guid>https://block385.com/north-korean-hackers-abuse-vs-code-auto-run-tasks-to-deploy-stoatwaffle-malware</guid>
<description><![CDATA[ The North Korean threat actors behind the Contagious Interview campaign, also tracked as WaterPlum, have been attributed to a malware family tracked as StoatWaffle that&#039;s distributed via malicious Microsoft Visual Studio Code (VS Code) projects.
The use of VS Code &quot;tasks.json&quot; to distribute malware is a relatively new tactic adopted by the threat actor since December 2025, with the attacks ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEYRIy7X7XvfWs__-DS2yjU2mg0-f4TxESTTQnzRIgLaWPDe3Oe_25A0_pi_XHxryaqyz4YBRzci03kVa5TgSstslqpZdhUwBniNuYvx8N4pEZEI4mHGmZuh1QmnlhRcBXWTWLttZkuVU7aFvOrNg8sp0ODl4-sDi0q3X3XzBbCD0ppjxYihFwMxuMSHf4/s1600/northkorean.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 21:30:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>North, Korean, Hackers, Abuse, Code, Auto-Run, Tasks, Deploy, StoatWaffle, Malware</media:keywords>
</item>

<item>
<title>Quantum threats are already active and the defense response remains fragmented</title>
<link>https://block385.com/quantum-threats-are-already-active-and-the-defense-response-remains-fragmented</link>
<guid>https://block385.com/quantum-threats-are-already-active-and-the-defense-response-remains-fragmented</guid>
<description><![CDATA[ Enterprises are moving toward post-quantum security at uneven speeds, and the gap between organizations that have built crypto-agility into their infrastructure and those that have adopted the label without the underlying capability is widening. Dr. Tan Teik Guan, CEO of Singapore-based cybersecurity company pQCee, draws a sharp line between the two. Crypto-agility, in his view, requires more than support for multiple algorithms or protocol-level negotiation. It demands the ability to respond with appropriate cryptographic defenses … More →
The post Quantum threats are already active and the defense response remains fragmented appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/21080307/tan_teik_guan-2-pqcee.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 18:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Quantum, threats, are, already, active, and, the, defense, response, remains, fragmented</media:keywords>
</item>

<item>
<title>Attackers Hide Infostealer in Copyright Infringement Notices</title>
<link>https://block385.com/attackers-hide-infostealer-in-copyright-infringement-notices</link>
<guid>https://block385.com/attackers-hide-infostealer-in-copyright-infringement-notices</guid>
<description><![CDATA[ A phishing campaign targeting healthcare, government, hospitality, and education sectors in various countries uses several evasion techniques to avoid detection. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blta5a35ef3b16df4da/69c1257327cbec3dd53e228d/Warning_(1800)_Wavebreakmedia_Ltd_IFE-210813_Alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 18:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Attackers, Hide, Infostealer, Copyright, Infringement, Notices</media:keywords>
</item>

<item>
<title>Straiker enables visibility and runtime protection for enterprise AI agents</title>
<link>https://block385.com/straiker-enables-visibility-and-runtime-protection-for-enterprise-ai-agents</link>
<guid>https://block385.com/straiker-enables-visibility-and-runtime-protection-for-enterprise-ai-agents</guid>
<description><![CDATA[ Straiker has launched Discover AI and expanded Defend AI to secure coding agents, productivity agents, and custom-built agent platforms. Agents are operating across enterprise systems with broad access, growing autonomy, and zero security oversight. That’s why Straiker built Discover AI and Defend AI: to give security teams visibility into what agents are running and protection against what they might do. Coding agents like Cursor, Claude Code, and GitHub Copilot are transforming how enterprise software gets … More →
The post Straiker enables visibility and runtime protection for enterprise AI agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/05/22145250/laptop-data2.png" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 16:01:21 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Straiker, enables, visibility, and, runtime, protection, for, enterprise, agents</media:keywords>
</item>

<item>
<title>Astrix advances AI agent security platform to govern shadow and enterprise agents</title>
<link>https://block385.com/astrix-advances-ai-agent-security-platform-to-govern-shadow-and-enterprise-agents</link>
<guid>https://block385.com/astrix-advances-ai-agent-security-platform-to-govern-shadow-and-enterprise-agents</guid>
<description><![CDATA[ Astrix Security has revealed a major expansion of its AI agent security platform, covering every layer where AI agents operate in the enterprise: from managed AI platforms to shadow deployments running on managed devices, detecting both agent existence and unauthorized access to enterprise resources, and enforcing policy over what agents are allowed to do. AI governance programs are not built for the speed at which agents are being deployed. Like third-party risk committees that never … More →
The post Astrix advances AI agent security platform to govern shadow and enterprise agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/25153014/artificial_intelligence-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 16:01:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Astrix, advances, agent, security, platform, govern, shadow, and, enterprise, agents</media:keywords>
</item>

<item>
<title>Anvilogic’s Blueprints replaces SOAR complexity with natural language security automation</title>
<link>https://block385.com/anvilogics-blueprints-replaces-soar-complexity-with-natural-language-security-automation</link>
<guid>https://block385.com/anvilogics-blueprints-replaces-soar-complexity-with-natural-language-security-automation</guid>
<description><![CDATA[ Anvilogic has launched Blueprints, a workflow automation capability that captures expert analyst practices and turns them into scalable, repeatable workflows across security teams. Instead of requiring specialized engineers to build and maintain code, Blueprints lets analysts author automation in natural language, deploy it the same day, and have it execute to automate processes across data onboarding, detection engineering, threat hunting, investigation and response. “Your best analyst, at infinite scale,” said Mackenzie Kyle, Chief Product Officer … More →
The post Anvilogic’s Blueprints replaces SOAR complexity with natural language security automation appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/10/27101944/genai2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 16:00:59 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Anvilogic’s, Blueprints, replaces, SOAR, complexity, with, natural, language, security, automation</media:keywords>
</item>

<item>
<title>Apiiro introduces AI Threat Modeling to identify risks before code exists</title>
<link>https://block385.com/apiiro-introduces-ai-threat-modeling-to-identify-risks-before-code-exists</link>
<guid>https://block385.com/apiiro-introduces-ai-threat-modeling-to-identify-risks-before-code-exists</guid>
<description><![CDATA[ Apiiro has announced AI Threat Modeling, a new capability within Apiiro Guardian Agent that automatically generates architecture-aware threat models to identify security and compliance risks before code exists. AI Threat Modeling allows enterprises to prevent risks at the speed of AI, whether developing first-party applications, delivering third-party applications to the cloud, or addressing the new attack surface created by AI capabilities embedded directly into these applications. Legacy threat modeling is broken. AI coding agents made … More →
The post Apiiro introduces AI Threat Modeling to identify risks before code exists appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/04/29124857/apiiro.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 16:00:50 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apiiro, introduces, Threat, Modeling, identify, risks, before, code, exists</media:keywords>
</item>

<item>
<title>Top must&#45;visit companies at RSAC 2026</title>
<link>https://block385.com/top-must-visit-companies-at-rsac-2026</link>
<guid>https://block385.com/top-must-visit-companies-at-rsac-2026</guid>
<description><![CDATA[ RSAC 2026 Conference is taking place at the Moscone Center in San Francisco March 23 – 26. With hundreds of booths, countless product demos, and nonstop buzz, navigating RSAC can be overwhelming. That’s why we’ve done the legwork to highlight the standout companies you won’t want to miss. Whether you’re looking for cutting-edge innovation, industry veterans with new offerings, or rising stars shaking things up, these exhibitors are bringing something special to the floor this … More →
The post Top must-visit companies at RSAC 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/22150556/rsac-2026-companies.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 16:00:37 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Top, must-visit, companies, RSAC, 2026</media:keywords>
</item>

<item>
<title>The devices winning the race to get hacked in 2026</title>
<link>https://block385.com/the-devices-winning-the-race-to-get-hacked-in-2026</link>
<guid>https://block385.com/the-devices-winning-the-race-to-get-hacked-in-2026</guid>
<description><![CDATA[ Enterprise networks keep adding connected devices, expanding the attack surface as threat actors target a wider range of systems, many of which are difficult to inventory, secure, and patch consistently. (Source: Forescout) Forescout’s 2026 Riskiest Devices research maps that shift in IT, IoT, OT, and IoMT environments, with 11 new riskiest asset types entering the list this year. That is the second-largest year-over-year increase on record, and two of the new entries moved straight into … More →
The post The devices winning the race to get hacked in 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/06/29155248/connected-home.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 16:00:24 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, devices, winning, the, race, get, hacked, 2026</media:keywords>
</item>

<item>
<title>Broadcom delivers XDR solution to under&#45;resourced SOC teams</title>
<link>https://block385.com/broadcom-delivers-xdr-solution-to-under-resourced-soc-teams</link>
<guid>https://block385.com/broadcom-delivers-xdr-solution-to-under-resourced-soc-teams</guid>
<description><![CDATA[ Broadcom announced Symantec CBX (Carbon Black XDR), a cloud-based platform that combines Symantec and Carbon Black technologies in one intuitive solution. CBX addresses the needs of the industry’s largest and historically underserved market: organizations that lack the resources and training for complex security implementations but face the same formidable attackers and threats. While today’s cyberattacks continue to escalate, organizations that used to fly under the radar of sophisticated attackers are facing more advanced persistent threats … More →
The post Broadcom delivers XDR solution to under-resourced SOC teams appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/02/27150233/security-1600.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 16:00:15 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Broadcom, delivers, XDR, solution, under-resourced, SOC, teams</media:keywords>
</item>

<item>
<title>AI Dominates RSAC Innovation Sandbox</title>
<link>https://block385.com/ai-dominates-rsac-innovation-sandbox</link>
<guid>https://block385.com/ai-dominates-rsac-innovation-sandbox</guid>
<description><![CDATA[ The 10 finalists will each have three minutes to make their case for being the most innovative, promising young security company of the year. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6398ac65343c7da6/69c145156f53d231e401fdf2/contest-Juergen-Hasenkopf-alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 16:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Dominates, RSAC, Innovation, Sandbox</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers &amp;amp; More</title>
<link>https://block385.com/weekly-recap-cicd-backdoor-fbi-buys-location-data-whatsapp-ditches-numbers-more</link>
<guid>https://block385.com/weekly-recap-cicd-backdoor-fbi-buys-location-data-whatsapp-ditches-numbers-more</guid>
<description><![CDATA[ Another week, another reminder that the internet is still a mess. Systems people thought were secure are being broken in simple ways, showing many still ignore basic advisories.
This edition covers a mix of issues: supply chain attacks hitting CI/CD setups, long-abused IoT devices being shut down, and exploits moving quickly from disclosure to real attacks. There are also new malware tricks ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhe8A2RKkUN6BATGKH_48mi3J6DYVutxBllcmOiNl7N3xeqPx9sySaIFdxMxfIp5VQksSCBdRKtpNpiWUcTo5VNClmu6dbs6hoM9Ljx3QXAWEnAjKAG0Vc8JHLxGWfZkq3ORe4PgT-RgpBxhPnfMtr8UOhnjXToH-WOa6h3IVUM3HQqvgmWmMTPjKsqTkSN/s1600/recap-bl.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 15:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>⚡, Weekly, Recap:, CICD, Backdoor, FBI, Buys, Location, Data, WhatsApp, Ditches, Numbers, More</media:keywords>
</item>

<item>
<title>We Found Eight Attack Vectors Inside AWS Bedrock. Here&amp;apos;s What Attackers Can Do with Them</title>
<link>https://block385.com/we-found-eight-attack-vectors-inside-aws-bedrock-heres-what-attackers-can-do-with-them</link>
<guid>https://block385.com/we-found-eight-attack-vectors-inside-aws-bedrock-heres-what-attackers-can-do-with-them</guid>
<description><![CDATA[ AWS Bedrock is Amazon&#039;s platform for building AI-powered applications. It gives developers access to foundation models and the tools to connect those models directly to enterprise data and systems. That connectivity is what makes it powerful – but it’s also what makes Bedrock a target.
When an AI agent can query your Salesforce instance, trigger a Lambda function, or pull from a SharePoint ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiNP5vhVrLuEm9El_BgbLywUuexUg6KzaMreEfpqeSpQnonIKWfB4fcCX_bXrkxTwUoqXqxjrXZdZbppYseQBmTTSXeZT3PLsXoUIKdVUxawVdz4e33n_E6iPxNLCL3mAypW2di8w755oQGTcP1dFoBaOXV9D7LuASxn-43LJ1JCxtOtTFZ_qUsBzlY878/s1600/xmcyber.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 15:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Found, Eight, Attack, Vectors, Inside, AWS, Bedrock., Heres, What, Attackers, Can, with, Them</media:keywords>
</item>

<item>
<title>Oracle issues emergency fix for pre&#45;auth RCE in Identity Manager (CVE&#45;2026&#45;21992)</title>
<link>https://block385.com/oracle-issues-emergency-fix-for-pre-auth-rce-in-identity-manager-cve-2026-21992</link>
<guid>https://block385.com/oracle-issues-emergency-fix-for-pre-auth-rce-in-identity-manager-cve-2026-21992</guid>
<description><![CDATA[ Oracle has released an out-of-band patch for a critical and easily exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager. The company did not say whether the vulnerability has been exploited as a zero-day, but has urged customers to apply the updates or provided mitigations as soon as possible. About CVE-2026-21992 CVE-2026-21992 is caused by missing authentication for a critical function. In Oracle Identity Manager – a solution for provisioning, managing and … More →
The post Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/12113306/oracle-eye-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 14:00:56 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Oracle, issues, emergency, fix, for, pre-auth, RCE, Identity, Manager, CVE-2026-21992</media:keywords>
</item>

<item>
<title>ESET introduces Cloud Workload Protection, bringing XDR visibility to cloud environments</title>
<link>https://block385.com/eset-introduces-cloud-workload-protection-bringing-xdr-visibility-to-cloud-environments</link>
<guid>https://block385.com/eset-introduces-cloud-workload-protection-bringing-xdr-visibility-to-cloud-environments</guid>
<description><![CDATA[ ESET has launched ESET Cloud Workload Protection as part of a comprehensive update for its ESET PROTECT Platform. The new module extends security beyond endpoints and servers to cover cloud workloads, enriching telemetry for detection and response while unifying security management across endpoint and cloud environments. “Many businesses, especially those in the midmarket, as well as MSPs, have been steadily adopting cloud features such as virtual machines to enhance their productivity,” said Michal Jankech, Vice … More →
The post ESET introduces Cloud Workload Protection, bringing XDR visibility to cloud environments appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/11/29120648/cloud_security-1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 14:00:46 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ESET, introduces, Cloud, Workload, Protection, bringing, XDR, visibility, cloud, environments</media:keywords>
</item>

<item>
<title>AppGate delivers identity&#45;based ZTNA for secure access across OT systems</title>
<link>https://block385.com/appgate-delivers-identity-based-ztna-for-secure-access-across-ot-systems</link>
<guid>https://block385.com/appgate-delivers-identity-based-ztna-for-secure-access-across-ot-systems</guid>
<description><![CDATA[ AppGate has announced the launch of its Operational Technology (OT) ZTNA solution. Designed to secure industrial control systems, manufacturing plants, energy facilities, and other critical infrastructure, the offering extends AppGate’s direct-routed ZTNA architecture into OT environments. It enables secure remote access without compromising performance or operational stability. As IT and OT systems grow increasingly interconnected, remote access has become fundamental to industrial operations. This shift challenges legacy security models that were designed for isolated networks. … More →
The post AppGate delivers identity-based ZTNA for secure access across OT systems appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11084626/zero-trust-1500-2.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 14:00:35 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AppGate, delivers, identity-based, ZTNA, for, secure, access, across, systems</media:keywords>
</item>

<item>
<title>Rubrik SAGE enables semantic governance for enterprise AI agents at scale</title>
<link>https://block385.com/rubrik-sage-enables-semantic-governance-for-enterprise-ai-agents-at-scale</link>
<guid>https://block385.com/rubrik-sage-enables-semantic-governance-for-enterprise-ai-agents-at-scale</guid>
<description><![CDATA[ Rubrik has unveiled its Semantic AI Governance Engine (SAGE), designed to secure and control autonomous agents in real time. SAGE powers Rubrik Agent Cloud, replacing static, manual oversight with intent-driven governance to safely scale the enterprise AI workforce while maintaining full control over agent behavior. Enterprise AI deployment is stalling at a governance bottleneck, as legacy systems rely on deterministic rules that cannot comprehend natural language nor adapt to dynamic and unforeseen actions taken by … More →
The post Rubrik SAGE enables semantic governance for enterprise AI agents at scale appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/06/09170820/ai-brain.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 14:00:25 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Rubrik, SAGE, enables, semantic, governance, for, enterprise, agents, scale</media:keywords>
</item>

<item>
<title>Black Duck Signal secures AI&#45;generated code with agentic application security</title>
<link>https://block385.com/black-duck-signal-secures-ai-generated-code-with-agentic-application-security</link>
<guid>https://block385.com/black-duck-signal-secures-ai-generated-code-with-agentic-application-security</guid>
<description><![CDATA[ Black Duck has announced the general availability of Black Duck Signal, an agentic AI application security solution purpose-built to secure AI-generated code in autonomous development workflows. As agentic AI coding assistants increasingly design, code and deliver production software, organizations face a new class of application risk, created at unprecedented speed and scale. Black Duck Signal is designed to meet this shift head-on, delivering AI-native security that intelligently assesses risk, validates findings and automates remediation at … More →
The post Black Duck Signal secures AI-generated code with agentic application security appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/03091934/lock-gear-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 14:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Black, Duck, Signal, secures, AI-generated, code, with, agentic, application, security</media:keywords>
</item>

<item>
<title>Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware</title>
<link>https://block385.com/microsoft-warns-irs-phishing-hits-29000-users-deploys-rmm-malware</link>
<guid>https://block385.com/microsoft-warns-irs-phishing-hits-29000-users-deploys-rmm-malware</guid>
<description><![CDATA[ Microsoft has warned of fresh campaigns that are capitalizing on the upcoming tax season in the U.S. to harvest credentials and deliver malware.
The email campaigns take advantage of the urgency and time-sensitive nature of emails to send phishing messages masquerading as refund notices, payroll forms, filing reminders, and requests from tax professionals to deceive recipients into opening ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEie9fqlMd4OuFVtXiIjViNTGyYhyol3qoSCp1VC7Au7Zp3ccwTT2YriDd5iWY7vc67FF0inmVd16ko0WfG3C57cyOs-I3RNaQXnk2eyfKefaJajCkfjvD1rfZp1hnOqyICcY5-dPdADaKq7bl74F4bocmJHp1W3sI6ZBGKIXiOI-phZVHwwyqtDQz1kNQty/s1600/irs.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 13:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Warns, IRS, Phishing, Hits, 29, 000, Users, Deploys, RMM, Malware</media:keywords>
</item>

<item>
<title>Zero Networks Kubernetes Access Matrix exposes hidden access paths and blast radius</title>
<link>https://block385.com/zero-networks-kubernetes-access-matrix-exposes-hidden-access-paths-and-blast-radius</link>
<guid>https://block385.com/zero-networks-kubernetes-access-matrix-exposes-hidden-access-paths-and-blast-radius</guid>
<description><![CDATA[ Zero Networks has announced the Kubernetes Access Matrix, a real time visual map that exposes every allowed and denied rule inside Kubernetes clusters. The new capability enables security and DevOps teams to see, understand, and control Kubernetes access at scale, closing “understanding what is going on inside K8s” gaps that leave organizations exposed to lateral movement and operational risk. In most IT environments, security and infrastructure teams control what can talk to what. In Kubernetes, … More →
The post Zero Networks Kubernetes Access Matrix exposes hidden access paths and blast radius appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 12:00:49 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Zero, Networks, Kubernetes, Access, Matrix, exposes, hidden, access, paths, and, blast, radius</media:keywords>
</item>

<item>
<title>Russian hackers go after high&#45;value targets through Signal</title>
<link>https://block385.com/russian-hackers-go-after-high-value-targets-through-signal</link>
<guid>https://block385.com/russian-hackers-go-after-high-value-targets-through-signal</guid>
<description><![CDATA[ Russian intelligence-linked hackers are targeting commercial messaging platforms, with Signal a primary focus, the FBI and CISA warn. The campaign is aimed at individuals of intelligence interest, including government personnel, journalists, and others with access to sensitive communications. It is believed that the campaign has compromised thousands of commercial messaging applications accounts. People who use these applications can develop a false sense of security, believing they are protected from hacking. Criminals exploit this through phishing … More →
The post Russian hackers go after high-value targets through Signal appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/06153812/singnal-app-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 12:00:39 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Russian, hackers, after, high-value, targets, through, Signal</media:keywords>
</item>

<item>
<title>Zluri addresses expanding identity attack surface across SaaS, cloud, and AI</title>
<link>https://block385.com/zluri-addresses-expanding-identity-attack-surface-across-saas-cloud-and-ai</link>
<guid>https://block385.com/zluri-addresses-expanding-identity-attack-surface-across-saas-cloud-and-ai</guid>
<description><![CDATA[ Enterprise identity is undergoing a fundamental shift. Employees are no longer the only identities operating inside organizations. Service accounts, machine identities, application integrations, and AI agents now interact with enterprise systems at scale, accelerating the growth of non-human identities and expanding the identity attack surface across SaaS applications, cloud infrastructure, and on-premises systems. To address this shift, Zluri expanded its platform to deliver the Zluri Identity Security Platform, helping enterprises discover, govern, and monitor identities … More →
The post Zluri addresses expanding identity attack surface across SaaS, cloud, and AI appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/09/16094152/identity-person.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 12:00:22 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Zluri, addresses, expanding, identity, attack, surface, across, SaaS, cloud, and</media:keywords>
</item>

<item>
<title>Proofpoint unifies email, data, and AI security to reduce enterprise blind spots</title>
<link>https://block385.com/proofpoint-unifies-email-data-and-ai-security-to-reduce-enterprise-blind-spots</link>
<guid>https://block385.com/proofpoint-unifies-email-data-and-ai-security-to-reduce-enterprise-blind-spots</guid>
<description><![CDATA[ Proofpoint has unveiled innovations across its Collaboration Security and Data Security portfolios, strengthening protection for the agentic workspace, where people and AI agents interact across communication and data environments to execute business-critical work. As organizations deploy AI assistants and autonomous agents, they are delegating authority at scale. AI systems now draft communications, access sensitive data, and take action at machine speed. Unlike deterministic systems built on fixed rules, AI generates outcomes based on prediction rather … More →
The post Proofpoint unifies email, data, and AI security to reduce enterprise blind spots appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/08140150/lock-red-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 12:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Proofpoint, unifies, email, data, and, security, reduce, enterprise, blind, spots</media:keywords>
</item>

<item>
<title>Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper</title>
<link>https://block385.com/trivy-hack-spreads-infostealer-via-docker-triggers-worm-and-kubernetes-wiper</link>
<guid>https://block385.com/trivy-hack-spreads-infostealer-via-docker-triggers-worm-and-kubernetes-wiper</guid>
<description><![CDATA[ Cybersecurity researchers have uncovered malicious artifacts distributed via Docker Hub following the Trivy supply chain attack, highlighting the widening blast radius across developer environments.
The last known clean release of Trivy on Docker Hub is 0.69.3. The malicious versions 0.69.4, 0.69.5, and 0.69.6 have since been removed from the container image library.
&quot;New image tags 0.69.5 and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3tECPxIu-t1cl5YE211vm5q8dB99cO4mW6hbz0jCRbtDjalNgI7gX42M9MQAkty0IsWyxB3cJDMOpKbqQlLSKMnjbGaBOJHB9QslmSQB6-96o4RlaFLKuTHEAq8HpO-KbprLYPIjSR64H9twUcA-fuV0CrB2qw7RlzNWhQUHEmyKboascQm-Udl5GPdwA/s1600/docker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 11:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Trivy, Hack, Spreads, Infostealer, via, Docker, Triggers, Worm, and, Kubernetes, Wiper</media:keywords>
</item>

<item>
<title>Booz Allen’s Vellox brings AI vs. AI defense to protect critical infrastructure and national security</title>
<link>https://block385.com/booz-allens-vellox-brings-ai-vs-ai-defense-to-protect-critical-infrastructure-and-national-security</link>
<guid>https://block385.com/booz-allens-vellox-brings-ai-vs-ai-defense-to-protect-critical-infrastructure-and-national-security</guid>
<description><![CDATA[ Booz Allen Hamilton’s new Vellox suite showcases how AI-native cyber defense can counter growing threats to U.S. national security and critical infrastructure. The company’s new threat report, When Cyberattacks Happen at AI Speed, shows that AI is widening the gap between the speed of cyberattacks and time to respond. In 2025, the average breakout time from initial access to ability to move into other systems “dropped to under 30 minutes, with the fastest cases measured … More →
The post Booz Allen’s Vellox brings AI vs. AI defense to protect critical infrastructure and national security appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/17092123/research-ai-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 10:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Booz, Allen’s, Vellox, brings, vs., defense, protect, critical, infrastructure, and, national, security</media:keywords>
</item>

<item>
<title>Hackers Exploit CVE&#45;2025&#45;32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems</title>
<link>https://block385.com/hackers-exploit-cve-2025-32975-cvss-100-to-hijack-unpatched-quest-kace-sma-systems</link>
<guid>https://block385.com/hackers-exploit-cve-2025-32975-cvss-100-to-hijack-unpatched-quest-kace-sma-systems</guid>
<description><![CDATA[ Threat actors are suspected to be exploiting a maximum-severity security flaw impacting Quest KACE Systems Management Appliance (SMA), according to Arctic Wolf.
The cybersecurity company said it observed malicious activity starting the week of March 9, 2026, in customer environments that&#039;s consistent with the exploitation of CVE-2025-32975 on unpatched SMA systems exposed to the internet. It&#039;s ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuTlyFHjxX97gPhHFjyvPGAPsLFbWQSHzAofYEPTsqZS1Xyc4KjjMDOqW-N7Iku9d1cuOJLI7EMdA-kA5X86I2neC5efkXETfsIVOZcIEVfLxWKFEnR3qXfgpLxXvG3ZKixxV_bmEDxXIN_65QzgRKguXIJkQhzY50ROEEV5irUXNeuekFatz88Yk_BONZ/s1600/kace.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 09:30:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hackers, Exploit, CVE-2025-32975, CVSS, 10.0, Hijack, Unpatched, Quest, KACE, SMA, Systems</media:keywords>
</item>

<item>
<title>NIST updates its DNS security guidance for the first time in over a decade</title>
<link>https://block385.com/nist-updates-its-dns-security-guidance-for-the-first-time-in-over-a-decade</link>
<guid>https://block385.com/nist-updates-its-dns-security-guidance-for-the-first-time-in-over-a-decade</guid>
<description><![CDATA[ DNS infrastructure underpins nearly every network connection an organization makes, yet security configurations for it have gone largely unrevised at the federal guidance level for more than twelve years. NIST published SP 800-81r3, the Secure Domain Name System Deployment Guide, superseding a version that dates to 2013. The document covers three main areas: using DNS as an active security control, securing the DNS protocol itself, and protecting the servers and infrastructure that run DNS services. … More →
The post NIST updates its DNS security guidance for the first time in over a decade appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/14151926/nist-1500-a.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 08:00:24 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NIST, updates, its, DNS, security, guidance, for, the, first, time, over, decade</media:keywords>
</item>

<item>
<title>Plumber: Open&#45;source scanner of GitLab CI/CD pipelines for compliance gaps</title>
<link>https://block385.com/plumber-open-source-scanner-of-gitlab-cicd-pipelines-for-compliance-gaps</link>
<guid>https://block385.com/plumber-open-source-scanner-of-gitlab-cicd-pipelines-for-compliance-gaps</guid>
<description><![CDATA[ GitLab CI/CD pipelines often accumulate configuration decisions that drift from security baselines over time. Container images get pinned to mutable tags, branches lose protection settings, and required templates go missing. An open-source tool called Plumber automates the detection of those conditions by scanning pipeline configuration and repository settings directly. What Plumber checks Plumber reads a project’s .gitlab-ci.yml file and queries the GitLab API to produce a compliance report. It includes eight controls that teams can … More →
The post Plumber: Open-source scanner of GitLab CI/CD pipelines for compliance gaps appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/22145543/plumber-scan-gitlab.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 08:00:14 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Plumber:, Open-source, scanner, GitLab, CICD, pipelines, for, compliance, gaps</media:keywords>
</item>

<item>
<title>Your AI agents are moving sensitive data. Do you know where?</title>
<link>https://block385.com/your-ai-agents-are-moving-sensitive-data-do-you-know-where</link>
<guid>https://block385.com/your-ai-agents-are-moving-sensitive-data-do-you-know-where</guid>
<description><![CDATA[ In this Help Net Security interview, Gidi Cohen, CEO at Bonfy.AI, addresses what he sees as the most pressing gap in AI agent security: data-layer risk. While the industry focuses on prompt injection and model behavior, Cohen argues the deeper threat is autonomous AI agents operating across systems with no visibility into what data they access, combine, or expose. He explains how Bonfy.AI approaches this through three areas: controlling what data agents can access for … More →
The post Your AI agents are moving sensitive data. Do you know where? appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/18184518/gidi_cohen-2-bonfyai.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 23 Mar 2026 08:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, agents, are, moving, sensitive, data., you, know, where</media:keywords>
</item>

<item>
<title>Week in review: ScreenConnect servers open to attack, exploited Microsoft SharePoint flaw</title>
<link>https://block385.com/week-in-review-screenconnect-servers-open-to-attack-exploited-microsoft-sharepoint-flaw</link>
<guid>https://block385.com/week-in-review-screenconnect-servers-open-to-attack-exploited-microsoft-sharepoint-flaw</guid>
<description><![CDATA[ Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: What smart factories keep getting wrong about cybersecurity In this Help Net Security interview, Packsize CSO Troy Rydman breaks down the biggest vulnerabilities in smart factory environments today, from IoT devices and legacy systems to human error. He explains how unmanaged devices, from sensors to robotic components, often go unpatched and become entry points for attackers. Certificate lifespans are shrinking … More →
The post Week in review: ScreenConnect servers open to attack, exploited Microsoft SharePoint flaw appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/25124830/cybersecurity-week-review-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Sun, 22 Mar 2026 12:00:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Week, review:, ScreenConnect, servers, open, attack, exploited, Microsoft, SharePoint, flaw</media:keywords>
</item>

<item>
<title>FBI Warns Russian Hackers Target Signal, WhatsApp in Mass Phishing Attacks</title>
<link>https://block385.com/fbi-warns-russian-hackers-target-signal-whatsapp-in-mass-phishing-attacks</link>
<guid>https://block385.com/fbi-warns-russian-hackers-target-signal-whatsapp-in-mass-phishing-attacks</guid>
<description><![CDATA[ Threat actors affiliated with Russian Intelligence Services are conducting phishing campaigns to compromise commercial messaging applications (CMAs) like WhatsApp and Signal to seize control of accounts belonging to individuals with high intelligence value, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) said Friday.
&quot;The campaign ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjiMsZnvgdoACYJn8WjDy_Lpvpy1iqvGpj-vb4hYfYTLujLp_5dm8WZKjl64LYwY4-MON0-1k8-F2K3KDu0QG7isYjhaMvre0E0vrqJCSP49r2j374JPbV6WvkTG8lwqwrxquX-3xrReaA3G-NQGvskSnlOtM1XRj1J3MdPuCK9lXC6vf8ZkrCizN6ohcLC/s1600/signal-whatsapp.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 21 Mar 2026 15:30:14 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FBI, Warns, Russian, Hackers, Target, Signal, WhatsApp, Mass, Phishing, Attacks</media:keywords>
</item>

<item>
<title>Oracle Patches Critical CVE&#45;2026&#45;21992 Enabling Unauthenticated RCE in Identity Manager</title>
<link>https://block385.com/oracle-patches-critical-cve-2026-21992-enabling-unauthenticated-rce-in-identity-manager</link>
<guid>https://block385.com/oracle-patches-critical-cve-2026-21992-enabling-unauthenticated-rce-in-identity-manager</guid>
<description><![CDATA[ Oracle has released security updates to address a critical security flaw impacting Identity Manager and Web Services Manager that could be exploited to achieve remote code execution.
The vulnerability, tracked as CVE-2026-21992, carries a CVSS score of 9.8 out of a maximum of 10.0.
&quot;This vulnerability is remotely exploitable without authentication,&quot; Oracle said in an advisory. &quot;If successfully ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxIh9aqIMPc6elNLcqZwmxGq0BHfA3NS2kkxawAr-H7SzPJKmvc7tXrykcm664TGFkJUIb_BmGpJV0CkEjIxVoRfTCrc8br5bi_TL93Nv_g7J_c9ccucZL4e55lp_zyywwBeAzDIoA1bnI95ELRLCbOyVf0WX0CGgGHLun2uQFKhqeMKf16nBOeJTO7O77/s1600/oracle-flaw-hack.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 21 Mar 2026 13:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Oracle, Patches, Critical, CVE-2026-21992, Enabling, Unauthenticated, RCE, Identity, Manager</media:keywords>
</item>

<item>
<title>CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026</title>
<link>https://block385.com/cisa-flags-apple-craft-cms-laravel-bugs-in-kev-orders-patching-by-april-3-2026</link>
<guid>https://block385.com/cisa-flags-apple-craft-cms-laravel-bugs-in-kev-orders-patching-by-april-3-2026</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added five security flaws impacting Apple, Craft CMS, and Laravel Livewire to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch them by April 3, 2026.
The vulnerabilities that have come under exploitation are listed below -

CVE-2025-31277 (CVSS score: 8.8) - A vulnerability in Apple ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJQDea3eiUAONNSYkmQsjicwXBMSALOAUJi7yPHqOStd9N-KBADSGXjH5zJS66VPyzi7-w5ULK7Ax9qH66_Av9E3xIL8BB7sDKz9d-ZbmlyqeyfKyCUYBb15eOH5_keQQ-RUchVoh7NvguG3Ps8sau8Ik17QNOMVtmTkQEck9gao_1zcLPE8JE_qPvc4Q9/s1600/cisa-kev.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 21 Mar 2026 11:30:14 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Flags, Apple, Craft, CMS, Laravel, Bugs, KEV, Orders, Patching, April, 2026</media:keywords>
</item>

<item>
<title>Trivy Supply Chain Attack Triggers Self&#45;Spreading CanisterWorm Across 47 npm Packages</title>
<link>https://block385.com/trivy-supply-chain-attack-triggers-self-spreading-canisterworm-across-47-npm-packages</link>
<guid>https://block385.com/trivy-supply-chain-attack-triggers-self-spreading-canisterworm-across-47-npm-packages</guid>
<description><![CDATA[ The threat actors behind the supply chain attack targeting the popular Trivy scanner are suspected to be conducting follow-on attacks that have led to the compromise of a large number of npm packages with a previously undocumented self-propagating worm dubbed CanisterWorm.
The name is a reference to the fact that the malware uses an ICP canister, which refers to tamperproof smart contracts on ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJqn31IC9aCQ9LMLCLRXgpwsa1gvtzXlYk20-1yRmCMYVM_MwGHedfSgbKl24yaeTx4fqRc4-vscge-d3P6sN8sErQBVGD0kgxMGzV-mDCI1wGFh87BB8me019zcennhvA6xyMHLnH9IKZ-txSWs9OwL5cGbg0X8sx_KZ2tj5A5awErRRRMbdSrw_cXs6a/s1600/npm-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 21 Mar 2026 09:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Trivy, Supply, Chain, Attack, Triggers, Self-Spreading, CanisterWorm, Across, npm, Packages</media:keywords>
</item>

<item>
<title>Patch Now: Oracle&amp;apos;s Fusion Middleware Has Critical RCE Flaw</title>
<link>https://block385.com/patch-now-oracles-fusion-middleware-has-critical-rce-flaw</link>
<guid>https://block385.com/patch-now-oracles-fusion-middleware-has-critical-rce-flaw</guid>
<description><![CDATA[ Attackers can execute arbitrary code without authentication if Oracle&#039;s Identity or Web Services Managers are exposed to the Web. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3966162dd76f69cb/69bd954678da062bb91c2e6a/Oracle-Jerome_Cid-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 22:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Patch, Now:, Oracles, Fusion, Middleware, Has, Critical, RCE, Flaw</media:keywords>
</item>

<item>
<title>Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets</title>
<link>https://block385.com/trivy-security-scanner-github-actions-breached-75-tags-hijacked-to-steal-cicd-secrets</link>
<guid>https://block385.com/trivy-security-scanner-github-actions-breached-75-tags-hijacked-to-steal-cicd-secrets</guid>
<description><![CDATA[ Trivy, a popular open-source vulnerability scanner maintained by Aqua Security, was compromised a second time within the span of a month to deliver malware that stole sensitive CI/CD secrets.
The latest incident impacted GitHub Actions &quot;aquasecurity/trivy-action&quot; and &quot;aquasecurity/setup-trivy,&quot; which are used to scan Docker container images for vulnerabilities and set up GitHub Actions workflow ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNf7vYlImTCJ7BCjYYEhoFZXTawhHcJJad9cFjQn98oQjaPY9HY6Qgpp6pAyqkq7CNHyVXI9fR8hcyVNlW_knYia3f0BhAlK7fZb2gplznk9v9QCFGKtIbMLTSu-erTslOxZCHd8jkJKXIcCYhK8QkKLuWjG8yxjhPBaEWUDzwY0sUkX5JvhBtzFxyfp_q/s1600/scan.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 21:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Trivy, Security, Scanner, GitHub, Actions, Breached, Tags, Hijacked, Steal, CICD, Secrets</media:keywords>
</item>

<item>
<title>Cyber OpSec Fail: Beast Gang Exposes Ransomware Server</title>
<link>https://block385.com/cyber-opsec-fail-beast-gang-exposes-ransomware-server</link>
<guid>https://block385.com/cyber-opsec-fail-beast-gang-exposes-ransomware-server</guid>
<description><![CDATA[ Files on a central cloud server used by the ransomware group highlight a systematic, aggressive attack on network backups as a key TTP. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt37940faf94d51576/69bd782de800671de0dc9622/beast-masks-at-hungarian-spring-carnival-Zsolt_Biczo-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 20:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cyber, OpSec, Fail:, Beast, Gang, Exposes, Ransomware, Server</media:keywords>
</item>

<item>
<title>Critical Langflow Flaw CVE&#45;2026&#45;33017 Triggers Attacks within 20 Hours of Disclosure</title>
<link>https://block385.com/critical-langflow-flaw-cve-2026-33017-triggers-attacks-within-20-hours-of-disclosure</link>
<guid>https://block385.com/critical-langflow-flaw-cve-2026-33017-triggers-attacks-within-20-hours-of-disclosure</guid>
<description><![CDATA[ A critical security flaw impacting Langflow has come under active exploitation within 20 hours of public disclosure, highlighting the speed at which threat actors weaponize newly published vulnerabilities.
The security defect, tracked as CVE-2026-33017 (CVSS score: 9.3), is a case of missing authentication combined with code injection that could result in remote code execution.
&quot;The POST /api/v1 ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2uKC6w30P_dGu6jY7cfDW9xY9ElBbdwmshMQwltpgGrYMyN9TOPaFRbeHh_KM9QUBB7g77BpRq559AtmaDLBFgbxMV_ctMYqQmlaKukZe-LaiyEY_S675PLWqSbGJnjh3_g59EhNTTgjMGxnk-YZjjzX6D7dXOiWklwr_tUnd5sMSp15Q6kKVtYJ4isnF/s1600/langflow.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 17:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, Langflow, Flaw, CVE-2026-33017, Triggers, Attacks, within, Hours, Disclosure</media:keywords>
</item>

<item>
<title>Cisco FMC flaw was exploited by Interlock weeks before patch (CVE&#45;2026&#45;20131)</title>
<link>https://block385.com/cisco-fmc-flaw-was-exploited-by-interlock-weeks-before-patch-cve-2026-20131</link>
<guid>https://block385.com/cisco-fmc-flaw-was-exploited-by-interlock-weeks-before-patch-cve-2026-20131</guid>
<description><![CDATA[ A critical vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) that Cisco disclosed and patched in early March 2026 has been exploited as a zero-day by the Interlock ransomware gang, Amazon CISO and VP of Security Engineering CJ Moses revealed. “Our research [using Amazon’s MadPot system of honeypots] found that Interlock was exploiting this vulnerability 36 days before its public disclosure, beginning January 26, 2026,” he said on Wednesday. CVE-2026-20131 exploited as zero-day for … More →
The post Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/01/23135631/cisco-flow.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 16:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cisco, FMC, flaw, was, exploited, Interlock, weeks, before, patch, CVE-2026-20131</media:keywords>
</item>

<item>
<title>Interlock Ransomware Targets Cisco Enterprise Firewalls</title>
<link>https://block385.com/interlock-ransomware-targets-cisco-enterprise-firewalls</link>
<guid>https://block385.com/interlock-ransomware-targets-cisco-enterprise-firewalls</guid>
<description><![CDATA[ The ransomware gang, known for double-extortion attacks, had access to a critical Cisco firewall vulnerability weeks before it was publicly disclosed. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc20a31ce918ced0e/69bc51ca221466202f29a950/Interlocking_Gears_Zoonar_GmbH_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 16:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Interlock, Ransomware, Targets, Cisco, Enterprise, Firewalls</media:keywords>
</item>

<item>
<title>With Government&amp;apos;s Role Uncertain, Businesses Unite to Combat Fraud</title>
<link>https://block385.com/with-governments-role-uncertain-businesses-unite-to-combat-fraud</link>
<guid>https://block385.com/with-governments-role-uncertain-businesses-unite-to-combat-fraud</guid>
<description><![CDATA[ Major industry leaders agree to share information and collaborate to boost defenses in the wake of distressing online scams. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt852374154dc9b41e/680964f6901a150e471ede06/Cyber_fraud_(1800)_Olekcii_Mach_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 16:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>With, Governments, Role, Uncertain, Businesses, Unite, Combat, Fraud</media:keywords>
</item>

<item>
<title>Magento PolyShell Flaw Enables Unauthenticated Uploads, RCE and Account Takeover</title>
<link>https://block385.com/magento-polyshell-flaw-enables-unauthenticated-uploads-rce-and-account-takeover</link>
<guid>https://block385.com/magento-polyshell-flaw-enables-unauthenticated-uploads-rce-and-account-takeover</guid>
<description><![CDATA[ Sansec is warning of a critical security flaw in Magento&#039;s REST API that could allow unauthenticated attackers to upload arbitrary executables and achieve code execution and account takeover.
The vulnerability has been codenamed PolyShell by Sansec owing to the fact that the attack hinges on disguising malicious code as an image. There is no evidence that the shortcoming has been exploited in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmvoo5bgNhw6SuInM6rRH_pdtYFmiDdMlG7hS2GdUJfwhXoOClt29lEpxaqI27b6XOOfX3eO8eHlUM0LA55P9U_HfWgVPyqDWMO01Chkp6aC-is0292EqVXPRjwesdZl9igZ0iD7NdoW8rQhKRVfF7s_I98a8r2YOk3-vjDMEz4eGGVXjmt-nUJpLpM4OL/s1600/mag.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 15:30:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Magento, PolyShell, Flaw, Enables, Unauthenticated, Uploads, RCE, and, Account, Takeover</media:keywords>
</item>

<item>
<title>Terminated contract led to $2.5 million cyber extortion scheme</title>
<link>https://block385.com/terminated-contract-led-to-25-million-cyber-extortion-scheme</link>
<guid>https://block385.com/terminated-contract-led-to-25-million-cyber-extortion-scheme</guid>
<description><![CDATA[ A federal jury convicted Cameron Curry, 27, a Charlotte resident, of carrying out an extensive cyber extortion scheme targeting a Washington, D.C.-based international technology company. He faces up to two years in prison on each of the six charges. Curry, who worked as a data analyst for about six months with the victim company and had access to its data files and internal personnel and corporate information, began the scheme after learning his contract would … More →
The post Terminated contract led to $2.5 million cyber extortion scheme appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/03/28115542/insider-threat-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 14:00:27 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Terminated, contract, led, 2.5, million, cyber, extortion, scheme</media:keywords>
</item>

<item>
<title>Google slows Android sideloading to trip up scammers</title>
<link>https://block385.com/google-slows-android-sideloading-to-trip-up-scammers</link>
<guid>https://block385.com/google-slows-android-sideloading-to-trip-up-scammers</guid>
<description><![CDATA[ Google’s advanced flow for Android changes how apps from unverified developers are installed, adding steps to reduce scam-driven sideloading. The feature is aimed at experienced users and allows sideloading through a controlled, one-time setup. It addresses scam scenarios where attackers pressure individuals to install malicious software. In these cases, scammers often stay on the phone and guide victims step by step, pushing them to bypass security warnings and disable protections before they can pause or … More →
The post Google slows Android sideloading to trip up scammers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/05104142/android-green-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 14:00:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, slows, Android, sideloading, trip, scammers</media:keywords>
</item>

<item>
<title>Google Adds 24&#45;Hour Wait for Unverified App Sideloading to Reduce Malware and Scams</title>
<link>https://block385.com/google-adds-24-hour-wait-for-unverified-app-sideloading-to-reduce-malware-and-scams</link>
<guid>https://block385.com/google-adds-24-hour-wait-for-unverified-app-sideloading-to-reduce-malware-and-scams</guid>
<description><![CDATA[ Google on Thursday announced a new &quot;advanced flow&quot; for Android sideloading that requires a mandatory 24-hour wait period to install apps from unverified developers in an attempt to balance openness with safety.
The new changes come against the backdrop of a developer verification mandate the tech giant announced last year that requires all Android apps to be registered by verified developers to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgg5Jk2lVSKahNb8j13vUPG5pkYP6zhO6lI9b-X50lBxAq_5yluF0ly4g80Z51IS-x-gwqVV3xIRyu5e9fMQb7Rsebhd1Als8TDnY2nLGESKkaVOP-balDBrPBTUfMyb4oEOvY8dVihZZxT05nhkCuZqYDsu3LsVDtjigqfaCwW112fZ9YLR8JesGrBtAvs/s1600/android-sideloading.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 13:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Adds, 24-Hour, Wait, for, Unverified, App, Sideloading, Reduce, Malware, and, Scams</media:keywords>
</item>

<item>
<title>The Importance of Behavioral Analytics in AI&#45;Enabled Cyber Attacks</title>
<link>https://block385.com/the-importance-of-behavioral-analytics-in-ai-enabled-cyber-attacks</link>
<guid>https://block385.com/the-importance-of-behavioral-analytics-in-ai-enabled-cyber-attacks</guid>
<description><![CDATA[ Artificial Intelligence (AI) is changing how individuals and organizations conduct many activities, including how cybercriminals carry out phishing attacks and iterate on malware. Now, cybercriminals are using AI to generate personalized phishing emails, deepfakes and malware that evade traditional detection by impersonating normal user activity and bypassing legacy security models. As a result, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIq94dqdTz9Ic4q8eAt2c90zqmtdvYtzdDTv5UHg6On7d5AiYKyX4DbcskeTXNuT_ucj287szoc6-QWLMwboEKuRY_M7yeW9KstNR5irszE54SZvzHyFo7NBvpnhFW3zKZTMBhnP_aSG-AS7DMjvuRwp6X9_QbVhRyJD3sLIRp32No8X2RrMUp9ff-f_c/s1600/keeper.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 13:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Importance, Behavioral, Analytics, AI-Enabled, Cyber, Attacks</media:keywords>
</item>

<item>
<title>Unpatched ScreenConnect servers open to attack (CVE&#45;2026&#45;3564)</title>
<link>https://block385.com/unpatched-screenconnect-servers-open-to-attack-cve-2026-3564</link>
<guid>https://block385.com/unpatched-screenconnect-servers-open-to-attack-cve-2026-3564</guid>
<description><![CDATA[ ConnectWise has patched a critical vulnerability (CVE-2026-3564) that could enable attackers to hijack ScreenConnect sessions by abusing ASP.NET machine keys to forge trusted authentication. About CVE-2026-3564 The ScreenConnect remote access platform is popular with managed service providers, IT departments, and technology solution providers. They can opt for the cloud-hosted version or can deploy it on their own servers or in their private cloud. CVE-2026-3564 stems from improper verification of cryptographic signature, can be exploited remotely … More →
The post Unpatched ScreenConnect servers open to attack (CVE-2026-3564) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/08/25164558/screenconnect-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 12:00:29 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Unpatched, ScreenConnect, servers, open, attack, CVE-2026-3564</media:keywords>
</item>

<item>
<title>Fake AI songs streamed billions of times, netting fraudster $10 million</title>
<link>https://block385.com/fake-ai-songs-streamed-billions-of-times-netting-fraudster-10-million</link>
<guid>https://block385.com/fake-ai-songs-streamed-billions-of-times-netting-fraudster-10-million</guid>
<description><![CDATA[ Michael Smith, 54, of Cornelius, North Carolina, has pleaded guilty in federal court to running a scheme that exploited music streaming platforms and diverted royalty payments from artists. He admitted to one count of conspiracy to commit wire fraud, which carries a maximum sentence of five years in prison, and agreed to forfeit $8,091,843.64. According to U.S. Attorney for the Southern District of New York Jay Clayton, Smith used AI to generate hundreds of thousands … More →
The post Fake AI songs streamed billions of times, netting fraudster $10 million appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/20104434/music-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 12:00:20 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fake, songs, streamed, billions, times, netting, fraudster, 10, million</media:keywords>
</item>

<item>
<title>Authorities disrupt four IoT botnets behind record DDoS attacks</title>
<link>https://block385.com/authorities-disrupt-four-iot-botnets-behind-record-ddos-attacks</link>
<guid>https://block385.com/authorities-disrupt-four-iot-botnets-behind-record-ddos-attacks</guid>
<description><![CDATA[ The U.S. Justice Department and international partners have disrupted four IoT botnets linked to DDoS attacks that reached 30 terabits per second, among the largest ever recorded.
The post Authorities disrupt four IoT botnets behind record DDoS attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/02/01161302/botnet-bot-1400.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 12:00:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Authorities, disrupt, four, IoT, botnets, behind, record, DDoS, attacks</media:keywords>
</item>

<item>
<title>Rapid7 enhances Exposure Command with runtime validation and DSPM for risk analysis</title>
<link>https://block385.com/rapid7-enhances-exposure-command-with-runtime-validation-and-dspm-for-risk-analysis</link>
<guid>https://block385.com/rapid7-enhances-exposure-command-with-runtime-validation-and-dspm-for-risk-analysis</guid>
<description><![CDATA[ Rapid7 has unveiled new cloud security capabilities within Exposure Command. The introduction of runtime validation and Data Security Posture Management (DSPM) enables organizations to identify, validate, and prioritize exploitable risks based on real-world attack paths and business impact. As organizations scale hybrid and multi-cloud environments, security programs must move beyond reactive models built on assessment alone. With runtime validation and DSPM, Rapid7 advances Exposure Command from continuous assessment to continuous validation, enabling proactive exposure reduction … More →
The post Rapid7 enhances Exposure Command with runtime validation and DSPM for risk analysis appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 12:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Rapid7, enhances, Exposure, Command, with, runtime, validation, and, DSPM, for, risk, analysis</media:keywords>
</item>

<item>
<title>AppViewX acquires Eos to extend identity security to AI agents and workloads</title>
<link>https://block385.com/appviewx-acquires-eos-to-extend-identity-security-to-ai-agents-and-workloads</link>
<guid>https://block385.com/appviewx-acquires-eos-to-extend-identity-security-to-ai-agents-and-workloads</guid>
<description><![CDATA[ AppViewX has acquired Eos, an AI-native identity control plane for AI agents and autonomous workloads within the enterprise. By combining AppViewX’s automated CLM and PKI with Eos’s agentic governance and privileged access control, the platform delivers an integrated solution for AI agent and machine identity security. The acquisition accelerates AppViewX’s evolution into an AI-native platform, positioning the company as a leader in securing machines, workloads, and AI agents in cloud and hybrid environments. Additionally, Archit … More →
The post AppViewX acquires Eos to extend identity security to AI agents and workloads appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/07/25111944/handshake2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 10:00:40 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AppViewX, acquires, Eos, extend, identity, security, agents, and, workloads</media:keywords>
</item>

<item>
<title>Bonfy ACS 2.0 helps organizations control data use in AI environments</title>
<link>https://block385.com/bonfy-acs-20-helps-organizations-control-data-use-in-ai-environments</link>
<guid>https://block385.com/bonfy-acs-20-helps-organizations-control-data-use-in-ai-environments</guid>
<description><![CDATA[ Bonfy.AI announced Bonfy Adaptive Content Security (Bonfy ACS) 2.0, a platform built to secure enterprise content across all systems, applications, and AI agents – anywhere data moves, resides, or is processed. As organizations race to deploy copilots, custom AI apps, and increasingly autonomous AI agents, security leaders are struggling with blind spots around how these systems access, transform, and share sensitive data, gaps that legacy DLP and DSPM tools were never designed to handle. By … More →
The post Bonfy ACS 2.0 helps organizations control data use in AI environments appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/20082408/bonfy-ai-1400.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 10:00:37 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bonfy, ACS, 2.0, helps, organizations, control, data, use, environments</media:keywords>
</item>

<item>
<title>ConductorOne unveils AI Access Management to accelerate secure, compliant AI adoption</title>
<link>https://block385.com/conductorone-unveils-ai-access-management-to-accelerate-secure-compliant-ai-adoption</link>
<guid>https://block385.com/conductorone-unveils-ai-access-management-to-accelerate-secure-compliant-ai-adoption</guid>
<description><![CDATA[ ConductorOne has announced its AI Access Management product extension, a unified control plane for managing access to AI tools, agents, and MCP connections across the enterprise. The platform enables organizations to accelerate AI adoption while maintaining full visibility, policy enforcement, and compliance. As AI tools proliferate across the enterprise, organizations face a critical challenge: 75% of knowledge workers use AI tools today, and 78% bring their own, creating massive shadow AI risk. Meanwhile, only 18% … More →
The post ConductorOne unveils AI Access Management to accelerate secure, compliant AI adoption appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 10:00:24 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ConductorOne, unveils, Access, Management, accelerate, secure, compliant, adoption</media:keywords>
</item>

<item>
<title>Semgrep Multimodal brings AI reasoning and rule&#45;based analysis to code security</title>
<link>https://block385.com/semgrep-multimodal-brings-ai-reasoning-and-rule-based-analysis-to-code-security</link>
<guid>https://block385.com/semgrep-multimodal-brings-ai-reasoning-and-rule-based-analysis-to-code-security</guid>
<description><![CDATA[ Semgrep announced Semgrep Multimodal, a system that combines AI reasoning with rule-based analysis for detection, triage, and remediation. Its detection finds up to 8x more true positives while cutting noise by 50% compared to foundation models alone, and has already discovered dozens of zero-days at customers. Multimodal is built on Semgrep Workflows, a framework for autonomous code security – using deterministic tools and AI so security teams can encode their processes once and scale them … More →
The post Semgrep Multimodal brings AI reasoning and rule-based analysis to code security appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 10:00:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Semgrep, Multimodal, brings, reasoning, and, rule-based, analysis, code, security</media:keywords>
</item>

<item>
<title>Native Launches With Security Control Plane for Multicloud</title>
<link>https://block385.com/native-launches-with-security-control-plane-for-multicloud</link>
<guid>https://block385.com/native-launches-with-security-control-plane-for-multicloud</guid>
<description><![CDATA[ The cloud security startup&#039;s platform translates and enforces security policies across AWS, Azure, Google Cloud and Oracle using provider-native controls. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7d9cfad3cb569366/6852ccdd054857546446b424/cloudsecurity_PeachayaTanomsup_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 10:00:01 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Native, Launches, With, Security, Control, Plane, for, Multicloud</media:keywords>
</item>

<item>
<title>Post&#45;Quantum Web Could be Safer, Faster</title>
<link>https://block385.com/post-quantum-web-could-be-safer-faster</link>
<guid>https://block385.com/post-quantum-web-could-be-safer-faster</guid>
<description><![CDATA[ Major providers are testing a quantum-safe version of HTTPS that shrinks certificates to a tenth their previous size, decreasing latency and adding transparency. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt425fdb51e3ce6240/69baf529f3fcafa854d648ce/spider-in-web-Teerayuth_Mitrsermsarp-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 10:00:01 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Post-Quantum, Web, Could, Safer, Faster</media:keywords>
</item>

<item>
<title>Llamafile, Mozilla’s portable LLM runner, gets GPU support and a rebuilt core</title>
<link>https://block385.com/llamafile-mozillas-portable-llm-runner-gets-gpu-support-and-a-rebuilt-core</link>
<guid>https://block385.com/llamafile-mozillas-portable-llm-runner-gets-gpu-support-and-a-rebuilt-core</guid>
<description><![CDATA[ Running a large language model on a single machine without cloud access or a container runtime remains a priority for practitioners working in air-gapped or resource-constrained environments. Llamafile, Mozilla-AI’s project for packaging and running LLMs as self-contained executables, has received its most significant architectural overhaul to date with version 0.10.0. A rebuild from the ground up The 0.10.0 release is the product of a deliberate decision to reconstruct Llamafile’s core from scratch. The stated goal … More →
The post Llamafile, Mozilla’s portable LLM runner, gets GPU support and a rebuilt core appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/19133815/llamafile-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 08:00:28 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Llamafile, Mozilla’s, portable, LLM, runner, gets, GPU, support, and, rebuilt, core</media:keywords>
</item>

<item>
<title>New infosec products of the week: March 20, 2026</title>
<link>https://block385.com/new-infosec-products-of-the-week-march-20-2026</link>
<guid>https://block385.com/new-infosec-products-of-the-week-march-20-2026</guid>
<description><![CDATA[ Here’s a look at the most interesting products from the past week, featuring releases from Intel 471, Kore.ai, NinjaOne, Pindrop, Secure Code Warrior, Token Security, and Xona Systems. NinjaOne Vulnerability Management enables real-time detection and autonomous patching NinjaOne has unveiled NinjaOne Vulnerability Management, a new solution that helps IT teams identify, prioritize, and remediate vulnerabilities faster, without relying on periodic scans from security teams that often lack context and connection to remediation workflows. Intel 471 … More →
The post New infosec products of the week: March 20, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/28091843/infosec-week-1200.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 08:00:25 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, infosec, products, the, week:, March, 20, 2026</media:keywords>
</item>

<item>
<title>Cloud misconfiguration has evolved and your controls haven’t</title>
<link>https://block385.com/cloud-misconfiguration-has-evolved-and-your-controls-havent</link>
<guid>https://block385.com/cloud-misconfiguration-has-evolved-and-your-controls-havent</guid>
<description><![CDATA[ In this Help Net Security video, Kat Traxler, Principal Security Researcher – Public Cloud at Vectra AI, walks through two AWS misconfigurations that go beyond the basics of bucket visibility. The first is bucket name squatting. Because S3 uses a global namespace, attackers can register bucket names they expect a target company will use, then wait for data or code to route their way. AWS recently addressed this by tying bucket names to account IDs … More →
The post Cloud misconfiguration has evolved and your controls haven’t appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/09/30153935/cloud-data.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 08:00:19 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cloud, misconfiguration, has, evolved, and, your, controls, haven’t</media:keywords>
</item>

<item>
<title>Field workers don’t need more access, they need better security</title>
<link>https://block385.com/field-workers-dont-need-more-access-they-need-better-security</link>
<guid>https://block385.com/field-workers-dont-need-more-access-they-need-better-security</guid>
<description><![CDATA[ In this Help Net Security interview, Chris Thompson, CISO at West Shore Home, discusses least privilege and credential hygiene for a field-based workforce. He covers access management, authentication practices, and data risk processes that support employees in the field. Thompson also outlines security awareness efforts and how field teams are integrated into an organization’s security posture. How do you think about least privilege when your workforce is mobile and time-pressured rather than desk-based? There is … More →
The post Field workers don’t need more access, they need better security appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/18172248/chris_thompson-2-west_shore_home.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 08:00:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Field, workers, don’t, need, more, access, they, need, better, security</media:keywords>
</item>

<item>
<title>DoJ Disrupts 3 Million&#45;Device IoT Botnets Behind Record 31.4 Tbps Global DDoS Attacks</title>
<link>https://block385.com/doj-disrupts-3-million-device-iot-botnets-behind-record-314-tbps-global-ddos-attacks</link>
<guid>https://block385.com/doj-disrupts-3-million-device-iot-botnets-behind-record-314-tbps-global-ddos-attacks</guid>
<description><![CDATA[ The U.S. Department of Justice (DoJ) on Thursday announced the disruption of command-and-control (C2) infrastructure used by several Internet of Things (IoT) botnets like AISURU, Kimwolf, JackSkid, and Mossad as part of a court-authorized law enforcement operation.
The effort also saw authorities from Canada and Germany targeting the operators behind these botnets, with a number of private ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinuGXmHjiDQoCgH14v3lddFUEZQ96DLgTZ_Q8k7l7lpnGTX4zzeJ78e0MLRH8L3Bah3_zMnLI4kVNn3RDbnlzXpzchm5mg_1SDo0mCETmOylAS9qCPuMVRhtAfVWDzHUDwK2fRNiACoXo3oPWR8VV0E3m5svUSuDATtF4O_CIC05Vco5m3dN9MR9D7V-JP/s1600/botnet-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 07:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DoJ, Disrupts, Million-Device, IoT, Botnets, Behind, Record, 31.4, Tbps, Global, DDoS, Attacks</media:keywords>
</item>

<item>
<title>Apple Warns Older iPhones Vulnerable to Coruna, DarkSword Exploit Kit Attacks</title>
<link>https://block385.com/apple-warns-older-iphones-vulnerable-to-coruna-darksword-exploit-kit-attacks</link>
<guid>https://block385.com/apple-warns-older-iphones-vulnerable-to-coruna-darksword-exploit-kit-attacks</guid>
<description><![CDATA[ Apple is urging users who are still running an outdated version of iOS to update their iPhones to secure against web-based attacks carried out via powerful exploit kits like Coruna and DarkSword.
These attacks employ malicious web content to target out-of-date versions of iOS, triggering an infection chain that leads to the theft of sensitive data.
&quot;For example, if you&#039;re using an older ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPwgJpN_6bTBVT2q2xpQB_QFewyV2cp-Acaxnjpc4-KQKGpQZiz339xOYJ9ew_UlCgScvvWA940DyAf2E_HomGHQXljbHclluIiK57hJKo00KBdTXh8BeVi0toqDVevMaRY_fSlTzyYkkJjdKU0pA7iKX6_yTwsOveceby7OB08v9V2GAoasiLsl1Cu2DS/s1600/apple-logo.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 07:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Warns, Older, iPhones, Vulnerable, Coruna, DarkSword, Exploit, Kit, Attacks</media:keywords>
</item>

<item>
<title>54 EDR Killers Use BYOVD to Exploit 35 Signed Vulnerable Drivers and Disable Security</title>
<link>https://block385.com/54-edr-killers-use-byovd-to-exploit-35-signed-vulnerable-drivers-and-disable-security</link>
<guid>https://block385.com/54-edr-killers-use-byovd-to-exploit-35-signed-vulnerable-drivers-and-disable-security</guid>
<description><![CDATA[ A new analysis of endpoint detection and response (EDR) killers has revealed that 54 of them leverage a technique known as bring your own vulnerable driver (BYOVD) by abusing a total of 35 vulnerable drivers.
EDR killer programs have been a common presence in ransomware intrusions as they offer a way for affiliates to neutralize security software before deploying file-encrypting malware. This ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIi1shGpEknr4-CSa7F-hGXgqRLy4TeRhG2CLzUE9WOs7c-XA-TRmAFhxGmJePCWAjYzRvtRW5ukvGvKluq5hOfv8F8QmzqTUxVjElk6zf3ovVxZIvqUdn1A2Z02kv7t8efDgyyZEUljfWZRxOZqAynFB92c66-ywA8vxkCUXiJ75g4U2vJUlOlzblxU_z/s1600/edr.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 07:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>EDR, Killers, Use, BYOVD, Exploit, Signed, Vulnerable, Drivers, and, Disable, Security</media:keywords>
</item>

<item>
<title>AI Conundrum: Why MCP Security Can&amp;apos;t Be Patched Away</title>
<link>https://block385.com/ai-conundrum-why-mcp-security-cant-be-patched-away</link>
<guid>https://block385.com/ai-conundrum-why-mcp-security-cant-be-patched-away</guid>
<description><![CDATA[ MCP introduces security risks into LLM environments that are architectural and not easily fixable, researcher says at RSAC 2026 Conference. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt1b349661d49e33aa/69bc6456139466076c16011f/mcp_Umut_Hasanoglu_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 20 Mar 2026 00:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Conundrum:, Why, MCP, Security, Cant, Patched, Away</media:keywords>
</item>

<item>
<title>Speagle Malware Hijacks Cobra DocGuard to Steal Data via Compromised Servers</title>
<link>https://block385.com/speagle-malware-hijacks-cobra-docguard-to-steal-data-via-compromised-servers</link>
<guid>https://block385.com/speagle-malware-hijacks-cobra-docguard-to-steal-data-via-compromised-servers</guid>
<description><![CDATA[ Cybersecurity researchers have flagged a new malware dubbed Speagle that hijacks the functionality and infrastructure of a legitimate program called Cobra DocGuard.
&quot;Speagle is designed to surreptitiously harvest sensitive information from infected computers and transmit it to a Cobra DocGuard server that has been compromised by the attackers, masking the data exfiltration process as legitimate ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZSgCN7uAT0GxA_9D78X0Q9nRTRmUKPnhIvtgPrg32f62joth8HoaFjuZ68g1l10CVcTjQXiaw3ueNoItw0YN8edclDT-c6IHodK_nSRjPFqUH2hTfceviQi1UZ_6Mo2NvGlkVNIdx3CvxpobdFm3jVUuvvdIDcn5LIKQFNNFe7MScF824trW9pajXcM3l/s1600/locks.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 23:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Speagle, Malware, Hijacks, Cobra, DocGuard, Steal, Data, via, Compromised, Servers</media:keywords>
</item>

<item>
<title>54 EDR Killers Use BYOVD to Exploit 34 Signed Vulnerable Drivers and Disable Security</title>
<link>https://block385.com/54-edr-killers-use-byovd-to-exploit-34-signed-vulnerable-drivers-and-disable-security</link>
<guid>https://block385.com/54-edr-killers-use-byovd-to-exploit-34-signed-vulnerable-drivers-and-disable-security</guid>
<description><![CDATA[ A new analysis of endpoint detection and response (EDR) killers has revealed that 54 of them leverage a technique known as bring your own vulnerable driver (BYOVD) by abusing a total of 34 vulnerable drivers.
EDR killer programs have been a common presence in ransomware intrusions as they offer a way for affiliates to neutralize security software before deploying file-encrypting malware. This ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIi1shGpEknr4-CSa7F-hGXgqRLy4TeRhG2CLzUE9WOs7c-XA-TRmAFhxGmJePCWAjYzRvtRW5ukvGvKluq5hOfv8F8QmzqTUxVjElk6zf3ovVxZIvqUdn1A2Z02kv7t8efDgyyZEUljfWZRxOZqAynFB92c66-ywA8vxkCUXiJ75g4U2vJUlOlzblxU_z/s1600/edr.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 21:30:07 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>EDR, Killers, Use, BYOVD, Exploit, Signed, Vulnerable, Drivers, and, Disable, Security</media:keywords>
</item>

<item>
<title>ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish &amp;amp; More</title>
<link>https://block385.com/threatsday-bulletin-fortigate-raas-citrix-exploits-mcp-abuse-livechat-phish-more</link>
<guid>https://block385.com/threatsday-bulletin-fortigate-raas-citrix-exploits-mcp-abuse-livechat-phish-more</guid>
<description><![CDATA[ ThreatsDay Bulletin is back on The Hacker News, and this week feels off in a familiar way. Nothing loud, nothing breaking everything at once. Just a lot of small things that shouldn’t work anymore but still do.
Some of it looks simple, almost sloppy, until you see how well it lands. Other bits feel a little too practical, like they’re already closer to real-world use than anyone ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgo8NYPjdG8isSFFKDJkDtz603as8VZqTtFenMMZGF6GB_abFJsu8Kj6alv-Bnk_K0k9sXEqyPo2WxK12jRPz9cMIEvzX7whTVEESRW_n8mQguCvj5nQzTjXdmcvmPKP6GMFJuropryXpS7Uyi0VKDAmdGFFu4OqeHFnYVkhDCNO86SgTRMcLu6O_ZtJKen/s1600/tdays.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 17:30:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ThreatsDay, Bulletin:, FortiGate, RaaS, Citrix, Exploits, MCP, Abuse, LiveChat, Phish, More</media:keywords>
</item>

<item>
<title>Komodor unveils Klaudia AI extensibility framework to power multi&#45;agent incident resolution</title>
<link>https://block385.com/komodor-unveils-klaudia-ai-extensibility-framework-to-power-multi-agent-incident-resolution</link>
<guid>https://block385.com/komodor-unveils-klaudia-ai-extensibility-framework-to-power-multi-agent-incident-resolution</guid>
<description><![CDATA[ Komodor has unveiled a new extensibility framework that transforms its Klaudia AI technology into a universal multi-agent platform for troubleshooting and optimizing the performance of complex cloud native infrastructures and applications. This new architecture enables organizations to extend Klaudia AI with their own tools, services and agents, and combine these with more than 50 specialized agents already provided by Komodor. These new multi-agent orchestration capabilities enable teams to automate investigation and remediation of operational issues … More →
The post Komodor unveils Klaudia AI extensibility framework to power multi-agent incident resolution appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 16:00:54 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Komodor, unveils, Klaudia, extensibility, framework, power, multi-agent, incident, resolution</media:keywords>
</item>

<item>
<title>Entro Security AGA brings governance and control to enterprise AI agents and access</title>
<link>https://block385.com/entro-security-aga-brings-governance-and-control-to-enterprise-ai-agents-and-access</link>
<guid>https://block385.com/entro-security-aga-brings-governance-and-control-to-enterprise-ai-agents-and-access</guid>
<description><![CDATA[ Entro Security has launched its Agentic Governance &amp; Administration (AGA), a new pillar of the Entro platform designed to help security and identity teams govern AI agents and AI access across enterprise systems. Applied to the new realities of AI-driven access, AGA brings governance back to fundamentals of inventory, ownership, least privilege, auditability, and enforcement as organizations accelerate adoption of AI assistants, agent platforms, and locally running agents. “Enterprise AI adoption rarely starts with a … More →
The post Entro Security AGA brings governance and control to enterprise AI agents and access appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 16:00:52 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Entro, Security, AGA, brings, governance, and, control, enterprise, agents, and, access</media:keywords>
</item>

<item>
<title>Discern deploys six AI agents to streamline security analysis, prioritization, and remediation</title>
<link>https://block385.com/discern-deploys-six-ai-agents-to-streamline-security-analysis-prioritization-and-remediation</link>
<guid>https://block385.com/discern-deploys-six-ai-agents-to-streamline-security-analysis-prioritization-and-remediation</guid>
<description><![CDATA[ Discern Security has introduced new agentic AI capabilities across its proactive security platform, designed to help security teams move faster from data to action. As environments become more complex and security teams face growing tool sprawl, fragmented workflows, and too much data with too little clarity, Discern provides an easier way to understand posture, prioritize work, and drive measurable risk reduction across the security stack. The Discern platform features six specialized AI agents, each built … More →
The post Discern deploys six AI agents to streamline security analysis, prioritization, and remediation appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 16:00:51 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Discern, deploys, six, agents, streamline, security, analysis, prioritization, and, remediation</media:keywords>
</item>

<item>
<title>Cobalt adds continuous pentesting AI capabilities to scale offensive security and real&#45;world risk</title>
<link>https://block385.com/cobalt-adds-continuous-pentesting-ai-capabilities-to-scale-offensive-security-and-real-world-risk</link>
<guid>https://block385.com/cobalt-adds-continuous-pentesting-ai-capabilities-to-scale-offensive-security-and-real-world-risk</guid>
<description><![CDATA[ Cobalt has released new AI capabilities for continuous pentesting. Delivered through the Cobalt Offensive Security Platform, these next-generation components integrate AI with human pentesters and more than a decade of proprietary pentesting intelligence to accelerate the speed, scale, and depth of offensive security programs. Attackers are increasingly using AI to automate reconnaissance, vulnerability discovery, and exploitation. At the same time, development practices are accelerating release velocity and expanding the attack surface across APIs, microservices, cloud … More →
The post Cobalt adds continuous pentesting AI capabilities to scale offensive security and real-world risk appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 16:00:49 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cobalt, adds, continuous, pentesting, capabilities, scale, offensive, security, and, real-world, risk</media:keywords>
</item>

<item>
<title>Nagomi Security expands into agent&#45;driven exposure elimination with Agentic Exposure Ops</title>
<link>https://block385.com/nagomi-security-expands-into-agent-driven-exposure-elimination-with-agentic-exposure-ops</link>
<guid>https://block385.com/nagomi-security-expands-into-agent-driven-exposure-elimination-with-agentic-exposure-ops</guid>
<description><![CDATA[ Nagomi Security has announced the next evolution of its platform with Agentic Exposure Ops, expanding Nagomi from exposure visibility to agent-driven exposure elimination. Most exposure management programs generate findings faster than teams can validate what’s real, route fixes to the right owners, and re-check outcomes as environments change. Agentic Exposure Ops closes that execution loop so high-impact conditions get eliminated and stay closed over time. That loop breaks in enterprises for a simple reason: the … More →
The post Nagomi Security expands into agent-driven exposure elimination with Agentic Exposure Ops appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 16:00:48 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Nagomi, Security, expands, into, agent-driven, exposure, elimination, with, Agentic, Exposure, Ops</media:keywords>
</item>

<item>
<title>Versa Secure Enterprise Browser delivers browser&#45;native security for enterprise apps</title>
<link>https://block385.com/versa-secure-enterprise-browser-delivers-browser-native-security-for-enterprise-apps</link>
<guid>https://block385.com/versa-secure-enterprise-browser-delivers-browser-native-security-for-enterprise-apps</guid>
<description><![CDATA[ Versa has revealed early access to Versa Secure Enterprise Browser, a new browser-native security capability within the VersaONE Universal SASE Platform that protects employees, contractors, and partner users as they access web, SaaS, and enterprise AI applications by enforcing security, access, and data protection policies directly within the browser session. The browser has become the dominant execution environment for enterprise work, yet it often remains outside the reach of consistent security, access, and data protection … More →
The post Versa Secure Enterprise Browser delivers browser-native security for enterprise apps appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 16:00:47 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Versa, Secure, Enterprise, Browser, delivers, browser-native, security, for, enterprise, apps</media:keywords>
</item>

<item>
<title>4chan shrugs off UK regulator, refuses to pay £520,000 in fines over online safety violations</title>
<link>https://block385.com/4chan-shrugs-off-uk-regulator-refuses-to-pay-520000-in-fines-over-online-safety-violations</link>
<guid>https://block385.com/4chan-shrugs-off-uk-regulator-refuses-to-pay-520000-in-fines-over-online-safety-violations</guid>
<description><![CDATA[ The U.K.’s media regulator Ofcom fined 4chan £450,000 under the Online Safety Act for failing to introduce age checks to stop children from accessing pornographic content on its platform. 4chan is an online forum notorious for its extreme right-wing content, gory videos, and non-consensual pornography. The regulator ordered the company to introduce age assurance measures by 2 April 2026 and said additional daily penalties of £500 could apply if the issue is not resolved, with … More →
The post 4chan shrugs off UK regulator, refuses to pay £520,000 in fines over online safety violations appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/12170127/uk-flag-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 16:00:45 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>4chan, shrugs, off, regulator, refuses, pay, £520, 000, fines, over, online, safety, violations</media:keywords>
</item>

<item>
<title>Flare Foretrace helps employees detect and fix identity risks to strengthen enterprise security</title>
<link>https://block385.com/flare-foretrace-helps-employees-detect-and-fix-identity-risks-to-strengthen-enterprise-security</link>
<guid>https://block385.com/flare-foretrace-helps-employees-detect-and-fix-identity-risks-to-strengthen-enterprise-security</guid>
<description><![CDATA[ Flare has unveiled the general availability of Foretrace, a new business-to-business-to-employee (B2B2E) product that delivers enterprise-grade identity protection directly to employees. Built on the same threat intelligence infrastructure used by security teams to defend their organizations, Foretrace allows individuals to monitor and remediate their personal digital identity exposures. The spread of infostealer malware and the shift to remote and hybrid work have created a new reality where personal and corporate identities are increasingly interconnected, exposing … More →
The post Flare Foretrace helps employees detect and fix identity risks to strengthen enterprise security appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 16:00:42 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Flare, Foretrace, helps, employees, detect, and, fix, identity, risks, strengthen, enterprise, security</media:keywords>
</item>

<item>
<title>DarkSword: Researchers uncover another iOS exploit kit</title>
<link>https://block385.com/darksword-researchers-uncover-another-ios-exploit-kit</link>
<guid>https://block385.com/darksword-researchers-uncover-another-ios-exploit-kit</guid>
<description><![CDATA[ A powerful iPhone hacking toolkit dubbed “DarkSword” has been used since November 2025 to compromise devices by exploiting zero-day iOS vulnerabilities, Google researchers have shared. iOS vulnerabilities exploited by DarkSword Two weeks ago, Google Threat Intelligence Group (GTIG) and iVerify disclosed the existence of Coruna, a spy-grade iOS exploit kit that has been used in a commercial surveillance operation, by state-linked threat actors engaged in cyber espionage, and cybercriminals. While Coruna contains five full iOS … More →
The post DarkSword: Researchers uncover another iOS exploit kit appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/08/13155936/apple_ios-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 16:00:27 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DarkSword:, Researchers, uncover, another, iOS, exploit, kit</media:keywords>
</item>

<item>
<title>Intezer AI SOC removes MDR limits with autonomous triage and optimization</title>
<link>https://block385.com/intezer-ai-soc-removes-mdr-limits-with-autonomous-triage-and-optimization</link>
<guid>https://block385.com/intezer-ai-soc-removes-mdr-limits-with-autonomous-triage-and-optimization</guid>
<description><![CDATA[ Intezer has expanded capabilities in its AI SOC platform designed for teams who have outgrown their traditional managed detection and response (MDR) services. Internal SOC teams can now focus on supervising outcomes rather than grinding through alerts, with Intezer providing autonomous triage and investigation, continuous optimization for their SIEM and EDR detection rules and expert human support whenever needed. When internal teams lack the capacity to investigate alerts around the clock, they often turn to … More →
The post Intezer AI SOC removes MDR limits with autonomous triage and optimization appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 16:00:14 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Intezer, SOC, removes, MDR, limits, with, autonomous, triage, and, optimization</media:keywords>
</item>

<item>
<title>New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data</title>
<link>https://block385.com/new-perseus-android-banking-malware-monitors-notes-apps-to-extract-sensitive-data</link>
<guid>https://block385.com/new-perseus-android-banking-malware-monitors-notes-apps-to-extract-sensitive-data</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed a new Android malware family called Perseus that&#039;s being actively distributed in the wild with an aim to conduct device takeover (DTO) and financial fraud.
Perseus is built upon the foundations of Cerberus and Phoenix, at the same time evolving into a &quot;more flexible and capable platform&quot; for compromising Android devices through dropper apps distributed ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO9NIqWSua7z7wlxbrmrChu5uZeRwYbuW8vAxVAajRSO8FoYtN_dHwnplt-OfqYnZX9PaOWZmxZPG_eRjiDVYOV2XDYq8hKWrRxT8jbTT4yKbAF91OjdZuxWIaxRZSNfbFpiLF_E8w-hUvIgncy7htyQS-2oRakIpIBReQSKUgR8QaIJ1C9oMvimAkUMsA/s1600/android-banking-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 15:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Perseus, Android, Banking, Malware, Monitors, Notes, Apps, Extract, Sensitive, Data</media:keywords>
</item>

<item>
<title>CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE&#45;2026&#45;20963)</title>
<link>https://block385.com/cisa-warns-of-active-exploitation-of-microsoft-sharepoint-vulnerability-cve-2026-20963</link>
<guid>https://block385.com/cisa-warns-of-active-exploitation-of-microsoft-sharepoint-vulnerability-cve-2026-20963</guid>
<description><![CDATA[ CVE-2026-20963, a remote code execution (RCE) SharePoint vulnerability Microsoft fixed in January 2026, is being exploited by attackers. The confirmation comes from the US Cybersecurity and Infrastructure Security Agency (CISA), which added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday. About CVE-2026-20963 CVE-2026-20963 affects Microsoft SharePoint Server Subscription Edition, Microsoft SharePoint Server 2019, and Microsoft SharePoint Enterprise Server 2016. It is caused by deserialization of untrusted data and may allow an unauthorized … More →
The post CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE-2026-20963) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/07/20231158/microsoft_sharepoint.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 14:00:40 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, warns, active, exploitation, Microsoft, SharePoint, vulnerability, CVE-2026-20963</media:keywords>
</item>

<item>
<title>Secure endpoint management systems immediately, CISA urges</title>
<link>https://block385.com/secure-endpoint-management-systems-immediately-cisa-urges</link>
<guid>https://block385.com/secure-endpoint-management-systems-immediately-cisa-urges</guid>
<description><![CDATA[ The US Cybersecurity and Infrastructure Security Agency (CISA) warns that the cyberattack on Stryker Corporation serves as a signal to U.S. organizations that foreign cyber activity tied to Middle East conflicts may be spilling into their operations. Attackers breached Stryker’s internal Microsoft environment and reportedly wiped 200,000 systems, servers, and mobile devices, while extracting 50 terabytes of data. To defend against similar malicious activity involving the misuse of legitimate endpoint management software, CISA urges organizations … More →
The post Secure endpoint management systems immediately, CISA urges appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/13095016/cisa-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 14:00:24 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Secure, endpoint, management, systems, immediately, CISA, urges</media:keywords>
</item>

<item>
<title>Teleport announced Beams, wants to remove major barrier to agentic AI</title>
<link>https://block385.com/teleport-announced-beams-wants-to-remove-major-barrier-to-agentic-ai</link>
<guid>https://block385.com/teleport-announced-beams-wants-to-remove-major-barrier-to-agentic-ai</guid>
<description><![CDATA[ Teleport today announced Beams, a trusted runtime designed to solve the security and IAM challenges blocking teams from designing and running AI agents in production infrastructure. Beams runs each agent in an isolated Firecracker VM with built-in identity. Each Beam is connected to infrastructure and inference services without secrets, with audit and access control. Beams will launch as an MVP on April 30, 2026. Beams addresses a key challenge engineers face when designing agentic workflows … More →
The post Teleport announced Beams, wants to remove major barrier to agentic AI appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/19131053/teleport-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 14:00:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Teleport, announced, Beams, wants, remove, major, barrier, agentic</media:keywords>
</item>

<item>
<title>How Ceros Gives Security Teams Visibility and Control in Claude Code</title>
<link>https://block385.com/how-ceros-gives-security-teams-visibility-and-control-in-claude-code</link>
<guid>https://block385.com/how-ceros-gives-security-teams-visibility-and-control-in-claude-code</guid>
<description><![CDATA[ Security teams have spent years building identity and access controls for human users and service accounts. But a new category of actor has quietly entered most enterprise environments, and it operates entirely outside those controls.
Claude Code, Anthropic&#039;s AI coding agent, is now running across engineering organizations at scale. It reads files, executes shell commands, calls external APIs, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8B3hISiw4s7wL5Eruja2BnTYM2QNrpsi6FnTtzznVz-Vu1pERgS-lZuIVKrps6nlxaauzfCXNfiiSInowjXHDhZ3UgoGD7OlFtwijFG0w5MtfnGu920etTBYP0tHnauL6Owztp_K0I8DUXlMSWd2LZz57O8NFm83E8H5QZ7Kb7RCOja4c-viaPrf9lC8/s1600/bi.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 13:30:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, Ceros, Gives, Security, Teams, Visibility, and, Control, Claude, Code</media:keywords>
</item>

<item>
<title>EDR killers are now standard equipment in ransomware attacks</title>
<link>https://block385.com/edr-killers-are-now-standard-equipment-in-ransomware-attacks</link>
<guid>https://block385.com/edr-killers-are-now-standard-equipment-in-ransomware-attacks</guid>
<description><![CDATA[ Ransomware attackers routinely deploy tools designed to disable endpoint detection and response software before launching encryptors. These tools, known as EDR killers, have become a standard component of ransomware intrusions. ESET Research tracked nearly 90 EDR killers actively used in the wild. The workflow is consistent across groups: an attacker gains high privileges, deploys an EDR killer to disrupt security software, then runs the encryptor. Affiliates prefer this approach because it gives them a brief, … More →
The post EDR killers are now standard equipment in ransomware attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/06091054/malware-monitor-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 12:00:19 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>EDR, killers, are, now, standard, equipment, ransomware, attacks</media:keywords>
</item>

<item>
<title>900,000 contact records exposed in Aura data breach</title>
<link>https://block385.com/900000-contact-records-exposed-in-aura-data-breach</link>
<guid>https://block385.com/900000-contact-records-exposed-in-aura-data-breach</guid>
<description><![CDATA[ Aura, the online safety service, confirmed that an unauthorized party accessed about 900,000 records, mostly names and email addresses from a marketing tool linked to a company it acquired in 2021. The incident occurred as a result of a targeted phone phishing attack that tricked one of the employees. Aura believes that contact information related to less than 20,000 active customers and less than 15,000 former customers was accessed. According to Have I Been Pwned, … More →
The post 900,000 contact records exposed in Aura data breach appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/02/25185231/data_breach-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 12:00:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>900, 000, contact, records, exposed, Aura, data, breach</media:keywords>
</item>

<item>
<title>Google limits Android accessibility API to curb malware abuse</title>
<link>https://block385.com/google-limits-android-accessibility-api-to-curb-malware-abuse</link>
<guid>https://block385.com/google-limits-android-accessibility-api-to-curb-malware-abuse</guid>
<description><![CDATA[ Google is restricting how Android apps can use accessibility features after years of abuse by banking Trojans and mobile malware. The changes, introduced in Android 17.2, limit access to the accessibility API when Advanced Protection Mode (APM) is enabled. Apps that do not serve a core accessibility function can no longer use these services, closing off a common attack vector. Accessibility API abuse remains a key threat vector The accessibility API allows apps to read … More →
The post Google limits Android accessibility API to curb malware abuse appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/05104256/android-color-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 12:00:07 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, limits, Android, accessibility, API, curb, malware, abuse</media:keywords>
</item>

<item>
<title>DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero&#45;Days for Full Device Takeover</title>
<link>https://block385.com/darksword-ios-exploit-kit-uses-6-flaws-3-zero-days-for-full-device-takeover</link>
<guid>https://block385.com/darksword-ios-exploit-kit-uses-6-flaws-3-zero-days-for-full-device-takeover</guid>
<description><![CDATA[ A new exploit kit for Apple iOS devices designed to steal sensitive data from is being wielded by multiple threat actors since at least November 2025, according to reports from Google Threat Intelligence Group (GTIG), iVerify, and Lookout.
According to GTIG, multiple commercial surveillance vendors and suspected state-sponsored actors have utilized the full-chain exploit kit, codenamed DarkSword ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEho7JmQ9e8aVTFWYRYkZD_7n8d_IVUkFzCBPFnqGvDe_32LG-Te8BFovDqiVjMusP3eUTgXzn5iDoVgLTSnR1RR44UHLh6fuegsRokauImqaCbIL2KqUJcjlmViSKAAaSpZ5d7-L1CjYhizgV92pUQFLKo2DqE1sPijXfWNv24vIjcWCHVoF-G1p7vPciP_/s1600/dark.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 11:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DarkSword, iOS, Exploit, Kit, Uses, Flaws, Zero-Days, for, Full, Device, Takeover</media:keywords>
</item>

<item>
<title>Omnix AI Advisor brings real&#45;time credential threat insights to enterprise security teams</title>
<link>https://block385.com/omnix-ai-advisor-brings-real-time-credential-threat-insights-to-enterprise-security-teams</link>
<guid>https://block385.com/omnix-ai-advisor-brings-real-time-credential-threat-insights-to-enterprise-security-teams</guid>
<description><![CDATA[ Dashlane has unveiled Omnix AI Advisor, a natural-language AI security assistant embedded into the Dashlane Omnix platform. Built upon Omnix’s advanced credential protection and visibility capabilities, Omnix AI Advisor accelerates enterprises’ transition to a proactive security posture by turning real-time credential risk data, such as dark web exposure and phishing logs, into contextual, actionable intelligence. Security teams are inundated with data, making it difficult to know what matters most. Omnix AI Advisor correlates multiple data … More →
The post Omnix AI Advisor brings real-time credential threat insights to enterprise security teams appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 10:00:39 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Omnix, Advisor, brings, real-time, credential, threat, insights, enterprise, security, teams</media:keywords>
</item>

<item>
<title>Java 26 ships with new cryptography API and HTTP/3 support</title>
<link>https://block385.com/java-26-ships-with-new-cryptography-api-and-http3-support</link>
<guid>https://block385.com/java-26-ships-with-new-cryptography-api-and-http3-support</guid>
<description><![CDATA[ Oracle released JDK 26, the 17th consecutive feature release delivered under the six-month cadence the project adopted in 2018. The release includes ten JDK Enhancement Proposals spanning language changes, garbage collection improvements, cryptographic tooling, and network protocol support. PEM encoding API targets cryptographic integration JEP 524 introduces a second preview of a PEM encoding API for cryptographic objects. The API converts keys, certificates, and certificate revocation lists into Privacy-Enhanced Mail format and decodes them back … More →
The post Java 26 ships with new cryptography API and HTTP/3 support appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/10/26165428/java-logo2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 10:00:37 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Java, ships, with, new, cryptography, API, and, HTTP3, support</media:keywords>
</item>

<item>
<title>Samba 4.24.0 ships Kerberos hardening and a CVE fix for domain encryption defaults</title>
<link>https://block385.com/samba-4240-ships-kerberos-hardening-and-a-cve-fix-for-domain-encryption-defaults</link>
<guid>https://block385.com/samba-4240-ships-kerberos-hardening-and-a-cve-fix-for-domain-encryption-defaults</guid>
<description><![CDATA[ Samba 4.24.0 arrived carrying a set of Kerberos security changes aimed at Active Directory deployments. The release fixes a vulnerability, extends audit coverage for sensitive AD attributes, and introduces configuration options to counter two related Kerberos impersonation techniques. A CVE drives the encryption default change The most directly security-relevant change in 4.24.0 is a shift in default encryption types for Kerberos. The kdc default domain supported enctypes parameter now defaults to AES-128 and AES-256 (specifically … More →
The post Samba 4.24.0 ships Kerberos hardening and a CVE fix for domain encryption defaults appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/09/04104453/samba-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 10:00:32 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Samba, 4.24.0, ships, Kerberos, hardening, and, CVE, fix, for, domain, encryption, defaults</media:keywords>
</item>

<item>
<title>Keysight SBOM Manager simplifies global cybersecurity compliance and software transparency</title>
<link>https://block385.com/keysight-sbom-manager-simplifies-global-cybersecurity-compliance-and-software-transparency</link>
<guid>https://block385.com/keysight-sbom-manager-simplifies-global-cybersecurity-compliance-and-software-transparency</guid>
<description><![CDATA[ Keysight Technologies has launched Keysight SBOM Manager, a new solution designed to help organizations meet growing global cybersecurity and software transparency requirements, led by the European Union’s Cyber Resilience Act (CRA). The solution provides a unified approach to generating, managing, and using Software Bill of Materials (SBOMs) for digital products, enabling organizations to meet regulatory obligations with greater accuracy, confidence, and consistency across the product lifecycle. Cybersecurity regulations worldwide are converging on a common expectation: … More →
The post Keysight SBOM Manager simplifies global cybersecurity compliance and software transparency appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 10:00:23 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Keysight, SBOM, Manager, simplifies, global, cybersecurity, compliance, and, software, transparency</media:keywords>
</item>

<item>
<title>Arcjet enables inline defense against prompt injection in production AI systems</title>
<link>https://block385.com/arcjet-enables-inline-defense-against-prompt-injection-in-production-ai-systems</link>
<guid>https://block385.com/arcjet-enables-inline-defense-against-prompt-injection-in-production-ai-systems</guid>
<description><![CDATA[ Arcjet has released AI Prompt Injection Protection, a new capability designed to stop prompt injection attacks before they reach production AI models. The feature detects hostile prompts at the application boundary and gives developers a decision point inside the request lifecycle where malicious instructions can be blocked before inference occurs. Companies are shipping AI features into production faster than security review cycles can keep up. As those systems gain access to data, tools, and expensive … More →
The post Arcjet enables inline defense against prompt injection in production AI systems appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 10:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Arcjet, enables, inline, defense, against, prompt, injection, production, systems</media:keywords>
</item>

<item>
<title>EU Sanctions Companies in China, Iran for Cyberattacks</title>
<link>https://block385.com/eu-sanctions-companies-in-china-iran-for-cyberattacks</link>
<guid>https://block385.com/eu-sanctions-companies-in-china-iran-for-cyberattacks</guid>
<description><![CDATA[ Already sanctioned in the US and the UK, these rulings prohibit companies and a couple of principals from entering or doing business in the European Union. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt447b0823e680034d/69bb012e65cf387ebf1f8817/EU_Iran_China-Wirestock_Inc.-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 10:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Sanctions, Companies, China, Iran, for, Cyberattacks</media:keywords>
</item>

<item>
<title>CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero&#45;Day Hit in Ransomware Attacks</title>
<link>https://block385.com/cisa-warns-of-zimbra-sharepoint-flaw-exploits-cisco-zero-day-hit-in-ransomware-attacks</link>
<guid>https://block385.com/cisa-warns-of-zimbra-sharepoint-flaw-exploits-cisco-zero-day-hit-in-ransomware-attacks</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged government agencies to apply patches for two security flaws impacting Synacor Zimbra Collaboration Suite (ZCS) and Microsoft Office SharePoint, stating they have been actively exploited in the wild.
The vulnerabilities in question are as follows -

CVE-2025-66376 (CVSS score: 7.2) - A stored cross-site scripting ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNz_gKNFLCIU1bf3r5ndKEJY42xA-0VYcdfKSV7dFnLR49717u_2GSnPWzDJk4OkX-VbcUgnij6CUo-ZJvV4-uWiUuXsS0FtuAA8RBYnElk3ELRm_ODa1MhwK9GcjjuIN3rqi51_BBFYvMYCbcJGifTrfv4bUHYZmkcJSnKGDT7NnLBHU4GtaxMvW9F7Pr/s1600/cida-patches.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 09:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Warns, Zimbra, SharePoint, Flaw, Exploits, Cisco, Zero-Day, Hit, Ransomware, Attacks</media:keywords>
</item>

<item>
<title>Your APIs are under siege, and attackers are just getting warmed up</title>
<link>https://block385.com/your-apis-are-under-siege-and-attackers-are-just-getting-warmed-up</link>
<guid>https://block385.com/your-apis-are-under-siege-and-attackers-are-just-getting-warmed-up</guid>
<description><![CDATA[ Internet-facing systems are handling sustained levels of malicious traffic across APIs, web applications, and DDoS channels. Akamai’s State of the Internet security report places these patterns within the same operating environment, with activity increasing across each area through 2025. The number of web attacks against apps and APIs continued an upward trajectory from January 2024 to December 2025, demonstrating their prevalence as a major threat to organizations (Source: Akamai) API activity centers on how applications … More →
The post Your APIs are under siege, and attackers are just getting warmed up appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/09/14190228/internet-global2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 08:00:46 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, APIs, are, under, siege, and, attackers, are, just, getting, warmed</media:keywords>
</item>

<item>
<title>Elite members of North Korean society fake their way into Western paychecks</title>
<link>https://block385.com/elite-members-of-north-korean-society-fake-their-way-into-western-paychecks</link>
<guid>https://block385.com/elite-members-of-north-korean-society-fake-their-way-into-western-paychecks</guid>
<description><![CDATA[ Increased federal activity, including indictments over the past year, has drawn attention to a pattern that has been unfolding inside corporate hiring pipelines. North Korean nationals are securing roles as remote IT contractors and full-time staff within organizations across North America and Western Europe, using standard hiring channels to get in. Research by IBM X-Force and Flare outlines how these workers operate within a broader state-backed system tied to revenue generation and access to corporate … More →
The post Elite members of North Korean society fake their way into Western paychecks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/24203710/north_korea-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 08:00:35 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Elite, members, North, Korean, society, fake, their, way, into, Western, paychecks</media:keywords>
</item>

<item>
<title>AI got it wrong with high confidence. Now what?</title>
<link>https://block385.com/ai-got-it-wrong-with-high-confidence-now-what</link>
<guid>https://block385.com/ai-got-it-wrong-with-high-confidence-now-what</guid>
<description><![CDATA[ In this Help Net Security interview, Christian Debes, Head of Data Analytics &amp; AI at SPRYFOX, talks about the growing gap between what AI models do and what their operators can explain. He argues this gap is already a liability, particularly when decisions affect people or money and no one can say why a model produced a certain output. Debes walks through how responsible teams approach confident wrong answers, why procurement leaders bear accountability when … More →
The post AI got it wrong with high confidence. Now what? appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/05095742/christian_debes-2-spryfox.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 08:00:20 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>got, wrong, with, high, confidence., Now, what</media:keywords>
</item>

<item>
<title>Betterleaks: Open&#45;source secrets scanner</title>
<link>https://block385.com/betterleaks-open-source-secrets-scanner</link>
<guid>https://block385.com/betterleaks-open-source-secrets-scanner</guid>
<description><![CDATA[ Secrets scanning has become standard practice across engineering organizations, and Gitleaks has been one of the most widely used tools in that space. The author of that project has now released a new tool called Betterleaks, which is designed to scan git repositories, directories, and standard input for leaked credentials, API keys, tokens, and passwords. Zach Rice, who wrote the original Gitleaks code approximately eight years ago and now serves as Head of Secrets Scanning … More →
The post Betterleaks: Open-source secrets scanner appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/19071748/betterleaks-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 08:00:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Betterleaks:, Open-source, secrets, scanner</media:keywords>
</item>

<item>
<title>C2 Implant &amp;apos;SnappyClient&amp;apos; Targets Crypto Wallets</title>
<link>https://block385.com/c2-implant-snappyclient-targets-crypto-wallets</link>
<guid>https://block385.com/c2-implant-snappyclient-targets-crypto-wallets</guid>
<description><![CDATA[ In addition to enabling remote access, the malware supports a wide range of capabilities, including data theft and spying. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0372e765e2f60601/69bb0ab9e800678b63dc8ddb/remoteaccess_Khanthachai_C_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 00:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Implant, SnappyClient, Targets, Crypto, Wallets</media:keywords>
</item>

<item>
<title>DarkSword: iPhone Exploit Kit Serves Spies &amp;amp;amp; Thieves Alike</title>
<link>https://block385.com/darksword-iphone-exploit-kit-serves-spies-thieves-alike</link>
<guid>https://block385.com/darksword-iphone-exploit-kit-serves-spies-thieves-alike</guid>
<description><![CDATA[ A sophisticated iOS exploit chain leverages multiple zero-day vulnerabilities and is targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4bc589598164c815/69bb0530a773073aa8a1472a/dark_sword_Eugeniusz_Dudzi%C5%84ski_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 19 Mar 2026 00:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DarkSword:, iPhone, Exploit, Kit, Serves, Spies, &amp;amp, Thieves, Alike</media:keywords>
</item>

<item>
<title>Researchers: Meta, TikTok Steal Personal &amp;amp;amp; Financial Info When Users Click Ads</title>
<link>https://block385.com/researchers-meta-tiktok-steal-personal-financial-info-when-users-click-ads</link>
<guid>https://block385.com/researchers-meta-tiktok-steal-personal-financial-info-when-users-click-ads</guid>
<description><![CDATA[ Tracking pixels let social media companies spy on their users even after they click over to advertiser sites, gleaning credit card info, geolocations, and more, according to an analysis. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt30ca0d4bf093c658/69b85abb65cf383bd31f7bee/Eye-Shotshop_GmbH-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 22:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers:, Meta, TikTok, Steal, Personal, &amp;amp, Financial, Info, When, Users, Click, Ads</media:keywords>
</item>

<item>
<title>Clear Communication: The Missing Link in Cybersecurity Success</title>
<link>https://block385.com/clear-communication-the-missing-link-in-cybersecurity-success</link>
<guid>https://block385.com/clear-communication-the-missing-link-in-cybersecurity-success</guid>
<description><![CDATA[ When technical expertise meets clear communication, cybersecurity teams thrive. Learn how to foster trust and collaboration across diverse working groups. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt92bc370b67bb04da/69b9cdb3a83108ae2cbb7076/friction1800_ArchivalSurvival_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 22:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Clear, Communication:, The, Missing, Link, Cybersecurity, Success</media:keywords>
</item>

<item>
<title>OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs</title>
<link>https://block385.com/ofac-sanctions-dprk-it-worker-network-funding-wmd-programs-through-fake-remote-jobs</link>
<guid>https://block385.com/ofac-sanctions-dprk-it-worker-network-funding-wmd-programs-through-fake-remote-jobs</guid>
<description><![CDATA[ The U.S. Department of the Treasury&#039;s Office of Foreign Assets Control (OFAC) has sanctioned six individuals and two entities for their involvement in the Democratic People&#039;s Republic of Korea (DPRK) information technology (IT) worker scheme with an aim to defraud U.S. businesses and generate illicit revenue for the regime to fund its weapons of mass destruction (WMD) programs.
&quot;The North Korean ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOXJqNKU2E3XuLpHv5iNIyXUsNHiw2sKZHX26AXk9X2bIlFfmTfRYdKkvL40FGg6dAccgemC93VDZ_l8uIFrzaxPY5OMtWeujIO4CS4XvbQQI-Y_B36j1wl5nFWFjXp968S6iTFFZlwdO9Qx8tNHBALQHagYFSFBGjncE6OJdk3ZOGZFWFnucDua1CawKd/s1600/1000061563.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 19:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OFAC, Sanctions, DPRK, Worker, Network, Funding, WMD, Programs, Through, Fake, Remote, Jobs</media:keywords>
</item>

<item>
<title>Token Security advances AI agent protection with intent&#45;based controls</title>
<link>https://block385.com/token-security-advances-ai-agent-protection-with-intent-based-controls</link>
<guid>https://block385.com/token-security-advances-ai-agent-protection-with-intent-based-controls</guid>
<description><![CDATA[ Token Security has unveiled intent-based AI agent security, a new approach that governs autonomous agents in enterprise environments by aligning their permissions with their intended purpose. As organizations deploy autonomous AI agents across enterprise infrastructure, security models are struggling to contain the risks. Token Security has been advancing the concept of intent-based security for AI agents, and using identity as the control plane for governing autonomous systems. Because AI agents interact with enterprise systems through … More →
The post Token Security advances AI agent protection with intent-based controls appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 18:00:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Token, Security, advances, agent, protection, with, intent-based, controls</media:keywords>
</item>

<item>
<title>&amp;apos;Claudy Day’ Trio of Flaws Exposes Claude Users to Data Theft</title>
<link>https://block385.com/claudy-day-trio-of-flaws-exposes-claude-users-to-data-theft</link>
<guid>https://block385.com/claudy-day-trio-of-flaws-exposes-claude-users-to-data-theft</guid>
<description><![CDATA[ A prompt injection vulnerability paired with other flaws can turn a Google search into a full attack chain that could threaten enterprise networks. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt10cc6694988697dc/69ba96a3a9cab62c8e5b1dba/claude_RalfLiebhold_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 18:00:05 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claudy, Day’, Trio, Flaws, Exposes, Claude, Users, Data, Theft</media:keywords>
</item>

<item>
<title>Interlock Ransomware Exploits Cisco FMC Zero&#45;Day CVE&#45;2026&#45;20131 for Root Access</title>
<link>https://block385.com/interlock-ransomware-exploits-cisco-fmc-zero-day-cve-2026-20131-for-root-access</link>
<guid>https://block385.com/interlock-ransomware-exploits-cisco-fmc-zero-day-cve-2026-20131-for-root-access</guid>
<description><![CDATA[ Amazon Threat Intelligence is warning of an active Interlock ransomware campaign that&#039;s exploiting a recently disclosed critical security flaw in Cisco Secure Firewall Management Center (FMC) Software.
The vulnerability in question is CVE-2026-20131 (CVSS score: 10.0), a case of insecure deserialization of user-supplied Java byte stream, which could allow an unauthenticated, remote attacker to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLy-BuHvT70pyyUq2TSAqeslGDbLeLRJucNouklV6oadLOcvzXBr9vTYM-ngHCkr1QTMkqrxPnKQ5JT81kh9SiSLrYNUiDg6Pd_y6zouESfFavzlTyT6PGpwLaNZ7T9z3lLGeYiWllCShgtZwIcLxRTq6zJpS6Pa7GjYMwRoxtgD3qzQ_hQKfAYTk75lVT/s1600/aws-3.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 17:30:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Interlock, Ransomware, Exploits, Cisco, FMC, Zero-Day, CVE-2026-20131, for, Root, Access</media:keywords>
</item>

<item>
<title>Firefox is getting a free built&#45;in VPN</title>
<link>https://block385.com/firefox-is-getting-a-free-built-in-vpn</link>
<guid>https://block385.com/firefox-is-getting-a-free-built-in-vpn</guid>
<description><![CDATA[ Mozilla is adding a free built-in VPN to Firefox, with the feature arriving in Firefox 149 on March 24. Privacy concerns often follow free VPN services, especially when unclear data practices put user information at risk. Mozilla says its version is grounded in its data principles and focus on trust, aiming to avoid the kinds of arrangements that have raised questions in the past. The feature routes browser traffic through a proxy to mask a … More →
The post Firefox is getting a free built-in VPN appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/07/16184414/firefox-2023.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 16:00:42 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Firefox, getting, free, built-in, VPN</media:keywords>
</item>

<item>
<title>Graylog advances explainable AI and automated workflows for faster threat detection</title>
<link>https://block385.com/graylog-advances-explainable-ai-and-automated-workflows-for-faster-threat-detection</link>
<guid>https://block385.com/graylog-advances-explainable-ai-and-automated-workflows-for-faster-threat-detection</guid>
<description><![CDATA[ Graylog has revealed advances in explainable AI and automated investigation workflows that help small-to-mid-sized security teams detect threats faster, investigate with confidence, and cut the manual documentation work that consumes analyst time. “Lean security teams don’t have the luxury of analyst bench depth or months of automation tuning,” said Andy Grolnick, CEO of Graylog. “Every capability we are showing at RSA is designed around the same principle: rapidly detect, decide, and document from one command … More →
The post Graylog advances explainable AI and automated workflows for faster threat detection appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 16:00:39 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Graylog, advances, explainable, and, automated, workflows, for, faster, threat, detection</media:keywords>
</item>

<item>
<title>Menlo Security delivers unified governance and threat prevention for AI agents and humans</title>
<link>https://block385.com/menlo-security-delivers-unified-governance-and-threat-prevention-for-ai-agents-and-humans</link>
<guid>https://block385.com/menlo-security-delivers-unified-governance-and-threat-prevention-for-ai-agents-and-humans</guid>
<description><![CDATA[ Menlo Security has unveiled the Browser Security Platform, purpose-built to secure the agentic enterprise, where autonomous AI agents will outnumber human employees and the browser has become the operating system for both. Menlo provides unified control plane to apply machine-speed governance and threat prevention to both human and non-human actors, deployed globally on Menlo’s elastic cloud infrastructure. “The next billion web users won’t be human. This isn’t a future prediction; it’s the current reality for … More →
The post Menlo Security delivers unified governance and threat prevention for AI agents and humans appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 16:00:36 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Menlo, Security, delivers, unified, governance, and, threat, prevention, for, agents, and, humans</media:keywords>
</item>

<item>
<title>Backslash adds cross&#45;product support to secure AI skills in developer environments</title>
<link>https://block385.com/backslash-adds-cross-product-support-to-secure-ai-skills-in-developer-environments</link>
<guid>https://block385.com/backslash-adds-cross-product-support-to-secure-ai-skills-in-developer-environments</guid>
<description><![CDATA[ Backslash Security has revealed new cross-product support for agentic AI Skills within its platform, enabling organizations to discover, assess, and apply security guardrails to Skills used across AI-native software development environments. The developer ecosystem of AI-powered coding agents and tools is rapidly expanding with new extensibility layers, including Skills, Model Context Protocol (MCP) servers, prompt rules, hooks, and plug-in architectures. As these capabilities enhance and automate developer productivity, they also introduce significant new security blind … More →
The post Backslash adds cross-product support to secure AI skills in developer environments appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 16:00:22 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Backslash, adds, cross-product, support, secure, skills, developer, environments</media:keywords>
</item>

<item>
<title>Dropzone AI releases autonomous Threat Hunting agent for continuous SOC detection</title>
<link>https://block385.com/dropzone-ai-releases-autonomous-threat-hunting-agent-for-continuous-soc-detection</link>
<guid>https://block385.com/dropzone-ai-releases-autonomous-threat-hunting-agent-for-continuous-soc-detection</guid>
<description><![CDATA[ Dropzone AI has released the AI Threat Hunter, its newest AI agent that enables security teams to proactively search for threats across their environments around the clock. The AI Threat Hunter is the next agent joining the Dropzone’s Agentic SOC team, expanding what AI agents can do across the full spectrum of detection and response. This new capability is designed to work seamlessly alongside SOC analysts, both human and autonomous, expanding security analytical capacity across … More →
The post Dropzone AI releases autonomous Threat Hunting agent for continuous SOC detection appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 16:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Dropzone, releases, autonomous, Threat, Hunting, agent, for, continuous, SOC, detection</media:keywords>
</item>

<item>
<title>Meta, TikTok Steal Personal &amp;amp;amp; Financial Info When Users Click Ads</title>
<link>https://block385.com/meta-tiktok-steal-personal-financial-info-when-users-click-ads</link>
<guid>https://block385.com/meta-tiktok-steal-personal-financial-info-when-users-click-ads</guid>
<description><![CDATA[ Tracking pixels let social media companies spy on their users even after they click over to advertiser sites, gleaning credit card info, geolocations, and more. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt30ca0d4bf093c658/69b85abb65cf383bd31f7bee/Eye-Shotshop_GmbH-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 16:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Meta, TikTok, Steal, Personal, &amp;amp, Financial, Info, When, Users, Click, Ads</media:keywords>
</item>

<item>
<title>Critical Unpatched Telnetd Flaw (CVE&#45;2026&#45;32746) Enables Unauthenticated Root RCE</title>
<link>https://block385.com/critical-unpatched-telnetd-flaw-cve-2026-32746-enables-unauthenticated-root-rce</link>
<guid>https://block385.com/critical-unpatched-telnetd-flaw-cve-2026-32746-enables-unauthenticated-root-rce</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed a critical security flaw impacting the GNU InetUtils telnet daemon (telnetd) that could be exploited by an unauthenticated remote attacker to execute arbitrary code with elevated privileges.
The vulnerability, tracked as CVE-2026-32746, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of out-of-bounds write in the LINEMODE Set ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhm7eXnUZ_n354WSYj7Qjrk3sBFZkhyQ41VtRezIQRVo3KqzZJDE_A7CqshkkQ6RCiOyS1zuS8liODqSRGhURLUozRKEDZ6BmKyOxBVy8K0EF5TQB5QlyC7c1Cv0mHSj0BNwtGAS-PgOUobvSWJ1b82qWBHCMEocTyoOayx69DzM_gveQSuD1zbjYAjziX7/s1600/linux.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 15:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, Unpatched, Telnetd, Flaw, CVE-2026-32746, Enables, Unauthenticated, Root, RCE</media:keywords>
</item>

<item>
<title>Claude Code Security and Magecart: Getting the Threat Model Right</title>
<link>https://block385.com/claude-code-security-and-magecart-getting-the-threat-model-right</link>
<guid>https://block385.com/claude-code-security-and-magecart-getting-the-threat-model-right</guid>
<description><![CDATA[ When a Magecart payload hides inside the EXIF data of a dynamically loaded third-party favicon, no repository scanner will catch it – because the malicious code never actually touches your repo. As teams adopt Claude Code Security for static analysis, this is the exact technical boundary where AI code scanning stops and client-side runtime execution begins.
A detailed analysis of where Claude ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggz_kaHz2bigOo1y7BON5yhR9pCor4YwRAVV2PhMpW80pO5LnEQpI6Nzwyb1vAXqsORLe3-nM6npur3xdVzjvgFuv0_weLt2k3aganHfRUGHnvg258ymm460jOPDouqbnhZiOWNgkTEov8Iy1Ldb53EQg94GZMocgH3nwILAvMzDaNsyK7WaSrc1k7Rts/s1600/ref.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 15:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Code, Security, and, Magecart:, Getting, the, Threat, Model, Right</media:keywords>
</item>

<item>
<title>9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors</title>
<link>https://block385.com/9-critical-ip-kvm-flaws-enable-unauthenticated-root-access-across-four-vendors</link>
<guid>https://block385.com/9-critical-ip-kvm-flaws-enable-unauthenticated-root-access-across-four-vendors</guid>
<description><![CDATA[ Cybersecurity researchers have warned about the risks posed by low-cost IP KVM (Keyboard, Video, Mouse over Internet Protocol) devices, which can grant attackers extensive control over compromised hosts.
The nine vulnerabilities, discovered by Eclypsium, span four different products from GL-iNet Comet RM-1, Angeet/Yeeso ES3 KVM, Sipeed NanoKVM, and JetKVM. The most severe of them allow ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1w0kzOmqTtztN-mHI2uI1lo8OnX3r0r6sB1FuwEKJAIX3zudBP_BkZiFk5f3RbtXjTiARWWhhKkLp2szjQk5-IVk_sOHkyGlIAof66_UIY595IhcdGZQR2xjTHKQSqWAV0bkjCPlfqBdJqokmSkZID1kQxcI8M-LX2aWSDErd63Y86_UTo321Fm45dcDC/s1600/ip.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 15:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, KVM, Flaws, Enable, Unauthenticated, Root, Access, Across, Four, Vendors</media:keywords>
</item>

<item>
<title>VIAVI advances NetSecOps with unified threat forensics and retrospective analysis</title>
<link>https://block385.com/viavi-advances-netsecops-with-unified-threat-forensics-and-retrospective-analysis</link>
<guid>https://block385.com/viavi-advances-netsecops-with-unified-threat-forensics-and-retrospective-analysis</guid>
<description><![CDATA[ VIAVI Solutions has announced its Observer Threat Forensics solution with an advanced retrospective analysis capability. The industry is shifting away from siloed network and security operations teams to a converged NetSecOps structure to close critical gaps in incident responses and strengthen resilience. Designed to increase visibility across operational teams, Observer Threat Forensics helps organizations identify potential vulnerabilities including post-detection analyses of a breach, the intrusion point and the exposed data. Observer Threat Forensics is built … More →
The post VIAVI advances NetSecOps with unified threat forensics and retrospective analysis appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 14:00:34 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>VIAVI, advances, NetSecOps, with, unified, threat, forensics, and, retrospective, analysis</media:keywords>
</item>

<item>
<title>Apple starts issuing lightweight security updates between software releases</title>
<link>https://block385.com/apple-starts-issuing-lightweight-security-updates-between-software-releases</link>
<guid>https://block385.com/apple-starts-issuing-lightweight-security-updates-between-software-releases</guid>
<description><![CDATA[ Apple is delivering small security updates, called Background Security Improvements, starting with iOS 26.1, iPadOS 26.1, and macOS 26.1. Apple describes Background Security Improvements as lightweight security releases for components such as Safari, the WebKit framework, and other system libraries, delivered through ongoing patches between software updates. “In rare instances of compatibility issues, Background Security Improvements may be temporarily removed and then enhanced in a subsequent software update,” the company noted. Users can manage Background … More →
The post Apple starts issuing lightweight security updates between software releases appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/20114620/apple2.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 14:00:31 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, starts, issuing, lightweight, security, updates, between, software, releases</media:keywords>
</item>

<item>
<title>Polygraf AI launches Desktop Overlay for real&#45;time AI behavior control in enterprise operations</title>
<link>https://block385.com/polygraf-ai-launches-desktop-overlay-for-real-time-ai-behavior-control-in-enterprise-operations</link>
<guid>https://block385.com/polygraf-ai-launches-desktop-overlay-for-real-time-ai-behavior-control-in-enterprise-operations</guid>
<description><![CDATA[ Polygraf AI has announced the launch of its Desktop Overlay, a new product designed to provide continuous, real-time guidance for compliance operations and data protection directly at the user interface level, as a personal compliance assistant. Built for highly regulated and government agencies, the Desktop Overlay runs at the edge and preemptively warns users of sensitive data exposure while they are writing, before the data is sent to third-party models, external systems, or leaves device … More →
The post Polygraf AI launches Desktop Overlay for real-time AI behavior control in enterprise operations appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 14:00:29 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Polygraf, launches, Desktop, Overlay, for, real-time, behavior, control, enterprise, operations</media:keywords>
</item>

<item>
<title>Veracode Fix for SCA automates open&#45;source vulnerability fixes</title>
<link>https://block385.com/veracode-fix-for-sca-automates-open-source-vulnerability-fixes</link>
<guid>https://block385.com/veracode-fix-for-sca-automates-open-source-vulnerability-fixes</guid>
<description><![CDATA[ Veracode has unveiled Veracode Fix for Software Composition Analysis (SCA), an AI-powered solution to address software supply chain risk. The enhanced automated remediation engine, the next evolution of Veracode’s Fix solution, enables organizations to detect and remediate open-source vulnerabilities easily, before code reaches production. Designed to integrate seamlessly into existing developer workflows, it delivers third-party updates and first-party code refactoring without breaking builds or disrupting development. In 2025, software supply chain breaches accounted for 30% … More →
The post Veracode Fix for SCA automates open-source vulnerability fixes appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 14:00:22 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Veracode, Fix, for, SCA, automates, open-source, vulnerability, fixes</media:keywords>
</item>

<item>
<title>TrojAI unveils new capabilities to secure agentic AI beyond the prompt layer</title>
<link>https://block385.com/trojai-unveils-new-capabilities-to-secure-agentic-ai-beyond-the-prompt-layer</link>
<guid>https://block385.com/trojai-unveils-new-capabilities-to-secure-agentic-ai-beyond-the-prompt-layer</guid>
<description><![CDATA[ TrojAI has announced major new capabilities designed to secure the growing deployment of agentic AI in the enterprise going beyond the prompt layer. “The innovations we are unveiling this week address some of the most significant and rapid changes to the AI security ecosystem. Enterprise deployment of agents is accelerating quickly, and these new TrojAI capabilities enable a new level of visibility and protection needed for the Agentic enterprise,” said Lee Weiner, CEO of TrojAI. … More →
The post TrojAI unveils new capabilities to secure agentic AI beyond the prompt layer appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 14:00:15 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TrojAI, unveils, new, capabilities, secure, agentic, beyond, the, prompt, layer</media:keywords>
</item>

<item>
<title>Corelight’s Agentic Triage turns SOC alerts into evidence&#45;backed investigations</title>
<link>https://block385.com/corelights-agentic-triage-turns-soc-alerts-into-evidence-backed-investigations</link>
<guid>https://block385.com/corelights-agentic-triage-turns-soc-alerts-into-evidence-backed-investigations</guid>
<description><![CDATA[ Corelight has introduced a new set of agentic AI capabilities aimed at helping security operations centers (SOCs) cut down on repetitive, time-consuming tasks. The updates are designed to boost analyst efficiency, speed up response times, and build trust through greater transparency. The release includes Agentic Triage to streamline SOC workflows, a new suite of machine learning models that turn encrypted traffic blind spots into actionable evidence, and expanded integrations “By pairing the industry’s highest-fidelity network … More →
The post Corelight’s Agentic Triage turns SOC alerts into evidence-backed investigations appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 14:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Corelight’s, Agentic, Triage, turns, SOC, alerts, into, evidence-backed, investigations</media:keywords>
</item>

<item>
<title>SideWinder Espionage Campaign Expands Across Southeast Asia</title>
<link>https://block385.com/sidewinder-espionage-campaign-expands-across-southeast-asia</link>
<guid>https://block385.com/sidewinder-espionage-campaign-expands-across-southeast-asia</guid>
<description><![CDATA[ The suspected India-linked threat group targets governments, telecom, and critical infrastructure using spear-phishing, old vulnerabilities, and rapidly rotating infrastructure to maintain persistent access. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt28c4d1bedaef1b13/69b9c60dfc6bd40f7fba492b/sidewinder-snake-on-sand-dune-Chantelle_Bosch-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 14:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SideWinder, Espionage, Campaign, Expands, Across, Southeast, Asia</media:keywords>
</item>

<item>
<title>Meta, TikTok Steal Users&amp;apos; Sensitive PII When They Click on Ads</title>
<link>https://block385.com/meta-tiktok-steal-users-sensitive-pii-when-they-click-on-ads</link>
<guid>https://block385.com/meta-tiktok-steal-users-sensitive-pii-when-they-click-on-ads</guid>
<description><![CDATA[ Tracking pixels let social media companies spy on their own customers when they click over to advertiser sites, gleaning credit card info, currency type, and more. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt30ca0d4bf093c658/69b85abb65cf383bd31f7bee/Eye-Shotshop_GmbH-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 14:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Meta, TikTok, Steal, Users, Sensitive, PII, When, They, Click, Ads</media:keywords>
</item>

<item>
<title>Product Walkthrough: How Mesh CSMA Reveals and Breaks Attack Paths to Crown Jewels</title>
<link>https://block385.com/product-walkthrough-how-mesh-csma-reveals-and-breaks-attack-paths-to-crown-jewels</link>
<guid>https://block385.com/product-walkthrough-how-mesh-csma-reveals-and-breaks-attack-paths-to-crown-jewels</guid>
<description><![CDATA[ Security teams today are not short on tools or data. They are overwhelmed by both. 
Yet within the terabytes of alerts, exposures, and misconfigurations – security teams still struggle to understand context: 
Q: Which exposures, misconfigurations, and vulnerabilities chain together to create viable attack paths to crown jewels?
Even the most mature security teams can’t answer that ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHQlWFzb-dPRLbO6sDQFLQgxeUGnAqvKyB-zYYZSGM9MySnNJYPuBGkaZCgGco3JT4zh1kuHg0PNbZ3drUNebzabC1l62_B_2laDHkQY3FZi8tYiG70rpoRE43pQcLc8bWXGXWNTdF9Nbr0-KKt8rkgpoaypKgLXJHyAxFGpik6iLrxckqVdW6bbAzhck/s1600/mesh-product.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 13:30:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Product, Walkthrough:, How, Mesh, CSMA, Reveals, and, Breaks, Attack, Paths, Crown, Jewels</media:keywords>
</item>

<item>
<title>Theori brings Xint Code to market for large&#45;scale AI code security analysis</title>
<link>https://block385.com/theori-brings-xint-code-to-market-for-large-scale-ai-code-security-analysis</link>
<guid>https://block385.com/theori-brings-xint-code-to-market-for-large-scale-ai-code-security-analysis</guid>
<description><![CDATA[ Theori has made Xint Code commercially available, an LLM-native static application security testing (SAST) tool capable of analyzing millions of lines of source code, configuration files, and binaries in less than 12 hours. Xint Code’s approach to deep scanning and contextual analysis of massive codebases helps application security teams identify, reproduce, validate and understand the real-world critical vulnerabilities in applications. It uses LLMs combined with a proprietary orchestration engine to scan and analyze each line … More →
The post Theori brings Xint Code to market for large-scale AI code security analysis appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 12:01:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Theori, brings, Xint, Code, market, for, large-scale, code, security, analysis</media:keywords>
</item>

<item>
<title>Island Enterprise Platform delivers unified control for workspaces and AI</title>
<link>https://block385.com/island-enterprise-platform-delivers-unified-control-for-workspaces-and-ai</link>
<guid>https://block385.com/island-enterprise-platform-delivers-unified-control-for-workspaces-and-ai</guid>
<description><![CDATA[ Island has launched the Island Enterprise Platform. This unified enterprise environment extends the security, productivity, and user experience of the Island Enterprise Browser to also include consumer browsers, desktop applications, and networks. The Island Enterprise Platform provides universal policies and permissions to networking, AI enablement, application access, data protection, identity, and productivity services. Context such as user role, device posture, geolocation, and network conditions dynamically governs access and protection in real time. Instead of receiving … More →
The post Island Enterprise Platform delivers unified control for workspaces and AI appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 12:01:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Island, Enterprise, Platform, delivers, unified, control, for, workspaces, and</media:keywords>
</item>

<item>
<title>Big tech companies step in to support the open source security ecosystem</title>
<link>https://block385.com/big-tech-companies-step-in-to-support-the-open-source-security-ecosystem</link>
<guid>https://block385.com/big-tech-companies-step-in-to-support-the-open-source-security-ecosystem</guid>
<description><![CDATA[ Backed by new funding commitments from major technology players, open source security efforts are moving beyond threat identification toward practical solutions for defenders. The Linux Foundation announced $12.5 million in grant funding backed by Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI to strengthen open source security. The funding will be directed through the foundation’s Alpha-Omega Project and the Open Source Security Foundation (OpenSSF). The initiative aims to address long-standing gaps in how open … More →
The post Big tech companies step in to support the open source security ecosystem appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/04/02103244/open_source-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 12:00:57 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Big, tech, companies, step, support, the, open, source, security, ecosystem</media:keywords>
</item>

<item>
<title>Abnormal AI Attune 1.0 targets AI&#45;driven attacks with behavioral detection</title>
<link>https://block385.com/abnormal-ai-attune-10-targets-ai-driven-attacks-with-behavioral-detection</link>
<guid>https://block385.com/abnormal-ai-attune-10-targets-ai-driven-attacks-with-behavioral-detection</guid>
<description><![CDATA[ Abnormal AI has unveiled the launch of Attune 1.0, a behavioral foundation model for cybersecurity. Trained on more than one billion derived behavioral signals, Attune now powers 85% of detections across the Abnormal Behavior Platform and establishes a shared intelligence layer for the company’s expanding security portfolio. Communication is how organizations build trust. That trust is being weaponized by attackers using AI to launch campaigns that are highly personalized for each and every target. This … More →
The post Abnormal AI Attune 1.0 targets AI-driven attacks with behavioral detection appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 12:00:44 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Abnormal, Attune, 1.0, targets, AI-driven, attacks, with, behavioral, detection</media:keywords>
</item>

<item>
<title>BlackHawk Data introduces CloudSight for continuous security auditing</title>
<link>https://block385.com/blackhawk-data-introduces-cloudsight-for-continuous-security-auditing</link>
<guid>https://block385.com/blackhawk-data-introduces-cloudsight-for-continuous-security-auditing</guid>
<description><![CDATA[ BlackHawk Data announced the launch of CloudSight, a continuous auditing and monitoring platform designed to help organizations maximize the security, performance, and visibility of their Cloudflare environments. As Cloudflare adoption continues to grow across enterprises, many organizations struggle to maintain visibility across their zones, DNS configurations, security rules, and performance settings. Industry estimates show that while approximately 38% of companies use Cloudflare, many organizations only utilize 40–60% of the platform’s capabilities, leaving security and performance … More →
The post BlackHawk Data introduces CloudSight for continuous security auditing appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 12:00:35 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>BlackHawk, Data, introduces, CloudSight, for, continuous, security, auditing</media:keywords>
</item>

<item>
<title>Blumira enhances EDR and ITDR to speed up threat detection and containment</title>
<link>https://block385.com/blumira-enhances-edr-and-itdr-to-speed-up-threat-detection-and-containment</link>
<guid>https://block385.com/blumira-enhances-edr-and-itdr-to-speed-up-threat-detection-and-containment</guid>
<description><![CDATA[ Blumira has announced the release of expanded endpoint detection and response (EDR) and identity threat detection and response (ITDR) capabilities in its platform. Security teams on Blumira Respond and Automate editions can now contain active threats by isolating compromised endpoints, stopping malicious processes, and locking out attackers across Microsoft 365 and Active Directory, without ever leaving the Blumira dashboard. “Ransomware and identity-based attacks including business email compromise are top-of-mind concerns keeping IT teams up at … More →
The post Blumira enhances EDR and ITDR to speed up threat detection and containment appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 12:00:23 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Blumira, enhances, EDR, and, ITDR, speed, threat, detection, and, containment</media:keywords>
</item>

<item>
<title>Druva connects identity data and behavior to restore access after attacks</title>
<link>https://block385.com/druva-connects-identity-data-and-behavior-to-restore-access-after-attacks</link>
<guid>https://block385.com/druva-connects-identity-data-and-behavior-to-restore-access-after-attacks</guid>
<description><![CDATA[ Druva has revealed Druva Identity Resilience, adding support for Okta and Microsoft Active Directory alongside Microsoft Entra ID. Druva Identity Resilience delivers unified protection, cyber recovery, and threat detection and response in a single SaaS platform, bringing disparate identity providers together so security and IT teams can restore trusted access through one coordinated process. Identity-driven attacks have reached a tipping point, with nearly 90% of incident response investigations now tracing back to identity compromise. In … More →
The post Druva connects identity data and behavior to restore access after attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 12:00:07 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Druva, connects, identity, data, and, behavior, restore, access, after, attacks</media:keywords>
</item>

<item>
<title>Ubuntu CVE&#45;2026&#45;3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit</title>
<link>https://block385.com/ubuntu-cve-2026-3888-bug-lets-attackers-gain-root-via-systemd-cleanup-timing-exploit</link>
<guid>https://block385.com/ubuntu-cve-2026-3888-bug-lets-attackers-gain-root-via-systemd-cleanup-timing-exploit</guid>
<description><![CDATA[ A high-severity security flaw affecting default installations of Ubuntu Desktop versions 24.04 and later could be exploited to escalate privileges to the root level.
Tracked as CVE-2026-3888 (CVSS score: 7.8), the issue could allow an attacker to seize control of a susceptible system.
&quot;This flaw (CVE-2026-3888) allows an unprivileged local attacker to escalate privileges to full root access ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjyR0arF1Y7SFoUB29ZhPX6xm5uAf4A7sdyhxPDSK52E3A-m2QCrr2DTMIYLCqIJnOUrQzo81R1_g-EMp82gZjHsMJegHxW4AeKRH3pnfjk2NGlBr5VZ9MoKRdbSgkBNs_039XoCT9eNSfka3VVbIhErq7lsOcW6gmN1CffJjFHrRILmXQgEmyZYz1E4KP/s1600/ubuntu.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 11:30:15 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ubuntu, CVE-2026-3888, Bug, Lets, Attackers, Gain, Root, via, systemd, Cleanup, Timing, Exploit</media:keywords>
</item>

<item>
<title>Cybercriminals scale up, government sector hit hardest</title>
<link>https://block385.com/cybercriminals-scale-up-government-sector-hit-hardest</link>
<guid>https://block385.com/cybercriminals-scale-up-government-sector-hit-hardest</guid>
<description><![CDATA[ Government agencies faced the highest volume of cyberattack campaigns in 2025, according to new findings from HPE Threat Labs, which tracked 1,186 active campaigns over the course of the year. The data covers activity observed between January 1 and December 31, 2025, and reflects a broad mix of sectors and attack types. Top sectors targeted by threat campaigns in 2025 (Source: HPE) AI and automation drive faster, more powerful cyberattacks Government agencies were targeted in … More →
The post Cybercriminals scale up, government sector hit hardest appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/12/03140722/criminal.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 10:01:01 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybercriminals, scale, up, government, sector, hit, hardest</media:keywords>
</item>

<item>
<title>Tufin introduces AI agents to take on network security work</title>
<link>https://block385.com/tufin-introduces-ai-agents-to-take-on-network-security-work</link>
<guid>https://block385.com/tufin-introduces-ai-agents-to-take-on-network-security-work</guid>
<description><![CDATA[ Tufin is launching a new collection of AI agents designed to take on network security tasks for teams that are already stretched thin. This helps free up scarce expertise to focus on higher-level risks, critical decisions, and defending the enterprise. Enterprise infrastructure is becoming more dynamic, decentralized, and harder to secure. Tufin’s Network Connectivity Graph, combined with its proven automation playbooks, provides the trusted data and control layer needed to support agent-driven network security at … More →
The post Tufin introduces AI agents to take on network security work appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 10:00:58 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tufin, introduces, agents, take, network, security, work</media:keywords>
</item>

<item>
<title>ManageEngine expands Endpoint Central with EDR and secure access</title>
<link>https://block385.com/manageengine-expands-endpoint-central-with-edr-and-secure-access</link>
<guid>https://block385.com/manageengine-expands-endpoint-central-with-edr-and-secure-access</guid>
<description><![CDATA[ ManageEngine has announced the expansion of its unified endpoint management and security (UEMS) platform, Endpoint Central, to include endpoint detection and response (EDR) and secure private access capabilities. The additions bolster Endpoint Central’s endpoint security capabilities by enabling AI-powered threat detection, automated remediation, and zero trust access to internal applications through device trust verification. As enterprises manage increasingly distributed workforces and device fleets, endpoints have emerged as both the operational hub of IT and the … More →
The post ManageEngine expands Endpoint Central with EDR and secure access appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 10:00:54 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ManageEngine, expands, Endpoint, Central, with, EDR, and, secure, access</media:keywords>
</item>

<item>
<title>Virtue AI brings continuous stress testing to enterprise AI agents</title>
<link>https://block385.com/virtue-ai-brings-continuous-stress-testing-to-enterprise-ai-agents</link>
<guid>https://block385.com/virtue-ai-brings-continuous-stress-testing-to-enterprise-ai-agents</guid>
<description><![CDATA[ Virtue AI has announced Agent ForgingGround with built-in Red-Teaming Agents, the first enterprise-scale testing ground designed to continuously evaluate and stress-test AI agents (including multi-agent systems) before, during, and after deployment. As organizations adopt large-scale AI agents, many enterprises are unprepared to manage agent risk. AI agents can call tools, access sensitive data, and execute actions in real-time across enterprise databases, financial records, messaging platforms, CRMs, and more. Agents operate in dynamic, stateful environments where … More →
The post Virtue AI brings continuous stress testing to enterprise AI agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 10:00:46 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Virtue, brings, continuous, stress, testing, enterprise, agents</media:keywords>
</item>

<item>
<title>Cayosoft adds AI identity visibility and incident response for hybrid environments</title>
<link>https://block385.com/cayosoft-adds-ai-identity-visibility-and-incident-response-for-hybrid-environments</link>
<guid>https://block385.com/cayosoft-adds-ai-identity-visibility-and-incident-response-for-hybrid-environments</guid>
<description><![CDATA[ Cayosoft has announced updates to its Cayosoft Guardian platform. Cayosoft Guardian will now bring AI agent identities into existing identity threat detection and response (ITDR) workflows, giving security teams visibility, reporting, alerting, and automated rollback, without adding another dashboard. Cayosoft also launched a new Identity Forensics &amp; Incident Response (IFIR) service, a purpose-built incident response offering designed specifically for Microsoft hybrid identity environments to address the growing operational and security risks created by complex environments … More →
The post Cayosoft adds AI identity visibility and incident response for hybrid environments appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 10:00:38 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cayosoft, adds, identity, visibility, and, incident, response, for, hybrid, environments</media:keywords>
</item>

<item>
<title>1Password Users API for Partners helps automate identity response during incidents</title>
<link>https://block385.com/1password-users-api-for-partners-helps-automate-identity-response-during-incidents</link>
<guid>https://block385.com/1password-users-api-for-partners-helps-automate-identity-response-during-incidents</guid>
<description><![CDATA[ 1Password has announced the public preview of Users API for Partners, which allows security teams to respond to incidents faster during active security events. Launch partners like CrowdStrike, in addition to BlinkOps, Elastic, Sumo Logic, Tines, and Torq enable mutual customers to automatically suspend or restore users in 1Password Enterprise Password Manager when risk is detected. As part of this launch, 1Password is introducing api.1password.com as a unified access point for its APIs, with standardized … More →
The post 1Password Users API for Partners helps automate identity response during incidents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 10:00:28 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>1Password, Users, API, for, Partners, helps, automate, identity, response, during, incidents</media:keywords>
</item>

<item>
<title>Linux Foundation secures $12.5 million to strengthen open source security and support maintainers</title>
<link>https://block385.com/linux-foundation-secures-125-million-to-strengthen-open-source-security-and-support-maintainers</link>
<guid>https://block385.com/linux-foundation-secures-125-million-to-strengthen-open-source-security-and-support-maintainers</guid>
<description><![CDATA[ The Linux Foundation has announced a total of $12.5 million in grants from Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI to strengthen the security of the open source software ecosystem. The funding will be managed by Alpha-Omega and the Open Source Security Foundation (OpenSSF), trusted security initiatives within the Linux Foundation, to support the development of long-term, sustainable security solutions for open source communities worldwide. As the security landscape grows more complex, advances … More →
The post Linux Foundation secures $12.5 million to strengthen open source security and support maintainers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 10:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Linux, Foundation, secures, 12.5, million, strengthen, open, source, security, and, support, maintainers</media:keywords>
</item>

<item>
<title>Apple Fixes WebKit Vulnerability Enabling Same&#45;Origin Policy Bypass on iOS and macOS</title>
<link>https://block385.com/apple-fixes-webkit-vulnerability-enabling-same-origin-policy-bypass-on-ios-and-macos</link>
<guid>https://block385.com/apple-fixes-webkit-vulnerability-enabling-same-origin-policy-bypass-on-ios-and-macos</guid>
<description><![CDATA[ Apple on Tuesday released its first round of Background Security Improvements to address a security flaw in WebKit that affects iOS, iPadOS, and macOS.
The vulnerability, tracked as CVE-2026-20643 (CVSS score: N/A), has been described as a cross-origin issue in WebKit&#039;s Navigation API that could be exploited to bypass the same-origin policy when processing maliciously crafted web content.
The ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrIGrK9v7gHMVWn2ApD_KeHXedmQ6FwRObZ4ZqEQssbaUU_8qjOSYBBRzZPzK0J8eHdH37Ws_n1u-ESXKJ1WEb4jjFcLn1Tdoj4n0z0wrfFj7X5DKIK8dzKYZ9uLDV2dg6HecUyRdUDkYR1LKkvhkGWBh_anbKF83bvLXUJBeTTwjCDeJ0V2hRAEN1bxhv/s1600/apple-hacking.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 09:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Fixes, WebKit, Vulnerability, Enabling, Same-Origin, Policy, Bypass, iOS, and, macOS</media:keywords>
</item>

<item>
<title>Global fraud losses climb to $442 billion</title>
<link>https://block385.com/global-fraud-losses-climb-to-442-billion</link>
<guid>https://block385.com/global-fraud-losses-climb-to-442-billion</guid>
<description><![CDATA[ Online fraud is reaching more victims and generating larger losses, driven by digital tools and organized networks operating across borders. Global trends in financial fraud (Source: Interpol) In INTERPOL’s March 2026 Global Financial Fraud Threat Assessment, financial fraud sits among the top five global crime threats, with a 54% rise in fraud related Notices and Diffusions from 2024 to 2025. “Estimating the financial cost of fraud is challenging for a number of reasons, including significant … More →
The post Global fraud losses climb to $442 billion appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/28163349/malware-danger-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 08:00:14 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Global, fraud, losses, climb, 442, billion</media:keywords>
</item>

<item>
<title>Stop building security goals around controls</title>
<link>https://block385.com/stop-building-security-goals-around-controls</link>
<guid>https://block385.com/stop-building-security-goals-around-controls</guid>
<description><![CDATA[ In this Help Net Security interview, Devin Rudnicki, CISO at Fitch Group, argues that security strategy fails when it loses its connection to business outcomes. Rudnicki walks through how to align security goals with corporate priorities, why CISOs must present risk in terms leadership can act on, and how to balance innovation speed with measured risk. She outlines three metrics every security program should track: value, risk, and maturity. Rudnicki also addresses where maturity models … More →
The post Stop building security goals around controls appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/11082416/devin_rudnicki-2-fitch_group.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 08:00:06 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Stop, building, security, goals, around, controls</media:keywords>
</item>

<item>
<title>Critical Unpatched Telnetd Flaw (CVE&#45;2026&#45;32746) Enables Unauthenticated Root RCE via Port 23</title>
<link>https://block385.com/critical-unpatched-telnetd-flaw-cve-2026-32746-enables-unauthenticated-root-rce-via-port-23</link>
<guid>https://block385.com/critical-unpatched-telnetd-flaw-cve-2026-32746-enables-unauthenticated-root-rce-via-port-23</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed a critical security flaw impacting the GNU InetUtils telnet daemon (telnetd) that could be exploited by an unauthenticated remote attacker to execute arbitrary code with elevated privileges.
The vulnerability, tracked as CVE-2026-32746, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of out-of-bounds write in the LINEMODE Set ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhm7eXnUZ_n354WSYj7Qjrk3sBFZkhyQ41VtRezIQRVo3KqzZJDE_A7CqshkkQ6RCiOyS1zuS8liODqSRGhURLUozRKEDZ6BmKyOxBVy8K0EF5TQB5QlyC7c1Cv0mHSj0BNwtGAS-PgOUobvSWJ1b82qWBHCMEocTyoOayx69DzM_gveQSuD1zbjYAjziX7/s1600/linux.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 07:30:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, Unpatched, Telnetd, Flaw, CVE-2026-32746, Enables, Unauthenticated, Root, RCE, via, Port</media:keywords>
</item>

<item>
<title>More Attackers Are Logging In, Not Breaking In</title>
<link>https://block385.com/more-attackers-are-logging-in-not-breaking-in</link>
<guid>https://block385.com/more-attackers-are-logging-in-not-breaking-in</guid>
<description><![CDATA[ Credential theft soared in the second half of 2025, thanks in part to the industrialization of infostealer malware and AI-enabled social engineering. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte1c1a2e88d4ce9b9/69b9bbb4f23269821ba62200/credentials_iWissawa_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 00:00:05 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>More, Attackers, Are, Logging, In, Not, Breaking</media:keywords>
</item>

<item>
<title>Less Lucrative Ransomware Market Makes Attackers Alter Methods</title>
<link>https://block385.com/less-lucrative-ransomware-market-makes-attackers-alter-methods</link>
<guid>https://block385.com/less-lucrative-ransomware-market-makes-attackers-alter-methods</guid>
<description><![CDATA[ Ransomware actors are ditching Cobalt Strike in favor of native Windows tools, as payment rates hit record lows and data theft surges. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte72d0bf351c7e0d2/69b9b4c0a7730701b4a14225/farmer_Yuri_Arcurs_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 18 Mar 2026 00:00:05 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Less, Lucrative, Ransomware, Market, Makes, Attackers, Alter, Methods</media:keywords>
</item>

<item>
<title>Hackers Target Cybersecurity Firm Outpost24 in 7&#45;Stage Phish</title>
<link>https://block385.com/hackers-target-cybersecurity-firm-outpost24-in-7-stage-phish</link>
<guid>https://block385.com/hackers-target-cybersecurity-firm-outpost24-in-7-stage-phish</guid>
<description><![CDATA[ The cyberattackers leveraged trusted brands and domains in an attempt to redirect a C-suite executive at Outpost24 to give up his credentials. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3587241c66f92ae3/69b97dcdccf6a3497fc59660/phishing_tadamichi_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 22:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hackers, Target, Cybersecurity, Firm, Outpost24, 7-Stage, Phish</media:keywords>
</item>

<item>
<title>AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE</title>
<link>https://block385.com/ai-flaws-in-amazon-bedrock-langsmith-and-sglang-enable-data-exfiltration-and-rce</link>
<guid>https://block385.com/ai-flaws-in-amazon-bedrock-langsmith-and-sglang-enable-data-exfiltration-and-rce</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed details of a new method for exfiltrating sensitive data from artificial intelligence (AI) code execution environments using domain name system (DNS) queries.
In a report published Monday, BeyondTrust revealed that Amazon Bedrock AgentCore Code Interpreter&#039;s sandbox mode permits outbound DNS queries that an attacker can exploit to enable interactive shells ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlC6FiLJ9YVGC1W0eo-MmFsPTu2DNqMSdo-QKnv1gdH_HpaKV3zPaWZrQTGNdklpv62BXb3ECiBqlkR1BzLbfz0tFWfMKNM1vZq88yf90XpycB2OSDq3NScWav6ZO_4IVjCWaJRJLwvthFo-7VJ-Uc8qijyycpXfkQRHcPr9pf-QVgGzyOeBFnwfOGnmLN/s1600/lang-ai.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 19:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Flaws, Amazon, Bedrock, LangSmith, and, SGLang, Enable, Data, Exfiltration, and, RCE</media:keywords>
</item>

<item>
<title>Warlock Ransomware Group Augments Post&#45;Exploitation Activities</title>
<link>https://block385.com/warlock-ransomware-group-augments-post-exploitation-activities</link>
<guid>https://block385.com/warlock-ransomware-group-augments-post-exploitation-activities</guid>
<description><![CDATA[ In a recent attack, the group showcased stealthier cross-network activity, thanks to its use of a new BYOVD technique and other tools. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt264596230fa2e85d/69b94ecca34bb9e46e896dc0/Warlock_wizard_(1800)_Tithi_Luadthong_alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 18:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Warlock, Ransomware, Group, Augments, Post-Exploitation, Activities</media:keywords>
</item>

<item>
<title>LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In&#45;Memory Loader</title>
<link>https://block385.com/leaknet-ransomware-uses-clickfix-via-hacked-sites-deploys-deno-in-memory-loader</link>
<guid>https://block385.com/leaknet-ransomware-uses-clickfix-via-hacked-sites-deploys-deno-in-memory-loader</guid>
<description><![CDATA[ The ransomware operation known as LeakNet has adopted the ClickFix social engineering tactic delivered through compromised websites as an initial access method.
The use of ClickFix, where users are tricked into manually running malicious commands to address non-existent errors, is a departure from relying on traditional methods for obtaining initial access, such as through stolen credentials ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNHJfW8wlD2yQtP3pzAZhSRXNrzlhxXWqqG6GiAH3nbBo44Bz5mQxZ1LtsokhDYs-FC2t8hyphenhyphenY-TlNvck_Rtou9A_AA9lRnKNDRbMxZTpHfAe-6WETM-yJoWzxTANKVWrcZFdu7sax22JeTcWAVwuLKMibTNkLwSRyC0_HfBgCFM6EWqPl5-HbGtJEiSCTC/s1600/leaknet-ransomware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 17:30:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>LeakNet, Ransomware, Uses, ClickFix, via, Hacked, Sites, Deploys, Deno, In-Memory, Loader</media:keywords>
</item>

<item>
<title>New Kingston IronKey USB drive delivers enterprise&#45;grade data security</title>
<link>https://block385.com/new-kingston-ironkey-usb-drive-delivers-enterprise-grade-data-security</link>
<guid>https://block385.com/new-kingston-ironkey-usb-drive-delivers-enterprise-grade-data-security</guid>
<description><![CDATA[ Kingston Digital has announced the launch of the next-generation IronKey Locker+ 50 G2 (LP50 G2) hardware-encrypted USB flash drive. The drive provides enterprise-grade security with FIPS 197 and AES 256-bit hardware encryption in XTS mode. It also safeguards against BadUSB with digitally signed firmware and against brute force password attacks. LP50G2 features a premium space grey metal casing and supports both Admin and User passwords with options for Complex or Passphrase modes. Complex mode allows … More →
The post New Kingston IronKey USB drive delivers enterprise-grade data security appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 16:00:57 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Kingston, IronKey, USB, drive, delivers, enterprise-grade, data, security</media:keywords>
</item>

<item>
<title>Kore.ai debuts Agent Management Platform to govern enterprise AI ecosystems</title>
<link>https://block385.com/koreai-debuts-agent-management-platform-to-govern-enterprise-ai-ecosystems</link>
<guid>https://block385.com/koreai-debuts-agent-management-platform-to-govern-enterprise-ai-ecosystems</guid>
<description><![CDATA[ Kore.ai has announced the launch of its Agent Management Platform, a unified command center designed to govern, monitor, and manage AI agents and AI systems across the enterprise. As organizations deploy AI and multi-agent systems, many are encountering “AI sprawl,” a phenomena analysts describe as dozens of AI initiatives across different teams, tools, and clouds without centralized visibility or governance. Gartner predicts that by 2028, enterprises will operate thousands of AI agents across various business … More →
The post Kore.ai debuts Agent Management Platform to govern enterprise AI ecosystems appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 16:00:54 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Kore.ai, debuts, Agent, Management, Platform, govern, enterprise, ecosystems</media:keywords>
</item>

<item>
<title>Huntress adds tools to its Agentic Security Platform to detect, fix, and prevent endpoint and identity risks</title>
<link>https://block385.com/huntress-adds-tools-to-its-agentic-security-platform-to-detect-fix-and-prevent-endpoint-and-identity-risks</link>
<guid>https://block385.com/huntress-adds-tools-to-its-agentic-security-platform-to-detect-fix-and-prevent-endpoint-and-identity-risks</guid>
<description><![CDATA[ Huntress has announced Managed Endpoint Security Posture Management (ESPM) and Managed Identity Security Posture Management (ISPM), expanding its Agentic Security Platform to deliver end-to-end protection across endpoints, identities, and human risk. Huntress built Managed ESPM from the ground up and developed Managed ISPM in less than four months by leveraging expertise and capabilities from its Inside Agent acquisition in November 2025. These products empower customers to proactively close common security gaps like misconfigurations, excessive permissions, … More →
The post Huntress adds tools to its Agentic Security Platform to detect, fix, and prevent endpoint and identity risks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 16:00:50 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Huntress, adds, tools, its, Agentic, Security, Platform, detect, fix, and, prevent, endpoint, and, identity, risks</media:keywords>
</item>

<item>
<title>Pindrop Fraud Assist uses AI to analyze calls and strengthen fraud prevention</title>
<link>https://block385.com/pindrop-fraud-assist-uses-ai-to-analyze-calls-and-strengthen-fraud-prevention</link>
<guid>https://block385.com/pindrop-fraud-assist-uses-ai-to-analyze-calls-and-strengthen-fraud-prevention</guid>
<description><![CDATA[ Pindrop has announced Pindrop Protect Fraud Assist, the agentic fraud investigation and case management solution for real-time phone conversations. As AI fraud attacks surge across contact centers, Pindrop Protect Fraud Assist embeds agentic AI directly into the fraud investigation workflow, helping analysts investigate smarter, close cases faster and keep pace with rising fraud volumes, without adding headcount. As an AI assistant to the fraud analyst, the agent delivers real-time call summaries, deep risk insights and … More →
The post Pindrop Fraud Assist uses AI to analyze calls and strengthen fraud prevention appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 16:00:45 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Pindrop, Fraud, Assist, uses, analyze, calls, and, strengthen, fraud, prevention</media:keywords>
</item>

<item>
<title>SailPoint improves visibility and control over unauthorized AI use</title>
<link>https://block385.com/sailpoint-improves-visibility-and-control-over-unauthorized-ai-use</link>
<guid>https://block385.com/sailpoint-improves-visibility-and-control-over-unauthorized-ai-use</guid>
<description><![CDATA[ SailPoint has announced the launch of SailPoint Shadow AI Remediation, the latest component of its real-time AI governance and security framework. This solution enables organizations to discover, monitor, and secure the use of unauthorized AI tools, known as “shadow AI,” helping to mitigate the security and compliance risks associated with the rapid growth of artificial intelligence. As employees turn to AI platforms like ChatGPT, Claude, Gemini, and others to enhance productivity, they often do so … More →
The post SailPoint improves visibility and control over unauthorized AI use appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 16:00:41 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SailPoint, improves, visibility, and, control, over, unauthorized, use</media:keywords>
</item>

<item>
<title>XM Cyber advances AI security with enhanced exposure and attack path visibility</title>
<link>https://block385.com/xm-cyber-advances-ai-security-with-enhanced-exposure-and-attack-path-visibility</link>
<guid>https://block385.com/xm-cyber-advances-ai-security-with-enhanced-exposure-and-attack-path-visibility</guid>
<description><![CDATA[ XM Cyber has enhanced its Continuous Exposure Management Platform to help organizations adopt AI without exposing themselves to new and emerging threats. The release introduces three major capabilities that enable organizations to embrace AI-driven innovation at full speed, without giving attackers a roadmap to their most critical assets. “Rapid AI adoption has created a dilemma for security leaders: innovate at speed, or maintain the controls needed to stay secure. Our new functionality eliminates this friction … More →
The post XM Cyber advances AI security with enhanced exposure and attack path visibility appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 16:00:38 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cyber, advances, security, with, enhanced, exposure, and, attack, path, visibility</media:keywords>
</item>

<item>
<title>Xona Systems brings real&#45;time threat response to OT remote access sessions</title>
<link>https://block385.com/xona-systems-brings-real-time-threat-response-to-ot-remote-access-sessions</link>
<guid>https://block385.com/xona-systems-brings-real-time-threat-response-to-ot-remote-access-sessions</guid>
<description><![CDATA[ Xona Systems has introduced Active Defense, a new capability that enables organizations to stop threats during live remote access sessions in operational technology (OT) environments automatically, without waiting for manual intervention. In many environments, the gap between detecting suspicious activity and stopping an active session can stretch from minutes to hours, leaving adversaries connected to operational systems while a response is coordinated. Active Defense closes that window. Remote connectivity is now essential for operating and … More →
The post Xona Systems brings real-time threat response to OT remote access sessions appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 16:00:32 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Xona, Systems, brings, real-time, threat, response, remote, access, sessions</media:keywords>
</item>

<item>
<title>SCW Trust Agent: AI tracks AI influence in code to reduce software risk</title>
<link>https://block385.com/scw-trust-agent-ai-tracks-ai-influence-in-code-to-reduce-software-risk</link>
<guid>https://block385.com/scw-trust-agent-ai-tracks-ai-influence-in-code-to-reduce-software-risk</guid>
<description><![CDATA[ Secure Code Warrior has announced SCW Trust Agent: AI, a governance solution designed to make AI influence in software development visible, attributable, and enforceable at the point of commit, enabling enterprises to scale AI coding tools with measurable control over software risk. Organizations can trace which AI models influenced specific commits, correlate that influence with vulnerability exposure, and take corrective action before insecure code reaches production. According to Sonar’s 2026 State of Code Developer Survey, … More →
The post SCW Trust Agent: AI tracks AI influence in code to reduce software risk appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 16:00:22 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SCW, Trust, Agent:, tracks, influence, code, reduce, software, risk</media:keywords>
</item>

<item>
<title>CTG unveils cyber resilience scoring dashboard for measurable risk reduction</title>
<link>https://block385.com/ctg-unveils-cyber-resilience-scoring-dashboard-for-measurable-risk-reduction</link>
<guid>https://block385.com/ctg-unveils-cyber-resilience-scoring-dashboard-for-measurable-risk-reduction</guid>
<description><![CDATA[ CTG has announced the launch of a cyber resilience scoring dashboard that helps organizations quantify risk, prioritize remediation, and track measurable improvement over time. The dashboard is part of the Group’s Cegeka Security Advisory Framework (CSAF), a modular approach that combines assessments and advisory services to help organizations continuously improve their security strategy. By translating assessment outcomes into a single score and clear trends, the dashboard provides immediate visibility into cyber risk, program maturity, and … More →
The post CTG unveils cyber resilience scoring dashboard for measurable risk reduction appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 16:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CTG, unveils, cyber, resilience, scoring, dashboard, for, measurable, risk, reduction</media:keywords>
</item>

<item>
<title>Imprivata enhances NHS access security with passwordless controls</title>
<link>https://block385.com/imprivata-enhances-nhs-access-security-with-passwordless-controls</link>
<guid>https://block385.com/imprivata-enhances-nhs-access-security-with-passwordless-controls</guid>
<description><![CDATA[ Imprivata has introduced new capabilities designed to help NHS organisations and UK healthcare providers meet the unique demands of the UK’s evolving compliance, cybersecurity, data protection landscape, including the Cyber Assessment Framework (CAF)-aligned Data Security and Protection Toolkit (DSPT) and Care Identity Service (Spine) Authentication. Imprivata Enterprise Access Management (EAM) offers context-aware passwordless authentication, high-assurance identity verification, and AI-powered behavioral analytics, expanding the company’s leading solutions for improving workflow productivity while meeting the unique demands … More →
The post Imprivata enhances NHS access security with passwordless controls appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 14:00:59 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Imprivata, enhances, NHS, access, security, with, passwordless, controls</media:keywords>
</item>

<item>
<title>Veritone secures AI data with automated PII removal</title>
<link>https://block385.com/veritone-secures-ai-data-with-automated-pii-removal</link>
<guid>https://block385.com/veritone-secures-ai-data-with-automated-pii-removal</guid>
<description><![CDATA[ Veritone deploys Veritone Redact with Veritone Data Refinery (VDR) to remove personally identifiable information (PII) and sensitive data before processing, enabling AI-ready data while protecting intellectual property (IP) and data owner rights. As the scale and stakes for AI deployments and applications put pressure on enterprises and hyperscalers alike to ensure AI training data is properly licensed with PII and other sensitive data removed, VDR is designed to help ensure the data is clean from … More →
The post Veritone secures AI data with automated PII removal appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 14:00:45 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Veritone, secures, data, with, automated, PII, removal</media:keywords>
</item>

<item>
<title>Chainguard locks down CI/CD with secure&#45;by&#45;default actions</title>
<link>https://block385.com/chainguard-locks-down-cicd-with-secure-by-default-actions</link>
<guid>https://block385.com/chainguard-locks-down-cicd-with-secure-by-default-actions</guid>
<description><![CDATA[ Chainguard has announced Chainguard Actions, secure-by-default workflows for CI/CD pipelines that allow developers and AI agents to ship quickly without introducing software supply chain risk. Using an agentic approach, Chainguard Actions provides a continuously secured catalog of workflows maintained by the Chainguard Factory, the infrastructure that has become the industry standard for delivering trusted open source artifacts. Chainguard Actions ingests widely used third-party CI/CD workflows, starting with GitHub Actions, and evaluates them against a security … More →
The post Chainguard locks down CI/CD with secure-by-default actions appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 14:00:34 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Chainguard, locks, down, CICD, with, secure-by-default, actions</media:keywords>
</item>

<item>
<title>EU sanctions Chinese company behind 65,000&#45;device hack</title>
<link>https://block385.com/eu-sanctions-chinese-company-behind-65000-device-hack</link>
<guid>https://block385.com/eu-sanctions-chinese-company-behind-65000-device-hack</guid>
<description><![CDATA[ The EU Council has sanctioned companies from China and Iran, along with two individuals, over cyberattacks targeting its member states and partners. “Those listed are subject to an asset freeze, while EU citizens and companies are prohibited from providing them with funds or economic resources. Individuals also face travel bans that prevent entry into or transit through EU territory,” the Council said in a statement. With the latest listings, the EU cyber sanctions regime applies … More →
The post EU sanctions Chinese company behind 65,000-device hack appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/10/11093409/eu-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 14:00:22 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>sanctions, Chinese, company, behind, 65, 000-device, hack</media:keywords>
</item>

<item>
<title>Intel 471 debuts integrated platform for external threat management</title>
<link>https://block385.com/intel-471-debuts-integrated-platform-for-external-threat-management</link>
<guid>https://block385.com/intel-471-debuts-integrated-platform-for-external-threat-management</guid>
<description><![CDATA[ Intel 471 has announced its latest product offering, the Cyber Threat Exposure Bundle, on its Verity471 platform. This new bundle combines Attack Surface Exposure, Third-Party Exposure, and Brand Exposure into a single solution, providing users with a standardized view to identify, prioritize, and remediate external risks. By integrating these solutions, organizations are better equipped to tackle a sophisticated threat landscape with enhanced visibility and intelligence, without disrupting business operations. “Since launching Verity471 in 2025, we … More →
The post Intel 471 debuts integrated platform for external threat management appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 14:00:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Intel, 471, debuts, integrated, platform, for, external, threat, management</media:keywords>
</item>

<item>
<title>AI is Everywhere, But CISOs are Still Securing It with Yesterday&amp;apos;s Skills and Tools, Study Finds</title>
<link>https://block385.com/ai-is-everywhere-but-cisos-are-still-securing-it-with-yesterdays-skills-and-tools-study-finds</link>
<guid>https://block385.com/ai-is-everywhere-but-cisos-are-still-securing-it-with-yesterdays-skills-and-tools-study-finds</guid>
<description><![CDATA[ A majority of security leaders are struggling to defend AI systems with tools and skills that are not fit for the challenge, according to the AI and Adversarial Testing Benchmark Report 2026 from Pentera.
The report, based on a survey of 300 US CISOs and senior security leaders, examines how organizations are securing AI infrastructure and highlights critical gaps tied to skills shortages and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8f5KRgkqcEs7OtCxyKrJIvPWUOZnbkV5dIFPc5TjDbkAliVww6lOjpuOBZYQw1TF4H28aJZNMY6KkZmnaQfIGsR4PlXWHl4Ps-zfPutG01bPkEIjKSLlCWwK66sjwPX7uf7qsrjl3kMTVe1F4Wl7BJj7dPiC0rDW_skQOlfgirUrzT9E5bccb4fTXdLI/s1600/pentera.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 13:30:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Everywhere, But, CISOs, are, Still, Securing, with, Yesterdays, Skills, and, Tools, Study, Finds</media:keywords>
</item>

<item>
<title>Millions of UK firms on alert after Companies House data exposure</title>
<link>https://block385.com/millions-of-uk-firms-on-alert-after-companies-house-data-exposure</link>
<guid>https://block385.com/millions-of-uk-firms-on-alert-after-companies-house-data-exposure</guid>
<description><![CDATA[ Companies House, the UK’s official company registry, said its WebFiling service is back online after being shut down on Friday to fix a security issue that may have exposed the personal data of millions of firms. An investigation indicates the flaw was likely introduced during an October 2025 update. According to Companies House, only users who were logged in and had a valid authentication code could have exploited the flaw. However, the vulnerability raised concerns … More →
The post Millions of UK firms on alert after Companies House data exposure appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/12170127/uk-flag-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 12:01:01 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Millions, firms, alert, after, Companies, House, data, exposure</media:keywords>
</item>

<item>
<title>Microsoft zeroes in on AI&#45;driven data risks in Fabric</title>
<link>https://block385.com/microsoft-zeroes-in-on-ai-driven-data-risks-in-fabric</link>
<guid>https://block385.com/microsoft-zeroes-in-on-ai-driven-data-risks-in-fabric</guid>
<description><![CDATA[ New Microsoft Purview innovations for Microsoft Fabric help organizations secure data and accelerate AI adoption. The updates focus on identifying risks, preventing data oversharing, and strengthening governance and data quality across the data estate. Integration between Microsoft Purview and Microsoft Fabric delivers unified data security and governance, enabling protection of sensitive data, maintaining visibility across the data environment, and supporting data readiness for AI use. “Microsoft Purview and Microsoft Fabric deliver an integrated and unified … More →
The post Microsoft zeroes in on AI-driven data risks in Fabric appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/12/09164604/microsoft-hot-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 12:00:49 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, zeroes, AI-driven, data, risks, Fabric</media:keywords>
</item>

<item>
<title>Jozu Agent Guard targets AI agents that evade controls</title>
<link>https://block385.com/jozu-agent-guard-targets-ai-agents-that-evade-controls</link>
<guid>https://block385.com/jozu-agent-guard-targets-ai-agents-that-evade-controls</guid>
<description><![CDATA[ Jozu has announced the launch of Jozu Agent Guard, a zero-trust AI runtime that executes agents, models, and MCP servers in secure environments with built-in policy enforcement and guardrails that cannot be disabled. As enterprises adopt AI agents, MCP servers, and tools such as Copilot, OpenClawd, and Claude Code, security teams face a growing gap. Employees are running these tools on their machines without formal vetting, policies, approvals, or security scans. Jozu Agent Guard allows … More →
The post Jozu Agent Guard targets AI agents that evade controls appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 12:00:34 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Jozu, Agent, Guard, targets, agents, that, evade, controls</media:keywords>
</item>

<item>
<title>Proofpoint addresses AI threats with intent&#45;based security</title>
<link>https://block385.com/proofpoint-addresses-ai-threats-with-intent-based-security</link>
<guid>https://block385.com/proofpoint-addresses-ai-threats-with-intent-based-security</guid>
<description><![CDATA[ Proofpoint has announced Proofpoint AI Security, the newest security solution that combines intent-based detection, multi-surface control points, and a comprehensive implementation framework to secure how humans and AI agents use AI across the enterprise. Based on the Agent Integrity Framework, which defines how an AI agent operates with integrity, Proofpoint is introducing a five-phase maturity model for implementation, from initial discovery through runtime enforcement. As organizations rapidly deploy autonomous AI agents to browse the web, … More →
The post Proofpoint addresses AI threats with intent-based security appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 12:00:17 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Proofpoint, addresses, threats, with, intent-based, security</media:keywords>
</item>

<item>
<title>Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate Malware</title>
<link>https://block385.com/konni-deploys-endrat-through-phishing-uses-kakaotalk-to-propagate-malware</link>
<guid>https://block385.com/konni-deploys-endrat-through-phishing-uses-kakaotalk-to-propagate-malware</guid>
<description><![CDATA[ North Korean threat actors have been observed sending phishing to compromise targets and obtain access to a victim&#039;s KakaoTalk desktop application to distribute malicious payloads to certain contacts.
The activity has been attributed by South Korean threat intelligence firm Genians to a hacking group referred to as Konni.
&quot;Initial access was achieved through a spear-phishing email disguised as a ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh64jRKLqi9-c5fwxRIgUOuYe8fcW2NWoeEfMBoi9oBOrVRu1CW6TXPBuAL3VPIKoQMX4EeeKtPt0wzGFExXyCm3rGmXRYzfWsFSp1JDpxZ82neNjqGELR9s2ViKaVzhk2taHFfQNGiIYC9JyhaOd8c4DLKmUZt_SleyWwtCwi2ffFpFI6SIFq3h7pni3NZ/s1600/attack-talk.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 11:30:14 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Konni, Deploys, EndRAT, Through, Phishing, Uses, KakaoTalk, Propagate, Malware</media:keywords>
</item>

<item>
<title>Traefik Triple Gate gains parallel safety pipelines, failover routing, and AI runtime controls</title>
<link>https://block385.com/traefik-triple-gate-gains-parallel-safety-pipelines-failover-routing-and-ai-runtime-controls</link>
<guid>https://block385.com/traefik-triple-gate-gains-parallel-safety-pipelines-failover-routing-and-ai-runtime-controls</guid>
<description><![CDATA[ Traefik Labs has announced new capabilities that extend Traefik Hub’s Triple Gate architecture (API Gateway, AI Gateway, and MCP Gateway) with deeper runtime governance across the full AI workflow, including a composable multi-vendor safety pipeline with parallel guard execution, multi-provider failover routing, token-level cost controls, graceful error handling for agent-aware enforcement, IBM Granite Guardian integration, and a new Regex Guard capability that enables organizations to create custom guards. These capabilities address a growing gap. Enterprises … More →
The post Traefik Triple Gate gains parallel safety pipelines, failover routing, and AI runtime controls appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 10:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Traefik, Triple, Gate, gains, parallel, safety, pipelines, failover, routing, and, runtime, controls</media:keywords>
</item>

<item>
<title>Cybersecurity jobs available right now: March 17, 2026</title>
<link>https://block385.com/cybersecurity-jobs-available-right-now-march-17-2026</link>
<guid>https://block385.com/cybersecurity-jobs-available-right-now-march-17-2026</guid>
<description><![CDATA[ Application Security DevSecOps Specialist NTT DATA | Italy | On-site – View job details As an Application Security DevSecOps Specialist, you will integrate security into CI/CD pipelines using tools such as SAST, DAST, SCA, secret scanning, and container scanning to ensure secure software delivery. You will conduct code security reviews, triage findings, and collaborate with developers to remediate vulnerabilities and promote secure coding practices. CISO Somnetics | India | On-site – View job details As … More →
The post Cybersecurity jobs available right now: March 17, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11140407/cybersecurity_jobs-3-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 08:00:32 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybersecurity, jobs, available, right, now:, March, 17, 2026</media:keywords>
</item>

<item>
<title>What to do in the first 24 hours of a breach</title>
<link>https://block385.com/what-to-do-in-the-first-24-hours-of-a-breach</link>
<guid>https://block385.com/what-to-do-in-the-first-24-hours-of-a-breach</guid>
<description><![CDATA[ In this Help Net Security video, Arvind Parthasarathi, CEO of CYGNVS, walks through a 10-step process for handling a cybersecurity breach. The first five steps cover preparation: setting up an out-of-band communication platform, identifying internal stakeholders, selecting external providers like legal counsel and forensic firms, building cross-functional playbooks, and running tabletop exercises to test those playbooks. The second five steps address what to do once a breach is underway. These include setting up real-time dashboards, … More →
The post What to do in the first 24 hours of a breach appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/23124652/attack-ddos-threat-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 08:00:22 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>What, the, first, hours, breach</media:keywords>
</item>

<item>
<title>Hidden instructions in README files can make AI agents leak data</title>
<link>https://block385.com/hidden-instructions-in-readme-files-can-make-ai-agents-leak-data</link>
<guid>https://block385.com/hidden-instructions-in-readme-files-can-make-ai-agents-leak-data</guid>
<description><![CDATA[ Developers rely on AI coding agents to set up projects, install dependencies, and run commands by following instructions in repository README files, which provide setup guidance for software projects. New research identifies a security risk when attackers hide malicious instructions in those documents. A semantic injection attack, where injections are embedded in an installation file, leading to the unintended leakage of sensitive local files. Tests showed that hidden instructions in README files could trigger AI … More →
The post Hidden instructions in README files can make AI agents leak data appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/27085031/ai-evolution-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 08:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hidden, instructions, README, files, can, make, agents, leak, data</media:keywords>
</item>

<item>
<title>CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths</title>
<link>https://block385.com/cisa-flags-actively-exploited-wing-ftp-vulnerability-leaking-server-paths</link>
<guid>https://block385.com/cisa-flags-actively-exploited-wing-ftp-vulnerability-leaking-server-paths</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a medium-severity security flaw impacting Wing FTP to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerability, CVE-2025-47813 (CVSS score: 4.3), is an information disclosure vulnerability that leaks the installation path of the application under certain conditions ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHrElxuBmshJ8wNl7qURDxcn2YLWxn07Uco53YCLhDLFqoS-exUpqGau4x9eFOvHq_KXg3ifLU3wVbZvhZExQ2XJJeWePG6zqRjrug6hAdOZaGcs78e68M7J23XMJWCXegidndqdayfGyPZt8mpLTExvPl_YJS8Nn5mPn4aEzlUKdU0B8J6-NtRX8_ncw7/s1600/cisa-ftp.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 07:30:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Flags, Actively, Exploited, Wing, FTP, Vulnerability, Leaking, Server, Paths</media:keywords>
</item>

<item>
<title>China&#45;Nexus Hackers Skulk in Southeast Asian Military Orgs for Years</title>
<link>https://block385.com/china-nexus-hackers-skulk-in-southeast-asian-military-orgs-for-years</link>
<guid>https://block385.com/china-nexus-hackers-skulk-in-southeast-asian-military-orgs-for-years</guid>
<description><![CDATA[ Researchers uncovered an extensive cyberespionage campaign that used novel backdoors and familiar evasion techniques to maintain persistent access to regional targets. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7557699e9afa3c6a/69b8742906fbf44512bd0258/chinahackers_JakubKrechowicz_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 17 Mar 2026 04:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>China-Nexus, Hackers, Skulk, Southeast, Asian, Military, Orgs, for, Years</media:keywords>
</item>

<item>
<title>GlassWorm Malware Evolves to Hide in Dependencies</title>
<link>https://block385.com/glassworm-malware-evolves-to-hide-in-dependencies</link>
<guid>https://block385.com/glassworm-malware-evolves-to-hide-in-dependencies</guid>
<description><![CDATA[ Researchers have identified dozens of malicious GlassWorm extensions that come with new evasion techniques. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt29f294da498da1a6/69b85a4f06fbf45feebd0234/Gummy_Worms_Clear_Brent_Hofacker_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 22:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GlassWorm, Malware, Evolves, Hide, Dependencies</media:keywords>
</item>

<item>
<title>Inside Olympic Cybersecurity: Lessons From Paris 2024 to Milan Cortina 2026</title>
<link>https://block385.com/inside-olympic-cybersecurity-lessons-from-paris-2024-to-milan-cortina-2026</link>
<guid>https://block385.com/inside-olympic-cybersecurity-lessons-from-paris-2024-to-milan-cortina-2026</guid>
<description><![CDATA[ Discover how Franz Regul, former CISO for the Paris 2024 Olympics, tackled unique cybersecurity challenges to protect the Olympics from evolving threats. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte9b9457cdec1b3d3/69b79e826b8a83f7009f71e1/olympics1800_sportpoint_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 22:00:03 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Inside, Olympic, Cybersecurity:, Lessons, From, Paris, 2024, Milan, Cortina, 2026</media:keywords>
</item>

<item>
<title>GlassWorm Attack Uses Stolen GitHub Tokens to Force&#45;Push Malware Into Python Repos</title>
<link>https://block385.com/glassworm-attack-uses-stolen-github-tokens-to-force-push-malware-into-python-repos</link>
<guid>https://block385.com/glassworm-attack-uses-stolen-github-tokens-to-force-push-malware-into-python-repos</guid>
<description><![CDATA[ The GlassWorm malware campaign is being used to fuel an ongoing attack that leverages the stolen GitHub tokens to inject malware into hundreds of Python repositories.
&quot;The attack targets Python projects — including Django apps, ML research code, Streamlit dashboards, and PyPI packages — by appending obfuscated code to files like setup.py, main.py, and app.py,&quot; StepSecurity said. &quot;Anyone who runs ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhm7L4zUQpR3yqvBYQOLElALmeqWJoxMkXDZVmvs0LgAMwPCH6yuBMCeP_IJwLfkM_4SFI5mXmBQKNWu8JgME_4yZ271ZLEeJe_l-mZ-H4gsw2XaZecZoUhvlaaxdWjcDnn3zrl4boAnxhfXUNogrGpM83ucMCez0IN1A9xKn2XlrUEfVcBgFdFuC7pWdsX/s1600/githun-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 21:30:10 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GlassWorm, Attack, Uses, Stolen, GitHub, Tokens, Force-Push, Malware, Into, Python, Repos</media:keywords>
</item>

<item>
<title>Attackers Abuse LiveChat to Phish Credit Card, Personal Data</title>
<link>https://block385.com/attackers-abuse-livechat-to-phish-credit-card-personal-data</link>
<guid>https://block385.com/attackers-abuse-livechat-to-phish-credit-card-personal-data</guid>
<description><![CDATA[ A social engineering campaign impersonating PayPal and Amazon uses customer support interactions to acquire sensitive info. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt30f7b6348acacc8e/69b7e580b62d6e0c4d7d956f/Phishing_ronstik_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 18:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Attackers, Abuse, LiveChat, Phish, Credit, Card, Personal, Data</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: Chrome 0&#45;Days, Router Botnets, AWS Breach, Rogue AI Agents &amp;amp; More</title>
<link>https://block385.com/weekly-recap-chrome-0-days-router-botnets-aws-breach-rogue-ai-agents-more</link>
<guid>https://block385.com/weekly-recap-chrome-0-days-router-botnets-aws-breach-rogue-ai-agents-more</guid>
<description><![CDATA[ Some weeks in security feel normal. Then you read a few tabs and get that immediate “ah, great, we’re doing this now” feeling.
This week has that energy. Fresh messes, old problems getting sharper, and research that stops feeling theoretical real fast. A few bits hit a little too close to real life, too. There’s a good mix here: weird abuse of trusted stuff, quiet infrastructure ugliness, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_H0YAbH9M9ZJEpNND8ld-a6PMbK_iC6MTl5KYp4PZ5cagUKRCuqsIsILZabA2CSAgcmKqr7xth_SL23l17zM8ANvYNa6LdvZc8xz_R08FfTek2V8rVtMBte0ubUnBlZ8IbZi0GBs-W4J9R7TCaVOCK9NYXWDPIAuFGTHyCOybC1PQqQKRKnTI6r9BZVaO/s1600/cyberrecap.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 17:30:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>⚡, Weekly, Recap:, Chrome, 0-Days, Router, Botnets, AWS, Breach, Rogue, Agents, More</media:keywords>
</item>

<item>
<title>Orca Platform enhancements use AI to cut cloud alert noise</title>
<link>https://block385.com/orca-platform-enhancements-use-ai-to-cut-cloud-alert-noise</link>
<guid>https://block385.com/orca-platform-enhancements-use-ai-to-cut-cloud-alert-noise</guid>
<description><![CDATA[ Orca Security has announced major enhancements to the Orca Platform, introducing new AI-powered security agents, real-time detection of AI usage across cloud environments, remediation-focused workflows, and code reachability analysis. These innovations enable organizations to move beyond fragmented alerts toward faster investigation, clearer prioritization, and measurable risk reduction. As enterprises accelerate AI adoption and scale across multi-cloud environments, security teams are inundated with alerts yet lack the context and prioritization needed to distinguish real, business-critical risk … More →
The post Orca Platform enhancements use AI to cut cloud alert noise appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 16:00:28 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Orca, Platform, enhancements, use, cut, cloud, alert, noise</media:keywords>
</item>

<item>
<title>NinjaOne Vulnerability Management enables real&#45;time detection and autonomous patching</title>
<link>https://block385.com/ninjaone-vulnerability-management-enables-real-time-detection-and-autonomous-patching</link>
<guid>https://block385.com/ninjaone-vulnerability-management-enables-real-time-detection-and-autonomous-patching</guid>
<description><![CDATA[ NinjaOne has unveiled NinjaOne Vulnerability Management, a new solution that helps IT teams identify, prioritize, and remediate vulnerabilities faster, without relying on periodic scans from security teams that often lack context and connection to remediation workflows. Built natively into the NinjaOne platform, the new solution brings together AI-driven real-time vulnerability assessment, patch confidence scoring, and remediation, allowing organizations to proactively fix vulnerabilities, minimize mean time to remediate, and reduce time spent vulnerable. The traditional approach … More →
The post NinjaOne Vulnerability Management enables real-time detection and autonomous patching appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 16:00:16 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NinjaOne, Vulnerability, Management, enables, real-time, detection, and, autonomous, patching</media:keywords>
</item>

<item>
<title>Stellar Cyber 6.4.0 reduces alert noise and speeds investigations with Autonomous SOC capabilities</title>
<link>https://block385.com/stellar-cyber-640-reduces-alert-noise-and-speeds-investigations-with-autonomous-soc-capabilities</link>
<guid>https://block385.com/stellar-cyber-640-reduces-alert-noise-and-speeds-investigations-with-autonomous-soc-capabilities</guid>
<description><![CDATA[ Stellar Cyber has announced he general availability of version 6.4.0 of its platform. With this release, Stellar Cyber delivers new Autonomous SOC capabilities designed to reduce alert noise, accelerate investigations, and transform the day-to-day experience of security analysts. Ushering in the human-augmented Autonomous SOC Security teams are overwhelmed by escalating alert volumes and increasingly complex attack techniques. Stellar Cyber 6.4.0 introduces coordinated agentic AI reasoning embedded directly into analyst workflows, enabling AI to work with … More →
The post Stellar Cyber 6.4.0 reduces alert noise and speeds investigations with Autonomous SOC capabilities appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 16:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Stellar, Cyber, 6.4.0, reduces, alert, noise, and, speeds, investigations, with, Autonomous, SOC, capabilities</media:keywords>
</item>

<item>
<title>Meta ditches end&#45;to&#45;end encrypted messaging on Instagram</title>
<link>https://block385.com/meta-ditches-end-to-end-encrypted-messaging-on-instagram</link>
<guid>https://block385.com/meta-ditches-end-to-end-encrypted-messaging-on-instagram</guid>
<description><![CDATA[ End-to-end encrypted messaging on Instagram will no longer be supported after May 8, 2026. Meta justified the move by saying the feature was rarely used, with only a small fraction of Instagram users enabling encryption. The company advised users seeking end-to-end encryption to switch to WhatsApp, where it is enabled by default. Unlike WhatsApp, Instagram never rolled out encryption to all users and the feature remained optional. Users with affected chats will see instructions on … More →
The post Meta ditches end-to-end encrypted messaging on Instagram appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/12100734/instagram-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 14:00:21 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Meta, ditches, end-to-end, encrypted, messaging, Instagram</media:keywords>
</item>

<item>
<title>Fingerprint’s MCP Server turns device intelligence into real&#45;time AI&#45;powered fraud insights</title>
<link>https://block385.com/fingerprints-mcp-server-turns-device-intelligence-into-real-time-ai-powered-fraud-insights</link>
<guid>https://block385.com/fingerprints-mcp-server-turns-device-intelligence-into-real-time-ai-powered-fraud-insights</guid>
<description><![CDATA[ Fingerprint has announced the launch of its Model Context Protocol (MCP) Server, an open-source MCP implementation for the fraud prevention space. The new server enables organizations to connect any AI assistant or agent directly to Fingerprint’s device intelligence platform, turning fraud analysis into real-time, AI-powered insights. The Fingerprint MCP Server uses a standard open protocol that allows organizations to bring their own preferred AI assistant, chatbot, or agent directly to their fraud data. This means … More →
The post Fingerprint’s MCP Server turns device intelligence into real-time AI-powered fraud insights appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 14:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fingerprint’s, MCP, Server, turns, device, intelligence, into, real-time, AI-powered, fraud, insights</media:keywords>
</item>

<item>
<title>Why Security Validation Is Becoming Agentic</title>
<link>https://block385.com/why-security-validation-is-becoming-agentic</link>
<guid>https://block385.com/why-security-validation-is-becoming-agentic</guid>
<description><![CDATA[ If you run security at any reasonably complex organization, your validation stack probably looks something like this: a BAS tool in one corner. A pentest engagement, or maybe an automated pentesting product, in another. A vulnerability scanner feeding an attack surface management platform somewhere else. Each tool gives you a slice of the picture. None of them talks to each other in any ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLVOZFyD6pBH1804jnpyTOScRJO3CnlHA2m3B-L1ML1B5l2iP70OHF_rUwtdHARpNsVh5WxdCXX7fO9NfpjPaH0jwJYCmWgGa2Eo5x9RPkl8PEl9e7tq2-T5sbv6KI7GnyzCr3PhSUSpweRRMlR0pGC4lO_3m1gVgLfrjt6sulJRo4yJKPlNSn_VyM8oo/s1600/picus.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 13:30:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, Security, Validation, Becoming, Agentic</media:keywords>
</item>

<item>
<title>ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers</title>
<link>https://block385.com/clickfix-campaigns-spread-macsync-macos-infostealer-via-fake-ai-tool-installers</link>
<guid>https://block385.com/clickfix-campaigns-spread-macsync-macos-infostealer-via-fake-ai-tool-installers</guid>
<description><![CDATA[ Three different ClickFix campaigns have been found to act as a delivery vector for the deployment of a macOS information stealer called MacSync.
&quot;Unlike traditional exploit-based attacks, this method relies entirely on user interaction – usually in the form of copying and executing commands – making it particularly effective against users who may not appreciate the implications of running ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFYjqyJvKKEaCGLTQo4-iMO_9Iq0V0lJVBlggKNorjB_DmPjq0sw_wl0EJ1oklawc4r9V7Axxk_J1WW1HEbIZwKRo8ui7thLccLTtcD6ePD0EcbJCvXWa0eAv0BYdV1cYO2HcDEIbB5GMNxUnV0TGTD3O2YAnOUcPqFJvTPPbYhufQ-sBuh1K01E6Szx9O/s1600/macos-clickfix.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 13:30:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ClickFix, Campaigns, Spread, MacSync, macOS, Infostealer, via, Fake, Tool, Installers</media:keywords>
</item>

<item>
<title>KEEQuant advances chip&#45;scale QKD for telecom, data centers, and critical infrastructure</title>
<link>https://block385.com/keequant-advances-chip-scale-qkd-for-telecom-data-centers-and-critical-infrastructure</link>
<guid>https://block385.com/keequant-advances-chip-scale-qkd-for-telecom-data-centers-and-critical-infrastructure</guid>
<description><![CDATA[ KEEQuant has announced its commercial chip-scale QKD technology, marking an advance in quantum-secure communications. The system replaces bulky optical assemblies with photonic integration, lowering the cost and complexity of quantum key distribution and making quantum-safe key exchange a practical upgrade for telecom operators, data center providers, and critical infrastructure organizations. The result is smaller, more scalable systems that remain compatible with existing fiber environments and encryption solutions, making adoption more practical for organizations preparing their … More →
The post KEEQuant advances chip-scale QKD for telecom, data centers, and critical infrastructure appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 12:00:20 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>KEEQuant, advances, chip-scale, QKD, for, telecom, data, centers, and, critical, infrastructure</media:keywords>
</item>

<item>
<title>Hackers tried to breach Poland’s nuclear research centre</title>
<link>https://block385.com/hackers-tried-to-breach-polands-nuclear-research-centre</link>
<guid>https://block385.com/hackers-tried-to-breach-polands-nuclear-research-centre</guid>
<description><![CDATA[ Poland’s National Centre for Nuclear Research (NCBJ) thwarted a cyberattack targeting its IT infrastructure. The attempted intrusion was detected and blocked before attackers could compromise systems or disrupt operations. “No production, operational, or research processes were disrupted, and the MARIA reactor is operating safely and smoothly, at full power,” said Prof. Jakub Kupecki, Director of the National Centre for Nuclear Research. The National Centre for Nuclear Research is one of the largest scientific institutes in … More →
The post Hackers tried to breach Poland’s nuclear research centre appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/06144641/polish-flag-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 12:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hackers, tried, breach, Poland’s, nuclear, research, centre</media:keywords>
</item>

<item>
<title>Microsoft Edge 146 adds IP privacy and local network access controls</title>
<link>https://block385.com/microsoft-edge-146-adds-ip-privacy-and-local-network-access-controls</link>
<guid>https://block385.com/microsoft-edge-146-adds-ip-privacy-and-local-network-access-controls</guid>
<description><![CDATA[ Microsoft Edge version 146 (Stable) became available on March 13, 2026, bringing updates to tracking protection, IP privacy, and enterprise network security policies. One change affects tracking prevention in InPrivate browsing. InPrivate windows use the same tracking prevention level configured for standard browsing sessions. The separate option that previously allowed a different tracking setting for private windows has been removed. The release expands Private IP, part of the Edge Secure Network capability. The feature routes … More →
The post Microsoft Edge 146 adds IP privacy and local network access controls appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/18141959/microsoft_edge-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 12:00:05 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Edge, 146, adds, privacy, and, local, network, access, controls</media:keywords>
</item>

<item>
<title>DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage</title>
<link>https://block385.com/drillapp-backdoor-targets-ukraine-abuses-microsoft-edge-debugging-for-stealth-espionage</link>
<guid>https://block385.com/drillapp-backdoor-targets-ukraine-abuses-microsoft-edge-debugging-for-stealth-espionage</guid>
<description><![CDATA[ Ukrainian entities have emerged as the target of a new campaign likely orchestrated by threat actors linked to Russia, according to a report from S2 Grupo&#039;s LAB52 threat intelligence team.
The campaign, observed in February 2026, has been assessed to share overlaps with a prior campaign mounted by Laundry Bear (aka UAC-0190 or Void Blizzard) aimed at Ukrainian defense forces with a malware ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLAzfBgcfc_bSkMovfPss0X0ONO4MhDVIOKyB_FgCnAZ4NOfVM3MdIMfIr0QMDCqKBvJaAz0mRIPYV075qfnurW27qWCCmjlcnDX-DOnb-kHulHrvk-k_cZCchJfEfxBdhkUf3GCbboHdQzxOCv3sEzSvgKaOoCNRgD20y7ZywYWsYtjjnh8dDLMbqJnvr/s1600/uk-cyberattacks.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 11:30:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DRILLAPP, Backdoor, Targets, Ukraine, Abuses, Microsoft, Edge, Debugging, for, Stealth, Espionage</media:keywords>
</item>

<item>
<title>JSOC IT’s AUTOPSY platform puts security stacks under live API verification</title>
<link>https://block385.com/jsoc-its-autopsy-platform-puts-security-stacks-under-live-api-verification</link>
<guid>https://block385.com/jsoc-its-autopsy-platform-puts-security-stacks-under-live-api-verification</guid>
<description><![CDATA[ JSOC IT has announced the launch of AUTOPSY, a security verification platform that investigates an organization’s security stack through live API integrations before a breach occurs, rather than after one forces the conversation. The platform’s flagship product, READY, is a security assessment that replaces self-reported questionnaires with API-verified telemetry across an organization’s security stack, including endpoint detection, identity and access management, backup and recovery, vulnerability management, and more than 24 integrated security platforms. The launch … More →
The post JSOC IT’s AUTOPSY platform puts security stacks under live API verification appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 10:00:21 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>JSOC, IT’s, AUTOPSY, platform, puts, security, stacks, under, live, API, verification</media:keywords>
</item>

<item>
<title>45,000 malicious IP addresses taken down, 94 suspects arrested</title>
<link>https://block385.com/45000-malicious-ip-addresses-taken-down-94-suspects-arrested</link>
<guid>https://block385.com/45000-malicious-ip-addresses-taken-down-94-suspects-arrested</guid>
<description><![CDATA[ An international law enforcement operation has taken down more than 45,000 malicious IP addresses and servers linked to phishing, malware, and ransomware activity. The action was carried out as part of Operation Synergia III, an investigation that ran from July 18, 2025 to January 31, 2026. According to INTERPOL, the operation resulted in 94 arrests, while 110 additional suspects remain under investigation. Authorities also seized 212 electronic devices and servers linked to the criminal networks. … More →
The post 45,000 malicious IP addresses taken down, 94 suspects arrested appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/27170602/law_enforcement-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 10:00:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>45, 000, malicious, addresses, taken, down, suspects, arrested</media:keywords>
</item>

<item>
<title>Fake scandal clips on Facebook bait victims into investment scams</title>
<link>https://block385.com/fake-scandal-clips-on-facebook-bait-victims-into-investment-scams</link>
<guid>https://block385.com/fake-scandal-clips-on-facebook-bait-victims-into-investment-scams</guid>
<description><![CDATA[ Bitdefender researchers uncovered hundreds of scam campaigns promoted through Facebook ads that use fake news stories, celebrity impersonation, and redirect chains to funnel victims into investment fraud schemes. The activity ran through 310 malvertising campaigns distributed on Meta platforms from February 9 to March 5, 2026. The campaigns generated more than 26,000 ad sightings with localized content in more than 15 languages. The operation used three main scam sub-campaigns with a smaller fourth branch, and … More →
The post Fake scandal clips on Facebook bait victims into investment scams appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/25153040/fraud-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 08:00:44 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fake, scandal, clips, Facebook, bait, victims, into, investment, scams</media:keywords>
</item>

<item>
<title>VulHunt: Open&#45;source vulnerability detection framework</title>
<link>https://block385.com/vulhunt-open-source-vulnerability-detection-framework</link>
<guid>https://block385.com/vulhunt-open-source-vulnerability-detection-framework</guid>
<description><![CDATA[ Binarly has published VulHunt Community Edition, making the core scanning engine from Binarly’s commercial Transparency Platform available to independent researchers and practitioners. What VulHunt does VulHunt Community Edition is a framework for detecting vulnerabilities in compiled software. It operates against multiple binary representations simultaneously, working across disassembly, an intermediate representation layer, and decompiled code. Targets include POSIX executables and UEFI firmware modules. The detection logic is expressed in Lua rules. Each rule specifies metadata such … More →
The post VulHunt: Open-source vulnerability detection framework appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/11084844/vulhunt-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 08:00:33 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>VulHunt:, Open-source, vulnerability, detection, framework</media:keywords>
</item>

<item>
<title>What smart factories keep getting wrong about cybersecurity</title>
<link>https://block385.com/what-smart-factories-keep-getting-wrong-about-cybersecurity</link>
<guid>https://block385.com/what-smart-factories-keep-getting-wrong-about-cybersecurity</guid>
<description><![CDATA[ In this Help Net Security interview, Packsize CSO Troy Rydman breaks down the biggest vulnerabilities in smart factory environments today, from IoT devices and legacy systems to human error. He explains how unmanaged devices, from sensors to robotic components, often go unpatched and become entry points for attackers. Legacy infrastructure is frequently overlooked as organizations move to cloud and SaaS platforms, leaving outdated systems exposed. Employees remain a persistent weak point, not because of negligence, … More →
The post What smart factories keep getting wrong about cybersecurity appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/10132547/troy_rydman-a-packsize.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 08:00:21 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>What, smart, factories, keep, getting, wrong, about, cybersecurity</media:keywords>
</item>

<item>
<title>Certificate lifespans are shrinking and most organizations aren’t ready</title>
<link>https://block385.com/certificate-lifespans-are-shrinking-and-most-organizations-arent-ready</link>
<guid>https://block385.com/certificate-lifespans-are-shrinking-and-most-organizations-arent-ready</guid>
<description><![CDATA[ The push for shorter TLS certificate lifespans has been building for years. It started with Google’s internal push toward 90-day certificates, which gained traction inside the industry before resistance from enterprise customers slowed things down. Then Apple proposed 47-day certificates, which reignited the debate and ultimately forced the CA/Browser Forum to set a formal schedule. The timeline that came out of those discussions moves certificate validity from one year down to 200 days, then 100, … More →
The post Certificate lifespans are shrinking and most organizations aren’t ready appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/04/10193105/certificates-1500-tech.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 08:00:13 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Certificate, lifespans, are, shrinking, and, most, organizations, aren’t, ready</media:keywords>
</item>

<item>
<title>Android 17 Blocks Non&#45;Accessibility Apps from Accessibility API to Prevent Malware Abuse</title>
<link>https://block385.com/android-17-blocks-non-accessibility-apps-from-accessibility-api-to-prevent-malware-abuse</link>
<guid>https://block385.com/android-17-blocks-non-accessibility-apps-from-accessibility-api-to-prevent-malware-abuse</guid>
<description><![CDATA[ Google is testing a new security feature as part of Android Advanced Protection Mode (AAPM) that prevents certain kinds of apps from using the accessibility services API.
The change, incorporated in Android 17 Beta 2, was first reported by Android Authority last week.
AAPM was introduced by Google in Android 16, released last year. When enabled, it causes the device to enter a heightened ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqvueuqNoIDsAH4vpBnbAGr2wz0tlhGECqZdmLWdnSPn-mZNpKuAIMPRyOR4B9C9RDKQKYKskTM-idN3OQ5zligs_i092dM4LLMP5jo1v2UHOe2hK9hV2GuX_5RvWrrmSh8b0FbKiVB7-5vuISiT_-ko5MbCTZs1YjLqFjUDZG8QFHIrV6MDlr1R1RdbM7/s1600/android-security.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 16 Mar 2026 07:30:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Android, Blocks, Non-Accessibility, Apps, from, Accessibility, API, Prevent, Malware, Abuse</media:keywords>
</item>

<item>
<title>Week in review: AiTM phishing kit used to hijack AWS accounts, year&#45;long malware campaign targets HR</title>
<link>https://block385.com/week-in-review-aitm-phishing-kit-used-to-hijack-aws-accounts-year-long-malware-campaign-targets-hr</link>
<guid>https://block385.com/week-in-review-aitm-phishing-kit-used-to-hijack-aws-accounts-year-long-malware-campaign-targets-hr</guid>
<description><![CDATA[ Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Turning expertise into opportunity for women in cybersecurity Speaker diversity in cybersecurity has been a talking point for over a decade, with panels, pledges, and dedicated conference tracks failing to produce change. Stages still skew heavily male, even as women represent millions of qualified professionals in the field. SheSpeaksCyber, a free and open directory launched by the Women4Cyber Foundation, aims … More →
The post Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/12/01112502/cybersecurity_week_in_review1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 15 Mar 2026 12:00:16 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Week, review:, AiTM, phishing, kit, used, hijack, AWS, accounts, year-long, malware, campaign, targets</media:keywords>
</item>

<item>
<title>OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration</title>
<link>https://block385.com/openclaw-ai-agent-flaws-could-enable-prompt-injection-and-data-exfiltration</link>
<guid>https://block385.com/openclaw-ai-agent-flaws-could-enable-prompt-injection-and-data-exfiltration</guid>
<description><![CDATA[ China&#039;s National Computer Network Emergency Response Technical Team (CNCERT) has issued a warning about the security stemming from the use of OpenClaw (formerly Clawdbot and Moltbot), an open-source and self-hosted autonomous artificial intelligence (AI) agent.
In a post shared on WeChat, CNCERT noted that the platform&#039;s &quot;inherently weak default security configurations,&quot; coupled with its ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg2mVucJhli25A25joXcap-ewfeMT1Vh-95wQKQfGOue7PwZJ1_55YsG8OQ1DQF7WVOU8tsOy73kGDzgfpTLLeqTYQ1k9LqrFWTNavDmfvCV-9IIER9PfrRsdg1wA5UzpIMrer3xC1mBClBzKkaT6pfczDbppMjZM7afcWu-RURquDGrEfjq3vVBsmlltLm/s1600/open-clawss.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 14 Mar 2026 19:30:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenClaw, Agent, Flaws, Could, Enable, Prompt, Injection, and, Data, Exfiltration</media:keywords>
</item>

<item>
<title>GlassWorm Supply&#45;Chain Attack Abuses 72 Open VSX Extensions to Target Developers</title>
<link>https://block385.com/glassworm-supply-chain-attack-abuses-72-open-vsx-extensions-to-target-developers</link>
<guid>https://block385.com/glassworm-supply-chain-attack-abuses-72-open-vsx-extensions-to-target-developers</guid>
<description><![CDATA[ Cybersecurity researchers have flagged a new iteration of the GlassWorm campaign that they say represents a &quot;significant escalation&quot; in how it propagates through the Open VSX registry.
&quot;Instead of requiring every malicious listing to embed the loader directly, the threat actor is now abusing extensionPack and extensionDependencies to turn initially standalone-looking extensions into transitive ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4d-2XpiCS0UYnMWh32sQEJP9LnlN_m7m2hok9CnY_vu05XXwWn4INodYCvrEdweEzpho7XqcuOFvEPnnEWlHCRa_q3HY3V5O_ii35MVWAimRwsgrpNQrvGqeUchhZ48FRUl91zTpYQdLMRxVvRjV_T8GEm-J9mnMesefzlgeaoE_EU7Ba32liTr63SsQq/s1600/open.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 14 Mar 2026 15:30:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GlassWorm, Supply-Chain, Attack, Abuses, Open, VSX, Extensions, Target, Developers</media:keywords>
</item>

<item>
<title>Why Post&#45;Quantum Cryptography Can&amp;apos;t Wait</title>
<link>https://block385.com/why-post-quantum-cryptography-cant-wait</link>
<guid>https://block385.com/why-post-quantum-cryptography-cant-wait</guid>
<description><![CDATA[ Organizations have to prepare to ensure they have cryptography in place in the post-quantum world. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc120a335b3af7fb9/69b4891a78da06d1781c112a/quantum-key-qkc-sakkmesterke-AdobeStock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 14 Mar 2026 00:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, Post-Quantum, Cryptography, Cant, Wait</media:keywords>
</item>

<item>
<title>The Data Gap: Why Nonprofit Cyber Incidents Go Underreported</title>
<link>https://block385.com/the-data-gap-why-nonprofit-cyber-incidents-go-underreported</link>
<guid>https://block385.com/the-data-gap-why-nonprofit-cyber-incidents-go-underreported</guid>
<description><![CDATA[ Threat actors target nonprofits due to security gaps and highly coveted information, but a lack of sufficient data makes it difficult to grasp the entire picture. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltca9a638d5179c87d/69b451ed1045ce42f1fbcbf7/AHHC42.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 14 Mar 2026 00:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Data, Gap:, Why, Nonprofit, Cyber, Incidents, Underreported</media:keywords>
</item>

<item>
<title>Cyberattackers Don&amp;apos;t Care About Good Causes</title>
<link>https://block385.com/cyberattackers-dont-care-about-good-causes</link>
<guid>https://block385.com/cyberattackers-dont-care-about-good-causes</guid>
<description><![CDATA[ Sightline Security&#039;s founder and advisory board discuss how cybersecurity poses significant problems for nonprofits and suggest ways the industry can help. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt11c9b8a6724cfae3/69b44a5923ae8474cdda186a/FRWRK1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 14 Mar 2026 00:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cyberattackers, Dont, Care, About, Good, Causes</media:keywords>
</item>

<item>
<title>Fake PoCs, Misunderstood Risks Cause Cisco SD&#45;WAN Chaos</title>
<link>https://block385.com/fake-pocs-misunderstood-risks-cause-cisco-sd-wan-chaos</link>
<guid>https://block385.com/fake-pocs-misunderstood-risks-cause-cisco-sd-wan-chaos</guid>
<description><![CDATA[ The excitement around Cisco&#039;s latest SD-WAN bugs has inspired some light fraud, misunderstandings, and overlooked risks. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltb8b697e643980aba/69b45a7c25d96d489066faf0/Cisco_Heat-ArcadeImages-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 22:00:02 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fake, PoCs, Misunderstood, Risks, Cause, Cisco, SD-WAN, Chaos</media:keywords>
</item>

<item>
<title>Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware</title>
<link>https://block385.com/chinese-hackers-target-southeast-asian-militaries-with-applechris-and-memfun-malware</link>
<guid>https://block385.com/chinese-hackers-target-southeast-asian-militaries-with-applechris-and-memfun-malware</guid>
<description><![CDATA[ A suspected China-based cyber espionage operation has targeted Southeast Asian military organizations as part of a state-sponsored campaign that dates back to at least 2020.
Palo Alto Networks Unit 42 is tracking the threat activity under the moniker CL-STA-1087, where CL refers to cluster, and STA stands for state-backed motivation.
&quot;The activity demonstrated strategic operational patience and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzrOk1hLgfo5WibM8DV2JEqpyhy4SAs-pmNPJ9lflvC8CLCTEGabnzpAk9XlUmyY3EmJI-_SnGCqDA4C-A1nwD7LKbC6SCiAyTziw9KtzqZWYkARHbidARtOH-SxtUh80Cy3WJrKRR_U1E2ETOr72gQGAEhTaM1WHTm-vTDwru1ypZmmMBlC6fmVQp6IPL/s1600/dll.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 19:30:14 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Chinese, Hackers, Target, Southeast, Asian, Militaries, with, AppleChris, and, MemFun, Malware</media:keywords>
</item>

<item>
<title>Meta to Shut Down Instagram End&#45;to&#45;End Encrypted Chat Support Starting May 2026</title>
<link>https://block385.com/meta-to-shut-down-instagram-end-to-end-encrypted-chat-support-starting-may-2026</link>
<guid>https://block385.com/meta-to-shut-down-instagram-end-to-end-encrypted-chat-support-starting-may-2026</guid>
<description><![CDATA[ Meta has announced plans to discontinue support for end-to-end encryption (E2EE) for chats on Instagram after May 8, 2026.
&quot;If you have chats that are impacted by this change, you will see instructions on how you can download any media or messages you may want to keep,&quot; the social media giant said in a help document. &quot;If you&#039;re on an older version of Instagram, you may also need to update the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgw1H50jEav77qEtezzwtuvWZF5YuaWWn_kwLx0sOZn8SBXFrcsqI5fwRoubG8lKN5T3xX_L5nLkfuQl-lavBiPJVvzZKZyK_KC_SjMJPJBVRGiTqxRJ0cbwxWyMban16y1KTNLeRzbesp_cxbpbd2gB8mxKSfV3pgO66kQf3xoLDFQB7MpH3vNRhYYjeyw/s1600/instagram.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 19:30:14 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Meta, Shut, Down, Instagram, End-to-End, Encrypted, Chat, Support, Starting, May, 2026</media:keywords>
</item>

<item>
<title>INTERPOL Dismantles 45,000 Malicious IPs, Arrests 94 in Global Cybercrime</title>
<link>https://block385.com/interpol-dismantles-45000-malicious-ips-arrests-94-in-global-cybercrime</link>
<guid>https://block385.com/interpol-dismantles-45000-malicious-ips-arrests-94-in-global-cybercrime</guid>
<description><![CDATA[ INTERPOL on Friday announced the takedown of 45,000 malicious IP addresses and servers used in connection with phishing, malware, and ransomware campaigns, as part of the agency&#039;s ongoing efforts to dismantle criminal networks, disrupt emerging threats, and safeguard victims from scams.
The effort is part of an international law enforcement operation that involved 72 countries and territories. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwam91c_LDbgwJb9W7Op3ENyT1BX3vzALg2WSk7s8J1QFMNYVES8F_i1KqCw-jCad0-64HTyo9EmVMEkd0jOoZaTWQFVO57DOBtx7x1PJqCepEYivGHLu_IAkCzBlzrx91izrAJ3NRMpXNvU2JOplVI3Gr7cusWU85AF9h_UoAIE3PGV2M2wG6M4J5yC_X/s1600/interpol.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 17:30:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>INTERPOL, Dismantles, 45, 000, Malicious, IPs, Arrests, Global, Cybercrime</media:keywords>
</item>

<item>
<title>Storm&#45;2561 Spreads Trojan VPN Clients via SEO Poisoning to Steal Credentials</title>
<link>https://block385.com/storm-2561-spreads-trojan-vpn-clients-via-seo-poisoning-to-steal-credentials</link>
<guid>https://block385.com/storm-2561-spreads-trojan-vpn-clients-via-seo-poisoning-to-steal-credentials</guid>
<description><![CDATA[ Microsoft has disclosed details of a credential theft campaign that employs fake virtual private network (VPN) clients distributed through search engine optimization (SEO) poisoning techniques.
&quot;The campaign redirects users searching for legitimate enterprise software to malicious ZIP files on attacker-controlled websites to deploy digitally signed trojans that masquerade as trusted VPN clients ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIHmOuzh2pt4Kd3D5FVJ3ryojQF5XMf6q51cdyxus7nMy4suicQ1RNW3_sjRA6OgE3H-JXTOoxz9wwMqEZQbJb9SXS7DOYTVUBK1MszgQoAR6rGGTgunHDAKM7NfOTkK-W2U9_5rT0Un6xn-cwMnGipbokPav0UoDL7eyQkKIrrKwa2h0BgCFqwuZe598R/s1600/vpn-download.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 17:30:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Storm-2561, Spreads, Trojan, VPN, Clients, via, SEO, Poisoning, Steal, Credentials</media:keywords>
</item>

<item>
<title>Will AI Save Consumers From Smartphone&#45;Based Phishing Attacks?</title>
<link>https://block385.com/will-ai-save-consumers-from-smartphone-based-phishing-attacks</link>
<guid>https://block385.com/will-ai-save-consumers-from-smartphone-based-phishing-attacks</guid>
<description><![CDATA[ Sophisticated phishing attacks are bypassing on-device protections with troubling frequency, making it more critical than ever for users to protect themselves from potential threats, new research from Omdia shows. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt92bbd581a26f98dc/69b314eb2c4f15f849268d6e/fish_hook_with_money_Maria_Dryfhout_Alamy_Stock_Photo.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 16:00:05 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Will, Save, Consumers, From, Smartphone-Based, Phishing, Attacks</media:keywords>
</item>

<item>
<title>Most Google Cloud Attacks Start With Bug Exploitation</title>
<link>https://block385.com/most-google-cloud-attacks-start-with-bug-exploitation</link>
<guid>https://block385.com/most-google-cloud-attacks-start-with-bug-exploitation</guid>
<description><![CDATA[ Forget stolen credentials and misconfigurations; AI means vulnerability exploits that beat patching cycles are the top cause of compromises in the cloud. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltce1b28d3805840ac/69b32c68d73e49322916d5a6/cloud-lightning-Athapet_Piruksa-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 16:00:05 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Most, Google, Cloud, Attacks, Start, With, Bug, Exploitation</media:keywords>
</item>

<item>
<title>What Orgs Can Learn From Olympics, World Cup IR Plans</title>
<link>https://block385.com/what-orgs-can-learn-from-olympics-world-cup-ir-plans</link>
<guid>https://block385.com/what-orgs-can-learn-from-olympics-world-cup-ir-plans</guid>
<description><![CDATA[ In this Reporters&#039; Notebook, we discuss cyberattackers targeting the Milan-Cortina Winter Games, adding them to a long list of global sporting events in the crosshairs. Though the attack surface is grander, there are key defense takeaways for regular enterprises too. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd4524e56ac3766e3/69b26b0a0d7dd2cd26ed0da3/olympics1800_SJBright_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 16:00:05 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>What, Orgs, Can, Learn, From, Olympics, World, Cup, Plans</media:keywords>
</item>

<item>
<title>Investigating a New Click&#45;Fix Variant</title>
<link>https://block385.com/investigating-a-new-click-fix-variant</link>
<guid>https://block385.com/investigating-a-new-click-fix-variant</guid>
<description><![CDATA[ Disclaimer: This report has been prepared by the Threat Research Center to enhance cybersecurity awareness and support the strengthening of defense capabilities. It is based on independent research and observations of the current threat landscape available at the time of publication. The content is intended for informational and preparedness purposes only.
Read more blogs around threat ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAy3Jm9mBV4SvNdfv5AJ_ZIKoJSwtUVeXkiFUNwKFUN3F5j3kYJTpD1a65PEcgqX2cMT0DmtJJ7YCrYuhElQ9nhYtQkXRtQxnkpOqTgSUOCAJgO8Lv8HDWZxVuy74vgjErtUYrHPH-UrWLfLoL18i__L9a-6T1xdgMPjsTamIOab3KGcJE3kzxz5aR8tm8/s1600/eviden.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 15:30:14 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Investigating, New, Click-Fix, Variant</media:keywords>
</item>

<item>
<title>EU Parliament backs extension of CSAM detection rules until 2027</title>
<link>https://block385.com/eu-parliament-backs-extension-of-csam-detection-rules-until-2027</link>
<guid>https://block385.com/eu-parliament-backs-extension-of-csam-detection-rules-until-2027</guid>
<description><![CDATA[ The European Parliament has voted to extend a temporary exemption to EU privacy legislation that allows online platforms to voluntarily detect child sexual abuse material (CSAM). The extension prolongs a derogation from the EU’s ePrivacy Directive, which was set to expire on 3 April 2026, until 3 August 2027. Lawmakers say the additional time will allow the EU to negotiate and adopt a permanent legal framework to prevent and combat child sexual abuse online. Members … More →
The post EU Parliament backs extension of CSAM detection rules until 2027 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/06/05105926/europe-1500-3.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 14:00:19 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Parliament, backs, extension, CSAM, detection, rules, until, 2027</media:keywords>
</item>

<item>
<title>Accertify’s Attack State targets credential stuffing and ATO attacks</title>
<link>https://block385.com/accertifys-attack-state-targets-credential-stuffing-and-ato-attacks</link>
<guid>https://block385.com/accertifys-attack-state-targets-credential-stuffing-and-ato-attacks</guid>
<description><![CDATA[ Accertify has announced the launch of Attack State, a new capability in its Account Protection solution designed to help organizations detect and respond to coordinated login attacks and other automated threats targeting customer accounts. Attack State analyzes login activity continuously and compares it to the organization’s broader traffic patterns to determine when a client’s environment may be under active attack. By comparing expected network behavior with real-time activity, the capability identifies anomalies associated with bot-driven … More →
The post Accertify’s Attack State targets credential stuffing and ATO attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 14:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Accertify’s, Attack, State, targets, credential, stuffing, and, ATO, attacks</media:keywords>
</item>

<item>
<title>Real&#45;Time Banking Trojan Strikes Brazil&amp;apos;s Pix Users</title>
<link>https://block385.com/real-time-banking-trojan-strikes-brazils-pix-users</link>
<guid>https://block385.com/real-time-banking-trojan-strikes-brazils-pix-users</guid>
<description><![CDATA[ The latest banking Trojan campaign to hit Brazil combines classic malware with a real-time human operator, waiting for the perfect moment to strike. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt85476f1678dce95b/69b30d03e135797c5ce84029/Pix_Logo_Rafael_Henrique_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 14:00:04 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Real-Time, Banking, Trojan, Strikes, Brazils, Pix, Users</media:keywords>
</item>

<item>
<title>Authorities dismantle SocksEscort proxy network behind millions in fraud</title>
<link>https://block385.com/authorities-dismantle-socksescort-proxy-network-behind-millions-in-fraud</link>
<guid>https://block385.com/authorities-dismantle-socksescort-proxy-network-behind-millions-in-fraud</guid>
<description><![CDATA[ SocksEscort, a residential proxy network used to exploit thousands of compromised home routers worldwide and facilitate large-scale fraud that cost victims millions of dollars, has been disrupted in an international law enforcement operation led by the U.S. Department of Justice. The domain seizure notice Law enforcement agencies seized 34 domains and 23 servers located in seven countries during the operation, Europol said. U.S. authorities also froze about $3.5 million in cryptocurrency linked to the network. … More →
The post Authorities dismantle SocksEscort proxy network behind millions in fraud appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/02/16114335/usa-doj-1400-1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 12:00:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Authorities, dismantle, SocksEscort, proxy, network, behind, millions, fraud</media:keywords>
</item>

<item>
<title>Google Fixes Two Chrome Zero&#45;Days Exploited in the Wild Affecting Skia and V8</title>
<link>https://block385.com/google-fixes-two-chrome-zero-days-exploited-in-the-wild-affecting-skia-and-v8</link>
<guid>https://block385.com/google-fixes-two-chrome-zero-days-exploited-in-the-wild-affecting-skia-and-v8</guid>
<description><![CDATA[ Google on Thursday released security updates for its Chrome web browser to address two high-severity vulnerabilities that it said have been exploited in the wild.
The list of vulnerabilities is as follows -

CVE-2026-3909 (CVSS score: 8.8) - An out-of-bounds write vulnerability in the Skia 2D graphics library that allows a remote attacker to perform out-of-bounds memory access via a crafted HTML ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjV6RqjIMz8KqPQlA1cIBNewRR0jZi7h-6Hs9JFjyV_wT8SKGcY_CP6J-DsPjP1eFKUYDQIJ8wztGrSmiD3HSopChiVBV1mLfYcoZolAxeFL-bRHV79PuCEC1sQQE3KMz9u8c8jFx4WXL62e6KXGYcivKjnyTiuvFj7BYXNaPrbXACyCvTb1Y9xpfYvq-AK/s1600/chrome-exploit.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 11:30:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Fixes, Two, Chrome, Zero-Days, Exploited, the, Wild, Affecting, Skia, and</media:keywords>
</item>

<item>
<title>Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation</title>
<link>https://block385.com/nine-crackarmor-flaws-in-linux-apparmor-enable-root-escalation-bypass-container-isolation</link>
<guid>https://block385.com/nine-crackarmor-flaws-in-linux-apparmor-enable-root-escalation-bypass-container-isolation</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed multiple security vulnerabilities within the Linux kernel&#039;s AppArmor module that could be exploited by unprivileged users to circumvent kernel protections, escalate to root, and undermine container isolation guarantees.
The nine confused deputy vulnerabilities have been collectively codenamed CrackArmor by the Qualys Threat Research Unit (TRU). The ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjq_iDZMyZB2yYcYrlFVa1dJoHT3mV0d9HfTPEpKmflkN-4zBDaSNIurPPADFGUW9GfTfMaCDlwUb6ywLpKiQa5CtSGSC6sPJIqfe-gRWhUa_z1B6Obazf_U5NuRX-ruWpomgMJQqcjD7XPeoyhgbVplGYCX3zQKFKmSIf0iSBwoUXhuE1ZZeZns9-fMlNr/s1600/linux-root.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 11:30:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Nine, CrackArmor, Flaws, Linux, AppArmor, Enable, Root, Escalation, Bypass, Container, Isolation</media:keywords>
</item>

<item>
<title>Red Access firewall&#45;native SSE adds GenAI security and browser protection to existing firewalls</title>
<link>https://block385.com/red-access-firewall-native-sse-adds-genai-security-and-browser-protection-to-existing-firewalls</link>
<guid>https://block385.com/red-access-firewall-native-sse-adds-genai-security-and-browser-protection-to-existing-firewalls</guid>
<description><![CDATA[ Red Access has announced firewall-native SSE, an agentless cloud layer that instantly upgrades any existing firewall with Security Service Edge (SSE), GenAI security, and browser-agnostic protection. Deployed directly on top of existing architecture, the firewall-native SSE eliminates the need for rip-and-replace projects, accelerating deployment while reducing operational overhead without compromising user experience. “Secure enterprise browsing solutions sit at the intersection of user, device, and web resources to enforce security policies,” said Andrew Green, Networking &amp; … More →
The post Red Access firewall-native SSE adds GenAI security and browser protection to existing firewalls appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 10:00:12 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Red, Access, firewall-native, SSE, adds, GenAI, security, and, browser, protection, existing, firewalls</media:keywords>
</item>

<item>
<title>BioCatch DeviceIQ helps banks spot risky devices before login</title>
<link>https://block385.com/biocatch-deviceiq-helps-banks-spot-risky-devices-before-login</link>
<guid>https://block385.com/biocatch-deviceiq-helps-banks-spot-risky-devices-before-login</guid>
<description><![CDATA[ BioCatch has announced the launch of DeviceIQ, a comprehensive new device identification and intelligence product that transforms how financial institutions evaluate the trustworthiness of devices used for digital banking. Traditional device identification has grown increasingly unreliable. Criminals utilize sophisticated evasion techniques (emulators, device spoofing, cloaked browsers, jailbroken devices, and data-wiping) to commit fraud repeatedly from the same physical devices. New technologies like agentic browsers add another layer of complexity by separating a user’s actions from … More →
The post BioCatch DeviceIQ helps banks spot risky devices before login appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 10:00:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>BioCatch, DeviceIQ, helps, banks, spot, risky, devices, before, login</media:keywords>
</item>

<item>
<title>Authorities Disrupt SocksEscort Proxy Botnet Exploiting 369,000 IPs Across 163 Countries</title>
<link>https://block385.com/authorities-disrupt-socksescort-proxy-botnet-exploiting-369000-ips-across-163-countries</link>
<guid>https://block385.com/authorities-disrupt-socksescort-proxy-botnet-exploiting-369000-ips-across-163-countries</guid>
<description><![CDATA[ A court-authorized international law enforcement operation has dismantled a criminal proxy service named SocksEscort that enslaved thousands of residential routers worldwide into a botnet for committing large-scale fraud.
&quot;SocksEscort infected home and small business internet routers with malware,&quot; the U.S. Department of Justice (DoJ) said. &quot;The malware allowed SocksEscort to direct internet ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVzS5AAXyP_Q8mGS7-ZejQUI5zUDhpgZ64cEqrWMzNKqSKhI1ruMBwk3fI_eOC0LA8CvuiQQjDlWbFm8PXgUilTaauAIv2pC5rM6pnZBLRqpE9AifLnZTbkkF4dXLf9Ngr30qtvowTYLqbH2sPF6sd6mgA74AbHqtZ9dVhjvvMW68luK5nuNCWbe3ftuLG/s1600/router.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 09:30:11 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Authorities, Disrupt, SocksEscort, Proxy, Botnet, Exploiting, 369, 000, IPs, Across, 163, Countries</media:keywords>
</item>

<item>
<title>New infosec products of the week: March 13, 2026</title>
<link>https://block385.com/new-infosec-products-of-the-week-march-13-2026</link>
<guid>https://block385.com/new-infosec-products-of-the-week-march-13-2026</guid>
<description><![CDATA[ Here’s a look at the most interesting products from the past week, featuring releases from Binary Defense, Mend.io, OPSWAT, Singulr AI, SOC Prime, Terra Security, and Vicarius. Singulr AI’s Agent Pulse delivers enforceable runtime governance and visibility for AI agents Singulr AI has announced the launch of Agent Pulse, extending its Unified AI Control Plane to autonomous AI agents and model context protocol (MCP) servers. Agent Pulse delivers enforceable runtime governance, contextual discovery, and measurable … More →
The post New infosec products of the week: March 13, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/28091843/infosec-week-1200.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 08:00:24 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, infosec, products, the, week:, March, 13, 2026</media:keywords>
</item>

<item>
<title>Passwords, MFA, and why neither is enough</title>
<link>https://block385.com/passwords-mfa-and-why-neither-is-enough</link>
<guid>https://block385.com/passwords-mfa-and-why-neither-is-enough</guid>
<description><![CDATA[ Passwords weren’t enough, so we added MFA. Now MFA isn’t enough either. In this Help Net Security video, Karlo Zatylny, CTO/CISO at Portnox, walks through why each layer of identity security has failed and what comes next. SMS codes can be intercepted through SIM swapping. Authenticator apps are vulnerable to replay attacks and push bombing. And even when MFA works correctly, session hijacking can let attackers impersonate a user after authentication is complete. The solution … More →
The post Passwords, MFA, and why neither is enough appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/04/29143955/mfa.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 08:00:17 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Passwords, MFA, and, why, neither, enough</media:keywords>
</item>

<item>
<title>AI coding agents keep repeating decade&#45;old security mistakes</title>
<link>https://block385.com/ai-coding-agents-keep-repeating-decade-old-security-mistakes</link>
<guid>https://block385.com/ai-coding-agents-keep-repeating-decade-old-security-mistakes</guid>
<description><![CDATA[ Coding agents are now writing production features on real development teams, and a new report from DryRun Security shows that those agents introduce security vulnerabilities at a high rate across nearly every type of application they build. “AI coding agents can produce working software at incredible speed, but security isn’t part of their default thinking,” said James Wickett, CEO of DryRun Security. “In our usage and experience, AI coding agents often missed adding security components … More →
The post AI coding agents keep repeating decade-old security mistakes appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/11092011/code-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 08:00:09 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>coding, agents, keep, repeating, decade-old, security, mistakes</media:keywords>
</item>

<item>
<title>Veeam Patches 7 Critical Backup &amp;amp; Replication Flaws Allowing Remote Code Execution</title>
<link>https://block385.com/veeam-patches-7-critical-backup-replication-flaws-allowing-remote-code-execution</link>
<guid>https://block385.com/veeam-patches-7-critical-backup-replication-flaws-allowing-remote-code-execution</guid>
<description><![CDATA[ Veeam has released security updates to address multiple critical vulnerabilities in its Backup &amp; Replication software that, if successfully exploited, could result in remote code execution.
The vulnerabilities are as follows -

CVE-2026-21666 (CVSS score: 9.9) - A vulnerability that allows an authenticated domain user to perform remote code execution on the Backup Server.
CVE-2026-21667 ( ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVixoCttO0Li1BNrJG6s8rsycHEzgVh52YFA_RHnrq4QMjt3fPQuKCJfw8rqCMZtgrSGrXxpPvTyhWQ_rD0D44_3TvBfNC0Eq_VRSWIqDFpDFdKdHMwQIidTX8E4Kc4iiWt3xcwhW_YC8oKLTZFMWN-uyCUjtIavnhXRHbs3gJOLuTUI1zg79tkK4gpsaQ/s1600/veeam.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 13 Mar 2026 07:30:08 +0100</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Veeam, Patches, Critical, Backup, Replication, Flaws, Allowing, Remote, Code, Execution</media:keywords>
</item>

</channel>
</rss>