<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
     xmlns:dc="http://purl.org/dc/elements/1.1/"
     xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
     xmlns:admin="http://webns.net/mvcb/"
     xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
     xmlns:content="http://purl.org/rss/1.0/modules/content/"
     xmlns:media="http://search.yahoo.com/mrss/">
<channel>
<title>Latest News on Technology, Cryptocurrency, AI, and Cyber Security &#45; : Cyber Security</title>
<link>https://block385.com/rss/category/cybernews</link>
<description>Latest News on Technology, Cryptocurrency, AI, and Cyber Security &#45; : Cyber Security</description>
<dc:language>en</dc:language>
<dc:rights>2026 Block385.com</dc:rights>

<item>
<title>Researchers Uncover Pre&#45;Stuxnet ‘fast16’ Malware Targeting Engineering Software</title>
<link>https://block385.com/researchers-uncover-pre-stuxnet-fast16-malware-targeting-engineering-software</link>
<guid>https://block385.com/researchers-uncover-pre-stuxnet-fast16-malware-targeting-engineering-software</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a new Lua-based malware created years before the notorious Stuxnet worm that aimed to sabotage Iran&#039;s nuclear program by destroying uranium enrichment centrifuges.
According to a new report published by SentinelOne, the previously undocumented cyber sabotage framework dates back to 2005, primarily targeting high-precision calculation software to tamper ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizs_g3Pi3X0KEIbHkq8WujTF9X1RE6Fu_p8CiWmZrjsBj0MK-OTgAj5Dn8hz_8-n_3KmkNhFYDHeKUxeAnJv3nWdqwu5XlKsUEC0yq-uOESR7HkzKLJ1-FdrJtyBy05M0NZ4HkrXZ_eCvCSEX3Y4jauh6A4loJ_gY-F5aOT39ZMn4noffniWz8VgIv1zA2/s1600/fast16-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 25 Apr 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, Uncover, Pre-Stuxnet, ‘fast16’, Malware, Targeting, Engineering, Software</media:keywords>
</item>

<item>
<title>CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline</title>
<link>https://block385.com/cisa-adds-4-exploited-flaws-to-kev-sets-may-2026-federal-deadline</link>
<guid>https://block385.com/cisa-adds-4-exploited-flaws-to-kev-sets-may-2026-federal-deadline</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added four vulnerabilities impacting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X series routers to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The list of vulnerabilities is below -

CVE-2024-57726 (CVSS score: 9.9) - A missing authorization vulnerability in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgBMgO4j_Nf0B9HdU4WtN1axBdJFNJgV6Xvb8pCk0kooK6_-gNIxfURSqLIJuuzaufzvoXVTkFFg9WfMkyHvu4h_DBQK4QMJ21JYdwWtLem-CSOgTEYFhXazp4aSPJJglbiZel1V5aatqMKFCXk3scw-3UmMzQPrmTn-CbgBBjpLu_i4TBfNyS2kgZSkreW/s1600/cisa-kev.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 25 Apr 2026 08:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Adds, Exploited, Flaws, KEV, Sets, May, 2026, Federal, Deadline</media:keywords>
</item>

<item>
<title>Indirect prompt injection is taking hold in the wild</title>
<link>https://block385.com/indirect-prompt-injection-is-taking-hold-in-the-wild</link>
<guid>https://block385.com/indirect-prompt-injection-is-taking-hold-in-the-wild</guid>
<description><![CDATA[ The open web is slowly but surely filling up with “traps” designed for LLM-powered AI agents. The technique, known as indirect prompt injection (IPI), involves hiding (more or less) covert instructions inside ordinary web pages, waiting for an AI agent to read them and carry out the author’s commands. The IPI attack kill chain (Source: Forcepoint) “Ignore previous instructions” In back-to-back reports published this week, Google and Forcepoint researchers laid out real-world evidence of these … More →
The post Indirect prompt injection is taking hold in the wild appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/08/28142151/agentic-ai-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 23:00:26 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Indirect, prompt, injection, taking, hold, the, wild</media:keywords>
</item>

<item>
<title>Users advised to drop passwords and make room for passkeys</title>
<link>https://block385.com/users-advised-to-drop-passwords-and-make-room-for-passkeys</link>
<guid>https://block385.com/users-advised-to-drop-passwords-and-make-room-for-passkeys</guid>
<description><![CDATA[ In a decisive move that could reshape how users log in online, the National Cyber Security Centre (NCSC) is urging consumers to abandon passwords in favour of passkeys, positioning them as the future of authentication. “Passkeys should become consumers’ first choice for logging into digital services,” NCSC said. Overhauling decades of security guidance, the agency will no longer recommend passwords where passkeys are available, citing their weaker resistance to current cyber threats. Since most breaches … More →
The post Users advised to drop passwords and make room for passkeys appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/25153052/passkeys-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 23:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Users, advised, drop, passwords, and, make, room, for, passkeys</media:keywords>
</item>

<item>
<title>US Busts Myanmar Ring Targeting US Citizens in Financial Fraud</title>
<link>https://block385.com/us-busts-myanmar-ring-targeting-us-citizens-in-financial-fraud</link>
<guid>https://block385.com/us-busts-myanmar-ring-targeting-us-citizens-in-financial-fraud</guid>
<description><![CDATA[ Some 29 people were charged, including a Cambodian senator, and authorities seized more than 500 Web domains tied to fake investment sites. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt798fb98cb0e72278/69eba133172e119ab194fef8/SE_Asia-slegers_hans-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Busts, Myanmar, Ring, Targeting, Citizens, Financial, Fraud</media:keywords>
</item>

<item>
<title>FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches</title>
<link>https://block385.com/firestarter-backdoor-hit-federal-cisco-firepower-device-survives-security-patches</link>
<guid>https://block385.com/firestarter-backdoor-hit-federal-cisco-firepower-device-survives-security-patches</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has revealed that an unnamed federal civilian agency&#039;s Cisco Firepower device running Adaptive Security Appliance (ASA) software was compromised in September 2025 with malware called FIRESTARTER.
FIRESTARTER, per CISA and the U.K.&#039;s National Cyber Security Centre (NCSC), is assessed to be a backdoor designed for remote access and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhL39ca_K84pnKcPSv77aXouF3t3HCOjjL1zFVEdeDE64LiUxQ2Het8xQeTeO0JZRHZE56SbG87psVmhYCbSyu5PE3FZiHrAIzm0zp8nfGKk7XwVTUUjpeZ7zDEZwuJaQkZp6Cl20WF7qkWDAuaOQW5-OtTQ1ZvjW4xhHB9HrC2O-C6pPPnE94gLqp1GZrI/s1600/cisco.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 20:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FIRESTARTER, Backdoor, Hit, Federal, Cisco, Firepower, Device, Survives, Security, Patches</media:keywords>
</item>

<item>
<title>Glasswing Secured the Code. The Rest of Your Stack Is Still on You</title>
<link>https://block385.com/glasswing-secured-the-code-the-rest-of-your-stack-is-still-on-you</link>
<guid>https://block385.com/glasswing-secured-the-code-the-rest-of-your-stack-is-still-on-you</guid>
<description><![CDATA[ Forgotten integrations, shadow IT, SaaS, and now shadow AI and agents are everywhere, and attackers don&#039;t need sophisticated AI models to take advantage. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6fceb678bad33d92/69eace49fd15051754836a22/Glasswing_Casimiro_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 19:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Glasswing, Secured, the, Code., The, Rest, Your, Stack, Still, You</media:keywords>
</item>

<item>
<title>NASA Employees Duped in Chinese Phishing Scheme Targeting U.S. Defense Software</title>
<link>https://block385.com/nasa-employees-duped-in-chinese-phishing-scheme-targeting-us-defense-software</link>
<guid>https://block385.com/nasa-employees-duped-in-chinese-phishing-scheme-targeting-us-defense-software</guid>
<description><![CDATA[ The Office of Inspector General (OIG) of the U.S. National Aeronautics and Space Administration (NASA) has revealed how a Chinese national posed as a U.S. researcher as part of a spear-phishing campaign to obtain sensitive information from the space agency, as well as from government entities, universities, and private companies, in violation of export control laws.
&quot;For years, NASA employees ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHAuHNFOxvs6UDl3EnaRiFcpN6xXjeqMCeudHBwRKzbIoUCdno0MHlfe2ijlnYU7D5k0vi4nlhv9j_hkR4zeaHTq2xewCOVza2_qYZZxpy_Qy1V_IQu5nO5lDyGzeG3P_B5kSbGT5W01Ic0E_FuSlWat1zsWYCDHhYbqQ_S5Q8p1WO14UStW8EJ4PIkKuX/s1600/WANTED.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 18:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NASA, Employees, Duped, Chinese, Phishing, Scheme, Targeting, U.S., Defense, Software</media:keywords>
</item>

<item>
<title>AI Phishing Is No. 1 With a Bullet for Cyberattackers</title>
<link>https://block385.com/ai-phishing-is-no-1-with-a-bullet-for-cyberattackers</link>
<guid>https://block385.com/ai-phishing-is-no-1-with-a-bullet-for-cyberattackers</guid>
<description><![CDATA[ In the past six months, companies have seen a significant influx of AI-powered phishing, as cyberattackers progress from small campaigns to 1-to-1 personalized attacks. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 17:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Phishing, No., With, Bullet, for, Cyberattackers</media:keywords>
</item>

<item>
<title>North Korea&amp;apos;s Lazarus Targets macOS Users via ClickFix</title>
<link>https://block385.com/north-koreas-lazarus-targets-macos-users-via-clickfix</link>
<guid>https://block385.com/north-koreas-lazarus-targets-macos-users-via-clickfix</guid>
<description><![CDATA[ Lazarus continues leveraging ClickFix for initial access and data theft, in this case, against Mac-centric organizations and their high-value leaders. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt955244a1688ad92a/69ea733c149efc64d46724f4/Mouse_click_Alexey_Stiop_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 15:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>North, Koreas, Lazarus, Targets, macOS, Users, via, ClickFix</media:keywords>
</item>

<item>
<title>Bridging the AI Agent Authority Gap: Continuous Observability as the Decision Engine</title>
<link>https://block385.com/bridging-the-ai-agent-authority-gap-continuous-observability-as-the-decision-engine</link>
<guid>https://block385.com/bridging-the-ai-agent-authority-gap-continuous-observability-as-the-decision-engine</guid>
<description><![CDATA[ The AI Agent Authority Gap - From Ungoverned to Delegation
As discussed in our previous article, AI agents are exposing a structural gap in enterprise security, but the problem is often framed too narrowly.
The issue is not simply that agents are new actors. It is that agents are delegated actors. They do not emerge with independent authority. They are triggered, invoked, provisioned, or ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZTTjYlof51AlGz6c8vyYmpqVPODX_zgUiWkJ-Mgq8a5d6pfOrUQqgu2A7H3dIcv7k4_AYSTxitHZiCxve_l8QG-zLLqgkLLdudvwjASI7p3CUtk6O0rntkr_mDPcUK66NPMoGEVWvS1mMKFzNKpRTAN2Wv9jLdLwcOlNAtlqfLCSCKpqHldT1e9AnnD0/s1600/or.gif" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bridging, the, Agent, Authority, Gap:, Continuous, Observability, the, Decision, Engine</media:keywords>
</item>

<item>
<title>26 FakeWallet Apps Found on Apple App Store Targeting Crypto Seed Phrases</title>
<link>https://block385.com/26-fakewallet-apps-found-on-apple-app-store-targeting-crypto-seed-phrases</link>
<guid>https://block385.com/26-fakewallet-apps-found-on-apple-app-store-targeting-crypto-seed-phrases</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a set of malicious apps on the Apple App Store that impersonate popular cryptocurrency wallets in an attempt to steal recovery phrases and private keys since at least fall 2025.
&quot;Once launched, these apps redirect users to browser pages designed to look similar to the App Store and distribute trojanized versions of legitimate wallets,&quot; Kaspersky ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFcKlAJD87JqpQgBraCHiotcX52rMft8iVqUuhlFlU-NTgMxjYfB2UQ0WLUbQ7yR_qCy9kvXJDFbZEHe10gEEOSUcKcUY6arDzLhyurrKlngubO7Lulc_nSHthxHv7WXqma34SDUl4o_F9Zw9N-1GQnTsxo3v-jO8eWTvRCx8hHmf5EaLCZMknYfMGpfcP/s1600/iphone.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FakeWallet, Apps, Found, Apple, App, Store, Targeting, Crypto, Seed, Phrases</media:keywords>
</item>

<item>
<title>With AI’s help, North Korean hackers stumbled into a near&#45;undetectable attack</title>
<link>https://block385.com/with-ais-help-north-korean-hackers-stumbled-into-a-near-undetectable-attack</link>
<guid>https://block385.com/with-ais-help-north-korean-hackers-stumbled-into-a-near-undetectable-attack</guid>
<description><![CDATA[ For many years, state-sponsored hacking was defined by human expertise in finding security holes, writing malware and exploits, pulling off social engineering and phishing attacks, and much more. Since the advent of LLM-powered AI assistants and tools, less skilled attackers have been able to carry out attacks and compromises that might otherwise have been out of their reach. Case in point: HexagonalRodent. According to Expel’s research, the group makes heavy use of generative AI, with … More →
The post With AI’s help, North Korean hackers stumbled into a near-undetectable attack appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23110249/north_korea-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:59 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>With, AI’s, help, North, Korean, hackers, stumbled, into, near-undetectable, attack</media:keywords>
</item>

<item>
<title>Where AI in CI/CD is working for engineering teams</title>
<link>https://block385.com/where-ai-in-cicd-is-working-for-engineering-teams</link>
<guid>https://block385.com/where-ai-in-cicd-is-working-for-engineering-teams</guid>
<description><![CDATA[ Developers have folded AI into daily coding work. Still, the same tools remain largely absent from the systems that validate and ship software. New research from JetBrains points to a widening gap between how engineers write code on their own machines and what runs inside continuous integration and delivery pipelines. Daily coding use climbs past 90% Workplace use of AI among developers exceeds 90%. The figure comes from three JetBrains studies: the AI Pulse survey … More →
The post Where AI in CI/CD is working for engineering teams appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23154258/devel.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:58 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Where, CICD, working, for, engineering, teams</media:keywords>
</item>

<item>
<title>IT spending to hit $6.31 trillion record, thanks to AI</title>
<link>https://block385.com/it-spending-to-hit-631-trillion-record-thanks-to-ai</link>
<guid>https://block385.com/it-spending-to-hit-631-trillion-record-thanks-to-ai</guid>
<description><![CDATA[ Global spending on IT is expected to reach $6.31 trillion in 2026, according to the latest quarterly forecast from Gartner, marking a 13.5% increase from the previous year. The forecast shows that growth is spread across all major segments, though not evenly. Much of the increase is tied to ongoing investment in AI, particularly in the infrastructure needed to support it, such as servers, data centers, and specialized hardware. “This latest forecast underscores the accelerating … More →
The post IT spending to hit $6.31 trillion record, thanks to AI appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23143436/money_hardware.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:57 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>spending, hit, 6.31, trillion, record, thanks</media:keywords>
</item>

<item>
<title>A study of 1,000 Android apps finds a privacy policy logging gap</title>
<link>https://block385.com/a-study-of-1000-android-apps-finds-a-privacy-policy-logging-gap</link>
<guid>https://block385.com/a-study-of-1000-android-apps-finds-a-privacy-policy-logging-gap</guid>
<description><![CDATA[ Android developers write log statements for the same reasons they always have: debugging crashes, tracing performance issues, and understanding how features behave in production. Legal and privacy teams, working from templates and regulatory checklists, draft policies describing what the app collects from users. These two workflows rarely intersect inside the same company. A new study of 1,000 Android apps shows what that disconnect looks like at scale, and the gap has implications for GDPR and … More →
The post A study of 1,000 Android apps finds a privacy policy logging gap appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23101514/android-broken-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:55 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>study, 1, 000, Android, apps, finds, privacy, policy, logging, gap</media:keywords>
</item>

<item>
<title>AI is speeding up nation&#45;state cyber programs</title>
<link>https://block385.com/ai-is-speeding-up-nation-state-cyber-programs</link>
<guid>https://block385.com/ai-is-speeding-up-nation-state-cyber-programs</guid>
<description><![CDATA[ In this Help Net Security interview, Kaja Ciglic, Senior Director, Cybersecurity Policy and Diplomacy at Microsoft, discusses how nation-state cyber programs have changed over three years. Cyber has become a core instrument of state power, integrated with military, economic, and diplomatic tools. Ciglic argues that responses like sanctions and indictments need broader strategies, including conditional economic pressure and state accountability for ransomware havens. She addresses NATO’s Article 5 ambiguity around cyber attacks and calls for … More →
The post AI is speeding up nation-state cyber programs appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23151100/kaja_ciglic-2-microsoft.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:52 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>speeding, nation-state, cyber, programs</media:keywords>
</item>

<item>
<title>OpenAI’s GPT&#45;5.5 is out with expanded cybersecurity safeguards</title>
<link>https://block385.com/openais-gpt-55-is-out-with-expanded-cybersecurity-safeguards</link>
<guid>https://block385.com/openais-gpt-55-is-out-with-expanded-cybersecurity-safeguards</guid>
<description><![CDATA[ Competition to release stronger AI models is accelerating, and just weeks after the release of GPT-5.4, OpenAI has introduced GPT-5.5, pointing to expanded safeguards in the new model. GPT-5.5 is being rolled out to Plus, Pro, Business, and Enterprise users in ChatGPT and Codex, while GPT-5.5 Pro is available to Pro, Business, and Enterprise users in ChatGPT. The models are expected to be made available through the API soon. The company said it is working … More →
The post OpenAI’s GPT-5.5 is out with expanded cybersecurity safeguards appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/23221051/gpt-55-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:50 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI’s, GPT-5.5, out, with, expanded, cybersecurity, safeguards</media:keywords>
</item>

<item>
<title>Ubuntu 26.04 LTS delivers memory&#45;safe system tools and live patching for Arm servers</title>
<link>https://block385.com/ubuntu-2604-lts-delivers-memory-safe-system-tools-and-live-patching-for-arm-servers</link>
<guid>https://block385.com/ubuntu-2604-lts-delivers-memory-safe-system-tools-and-live-patching-for-arm-servers</guid>
<description><![CDATA[ Linux distributions have spent the past few years absorbing GPU vendor toolchains, Rust-based system components, and more stringent encryption defaults. Ubuntu 26.04 LTS, codenamed Resolute Raccoon, pulls most of those threads together into a single release that will receive standard security support until April 2031. Rust moves into the system layer One of the more consequential changes in this release is the expansion of memory-safe components at the OS level. Ubuntu 26.04 LTS ships with … More →
The post Ubuntu 26.04 LTS delivers memory-safe system tools and live patching for Arm servers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/24064115/ubuntu_26_04_lts_resolute_raccoon-l.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:46 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ubuntu, 26.04, LTS, delivers, memory-safe, system, tools, and, live, patching, for, Arm, servers</media:keywords>
</item>

<item>
<title>Meta is overhauling how you sign in, manage settings, and protect your accounts</title>
<link>https://block385.com/meta-is-overhauling-how-you-sign-in-manage-settings-and-protect-your-accounts</link>
<guid>https://block385.com/meta-is-overhauling-how-you-sign-in-manage-settings-and-protect-your-accounts</guid>
<description><![CDATA[ Meta Account gives users of Meta apps and devices a simpler way to access and manage their accounts. Accounts Center will automatically be updated to a Meta Account as part of a gradual rollout over the next year. Users will be notified when the change occurs. It supports Meta technologies including Facebook, Instagram, Messenger, Threads, Meta AI, AI glasses, and Meta Quest headsets. WhatsApp can be added optionally. It is only included if it was … More →
The post Meta is overhauling how you sign in, manage settings, and protect your accounts appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/24111457/meta-place.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:38 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Meta, overhauling, how, you, sign, in, manage, settings, and, protect, your, accounts</media:keywords>
</item>

<item>
<title>New Cisco firewall malware can only be killed by pulling the plug</title>
<link>https://block385.com/new-cisco-firewall-malware-can-only-be-killed-by-pulling-the-plug</link>
<guid>https://block385.com/new-cisco-firewall-malware-can-only-be-killed-by-pulling-the-plug</guid>
<description><![CDATA[ Suspected state-sponsored attackers are using a custom backdoor to persistently compromise Cisco security devices (firewalls), the US CISA and the UK National Cyber Security Centre warned on Thusday. “The [Firestarter] malware (…) is relevant for both Cisco Firepower and Secure Firewall devices; however, CISA has only observed a successful implant of the malware in the wild on a Cisco Firepower device running ASA software,” the Cybersecurity and Infrastructure Security Agency noted. CISA also shared threat … More →
The post New Cisco firewall malware can only be killed by pulling the plug appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/04/02170806/backdoor-1-1600.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:27 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Cisco, firewall, malware, can, only, killed, pulling, the, plug</media:keywords>
</item>

<item>
<title>Compromised everyday devices power Chinese cyber espionage operations</title>
<link>https://block385.com/compromised-everyday-devices-power-chinese-cyber-espionage-operations</link>
<guid>https://block385.com/compromised-everyday-devices-power-chinese-cyber-espionage-operations</guid>
<description><![CDATA[ China-linked threat actors have shifted from individually procured infrastructure to large-scale covert networks, botnets built from compromised routers and other edge devices, the National Cyber Security Centre (NCSC) warns. To help organizations address this threat, the NCSC, together with the Cyber League and partner agencies, has issued an advisory. The advisory includes guidance for organizations of all sizes, urging them to map and baseline traffic from edge devices, particularly VPN and remote access connections, and … More →
The post Compromised everyday devices power Chinese cyber espionage operations appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/03/26092845/hand-monitor-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 13:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Compromised, everyday, devices, power, Chinese, cyber, espionage, operations</media:keywords>
</item>

<item>
<title>Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2</title>
<link>https://block385.com/tropic-trooper-uses-trojanized-sumatrapdf-and-github-to-deploy-adaptixc2</link>
<guid>https://block385.com/tropic-trooper-uses-trojanized-sumatrapdf-and-github-to-deploy-adaptixc2</guid>
<description><![CDATA[ Chinese-speaking individuals are the target of a new campaign that uses a trojanized version of SumatraPDF reader to deploy the AdaptixC2 Beacon post-exploitation agent and ultimately facilitate the abuse of Microsoft Visual Studio Code (VS Code) tunnels for remote access.
Zscaler ThreatLabz, which discovered the campaign last month, has attributed it with high confidence to Tropic Trooper (aka ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEheXZWhV-F6JpyIS7BshxCI158lslIFwx6XU9K15AoGDti8DVknLSrhAEc9HybQjSHfjfuKpGJ5by4EJamG4RV_7v8_SzlmhmSlxcfIBRaYX913E8f6-z0NQyMJ9g0VkszTUY726Csg6xWhwY16ygTe_JySvgj-JkaMyX4ZdM7yCuxRT_98lv22nywvy6r5/s1600/cyberattack.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 12:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tropic, Trooper, Uses, Trojanized, SumatraPDF, and, GitHub, Deploy, AdaptixC2</media:keywords>
</item>

<item>
<title>UNC6692 Impersonates IT Help Desk via Microsoft Teams to Deploy SNOW Malware</title>
<link>https://block385.com/unc6692-impersonates-it-help-desk-via-microsoft-teams-to-deploy-snow-malware</link>
<guid>https://block385.com/unc6692-impersonates-it-help-desk-via-microsoft-teams-to-deploy-snow-malware</guid>
<description><![CDATA[ A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft Teams to deploy a custom malware suite on compromised hosts.
&quot;As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT help desk employees, convincing their victim to accept a Microsoft Teams chat invitation from an account ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHoBLtF5qmS63UuZJdrs4DtwoJRc6V3OK_4vUjCp-mHUs99AlJkzxcQgZH-tD0dFneYJHfBEumdGw42jcqcYHYiqmNHBtHZVB7m83pxPakcbupcdcRmDzg2fedK4doHPUwOfGoqY2a44VUwgK1g8cyZSgpMmpzcbWuBrzxvdalA9bkt8_26WkdIfZy6qqa/s1600/helpdesk.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 12:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>UNC6692, Impersonates, Help, Desk, via, Microsoft, Teams, Deploy, SNOW, Malware</media:keywords>
</item>

<item>
<title>LMDeploy CVE&#45;2026&#45;33626 Flaw Exploited Within 13 Hours of Disclosure</title>
<link>https://block385.com/lmdeploy-cve-2026-33626-flaw-exploited-within-13-hours-of-disclosure</link>
<guid>https://block385.com/lmdeploy-cve-2026-33626-flaw-exploited-within-13-hours-of-disclosure</guid>
<description><![CDATA[ A high-severity security flaw in LMDeploy, an open-source toolkit for compressing, deploying, and serving LLMs, has come under active exploitation in the wild less than 13 hours after its public disclosure.
The vulnerability, tracked as CVE-2026-33626 (CVSS score: 7.5), relates to a Server-Side Request Forgery (SSRF) vulnerability that could be exploited to access sensitive data.
&quot;A server-side ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjQrFbHBSUJCgc3WB8IsBaYhvbOnk7jwkU3MRHO7YVAFZBBwi7LE2OZzC_oddjsfbh_YwW7czfQ0FzCpHyztt-N8po5TkqZqsOhm_LpW4dxmzaDtGkud-vho2R409maf5r_QBAPjGUpfFShbENQ-qIpwaQ0eNmBgD7U-Pgu4uFgSzGRxt6O7kKLAg_PyVg/s1600/lmdeploy.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 10:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>LMDeploy, CVE-2026-33626, Flaw, Exploited, Within, Hours, Disclosure</media:keywords>
</item>

<item>
<title>Tropic Trooper APT Takes Aim at Home Routers, Japanese Targets</title>
<link>https://block385.com/tropic-trooper-apt-takes-aim-at-home-routers-japanese-targets</link>
<guid>https://block385.com/tropic-trooper-apt-takes-aim-at-home-routers-japanese-targets</guid>
<description><![CDATA[ The Chinese state-sponsored cyber threat is known for moving fast and trying odd attack vectors; now it&#039;s branching out in tools, victimology, and TTPs. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf6b44cf37bbcf09b/69ea75dbb14e60a8c0fb9e7b/tropical1800_Marc_Anderson_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 05:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tropic, Trooper, APT, Takes, Aim, Home, Routers, Japanese, Targets</media:keywords>
</item>

<item>
<title>China&#45;Backed Hackers Are Industrializing Botnets</title>
<link>https://block385.com/china-backed-hackers-are-industrializing-botnets</link>
<guid>https://block385.com/china-backed-hackers-are-industrializing-botnets</guid>
<description><![CDATA[ China&#039;s state-backed groups are now using covert networks of compromised devices to execute attacks in a low-cost, low-risk, and deniable way. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt015e58f9d5bdd548/69ea8696be3c0328a992e3db/china_GagoDesign_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 24 Apr 2026 01:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>China-Backed, Hackers, Are, Industrializing, Botnets</media:keywords>
</item>

<item>
<title>UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy SNOW Malware</title>
<link>https://block385.com/unc6692-impersonates-it-helpdesk-via-microsoft-teams-to-deploy-snow-malware</link>
<guid>https://block385.com/unc6692-impersonates-it-helpdesk-via-microsoft-teams-to-deploy-snow-malware</guid>
<description><![CDATA[ A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft Teams to deploy a custom malware suite on compromised hosts.
&quot;As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT helpdesk employees, convincing their victim to accept a Microsoft Teams chat invitation from an account ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHoBLtF5qmS63UuZJdrs4DtwoJRc6V3OK_4vUjCp-mHUs99AlJkzxcQgZH-tD0dFneYJHfBEumdGw42jcqcYHYiqmNHBtHZVB7m83pxPakcbupcdcRmDzg2fedK4doHPUwOfGoqY2a44VUwgK1g8cyZSgpMmpzcbWuBrzxvdalA9bkt8_26WkdIfZy6qqa/s1600/helpdesk.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 20:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>UNC6692, Impersonates, Helpdesk, via, Microsoft, Teams, Deploy, SNOW, Malware</media:keywords>
</item>

<item>
<title>Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign</title>
<link>https://block385.com/bitwarden-cli-compromised-in-ongoing-checkmarx-supply-chain-campaign</link>
<guid>https://block385.com/bitwarden-cli-compromised-in-ongoing-checkmarx-supply-chain-campaign</guid>
<description><![CDATA[ Bitwarden CLI has been compromised as part of the newly discovered and ongoing Checkmarx supply chain campaign, according to new findings from JFrog and Socket.
&quot;The affected package version appears to be @bitwarden/cli@2026.4.0, and the malicious code was published in &#039;bw1.js,&#039; a file included in the package contents,&quot; the application security company said.
&quot;The attack appears to have leveraged ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3GuK50sJwMRH4ad8bcUVRSBm1Wk0X5Gj1dSalza49wWxFY9g3_E32271zOeqx6vsqrWY2SWAVnnXTKiJZvKbhxynk018zLTIlZpBNhFA_QVi6kzn7vATBe419m222ZMUcTToaSn19L4DgElrI9luwUv2EJk0efy5TLDIqIUyGcOnTvVU2KKZw9AMsMipz/s1600/bitwarden.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 18:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bitwarden, CLI, Compromised, Ongoing, Checkmarx, Supply, Chain, Campaign</media:keywords>
</item>

<item>
<title>ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories</title>
<link>https://block385.com/threatsday-bulletin-290m-defi-hack-macos-lotl-abuse-proxysmart-sim-farms-25-new-stories</link>
<guid>https://block385.com/threatsday-bulletin-290m-defi-hack-macos-lotl-abuse-proxysmart-sim-farms-25-new-stories</guid>
<description><![CDATA[ You scroll past one incident and see another that feels familiar, like it should have been fixed years ago, but it still works with small changes. Same bugs. Same mistakes.
The supply chain is messy. Packages you did not check are stealing data, adding backdoors, and spreading. Attacking the systems behind apps is easier than breaking the apps themselves. The exploits are simple but still work ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCPlFIV8w3UXOQRe4cwOn8C-x6WYxvZnNAOHSUnzIg8TFswCnJNoyTFJTdzAbl_a6JNCzhbAk4yGQbhI_cjF-FATAAmJJJiLjo2cZgbMQpfhYnrH6MFv6TVEqC3sblGQPViYTDE0o3alqO3YsIzatrw7NwlTkv1g6NkiVegSWKuRuQcajEyNdAUEaTamQ-/s1600/threatsday.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 18:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ThreatsDay, Bulletin:, 290M, DeFi, Hack, macOS, LotL, Abuse, ProxySmart, SIM, Farms, 25, New, Stories</media:keywords>
</item>

<item>
<title>Chinese APT Abuses Multiple Cloud Tools to Spy on Mongolia</title>
<link>https://block385.com/chinese-apt-abuses-multiple-cloud-tools-to-spy-on-mongolia</link>
<guid>https://block385.com/chinese-apt-abuses-multiple-cloud-tools-to-spy-on-mongolia</guid>
<description><![CDATA[ The threat actor gave itself plenty of options to support command and control, tapping Microsoft Outlook, Slack, Discord, and file.io for online espionage. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt17fc2cec7ba9f5b3/69e90f257417a71b03305c14/Beijing_Ulaanbaatar-Trevor_Mogg-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Chinese, APT, Abuses, Multiple, Cloud, Tools, Spy, Mongolia</media:keywords>
</item>

<item>
<title>Bad Memories Still Haunt AI Agents</title>
<link>https://block385.com/bad-memories-still-haunt-ai-agents</link>
<guid>https://block385.com/bad-memories-still-haunt-ai-agents</guid>
<description><![CDATA[ Cisco found and fixed a significant vulnerability in the way Anthropic handles memories, but experts warn that mishandled memory files will continue threaten AI systems. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0abdbe2d875193af/69de52650bc850de57243ab8/digital-brain-Billion_Photos-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bad, Memories, Still, Haunt, Agents</media:keywords>
</item>

<item>
<title>Africa Relinquishes Cyberattack Lead to Latin America — For Now</title>
<link>https://block385.com/africa-relinquishes-cyberattack-lead-to-latin-america-for-now</link>
<guid>https://block385.com/africa-relinquishes-cyberattack-lead-to-latin-america-for-now</guid>
<description><![CDATA[ The volume of cyberattacks targeting Africa declined in the past year, with weekly attacks down 22%, as attackers seemingly shifted their focus to other regions. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt041f5fc64dbe4d6f/679016b514bc5279608b2db9/Ground_Picture-Africa-cyber-identity-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Africa, Relinquishes, Cyberattack, Lead, Latin, America, —, For, Now</media:keywords>
</item>

<item>
<title>Electricity Is a Growing Area of Cyber Risk</title>
<link>https://block385.com/electricity-is-a-growing-area-of-cyber-risk</link>
<guid>https://block385.com/electricity-is-a-growing-area-of-cyber-risk</guid>
<description><![CDATA[ IT has long been concerned about ensuring systems receive the right amount of electricity. Cyberattackers are realizing they can manipulate voltage fluctuations for their purposes, too. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltdda8d92d977d3fd5/69e8dc16a28c2093e5e0035e/FH7C4H.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 15:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Electricity, Growing, Area, Cyber, Risk</media:keywords>
</item>

<item>
<title>[Webinar] Mythos Reality Check: Beating Automated Exploitation at AI Speed</title>
<link>https://block385.com/webinar-mythos-reality-check-beating-automated-exploitation-at-ai-speed</link>
<guid>https://block385.com/webinar-mythos-reality-check-beating-automated-exploitation-at-ai-speed</guid>
<description><![CDATA[ Imagine a world where hackers don&#039;t sleep, don&#039;t take breaks, and find weak spots in your systems instantly.
Well, that world is already here.
Thanks to AI, attackers are now launching automated, large-scale exploits faster than ever before. The time you have to fix a vulnerability before it gets attacked is shrinking to zero. We call this the Collapsing Exploit Window, and it means your ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirgCFjBm7wVU1Nve1GwsT-mX4Fm9C2OB25FN0xsgQxB5H1y0XN-I4TrfFH3f47uWBie1-yNBz_K2tuml0FOagCnaxI5xQvqoVbpzOUU6bCoaBZLohQWPSWF4r2YSEXIQKt3FRdoSXjvAk8OTmysTV4uoPD87y-3Boh7UzcJoUFIQxkmB576KIDMtU0YHDx/s1600/miggo-webinar.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Webinar, Mythos, Reality, Check:, Beating, Automated, Exploitation, Speed</media:keywords>
</item>

<item>
<title>Project Glasswing Proved AI Can Find the Bugs. Who&amp;apos;s Going to Fix Them?</title>
<link>https://block385.com/project-glasswing-proved-ai-can-find-the-bugs-whos-going-to-fix-them</link>
<guid>https://block385.com/project-glasswing-proved-ai-can-find-the-bugs-whos-going-to-fix-them</guid>
<description><![CDATA[ Last week, Anthropic announced Project Glasswing, an AI model so effective at discovering software vulnerabilities that they took the extraordinary step of postponing its public release. Instead, the company has given access to Apple, Microsoft, Google, Amazon, and a coalition of others to find and patch bugs before adversaries can.
Mythos Preview, the model that led to Project Glasswing, found ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkzSPo6TkrJjcTvsuM1O71fiiZ7gnKw4PqqtKu_TeAaZNr5qAEfsfVvoZv64F7EFULRIv8SKePHZehY_0g9AqyqlnMdTPF-OLf1S9RwmB-edOgYKEg1Llw-6m87CQBglHxbK3oS0Brnwc9_x_oi56XGuxe1V9vN0KfoY9cUmU4mplEHeqQxO-5byx79YY/s1600/picus-main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Project, Glasswing, Proved, Can, Find, the, Bugs., Whos, Going, Fix, Them</media:keywords>
</item>

<item>
<title>Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages</title>
<link>https://block385.com/apple-fixes-ios-flaw-that-let-fbi-recover-deleted-signal-messages</link>
<guid>https://block385.com/apple-fixes-ios-flaw-that-let-fbi-recover-deleted-signal-messages</guid>
<description><![CDATA[ Apple has rolled out a software fix for iOS and iPadOS to address a Notification Services flaw that stored notifications marked for deletion on the device.
The vulnerability, tracked as CVE-2026-28950 (CVSS score: N/A), has been described as a logging issue that has been addressed with improved data redaction.
&quot;Notifications marked for deletion could be unexpectedly retained on the device,&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8iikjICH9h-OY06K3jZBcEcwtWEuusLcRgwG1T5SvE39V2ZfqSe7Z7N3NFXzfxgYicI_yo8bvme9f4RYazoU-5dUmoTKJMgdmW38AuWgFEWKNBTxgqQJAgpwZUOS926Ue1qCGUW7ou2wStgU-vRsle4Ky8pcp2I2mT_Sm3eyUw__JZaO-BrBZ80z3Zhvx/s1600/apple-signal.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Fixes, iOS, Flaw, That, Let, FBI, Recover, Deleted, Signal, Messages</media:keywords>
</item>

<item>
<title>GopherWhisper APT group hides command and control traffic in Slack and Discord</title>
<link>https://block385.com/gopherwhisper-apt-group-hides-command-and-control-traffic-in-slack-and-discord</link>
<guid>https://block385.com/gopherwhisper-apt-group-hides-command-and-control-traffic-in-slack-and-discord</guid>
<description><![CDATA[ Attackers continue to lean on everyday collaboration platforms to hide command and control traffic inside normal enterprise noise. A newly identified China-aligned APT group pushes that trend further, running its operations through Slack workspaces, Discord servers, Outlook drafts, and the file.io sharing service. GopherWhisper toolset overview ESET researchers have named the group GopherWhisper and tied it to an intrusion at a Mongolian governmental entity. The name draws on two elements: most of the group’s tooling … More →
The post GopherWhisper APT group hides command and control traffic in Slack and Discord appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/09194120/laptop-danger-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 13:00:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GopherWhisper, APT, group, hides, command, and, control, traffic, Slack, and, Discord</media:keywords>
</item>

<item>
<title>&amp;apos;Zealot&amp;apos; Shows What AI&amp;apos;s Capable of in Staged Cloud Attack</title>
<link>https://block385.com/zealot-shows-what-ais-capable-of-in-staged-cloud-attack</link>
<guid>https://block385.com/zealot-shows-what-ais-capable-of-in-staged-cloud-attack</guid>
<description><![CDATA[ The proof of concept revealed AI-based attacks unfold too fast for human defenders to respond, and that AI evinced more autonomous behavior than expected. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc3681a58fc1b6aef/69e936be6b27ed085e8c5508/aicyber_DigitalPen_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 13:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Zealot, Shows, What, AIs, Capable, Staged, Cloud, Attack</media:keywords>
</item>

<item>
<title>China&#45;Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors</title>
<link>https://block385.com/china-linked-gopherwhisper-infects-12-mongolian-government-systems-with-go-backdoors</link>
<guid>https://block385.com/china-linked-gopherwhisper-infects-12-mongolian-government-systems-with-go-backdoors</guid>
<description><![CDATA[ Mongolian governmental institutions have emerged as the target of a previously undocumented China-aligned advanced persistent threat (APT) group tracked as GopherWhisper.
&quot;The group wields a wide array of tools mostly written in Go, using injectors and loaders to deploy and execute various backdoors in its arsenal,&quot; Slovakian cybersecurity company ESET said in a report shared with The Hacker ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcPZEHQ2ePgeeD1JO3nqkHDxu5XWd53XZ8GsPxgX5Gl3vY-isf7bdT1_8ZGbMGOwic5gJKYXp0G5rIiSacQvidnb3_voREgqsyanhwo0uQs1HLNXACrsV2tLmHXlxA4FizErdbwb5o35MEDIrZKMkDsAAzIVPt0g6pTMbsZSN7SIwTEozmgX7MO26XxapY/s1600/chinese-hacking.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 12:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>China-Linked, GopherWhisper, Infects, Mongolian, Government, Systems, with, Backdoors</media:keywords>
</item>

<item>
<title>Vercel Finds More Compromised Accounts in Context.ai&#45;Linked Breach</title>
<link>https://block385.com/vercel-finds-more-compromised-accounts-in-contextai-linked-breach</link>
<guid>https://block385.com/vercel-finds-more-compromised-accounts-in-contextai-linked-breach</guid>
<description><![CDATA[ Vercel on Wednesday revealed that it has identified an additional set of customer accounts that were compromised as part of a security incident that enabled unauthorized access to its internal systems.
The company said it made the discovery after expanding its investigation to include an extra set of compromise indicators, alongside a review of requests to the Vercel network and environment ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzwM3USZlfhbZvEZWWJp8Qa4g-UzetuH1vkGUsyr3Ju00B8gC8z791k1Gv-WZ_pMB1VQtX1xLFj-ETJg33razqLHCpoOzMcbb65ucw8jruZ_ltVmaO4bky9WmoFSXfgquEn8HVbLx_I02h0BDOXPBn61_jdnRYKSleCpfUR8G4pkEpsn592IvR3D3qgt0X/s1600/vercel-breach.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 12:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vercel, Finds, More, Compromised, Accounts, Context.ai-Linked, Breach</media:keywords>
</item>

<item>
<title>Apple Patches iOS Flaw That Stored Deleted Signal Notifications in FBI Forensic Case</title>
<link>https://block385.com/apple-patches-ios-flaw-that-stored-deleted-signal-notifications-in-fbi-forensic-case</link>
<guid>https://block385.com/apple-patches-ios-flaw-that-stored-deleted-signal-notifications-in-fbi-forensic-case</guid>
<description><![CDATA[ Apple has rolled out a software fix for iOS and iPadOS to address a Notification Services flaw that stored notifications marked for deletion on the device.
The vulnerability, tracked as CVE-2026-28950 (CVSS score: N/A), has been described as a logging issue that has been addressed with improved data redaction.
&quot;Notifications marked for deletion could be unexpectedly retained on the device,&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8iikjICH9h-OY06K3jZBcEcwtWEuusLcRgwG1T5SvE39V2ZfqSe7Z7N3NFXzfxgYicI_yo8bvme9f4RYazoU-5dUmoTKJMgdmW38AuWgFEWKNBTxgqQJAgpwZUOS926Ue1qCGUW7ou2wStgU-vRsle4Ky8pcp2I2mT_Sm3eyUw__JZaO-BrBZ80z3Zhvx/s1600/apple-signal.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 12:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Patches, iOS, Flaw, That, Stored, Deleted, Signal, Notifications, FBI, Forensic, Case</media:keywords>
</item>

<item>
<title>OpenAI tackles a bad habit people have when interacting with AI</title>
<link>https://block385.com/openai-tackles-a-bad-habit-people-have-when-interacting-with-ai</link>
<guid>https://block385.com/openai-tackles-a-bad-habit-people-have-when-interacting-with-ai</guid>
<description><![CDATA[ Since people tend to paste personal data into AI tools such as ChatGPT, OpenAI has released Privacy Filter, an open-weight model designed to detect and redact personally identifiable information (PII) in text. The model is available under the Apache 2.0 license on Hugging Face and GitHub. “This release is part of our broader effort to support a more resilient software ecosystem by providing developers with practical infrastructure for building with AI safely, including tools and … More →
The post OpenAI tackles a bad habit people have when interacting with AI appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05155719/openai-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 11:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI, tackles, bad, habit, people, have, when, interacting, with</media:keywords>
</item>

<item>
<title>Scenario: Open&#45;source framework for automated AI app red&#45;teaming</title>
<link>https://block385.com/scenario-open-source-framework-for-automated-ai-app-red-teaming</link>
<guid>https://block385.com/scenario-open-source-framework-for-automated-ai-app-red-teaming</guid>
<description><![CDATA[ Enterprises running customer service bots, data analytics agents, and other AI-driven applications in production handle sensitive records and connect to core business systems every day. LangWatch has released Scenario, an open-source framework that runs automated red-team exercises against AI agents using multi-turn attack techniques that mirror how adversaries operate in the wild. Multi-turn attacks replace single-shot testing Single-prompt penetration tests have long been the standard approach for probing LLMs. Models often hold firm against a … More →
The post Scenario: Open-source framework for automated AI app red-teaming appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22144039/scenario-ai-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 09:00:19 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Scenario:, Open-source, framework, for, automated, app, red-teaming</media:keywords>
</item>

<item>
<title>A year in, Zoom’s CISO reflects on balancing security and business</title>
<link>https://block385.com/a-year-in-zooms-ciso-reflects-on-balancing-security-and-business</link>
<guid>https://block385.com/a-year-in-zooms-ciso-reflects-on-balancing-security-and-business</guid>
<description><![CDATA[ In this Help Net Security interview, Sandra McLeod, CISO at Zoom, reflects on her first year in the role. She talks about moving from reactive firefighting to business strategy, and what she heard from engineers, the board, and customers during her early months. McLeod discusses how she prepared for incident management, the dual job of handling crises and explaining them afterward, and her experience as a woman in technical leadership at Zoom. She closes with … More →
The post A year in, Zoom’s CISO reflects on balancing security and business appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22090836/sandra_mcleod-2-zoom.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 09:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>year, in, Zoom’s, CISO, reflects, balancing, security, and, business</media:keywords>
</item>

<item>
<title>Ransomware, fraud, and lawsuits drive cyber insurance claims to new peaks</title>
<link>https://block385.com/ransomware-fraud-and-lawsuits-drive-cyber-insurance-claims-to-new-peaks</link>
<guid>https://block385.com/ransomware-fraud-and-lawsuits-drive-cyber-insurance-claims-to-new-peaks</guid>
<description><![CDATA[ The 2026 InsurSec Report from At-Bay, covering more than 100,000 policy years of claims data, documents a 7% year-over-year rise in overall claim frequency and an all-time high average severity of $221,000. Ransomware severity reached $508,000, up 16% from the prior year, making it the costliest incident type by a wide margin. Remote access weaknesses dominate ransomware entry Remote access services served as the entry point for 87% of ransomware claims in 2025, up from … More →
The post Ransomware, fraud, and lawsuits drive cyber insurance claims to new peaks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/16113804/person-computer-red-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 07:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ransomware, fraud, and, lawsuits, drive, cyber, insurance, claims, new, peaks</media:keywords>
</item>

<item>
<title>GDPR works, but only where someone enforces it</title>
<link>https://block385.com/gdpr-works-but-only-where-someone-enforces-it</link>
<guid>https://block385.com/gdpr-works-but-only-where-someone-enforces-it</guid>
<description><![CDATA[ A new measurement study of web tracking across ten countries offers a reality check for anyone working on privacy compliance. Researchers crawled the same set of globally popular websites from virtual machines located in Australia, Brazil, Canada, Germany, India, Singapore, South Africa, South Korea, Spain, and California. The results show that European privacy law does reduce tracking, and that most of the reduction happens in the two jurisdictions where regulators bring cases. The headline numbers … More →
The post GDPR works, but only where someone enforces it appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22103033/europe-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 07:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GDPR, works, but, only, where, someone, enforces</media:keywords>
</item>

<item>
<title>&amp;apos;The Gentlemen&amp;apos; Rapidly Rises to Ransomware Prominence</title>
<link>https://block385.com/the-gentlemen-rapidly-rises-to-ransomware-prominence</link>
<guid>https://block385.com/the-gentlemen-rapidly-rises-to-ransomware-prominence</guid>
<description><![CDATA[ Not nearly as polite as the name suggests, the ransomware gang has impressed researchers with its speed in scaling up operations — and its sophistication. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt9dfe08179358f99d/69e92147a425f3fc877c3bd4/Gentlemen_Sign_David_Morphew_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 23 Apr 2026 01:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Gentlemen, Rapidly, Rises, Ransomware, Prominence</media:keywords>
</item>

<item>
<title>Google’s Workspace Intelligence promises privacy while running on your data</title>
<link>https://block385.com/googles-workspace-intelligence-promises-privacy-while-running-on-your-data</link>
<guid>https://block385.com/googles-workspace-intelligence-promises-privacy-while-running-on-your-data</guid>
<description><![CDATA[ Security and data governance are among the key considerations in Google’s latest AI update, which introduces Workspace Intelligence within Google Workspace. Google describes the feature as “a secure, dynamic system that inherently understands complex semantic relationships within your Workspace apps (such as Docs, Slides, or Gmail) content, your active projects, your collaborators, and your organization’s domain knowledge.” “Workspace Intelligence is built on the same reliable, secure, and compliant infrastructure as the rest of Workspace,” Yulie … More →
The post Google’s Workspace Intelligence promises privacy while running on your data appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22162448/google-workspace-intelligence.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 23:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google’s, Workspace, Intelligence, promises, privacy, while, running, your, data</media:keywords>
</item>

<item>
<title>Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain</title>
<link>https://block385.com/malicious-kics-docker-images-and-vs-code-extensions-hit-checkmarx-supply-chain</link>
<guid>https://block385.com/malicious-kics-docker-images-and-vs-code-extensions-hit-checkmarx-supply-chain</guid>
<description><![CDATA[ Cybersecurity researchers have warned of malicious images pushed to the official &quot;checkmarx/kics&quot; Docker Hub repository.
In an alert published today, software supply chain security company Socket revealed that unknown threat actors managed to have overwritten existing tags, including v2.1.20 and alpine, while also introducing a new v2.1.21 tag that does not correspond to an official release. The ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimocxAyADkuC5qBKZquZhHtUaDSArR1yrr0eRW7dQ_qo4yJpHxj2VYF0qQBxxYfhwOv5g3PJ6raoVwGHrns8DiRFppR_OPFhc2NUoVxlMc0W3fwVyR8J0daGZ_a8IOSuqL1kXJmY6Sj1bvqJ7OwkZfJQB2Cha4WldeRwCcAopoTllcER15ca3eFwsibt6i/s1600/kics.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 22:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Malicious, KICS, Docker, Images, and, Code, Extensions, Hit, Checkmarx, Supply, Chain</media:keywords>
</item>

<item>
<title>Self&#45;Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens</title>
<link>https://block385.com/self-propagating-supply-chain-worm-hijacks-npm-packages-to-steal-developer-tokens</link>
<guid>https://block385.com/self-propagating-supply-chain-worm-hijacks-npm-packages-to-steal-developer-tokens</guid>
<description><![CDATA[ Cybersecurity researchers have flagged a fresh set of packages that have been compromised by bad actors to deliver a self-propagating worm that spreads through stolen developer npm tokens.
The supply chain worm has been detected by both Socket and StepSecurity, with the companies tracking the activity under the name CanisterSprawl owing to the use of an ICP canister to exfiltrate the stolen data ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIdq7inTckksldfLXx5JPM1spcmvj-W0C5jvCNGSfvUlWfhmFERkPhE9WNRTkTib4uZFsKKn2lBvxnhsZbEaOnGKI4pkSKu8kpyBn7VEsY3BbVN5ZklAoliWNZC-b526mJbr5xiYxKwRFXB8pnV2K-H5ww5mG3_1GrWjgvrsnqJ2EJu1gZJ15-D29njRY9/s1600/npm.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Self-Propagating, Supply, Chain, Worm, Hijacks, npm, Packages, Steal, Developer, Tokens</media:keywords>
</item>

<item>
<title>Claude Mythos finds 271 Firefox flaws, Mozilla believes it shifts security toward defenders</title>
<link>https://block385.com/claude-mythos-finds-271-firefox-flaws-mozilla-believes-it-shifts-security-toward-defenders</link>
<guid>https://block385.com/claude-mythos-finds-271-firefox-flaws-mozilla-believes-it-shifts-security-toward-defenders</guid>
<description><![CDATA[ The Mozilla Foundation tested Claude Mythos, an Anthropic AI model that has stirred debate in the cybersecurity community. Before granting access to Mythos, Mozilla scanned Firefox using Opus 4.6, which led to fixes for 22 security-sensitive bugs in Firefox 148. For instance, Mythos identified 271 vulnerabilities in Firefox 150. Firefox CTO Bobby Holley said other teams are beginning to experience the same “vertigo” that Mozilla felt when the findings first came into focus. “For a … More →
The post Claude Mythos finds 271 Firefox flaws, Mozilla believes it shifts security toward defenders appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/07/16184414/firefox-2023.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 19:00:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Mythos, finds, 271, Firefox, flaws, Mozilla, believes, shifts, security, toward, defenders</media:keywords>
</item>

<item>
<title>Cyberattack on French government agency triggers phishing alert</title>
<link>https://block385.com/cyberattack-on-french-government-agency-triggers-phishing-alert</link>
<guid>https://block385.com/cyberattack-on-french-government-agency-triggers-phishing-alert</guid>
<description><![CDATA[ France Titres, a French government agency, has disclosed a data breach that may have exposed user data from its online portal. France Titres, also known as the Agence nationale des titres sécurisés (ANTS), operates under the French Ministry of the Interior and manages systems for official identity and registration documents, including driver’s licences, national ID cards, passports, and immigration documents. According to the agency, the incident was detected on Wednesday, April 15, and remains under … More →
The post Cyberattack on French government agency triggers phishing alert appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22163101/france-titres-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 19:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cyberattack, French, government, agency, triggers, phishing, alert</media:keywords>
</item>

<item>
<title>Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API</title>
<link>https://block385.com/harvester-deploys-linux-gogra-backdoor-in-south-asia-using-microsoft-graph-api</link>
<guid>https://block385.com/harvester-deploys-linux-gogra-backdoor-in-south-asia-using-microsoft-graph-api</guid>
<description><![CDATA[ The threat actor known as Harvester has been attributed to a new Linux version of its GoGra backdoor deployed as part of attacks likely targeting entities in South Asia.
&quot;The malware uses the legitimate Microsoft Graph API and Outlook mailboxes as a covert command-and-control (C2) channel, allowing it to bypass traditional perimeter network defenses,&quot; the Symantec and Carbon Black Threat Hunter ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiptXaD_Im0Bee0znCFTtBnOBEGGfeP-lS85crmRfAsd5-sMOsHstg9jATLVQOSJF2tiQQ6qkQ2ZWK98foU4WIQU_tHja8H882jF-_oiA5UGh-iG0-ByeaGfBbjDGid-FkfsNfKQUljfBsgejRsHBiBeX1DXRbjf1ohM1uhZiKdsjpBaH_0lYylOWSA9itt/s1600/linux.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 18:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Harvester, Deploys, Linux, GoGra, Backdoor, South, Asia, Using, Microsoft, Graph, API</media:keywords>
</item>

<item>
<title>Acronis GenAI Protection gives MSPs control over AI usage and data risks</title>
<link>https://block385.com/acronis-genai-protection-gives-msps-control-over-ai-usage-and-data-risks</link>
<guid>https://block385.com/acronis-genai-protection-gives-msps-control-over-ai-usage-and-data-risks</guid>
<description><![CDATA[ Acronis has launced Acronis GenAI Protection, a monitoring and security solution that enables managed service providers (MSPs) to control generative AI usage across client environments, preventing sensitive data exposure and protecting against malicious prompt manipulation. Acronis GenAI Protection represents the initial phase of Acronis Cyber Workspace, with additional capabilities planned for release to deliver a protected AI workspace, natively integrated into the Acronis platform. As organisations rapidly adopt generative AI tools, businesses face growing risks … More →
The post Acronis GenAI Protection gives MSPs control over AI usage and data risks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 17:00:25 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Acronis, GenAI, Protection, gives, MSPs, control, over, usage, and, data, risks</media:keywords>
</item>

<item>
<title>New Mirai variants target routers and DVRs in parallel campaigns</title>
<link>https://block385.com/new-mirai-variants-target-routers-and-dvrs-in-parallel-campaigns</link>
<guid>https://block385.com/new-mirai-variants-target-routers-and-dvrs-in-parallel-campaigns</guid>
<description><![CDATA[ Hidden inside newly discovered botnet malware is an unusual message from its creator: “AI.NEEDS.TO.DIE”. Dubbed “tuxnokill” by researchers at Akamai, the malware is one of two fresh Mirai botnet variants documented this month by major cybersecurity firms and, judging by the aforementioned hard-coded string, this particular variant might have been coded the old-fashioned way. “Tuxnokill” and “Nexcorium” Based on hits on the company’s global network of honeypots, Akamai found that tuxnokill is spreading through CVE-2025-29635, … More →
The post New Mirai variants target routers and DVRs in parallel campaigns appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/23124652/attack-ddos-threat-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 17:00:21 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Mirai, variants, target, routers, and, DVRs, parallel, campaigns</media:keywords>
</item>

<item>
<title>Prove Identity Platform connects verification, authentication, and fraud prevention</title>
<link>https://block385.com/prove-identity-platform-connects-verification-authentication-and-fraud-prevention</link>
<guid>https://block385.com/prove-identity-platform-connects-verification-authentication-and-fraud-prevention</guid>
<description><![CDATA[ Prove has launched the Prove Identity Platform, turning identity verification into an ongoing, real-time process for users, businesses, and AI agents. AI agents are already initiating real transactions on behalf of real people. OpenAI and Stripe launched the Agentic Commerce Protocol in September. Visa named Anthropic, OpenAI, and Perplexity as agentic commerce partners. As that shift accelerates, the central question facing every organization becomes: Is this person real, and did they authorize this specific action, … More →
The post Prove Identity Platform connects verification, authentication, and fraud prevention appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 17:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Prove, Identity, Platform, connects, verification, authentication, and, fraud, prevention</media:keywords>
</item>

<item>
<title>Claude Mythos finds 271 Firefox flaws, Mozilla believes zero&#45;days are numbered</title>
<link>https://block385.com/claude-mythos-finds-271-firefox-flaws-mozilla-believes-zero-days-are-numbered</link>
<guid>https://block385.com/claude-mythos-finds-271-firefox-flaws-mozilla-believes-zero-days-are-numbered</guid>
<description><![CDATA[ The Mozilla Foundation tested Claude Mythos, an Anthropic AI model that has stirred debate in the cybersecurity community. Before granting access to Mythos, Mozilla scanned Firefox using Opus 4.6, which led to fixes for 22 security-sensitive bugs in Firefox 148. For instance, Mythos identified 271 vulnerabilities in Firefox 150. Firefox CTO Bobby Holley said other teams are beginning to experience the same “vertigo” that Mozilla felt when the findings first came into focus. “For a … More →
The post Claude Mythos finds 271 Firefox flaws, Mozilla believes zero-days are numbered appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/07/16184414/firefox-2023.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 17:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Mythos, finds, 271, Firefox, flaws, Mozilla, believes, zero-days, are, numbered</media:keywords>
</item>

<item>
<title>DPRK Fake Job Scams Self&#45;Propagate in &amp;apos;Contagious Interview&amp;apos;</title>
<link>https://block385.com/dprk-fake-job-scams-self-propagate-in-contagious-interview</link>
<guid>https://block385.com/dprk-fake-job-scams-self-propagate-in-contagious-interview</guid>
<description><![CDATA[ A compromised developer&#039;s repository serves as a worm-like infection vector to spread remote access Trojans (RATs) and other malware. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3fce2e5014a4ecec/694ad7a0ec1580176ac05f87/DPRK_Square_Ian_Cowe_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 17:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DPRK, Fake, Job, Scams, Self-Propagate, Contagious, Interview</media:keywords>
</item>

<item>
<title>Progress Software fixes sneaky WAF bypass vulnerability (CVE&#45;2026&#45;21876)</title>
<link>https://block385.com/progress-software-fixes-sneaky-waf-bypass-vulnerability-cve-2026-21876</link>
<guid>https://block385.com/progress-software-fixes-sneaky-waf-bypass-vulnerability-cve-2026-21876</guid>
<description><![CDATA[ Progress Software has fixed a slew of high-severity vulnerabilities in MOVEit WAF and LoadMaster, including a flaw (CVE-2026-21876) that may allow attackers to bypass firewall detection. MOVEit WAF (web application firewall) is designed to protect Progress’s managed file transfer platform MOVEit Transfer from web-based attacks. (A zero-day vulnerability in MOVEit Transfer was infamously exploited in 2023 by the Cl0p cyber extortion gang to grab data from hundreds of organizations.) LoadMaster is the company’s general-purpose enterprise … More →
The post Progress Software fixes sneaky WAF bypass vulnerability (CVE-2026-21876) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/06/12085541/progress-cyber1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 15:00:20 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Progress, Software, fixes, sneaky, WAF, bypass, vulnerability, CVE-2026-21876</media:keywords>
</item>

<item>
<title>Elastic MCP Apps bring security and observability workflows into AI tools</title>
<link>https://block385.com/elastic-mcp-apps-bring-security-and-observability-workflows-into-ai-tools</link>
<guid>https://block385.com/elastic-mcp-apps-bring-security-and-observability-workflows-into-ai-tools</guid>
<description><![CDATA[ Elastic has announced MCP Apps for Elastic, delivering agent-native UI experiences for security and observability workflows across third-party coding tools and chat clients. The new MCP Apps enable teams to investigate threats, diagnose system behavior, and act on data directly within the AI tools they already use, without switching tools or stitching together separate systems. Built on the Model Context Protocol (MCP) apps spec, the open standard co-authored by Anthropic and OpenAI, these apps allow … More →
The post Elastic MCP Apps bring security and observability workflows into AI tools appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 15:00:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Elastic, MCP, Apps, bring, security, and, observability, workflows, into, tools</media:keywords>
</item>

<item>
<title>Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack</title>
<link>https://block385.com/lotus-wiper-malware-targets-venezuelan-energy-systems-in-destructive-attack</link>
<guid>https://block385.com/lotus-wiper-malware-targets-venezuelan-energy-systems-in-destructive-attack</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a previously undocumented data wiper that has been used in attacks targeting Venezuela at the end of last year and the start of 2026.
Dubbed Lotus Wiper, the novel file wiper has been used in a destructive campaign targeting the energy and utilities sector in Venezuela, per findings from Kaspersky.
&quot;Two batch scripts are responsible for initiating the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhANfDCr_4asg41Zj98h_tyRYig7XZGWHyCgPXHcVUvax_31CDUNrmrUp9rBFZK0u0Ai97i5pUlapu4ePRoBQAzvxt-KX3u80dTOjzyPPOOGzuCUmBZgaczzHisujoEXmfO08HtxqTbkAYBRI7JdBKffmATJHHM4uDe2RDsPyC11CkgenulBnQ7ZhyH8m-t/s1600/wiper-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Lotus, Wiper, Malware, Targets, Venezuelan, Energy, Systems, Destructive, Attack</media:keywords>
</item>

<item>
<title>Toxic Combinations: When Cross&#45;App Permissions Stack into Risk</title>
<link>https://block385.com/toxic-combinations-when-cross-app-permissions-stack-into-risk</link>
<guid>https://block385.com/toxic-combinations-when-cross-app-permissions-stack-into-risk</guid>
<description><![CDATA[ On January 31, 2026, researchers disclosed that Moltbook, a social network built for AI agents, had left its database wide open, exposing 35,000 email addresses and 1.5 million agent API tokens across 770,000 active agents.
The more worrying part sat inside the private messages. Some of those conversations held plaintext third-party credentials, including OpenAI API keys shared between agents, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeaSL6v6uahfzJpHJb0ATKZ7cbexnfYIayT74IyU1S-7f3T-4gfnWowlobm5RH4ZYrsIdeNq_OOHGxp2LbU-aELaO9RbYa15MfKN38-ZQPGhrgH0PYCsVIucG95SSw-WCzzo9eUhITn4A3txsa8H59XhTcAaOObC0r-Es_7i0RH8aDo_qhZ45MfaOTVF2t/s1600/reco.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Toxic, Combinations:, When, Cross-App, Permissions, Stack, into, Risk</media:keywords>
</item>

<item>
<title>OneDrive updates focus on AI, access control, and compliance</title>
<link>https://block385.com/onedrive-updates-focus-on-ai-access-control-and-compliance</link>
<guid>https://block385.com/onedrive-updates-focus-on-ai-access-control-and-compliance</guid>
<description><![CDATA[ Microsoft OneDrive’s recent updates focus on improving intelligence, collaboration, and administrative control. “Last year, we made a promise: your files should work for you, not the other way around. That meant reimagining OneDrive not just as a place to store files, but as an intelligent layer that surfaces what matters, eliminates busy work, and enables seamless collaboration across your organization. OneDrive became smarter, more collaborative, and more central to how work flows across Microsoft 365,” … More →
The post OneDrive updates focus on AI, access control, and compliance appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22082924/onedrive-logo-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 13:00:21 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OneDrive, updates, focus, AI, access, control, and, compliance</media:keywords>
</item>

<item>
<title>Phishing reclaims the top initial access spot, attackers experiment with AI tools</title>
<link>https://block385.com/phishing-reclaims-the-top-initial-access-spot-attackers-experiment-with-ai-tools</link>
<guid>https://block385.com/phishing-reclaims-the-top-initial-access-spot-attackers-experiment-with-ai-tools</guid>
<description><![CDATA[ Phishing returned as the leading method attackers used to break into organizations in the first quarter of 2026, accounting for over a third of engagements where initial access could be determined, according to Cisco Talos. It is the first quarter phishing has led the category since Q2 2025, when exploitation of public-facing applications took over following widespread attacks against on-premises Microsoft SharePoint servers. That SharePoint exploitation wave, collectively tracked as ToolShell, drove public-facing application exploitation … More →
The post Phishing reclaims the top initial access spot, attackers experiment with AI tools appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/05/18153305/phishing-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 13:00:18 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Phishing, reclaims, the, top, initial, access, spot, attackers, experiment, with, tools</media:keywords>
</item>

<item>
<title>Tencent’s QClaw AI agent app arrives on Windows and macOS</title>
<link>https://block385.com/tencents-qclaw-ai-agent-app-arrives-on-windows-and-macos</link>
<guid>https://block385.com/tencents-qclaw-ai-agent-app-arrives-on-windows-and-macos</guid>
<description><![CDATA[ Tencent has opened an international beta of QClaw, an AI agent application aimed at consumers in Canada, Japan, Singapore, South Korea, and the United States. The first wave is capped at 20,000 users. Additional markets are scheduled to follow. QClaw runs on Windows and MacOS. Setup takes about three minutes and involves downloading the application, registering an account, and scanning a QR code. The software is built on OpenClaw, the open-source personal AI assistant project. … More →
The post Tencent’s QClaw AI agent app arrives on Windows and macOS appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/22122919/qclaw-1400.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 13:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tencent’s, QClaw, agent, app, arrives, Windows, and, macOS</media:keywords>
</item>

<item>
<title>Microsoft Patches Critical ASP.NET Core CVE&#45;2026&#45;40372 Privilege Escalation Bug</title>
<link>https://block385.com/microsoft-patches-critical-aspnet-core-cve-2026-40372-privilege-escalation-bug</link>
<guid>https://block385.com/microsoft-patches-critical-aspnet-core-cve-2026-40372-privilege-escalation-bug</guid>
<description><![CDATA[ Microsoft has released out-of-band updates to address a security vulnerability in ASP.NET Core that could allow an attacker to escalate privileges.
The vulnerability, tracked as CVE-2026-40372, carries a CVSS score of 9.1 out of 10.0. It&#039;s rated Important in severity. An anonymous researcher has been credited with discovering and reporting the flaw.
&quot;Improper verification of cryptographic ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYMuDYXH3vQ6ycJCKfikptBR0jdQdnf-s36gDb0LYx3gvMwQOQLrt072KY5GZ0T2GRhyphenhyphenrfIg5qcCqjE0J_PtKQ1P409j_veWwKYoGsGssQcTotxI2-Dl8akDSyPif_j4LgFL3kWI6pvWKX5QBjsnIZIHdFzlAIRgxspuS4W0Ywe-Z63zmIyL7X39CG_3Ng/s1600/dotnet.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Patches, Critical, ASP.NET, Core, CVE-2026-40372, Privilege, Escalation, Bug</media:keywords>
</item>

<item>
<title>Mustang Panda’s New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles</title>
<link>https://block385.com/mustang-pandas-new-lotuslite-variant-targets-india-banks-south-korea-policy-circles</link>
<guid>https://block385.com/mustang-pandas-new-lotuslite-variant-targets-india-banks-south-korea-policy-circles</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a new variant of a known malware called LOTUSLITE that&#039;s distributed via a theme related to India&#039;s banking sector.
&quot;The backdoor communicates with a dynamic DNS-based command-and-control server over HTTPS and supports remote shell access, file operations, and session management, indicating a continued espionage-focused capability set rather than ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQHPkb7rlS_ueovJaV3s5KxgSQFfHhuZhvW8R8L9wG8j-trZvnmusj4EGvkOPah_XSqgJDLIiRWozv7RtA3o_1VaHYWnaH77PH2kOg2FYkc60uIc6WTf6frjbUp3IwhtB038_wojAl7G5OxcC4aSy5kLF48ssz_3xqLCD7bDbg6_i-RdY8tLvjxlj4Xc0o/s1600/indian-banks.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mustang, Panda’s, New, LOTUSLITE, Variant, Targets, India, Banks, South, Korea, Policy, Circles</media:keywords>
</item>

<item>
<title>Cohere AI Terrarium Sandbox Flaw Enables Root Code Execution, Container Escape</title>
<link>https://block385.com/cohere-ai-terrarium-sandbox-flaw-enables-root-code-execution-container-escape</link>
<guid>https://block385.com/cohere-ai-terrarium-sandbox-flaw-enables-root-code-execution-container-escape</guid>
<description><![CDATA[ A critical security vulnerability has been disclosed in a Python-based sandbox called Terrarium that could result in arbitrary code execution.
The vulnerability, tracked as CVE-2026-5752, is rated 9.3 on the CVSS scoring system.
&quot;Sandbox escape vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal,&quot; according to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjQ3NMjiDO5jGFykZtDgbq7FvB0nT8CMXMucn5cumu_V80blg8Wt6cklpQnCeG-EuX6oGvqmQKRJxFlmynTBatMk0zgDDsdurGDcs5rXScEF_jVNV10bEqJSJcj5YsAtLS_Pag8LRPrUZr4w9M-JJldxaYYMxtf3zrGia8QjUq-PtjLk_g4-qkkINXx4uGY/s1600/sandbox.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cohere, Terrarium, Sandbox, Flaw, Enables, Root, Code, Execution, Container, Escape</media:keywords>
</item>

<item>
<title>Shadow AI, deepfakes, and supply chain compromise are rewriting the financial sector threat playbook</title>
<link>https://block385.com/shadow-ai-deepfakes-and-supply-chain-compromise-are-rewriting-the-financial-sector-threat-playbook</link>
<guid>https://block385.com/shadow-ai-deepfakes-and-supply-chain-compromise-are-rewriting-the-financial-sector-threat-playbook</guid>
<description><![CDATA[ Financially motivated attacks continued to drive the bulk of cyber incidents against banks, insurers, and payment processors in 2025. Approximately 90% of breaches affecting financial institutions carried a financial motive, with data breaches accounting for roughly 64% of incidents and ransomware making up the remaining 36%. The average cost of a data breach in the sector reached $5.56 million per incident, placing finance second among all industries by breach cost. Personal data was the most … More →
The post Shadow AI, deepfakes, and supply chain compromise are rewriting the financial sector threat playbook appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/21151402/vault-blue-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 09:00:19 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Shadow, AI, deepfakes, and, supply, chain, compromise, are, rewriting, the, financial, sector, threat, playbook</media:keywords>
</item>

<item>
<title>Apple Intelligence flaw kept stolen tokens reusable on another device</title>
<link>https://block385.com/apple-intelligence-flaw-kept-stolen-tokens-reusable-on-another-device</link>
<guid>https://block385.com/apple-intelligence-flaw-kept-stolen-tokens-reusable-on-another-device</guid>
<description><![CDATA[ Apple claims that Apple Intelligence, a GenAI service provided on its operating systems, is designed with an extra focus on user security and privacy through a two-stage authentication and authorization system using anonymous access tokens. However, researchers from The Ohio State University have identified vulnerabilities in this design, demonstrated on macOS 26.0 (Tahoe), that allow attackers to steal and reuse these tokens. Service infrastructure The system offloads complex requests to cloud servers using Private Cloud … More →
The post Apple Intelligence flaw kept stolen tokens reusable on another device appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/21204126/apple-intelligence-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 09:00:17 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Intelligence, flaw, kept, stolen, tokens, reusable, another, device</media:keywords>
</item>

<item>
<title>PentAGI: Open&#45;source autonomous AI penetration testing system</title>
<link>https://block385.com/pentagi-open-source-autonomous-ai-penetration-testing-system</link>
<guid>https://block385.com/pentagi-open-source-autonomous-ai-penetration-testing-system</guid>
<description><![CDATA[ Penetration testers have long relied on collections of specialized tools, manual coordination, and documented runbooks to work through a target assessment. PentAGI, an open-source project from VXControl, attempts to automate that entire workflow using a multi-agent AI system that plans, researches, and executes penetration tests with minimal human direction. How the agent system works PentAGI organizes work into a hierarchy of flows, tasks, subtasks, and actions. An orchestrator agent receives a goal and coordinates three … More →
The post PentAGI: Open-source autonomous AI penetration testing system appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16131911/pentagi-1400.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 09:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>PentAGI:, Open-source, autonomous, penetration, testing, system</media:keywords>
</item>

<item>
<title>Ransomware Negotiator Pleads Guilty to BlackCat Scheme</title>
<link>https://block385.com/ransomware-negotiator-pleads-guilty-to-blackcat-scheme</link>
<guid>https://block385.com/ransomware-negotiator-pleads-guilty-to-blackcat-scheme</guid>
<description><![CDATA[ A cautionary tale illustrates why the person negotiating should never be involved with any part of the ransom payment process, experts noted. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blta6fb987cb0bb58ed/69e7dd3f2efc0b3c473984ab/insider_threat_Cagkan_Sayin_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 22 Apr 2026 01:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ransomware, Negotiator, Pleads, Guilty, BlackCat, Scheme</media:keywords>
</item>

<item>
<title>Thunderbird 150 arrives with encrypted message search and OpenPGP improvements</title>
<link>https://block385.com/thunderbird-150-arrives-with-encrypted-message-search-and-openpgp-improvements</link>
<guid>https://block385.com/thunderbird-150-arrives-with-encrypted-message-search-and-openpgp-improvements</guid>
<description><![CDATA[ Released today, Thunderbird 150.0 brings eight new features, a round of bug fixes, and security patches that cover the web engine underlying the email client. Thunderbird 150.0 runs on Windows 10 or later, macOS 10.15 or later, and Linux with GTK+ 3.14 or higher. Encrypted email gets more useful Two of the most notable additions in this release touch how users interact with encrypted mail. Thunderbird 150.0 adds message body search for OpenPGP and S/MIME … More →
The post Thunderbird 150 arrives with encrypted message search and OpenPGP improvements appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/21211406/thunderbird-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 23:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Thunderbird, 150, arrives, with, encrypted, message, search, and, OpenPGP, improvements</media:keywords>
</item>

<item>
<title>Exploits Turn Windows Defender into Attacker Tool</title>
<link>https://block385.com/exploits-turn-windows-defender-into-attacker-tool</link>
<guid>https://block385.com/exploits-turn-windows-defender-into-attacker-tool</guid>
<description><![CDATA[ Three proof-of-concept exploits are being used in active attacks against Microsoft&#039;s built-in security platform; two are unpatched. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4525b1bf0b3427d5/69e7b7f7df45795969187014/defender_aileenchik_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 23:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Exploits, Turn, Windows, Defender, into, Attacker, Tool</media:keywords>
</item>

<item>
<title>SystemBC C2 Server Reveals 1,570+ Victims in The Gentlemen Ransomware Operation</title>
<link>https://block385.com/systembc-c2-server-reveals-1570-victims-in-the-gentlemen-ransomware-operation</link>
<guid>https://block385.com/systembc-c2-server-reveals-1570-victims-in-the-gentlemen-ransomware-operation</guid>
<description><![CDATA[ Threat actors associated with The Gentlemen ransomware‑as‑a‑service (RaaS) operation have been observed attempting to deploy a known proxy malware called SystemBC.
According to new research published by Check Point, the command-and-control (C2 or C&amp;C) server linked to SystemBC has led to the discovery of a botnet of more than 1,570 victims.
&quot;SystemBC establishes SOCKS5 network tunnels within ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilP_Mn9bBsagBDSKxEcqQsy6typf-qNaLt59kGWS1jLvc22Z9AC8lY93_TZaBAUN3bx7PHgaGX8xfPIIipQgGZd5DViTIHxpnAS2mJj4X9EfkFWwlwPznOEgqu38CmzzUa4y4jUh6x0RBMkCG7AwRwLU6PhLNbbnOO1bq5sJxGVIy0GZije7IuCYZNuS4C/s1600/botnet.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 22:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SystemBC, Server, Reveals, 1, 570, Victims, The, Gentlemen, Ransomware, Operation</media:keywords>
</item>

<item>
<title>Ransomware negotiator admits role in attacks he was hired to resolve</title>
<link>https://block385.com/ransomware-negotiator-admits-role-in-attacks-he-was-hired-to-resolve</link>
<guid>https://block385.com/ransomware-negotiator-admits-role-in-attacks-he-was-hired-to-resolve</guid>
<description><![CDATA[ A Florida man, formerly employed as a ransomware negotiator, pleaded guilty to conspiring to carry out ransomware attacks against US companies. Prosecutors say Angelo Martino, 41, used his position at DigitalMint, a crypto broker that helps victims negotiate and pay ransomware demands, to pass sensitive information to attackers. Alongside Martino, two more individuals were involved in the scheme: Ryan Goldberg of Georgia and Kevin Martin of Texas. All three men worked in the cybersecurity industry … More →
The post Ransomware negotiator admits role in attacks he was hired to resolve appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/02133805/ransomware-skull.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 21:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ransomware, negotiator, admits, role, attacks, was, hired, resolve</media:keywords>
</item>

<item>
<title>VirtualBox 7.2.8 is out with Linux kernel 7.0 support and crash fixes</title>
<link>https://block385.com/virtualbox-728-is-out-with-linux-kernel-70-support-and-crash-fixes</link>
<guid>https://block385.com/virtualbox-728-is-out-with-linux-kernel-70-support-and-crash-fixes</guid>
<description><![CDATA[ Oracle shipped VirtualBox 7.2.8 on April 21, 2026, as a maintenance release covering crashes, networking problems, clipboard issues, and extended Linux kernel compatibility. The update touches the VMM layer, NAT networking, graphics, UEFI, and both Linux and Windows guest support. VMM and core stability A Guru Meditation error carrying the code VERR_IEM_IPE_4 is fixed in this release. The condition occurred when a guest attempted to execute the wrong hypercall instruction and injected an undefined instruction … More →
The post VirtualBox 7.2.8 is out with Linux kernel 7.0 support and crash fixes appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/21201552/virtualbox-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 21:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>VirtualBox, 7.2.8, out, with, Linux, kernel, 7.0, support, and, crash, fixes</media:keywords>
</item>

<item>
<title>Surge in Bomgar RMM Exploitation Demonstrates Supply Chain Risk</title>
<link>https://block385.com/surge-in-bomgar-rmm-exploitation-demonstrates-supply-chain-risk</link>
<guid>https://block385.com/surge-in-bomgar-rmm-exploitation-demonstrates-supply-chain-risk</guid>
<description><![CDATA[ The critical remote code execution flaw (CVE-2026-1731) in the remote monitoring and management tool can be exploited to spread ransomware and compromise supply chains. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt45973c33b8514dc7/69e6020c564106783a09ab08/sharks_swimming_around_computer_artpartner-images.com_Alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 21:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Surge, Bomgar, RMM, Exploitation, Demonstrates, Supply, Chain, Risk</media:keywords>
</item>

<item>
<title>22 BRIDGE:BREAK Flaws Expose Thousands of Lantronix and Silex Serial&#45;to&#45;IP Converters</title>
<link>https://block385.com/22-bridgebreak-flaws-expose-thousands-of-lantronix-and-silex-serial-to-ip-converters</link>
<guid>https://block385.com/22-bridgebreak-flaws-expose-thousands-of-lantronix-and-silex-serial-to-ip-converters</guid>
<description><![CDATA[ Cybersecurity researchers have identified 22 new vulnerabilities in popular models of serial-to-IP converters from Lantronix and Silex that could be exploited to hijack susceptible devices and tamper with data exchanged by them.
The vulnerabilities have been collectively codenamed BRIDGE:BREAK by Forescout Research Vedere Labs, which identified nearly 20,000 Serial-to-Ethernet converters exposed ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguDEDMst3MIdrJaNrbo9p_7mjaF2nB_5UuQZR2JhNRNPw8h619BhPWYUZ0yYD-ix_jIluuAwjip4ho4huSuYqr4lXcperdn-4_tFKZ6yivKeOuDJd9O-1EDiwIvD1sPwRGL6keOFr5muqqXp2GWdOlpmi9_uQyREP_iiEz0ZoX-W4ACBSxYarYPb4CJTIY/s1600/hardware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 20:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>BRIDGE:BREAK, Flaws, Expose, Thousands, Lantronix, and, Silex, Serial-to-IP, Converters</media:keywords>
</item>

<item>
<title>22 BRIDGE:BREAK Flaws Expose 20,000 Lantronix and Silex Serial&#45;to&#45;IP Converters</title>
<link>https://block385.com/22-bridgebreak-flaws-expose-20000-lantronix-and-silex-serial-to-ip-converters</link>
<guid>https://block385.com/22-bridgebreak-flaws-expose-20000-lantronix-and-silex-serial-to-ip-converters</guid>
<description><![CDATA[ Cybersecurity researchers have identified 22 new vulnerabilities in popular models of serial-to-IP converters from Lantronix and Silex that could be exploited to hijack susceptible devices and tamper with data exchanged by them.
The vulnerabilities have been collectively codenamed BRIDGE:BREAK by Forescout Research Vedere Labs, which identified nearly 20,000 Serial-to-Ethernet converters exposed ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguDEDMst3MIdrJaNrbo9p_7mjaF2nB_5UuQZR2JhNRNPw8h619BhPWYUZ0yYD-ix_jIluuAwjip4ho4huSuYqr4lXcperdn-4_tFKZ6yivKeOuDJd9O-1EDiwIvD1sPwRGL6keOFr5muqqXp2GWdOlpmi9_uQyREP_iiEz0ZoX-W4ACBSxYarYPb4CJTIY/s1600/hardware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 18:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>BRIDGE:BREAK, Flaws, Expose, 20, 000, Lantronix, and, Silex, Serial-to-IP, Converters</media:keywords>
</item>

<item>
<title>Ransomware Negotiator Pleads Guilty to Aiding BlackCat Attacks in 2023</title>
<link>https://block385.com/ransomware-negotiator-pleads-guilty-to-aiding-blackcat-attacks-in-2023</link>
<guid>https://block385.com/ransomware-negotiator-pleads-guilty-to-aiding-blackcat-attacks-in-2023</guid>
<description><![CDATA[ A third individual who was employed as a ransomware negotiator has pleaded guilty to conducting ransomware attacks against U.S. companies in 2023.
Angelo Martino, 41, of Land O&#039;Lakes, Florida, teamed up with the operators of the BlackCat ransomware starting in April 2023 to assist the e-crime gang in extracting higher amounts as ransoms.
&quot;Working as a negotiator on behalf of five different ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhau3OWhO8rBZT2xz8xcZ90Y8tYMmkZCI81G0GGeUkEHBQi4HzltJJJkzdQr6YS-4R8kZKSAf6Dc9YT6ifgHjmdQSpBvRgJbkEvzIW1dy57LQHQBJkc0YXS3zdYy6TTH8rklsIUGX32R0nk3hBrcYt804nqjBOND_ighh-SHyHHHBt-sJhfOszExZfVmwW8/s1600/ransomware-hacker.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 18:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ransomware, Negotiator, Pleads, Guilty, Aiding, BlackCat, Attacks, 2023</media:keywords>
</item>

<item>
<title>Scattered Spider hacker pleads guilty to stealing $8 million in cryptocurrency</title>
<link>https://block385.com/scattered-spider-hacker-pleads-guilty-to-stealing-8-million-in-cryptocurrency</link>
<guid>https://block385.com/scattered-spider-hacker-pleads-guilty-to-stealing-8-million-in-cryptocurrency</guid>
<description><![CDATA[ A British national tied to the Scattered Spider cybercrime group pleaded guilty to hacking multiple companies via SMS phishing and stealing over $8 million in virtual currency from US victims. Tyler Robert Buchanan, 24, of Dundee, Scotland, pleaded guilty to conspiracy to commit wire fraud and aggravated identity theft. In November 2024, US authorities unsealed criminal charges against Buchanan and four other alleged members of the Scattered Spider group, accusing them of using phishing text … More →
The post Scattered Spider hacker pleads guilty to stealing $8 million in cryptocurrency appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/06/25143238/cyber-threat1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 17:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Scattered, Spider, hacker, pleads, guilty, stealing, million, cryptocurrency</media:keywords>
</item>

<item>
<title>Google Fixes Critical RCE Flaw in AI&#45;Based Antigravity Tool</title>
<link>https://block385.com/google-fixes-critical-rce-flaw-in-ai-based-antigravity-tool</link>
<guid>https://block385.com/google-fixes-critical-rce-flaw-in-ai-based-antigravity-tool</guid>
<description><![CDATA[ The prompt injection vulnerability in the agentic AI product for filesystem operations was a sanitization issue that allowed for sandbox escape and arbitrary code execution. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt603689f53740e77f/69e758abcb63e88a3d9bab05/AI(1800)_NicoElNino_Alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Fixes, Critical, RCE, Flaw, AI-Based, Antigravity, Tool</media:keywords>
</item>

<item>
<title>5 Places where Mature SOCs Keep MTTR Fast and Others Waste Time</title>
<link>https://block385.com/5-places-where-mature-socs-keep-mttr-fast-and-others-waste-time</link>
<guid>https://block385.com/5-places-where-mature-socs-keep-mttr-fast-and-others-waste-time</guid>
<description><![CDATA[ Security teams often present MTTR as an internal KPI. Leadership sees it differently: every hour a threat dwells inside the environment is an hour of potential data exfiltration, service disruption, regulatory exposure, and brand damage. 
The root cause of slow MTTR is almost never &quot;not enough analysts.&quot; It is almost always the same structural problem: threat intelligence that exists ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZct3ObvKWOQuvm1iZXNZ2nc7pHglILHvCbnLW1HDwUNdkgjuBap_OEBwgsXuxXBkIqmlYLgcccvPt28Knlm3jG5B3MOsXk40-bBUlhVLU3BqjWwSlxuSbiyfwHj-S15tikmwmgH37VhkaM5lMC2sL7bod_uOo0VxatuOekhYxdmkci38SzbsnZHkN-ho/s1600/boosters.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 16:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Places, where, Mature, SOCs, Keep, MTTR, Fast, and, Others, Waste, Time</media:keywords>
</item>

<item>
<title>CISA flags another Cisco Catalyst SD&#45;WAN Manager bug as exploited (CVE&#45;2026&#45;20133)</title>
<link>https://block385.com/cisa-flags-another-cisco-catalyst-sd-wan-manager-bug-as-exploited-cve-2026-20133</link>
<guid>https://block385.com/cisa-flags-another-cisco-catalyst-sd-wan-manager-bug-as-exploited-cve-2026-20133</guid>
<description><![CDATA[ CISA added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including a Cisco Catalyst SD-WAN Manager vulnerability (CVE-2026-20133) that Cisco has yet to flag as exploited. Three Cisco Catalyst SD-WAN Manager vulnerabilities Alongside CVE-2026-20133, CISA has also listed CVE-2026-20128 and CVE-2026-20122 – two other Catalyst SD-WAN Manager vulnerabilities – as being leveraged in attacks. The latter two flaws have been confirmed as actively exploited by Cisco in early March 2026. In March, VulnCheck’s … More →
The post CISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/06151815/cisco-1500-hands.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 15:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, flags, another, Cisco, Catalyst, SD-WAN, Manager, bug, exploited, CVE-2026-20133</media:keywords>
</item>

<item>
<title>OpenAI’s Chronicle feature lets Codex read your screen, raising privacy concerns</title>
<link>https://block385.com/openais-chronicle-feature-lets-codex-read-your-screen-raising-privacy-concerns</link>
<guid>https://block385.com/openais-chronicle-feature-lets-codex-read-your-screen-raising-privacy-concerns</guid>
<description><![CDATA[ OpenAI’s Chronicle is a feature designed to help Codex, an AI-powered coding assistant, better understand what users are working on by capturing context directly from their screens. It uses recent screen activity to build memories, allowing Codex to interpret references, identify relevant sources, and pick up on the tools and workflows users rely on, without requiring them to restate context in every prompt. “In these cases, Codex uses Chronicle to provide additional context. When another … More →
The post OpenAI’s Chronicle feature lets Codex read your screen, raising privacy concerns appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05155719/openai-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 15:00:24 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI’s, Chronicle, feature, lets, Codex, read, your, screen, raising, privacy, concerns</media:keywords>
</item>

<item>
<title>Silobreaker Mimir adds agentic AI to intelligence workflows with governance and transparency</title>
<link>https://block385.com/silobreaker-mimir-adds-agentic-ai-to-intelligence-workflows-with-governance-and-transparency</link>
<guid>https://block385.com/silobreaker-mimir-adds-agentic-ai-to-intelligence-workflows-with-governance-and-transparency</guid>
<description><![CDATA[ Silobreaker has announced new agentic AI capabilities that combine faster research and deeper contextual analysis with built-in governance and transparency to ensure trusted intelligence can be safely consumed across the wider enterprise. Silobreaker Mimir is an embedded agentic capability for intelligence operations, working directly within the analyst workflow. It helps teams retrieve evidence, deepen analysis, and turn validated findings into native assets and stakeholder ready outputs, such as creating dashboards and reports, without leaving the … More →
The post Silobreaker Mimir adds agentic AI to intelligence workflows with governance and transparency appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 15:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Silobreaker, Mimir, adds, agentic, intelligence, workflows, with, governance, and, transparency</media:keywords>
</item>

<item>
<title>Ivanti Neurons AI automates IT operations, reducing manual work and security risk</title>
<link>https://block385.com/ivanti-neurons-ai-automates-it-operations-reducing-manual-work-and-security-risk</link>
<guid>https://block385.com/ivanti-neurons-ai-automates-it-operations-reducing-manual-work-and-security-risk</guid>
<description><![CDATA[ Ivanti has revealed new solution capabilities, focusing on enabling autonomous IT operations and organizations to secure their environments more efficiently at scale. With these advancements, Ivanti enables IT and security operations to detect, decide, and act autonomously without sacrificing trust, governance, or control. AI capabilities and the threat landscape are changing quickly, and IT and security teams are under constant pressure to keep systems secure while supporting day-to-day work. That means more devices to manage, … More →
The post Ivanti Neurons AI automates IT operations, reducing manual work and security risk appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 15:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ivanti, Neurons, automates, operations, reducing, manual, work, and, security, risk</media:keywords>
</item>

<item>
<title>Chinese APT Targets Indian Banks, Korean Policy Circles</title>
<link>https://block385.com/chinese-apt-targets-indian-banks-korean-policy-circles</link>
<guid>https://block385.com/chinese-apt-targets-indian-banks-korean-policy-circles</guid>
<description><![CDATA[ China is spying on India&#039;s financial sector, for some reason, and it&#039;s not putting much effort into it, judging by some stale TTPs. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltbcf944fb9a38a8ce/69e680b5c3e9c2d5dd27d590/China_India_Korea-Wirestock_Inc.-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 15:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Chinese, APT, Targets, Indian, Banks, Korean, Policy, Circles</media:keywords>
</item>

<item>
<title>Serial&#45;to&#45;IP Devices Hide Thousands of Old &amp;amp;amp; New Bugs</title>
<link>https://block385.com/serial-to-ip-devices-hide-thousands-of-old-new-bugs</link>
<guid>https://block385.com/serial-to-ip-devices-hide-thousands-of-old-new-bugs</guid>
<description><![CDATA[ The OT devices that translate machine talk into Internet-speak are riddled with vulnerabilities and more frequently targeted for attacks, researchers say. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt36307cc72d4778e2/69dd36cd61216874471aaef1/Industrial_site-Tony_Watson-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 15:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Serial-to-IP, Devices, Hide, Thousands, Old, &amp;amp, New, Bugs</media:keywords>
</item>

<item>
<title>No Exploit Needed: How Attackers Walk Through the Front Door via Identity&#45;Based Attacks</title>
<link>https://block385.com/no-exploit-needed-how-attackers-walk-through-the-front-door-via-identity-based-attacks</link>
<guid>https://block385.com/no-exploit-needed-how-attackers-walk-through-the-front-door-via-identity-based-attacks</guid>
<description><![CDATA[ The cybersecurity industry has spent the last several years chasing sophisticated threats like zero-days, supply chain compromises, and AI-generated exploits. However, the most reliable entry point for attackers still hasn&#039;t changed: stolen credentials.
Identity-based attacks remain a dominant initial access vector in breaches today. Attackers obtain valid credentials through credential stuffing ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEin_RithPNlLYdgxg906-M63Q0-Kv83Kl-WNjK8x5OjKiSgcDMaljvqb7XkLPoEeUDEMRdi4Cqh9DH-pv9QP1ViNjUi3q3qn5r_Lig04a3zO9TgkgiQqSLC50mE6q-6hr94bo4UnXnP5QksLGeAgSOemxUOZaXIw9Z2UHpZuinm7pqF9N0xtJNVovfojx0/s1600/door.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 14:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Exploit, Needed:, How, Attackers, Walk, Through, the, Front, Door, via, Identity-Based, Attacks</media:keywords>
</item>

<item>
<title>NGate Campaign Targets Brazil, Trojanizes HandyPay to Steal NFC Data and PINs</title>
<link>https://block385.com/ngate-campaign-targets-brazil-trojanizes-handypay-to-steal-nfc-data-and-pins</link>
<guid>https://block385.com/ngate-campaign-targets-brazil-trojanizes-handypay-to-steal-nfc-data-and-pins</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a new iteration of an Android malware family calledNGate that has been found to abuse a legitimate application called HandyPay instead of NFCGate.
&quot;The threat actors took the app, which is used to relay NFC data, and patched it with malicious code that appears to have been AI-generated,&quot; ESET security researcher Lukáš Štefanko said in a report ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjcErEs-NVQwFX9tnOmYqQrfDjLm6WUB5jr8ltsA6bMOlVwmDwzBb5RbYAidS2jxdCPQ9RJtsgl453b7KbY8z_6tOjs0VIA7vF8LjM2OJqkZW8c1IM6TYwToxxp4dk8O0KiozATn5L4U40n2HK-Nya7tcimt1exRy9ZtYnri0XyMuM55W5AbC_8EAE0oDQC/s1600/android-nfc.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 14:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NGate, Campaign, Targets, Brazil, Trojanizes, HandyPay, Steal, NFC, Data, and, PINs</media:keywords>
</item>

<item>
<title>Google Patches Antigravity IDE Flaw Enabling Prompt Injection Code Execution</title>
<link>https://block385.com/google-patches-antigravity-ide-flaw-enabling-prompt-injection-code-execution</link>
<guid>https://block385.com/google-patches-antigravity-ide-flaw-enabling-prompt-injection-code-execution</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a vulnerability in Google&#039;s agentic integrated development environment (IDE), Antigravity, that could be exploited to achieve code execution.
The flaw, since patched, combines Antigravity&#039;s permitted file-creation capabilities with an insufficient input sanitization in Antigravity&#039;s native file-searching tool, find_by_name, to bypass the program&#039;s Strict ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsCaDWCQOL4W8DvgT0eI2Q12HA0ThHQO8TZ-X02vqHH4lZfIeUUZ9yeQAHESn6Oe5AoqLEpTuRL9Gco-SPynh5K0fW8D0KFLEvnHnd48MHKL5OUFnw4lOPsAqBg2N8zlCEnoJMM7ZrtxyVuwhytN3SebEbluda4uN12VG2OVi6fV4SItz_57pdCGe7U0ai/s1600/ide.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 14:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Patches, Antigravity, IDE, Flaw, Enabling, Prompt, Injection, Code, Execution</media:keywords>
</item>

<item>
<title>NGate NFC malware targets Android users through trojanized payment app</title>
<link>https://block385.com/ngate-nfc-malware-targets-android-users-through-trojanized-payment-app</link>
<guid>https://block385.com/ngate-nfc-malware-targets-android-users-through-trojanized-payment-app</guid>
<description><![CDATA[ NFC-based payment fraud is expanding geographically and operationally. A campaign active since November 2025 is targeting Android users in Brazil using a new variant of the NGate malware family, this time embedded in a trojanized version of HandyPay, a legitimate NFC relay application available on Google Play since 2021. ESET Research identified the campaign and attributed two separate NGate samples to the same threat actor. Both samples are distributed from the same domain and use … More →
The post NGate NFC malware targets Android users through trojanized payment app appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/21081703/ngate_nfc-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 13:00:22 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NGate, NFC, malware, targets, Android, users, through, trojanized, payment, app</media:keywords>
</item>

<item>
<title>A single platform powers SIM farm proxy networks across 17 countries</title>
<link>https://block385.com/a-single-platform-powers-sim-farm-proxy-networks-across-17-countries</link>
<guid>https://block385.com/a-single-platform-powers-sim-farm-proxy-networks-across-17-countries</guid>
<description><![CDATA[ Racks of phones and 4G modems, connected to carrier networks and rented out as commercial mobile proxy services, are operating across at least 94 locations in 17 countries. An investigation by infrastructure intelligence firm Infrawatch traced a large portion of those deployments to a shared software platform called ProxySmart, built and operated out of Minsk, Belarus. SIM farm (Source: Infrawatch) Infrawatch identified 87 distinct instances of the ProxySmart control panel exposed on the internet, spread … More →
The post A single platform powers SIM farm proxy networks across 17 countries appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/28163349/malware-danger-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 13:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>single, platform, powers, SIM, farm, proxy, networks, across, countries</media:keywords>
</item>

<item>
<title>CISA Adds 8 Exploited Flaws to KEV, Sets April&#45;May 2026 Federal Deadlines</title>
<link>https://block385.com/cisa-adds-8-exploited-flaws-to-kev-sets-april-may-2026-federal-deadlines</link>
<guid>https://block385.com/cisa-adds-8-exploited-flaws-to-kev-sets-april-may-2026-federal-deadlines</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including three flaws impacting Cisco Catalyst SD-WAN Manager, citing evidence of active exploitation.
The list of vulnerabilities is as follows -

CVE-2023-27351 (CVSS score: 8.2) - An improper authentication vulnerability in PaperCut ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzjZ6Llk3l-F3OFNRpNKvTziH1GObU6niwTMke4hEeI5bVXCcILs3kb25Dehkk1VCBf8NzEEPMLxElgbqLzAq0I1GuFAsDojdbVw-R6CGW6-qMXPaeiKXzQqn9JUL-VoPCVMx8h7FrOXIovnLwLv7T-O2wLdc4kIDA0bftbBDp9kwoDmqq6iYYlaZF6Qaz/s1600/cisa-kev.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 10:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Adds, Exploited, Flaws, KEV, Sets, April-May, 2026, Federal, Deadlines</media:keywords>
</item>

<item>
<title>Cybersecurity jobs available right now: April 21, 2026</title>
<link>https://block385.com/cybersecurity-jobs-available-right-now-april-21-2026</link>
<guid>https://block385.com/cybersecurity-jobs-available-right-now-april-21-2026</guid>
<description><![CDATA[ Application Security Engineer (DevSecOps / Azure DevOps) BEWAHARVEST | Philippines | Hybrid – View job details As an Application Security Engineer (DevSecOps / Azure DevOps), you will embed security across the SDLC by working with engineering and DevOps teams to implement automated security controls and testing. You will manage application security programs including SAST, DAST, SCA, IAST, and RASP, integrating them into Azure DevOps pipelines with enforceable quality gates. You will perform API security testing, … More →
The post Cybersecurity jobs available right now: April 21, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11140416/cybersecurity_jobs-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 07:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybersecurity, jobs, available, right, now:, April, 21, 2026</media:keywords>
</item>

<item>
<title>Researchers build an encrypted routing layer for private AI inference</title>
<link>https://block385.com/researchers-build-an-encrypted-routing-layer-for-private-ai-inference</link>
<guid>https://block385.com/researchers-build-an-encrypted-routing-layer-for-private-ai-inference</guid>
<description><![CDATA[ Organizations in healthcare, finance, and other sensitive industries want to use large AI models without exposing private data to the cloud servers running those models. A cryptographic technique called Secure Multi-Party Computation (MPC) makes this possible. It splits data into encrypted fragments, distributes them across two or more servers that do not share information with each other, and lets those servers compute an AI result without either one ever seeing the raw input. The catch … More →
The post Researchers build an encrypted routing layer for private AI inference appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/12093307/brain-ai-intelligence-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 07:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, build, encrypted, routing, layer, for, private, inference</media:keywords>
</item>

<item>
<title>Vercel Employee&amp;apos;s AI Tool Access Led to Data Breach</title>
<link>https://block385.com/vercel-employees-ai-tool-access-led-to-data-breach</link>
<guid>https://block385.com/vercel-employees-ai-tool-access-led-to-data-breach</guid>
<description><![CDATA[ Stolen OAuth tokens, which are at the root of these breaches, &quot;are the new attack surface, the new lateral movement,&quot; a researcher noted. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3396b116c4a5d80b/69e6744aa61d112dbb7caf20/allow_access_keyboard_alon_harel_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 21 Apr 2026 01:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vercel, Employees, Tool, Access, Led, Data, Breach</media:keywords>
</item>

<item>
<title>Serial&#45;to&#45;IP Devices Hide Thousands of Old and New Bugs</title>
<link>https://block385.com/serial-to-ip-devices-hide-thousands-of-old-and-new-bugs</link>
<guid>https://block385.com/serial-to-ip-devices-hide-thousands-of-old-and-new-bugs</guid>
<description><![CDATA[ The OT devices that translate machine talk into Internet-speak are riddled with vulnerabilities and more frequently targeted for attacks, researchers say. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt36307cc72d4778e2/69dd36cd61216874471aaef1/Industrial_site-Tony_Watson-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 23:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Serial-to-IP, Devices, Hide, Thousands, Old, and, New, Bugs</media:keywords>
</item>

<item>
<title>SGLang CVE&#45;2026&#45;5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files</title>
<link>https://block385.com/sglang-cve-2026-5760-cvss-98-enables-rce-via-malicious-gguf-model-files</link>
<guid>https://block385.com/sglang-cve-2026-5760-cvss-98-enables-rce-via-malicious-gguf-model-files</guid>
<description><![CDATA[ A critical security vulnerability has been disclosed in SGLang that, if successfully exploited, could result in remote code execution on susceptible systems.
The vulnerability, tracked as CVE-2026-5760, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of command injection leading to the execution of arbitrary code.
SGLang is a high-performance, open-source serving ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHmSpfy0MbO4mTB5B4TYrJzfBNO0HD2Z194J1U3YlwUQpQsTGompmNqR7_Rx4nbgPXHs3Mel7tBcZDXOVeYDXev1luKnr5VUzbmPornwB-bcciiA_Zvmam5q9lwPK5b9K-my0_a1VBjA-2Pjmb31yWEiyBAl_ipNM5gvJM19yxcT-Q468-8VL8KrfCYHen/s1600/sgll.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 22:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SGLang, CVE-2026-5760, CVSS, 9.8, Enables, RCE, via, Malicious, GGUF, Model, Files</media:keywords>
</item>

<item>
<title>Product showcase: Syncthing for secure, private file synchronization</title>
<link>https://block385.com/product-showcase-syncthing-for-secure-private-file-synchronization</link>
<guid>https://block385.com/product-showcase-syncthing-for-secure-private-file-synchronization</guid>
<description><![CDATA[ Syncthing is a free and open-source application that synchronizes files directly between your devices. Instead of uploading data to a central server, it uses a peer-to-peer approach, transferring files whenever peers are online. This decentralized model ensures that your data remains private and under your control. Syncthing monitors shared folders for changes. When a file is created, modified, or removed, updates are propagated to connected peers. Synchronization happens automatically once they are online, keeping folder … More →
The post Product showcase: Syncthing for secure, private file synchronization appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16133444/synchthing-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:19 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Product, showcase:, Syncthing, for, secure, private, file, synchronization</media:keywords>
</item>

<item>
<title>How to spot a North Korean fake in a job interview</title>
<link>https://block385.com/how-to-spot-a-north-korean-fake-in-a-job-interview</link>
<guid>https://block385.com/how-to-spot-a-north-korean-fake-in-a-job-interview</guid>
<description><![CDATA[ North Korean operatives are getting hired at companies by passing job interviews using fake identities and AI tools. In this Help Net Security video, Adrian Cheek, a senior cybercrime researcher at Flare, outlines several ways organizations can catch these attempts before extending an offer. Basic video checks, like asking candidates to move their head or place objects in front of the camera, can expose low-quality deepfake setups. Requiring an in-person interview at a later stage … More →
The post How to spot a North Korean fake in a job interview appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16065400/north_korean-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:18 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, spot, North, Korean, fake, job, interview</media:keywords>
</item>

<item>
<title>SmokedMeat: Open&#45;source tool shows what attackers do inside CI/CD pipelines</title>
<link>https://block385.com/smokedmeat-open-source-tool-shows-what-attackers-do-inside-cicd-pipelines</link>
<guid>https://block385.com/smokedmeat-open-source-tool-shows-what-attackers-do-inside-cicd-pipelines</guid>
<description><![CDATA[ Boost Security has released SmokedMeat, an open-source framework that runs attack chains against CI/CD infrastructure so engineering and security teams can see what an attacker would do in their specific environment. What the tool does SmokedMeat takes a flagged pipeline vulnerability and executes a live demonstration against a team’s own infrastructure. Starting from a single vulnerability, it deploys a payload, compromises the runner, harvests credentials from process memory, exchanges those credentials for cloud access, exposes … More →
The post SmokedMeat: Open-source tool shows what attackers do inside CI/CD pipelines appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16194738/smokedmeat-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SmokedMeat:, Open-source, tool, shows, what, attackers, inside, CICD, pipelines</media:keywords>
</item>

<item>
<title>EU pushes for stronger cloud sovereignty, awards €180 million to four providers</title>
<link>https://block385.com/eu-pushes-for-stronger-cloud-sovereignty-awards-180-million-to-four-providers</link>
<guid>https://block385.com/eu-pushes-for-stronger-cloud-sovereignty-awards-180-million-to-four-providers</guid>
<description><![CDATA[ The European Commission is stepping up efforts to strengthen the EU’s digital sovereignty by awarding a cloud services tender worth up to €180 million over six years. The initiative gives EU institutions and agencies access to sovereign cloud services delivered by a group of Europe-based providers. Four vendors were selected under the tender. Post Telecom will work with CleverCloud and OVHcloud, while STACKIT and Scaleway secured contracts independently. Proximus joins the list through partnerships with … More →
The post EU pushes for stronger cloud sovereignty, awards €180 million to four providers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/03083348/eu-stars-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:15 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>pushes, for, stronger, cloud, sovereignty, awards, €180, million, four, providers</media:keywords>
</item>

<item>
<title>Meta and PortSwigger drive offensive security further to find what others miss</title>
<link>https://block385.com/meta-and-portswigger-drive-offensive-security-further-to-find-what-others-miss</link>
<guid>https://block385.com/meta-and-portswigger-drive-offensive-security-further-to-find-what-others-miss</guid>
<description><![CDATA[ Meta Bug Bounty and PortSwigger have formed a partnership to help security researchers sharpen their skills, collaborate more closely, and improve vulnerability discovery. The initiative combines Meta’s bug bounty program with PortSwigger’s Burp Suite, reflecting a shared focus on improving both tooling and education for the global security community. “By joining forces, we’re not just offering resources; we’re building bridges between communities,” Meta Bug Bounty said. In this collaboration, PortSwigger is providing Burp Suite Professional … More →
The post Meta and PortSwigger drive offensive security further to find what others miss appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/09135147/meta-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Meta, and, PortSwigger, drive, offensive, security, further, find, what, others, miss</media:keywords>
</item>

<item>
<title>AI platform ATHR makes voice phishing a one&#45;person job</title>
<link>https://block385.com/ai-platform-athr-makes-voice-phishing-a-one-person-job</link>
<guid>https://block385.com/ai-platform-athr-makes-voice-phishing-a-one-person-job</guid>
<description><![CDATA[ For $4,000 and a cut of the take, a lone criminal can now run a fully automated voice-phishing operation via ATHR, a plaform that spoofs emails alerts from Google, Microsoft, and Coinbase, buries a phone number in each message, and when the victim calls back, hands them off to either a human scammer or an AI voice agent. ATHR for sale AI is becoming part of everyday criminal workflows, and fueling the rise in cyber … More →
The post AI platform ATHR makes voice phishing a one-person job appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/20113549/robocaller-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>platform, ATHR, makes, voice, phishing, one-person, job</media:keywords>
</item>

<item>
<title>Vercel breached via compromised third&#45;party AI tool</title>
<link>https://block385.com/vercel-breached-via-compromised-third-party-ai-tool</link>
<guid>https://block385.com/vercel-breached-via-compromised-third-party-ai-tool</guid>
<description><![CDATA[ Cloud deployment and hosting platform Vercel has suffered a security breach that resulted in attackers accessing some of its internal systems and compromising Vercel credentials of a “limited subset of customers”. Advice for affected customers “The incident originated with a compromise of Context.ai, a third-party AI tool used by a Vercel employee,” the Vercel security team explained in a post published on Sunday. “The attacker used that access to take over the employee’s Vercel Google … More →
The post Vercel breached via compromised third-party AI tool appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/20165413/vercel-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vercel, breached, via, compromised, third-party, tool</media:keywords>
</item>

<item>
<title>WhatsApp Leaks User Metadata to Attackers</title>
<link>https://block385.com/whatsapp-leaks-user-metadata-to-attackers</link>
<guid>https://block385.com/whatsapp-leaks-user-metadata-to-attackers</guid>
<description><![CDATA[ Strangers can infer limited info about you without knowing or messaging you, which could theoretically aid certain kinds of malicious activity. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd2f4132144e85dfb/69e291d49ba34f4b11a4782a/WhatsApp-stLegat-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>WhatsApp, Leaks, User, Metadata, Attackers</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge &amp;amp; More</title>
<link>https://block385.com/weekly-recap-vercel-hack-push-fraud-qemu-abused-new-android-rats-emerge-more</link>
<guid>https://block385.com/weekly-recap-vercel-hack-push-fraud-qemu-abused-new-android-rats-emerge-more</guid>
<description><![CDATA[ Monday’s recap shows the same pattern in different places. A third-party tool becomes a way in, then leads to internal access. A trusted download path is briefly swapped to deliver malware. Browser extensions act normally while pulling data and running code. Even update channels are used to push payloads. It’s not breaking systems—it’s bending trust.
There’s also a shift in how attacks run. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirkQSoHlNZvcdjrevc7r-D8mPj49i3XRimQjk-HtEVDYVX4vKEcW4JLiTblV5oI8MtUib2Q5iFerdt0x4_mGDvMJqsDd2wX6QNQxM25Wnrq-MRYADw1YuJly5yoSTIz_ToqlWsAKA2hLwru4Crx8aSguTETpDl4mjRfrCg0G8Cca5Rk0Am6FCwRCNPIqBy/s1600/recap-april.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 16:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>⚡, Weekly, Recap:, Vercel, Hack, Push, Fraud, QEMU, Abused, New, Android, RATs, Emerge, More</media:keywords>
</item>

<item>
<title>Coast Guard&amp;apos;s New Cybersecurity Rules Offer Lessons for CISOs</title>
<link>https://block385.com/coast-guards-new-cybersecurity-rules-offer-lessons-for-cisos</link>
<guid>https://block385.com/coast-guards-new-cybersecurity-rules-offer-lessons-for-cisos</guid>
<description><![CDATA[ The Maritime Transportation Security Act (MTSA) requires plans to protect OT systems, audits by independent third parties, and a hybrid OT-security role. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6abfeadd95d5d9a7/69e150afd52b1acba510683c/maritime-shipping-GreenOak-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 15:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Coast, Guards, New, Cybersecurity, Rules, Offer, Lessons, for, CISOs</media:keywords>
</item>

<item>
<title>Why Most AI Deployments Stall After the Demo</title>
<link>https://block385.com/why-most-ai-deployments-stall-after-the-demo</link>
<guid>https://block385.com/why-most-ai-deployments-stall-after-the-demo</guid>
<description><![CDATA[ The fastest way to fall in love with an AI tool is to watch the demo.
Everything moves quickly. Prompts land cleanly. The system produces impressive outputs in seconds. It feels like the beginning of a new era for your team.
But most AI initiatives don&#039;t fail because of bad technology. They stall because what worked in the demo doesn&#039;t survive contact with real operations. The gap between a ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihbqFqPAZp1E63toW329kiZdn6SI22yIZDqIGwAsO9Q2_Xi8g6qCWwj0dH2A4LupHGVzobsdiP9dcvAoSzXSKkte4q0yLnAN2V5wsntPma9PIiv4SzNQnU3wkFCztV-N8Dn36S_oP9tq3obvAVOUUPegjGguA1SUVYR2ptZigH9ET-5dTVZU966eoLh9A/s1600/tines.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 14:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, Most, Deployments, Stall, After, the, Demo</media:keywords>
</item>

<item>
<title>Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain</title>
<link>https://block385.com/anthropic-mcp-design-vulnerability-enables-rce-threatening-ai-supply-chain</link>
<guid>https://block385.com/anthropic-mcp-design-vulnerability-enables-rce-threatening-ai-supply-chain</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a critical &quot;by design&quot; weakness in the Model Context Protocol&#039;s (MCP) architecture that could pave the way for remote code execution and have a cascading effect on the artificial intelligence (AI) supply chain.
&quot;This flaw enables Arbitrary Command Execution (RCE) on any system running a vulnerable MCP implementation, granting attackers direct access to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbUnokdbuoiv9j36ekgZbT7VQVSUJBbB4xzoXJKD8iTTO76tSRyhXGdOk2aZKX-RU_WeGyRzHfAf0zwva_cSY7JL5a7Fhmrtzjd-p-kg6JK75nE-nQiSESaDAHlyTN8be1iUFxp9xCq94-1JwZ16pwYZJkKxIFwqa8vNmfxZl8OCXRWnT0GKWOpYVPgbMb/s1600/mcp.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 14:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Anthropic, MCP, Design, Vulnerability, Enables, RCE, Threatening, Supply, Chain</media:keywords>
</item>

<item>
<title>Researchers Detect ZionSiphon Malware Targeting Israeli Water, Desalination OT Systems</title>
<link>https://block385.com/researchers-detect-zionsiphon-malware-targeting-israeli-water-desalination-ot-systems</link>
<guid>https://block385.com/researchers-detect-zionsiphon-malware-targeting-israeli-water-desalination-ot-systems</guid>
<description><![CDATA[ Cybersecurity researchers have flagged a new malware called ZionSiphon that appears to be specifically designed to target Israeli water treatment and desalination systems.
The malware has been codenamed ZionSiphon by Darktrace, highlighting its ability to set up persistence, tamper with local configuration files, and scan for operational technology (OT)-relevant services on the local subnet. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihoHF4qP6hw3msdH8s3stwjZR1a2Aqp6kSB97wFpmQefaNtVM8lc-Eu0Gv3jeMK2qa9aLGjSSZp3cJGNaE3eft6h17HnKqPGlhLbfkVzLqfv3VW-SEDLToW6z8SGiDeSE8jXdHyNqxqG_a4B34PjM3rbiOddEvQlgOFfbow8n6V_qGB-70uEj9fRrNLVOt/s1600/water.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, Detect, ZionSiphon, Malware, Targeting, Israeli, Water, Desalination, Systems</media:keywords>
</item>

<item>
<title>Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials</title>
<link>https://block385.com/vercel-breach-tied-to-context-ai-hack-exposes-limited-customer-credentials</link>
<guid>https://block385.com/vercel-breach-tied-to-context-ai-hack-exposes-limited-customer-credentials</guid>
<description><![CDATA[ Web infrastructure provider Vercel has disclosed a security breach that allows bad actors to gain unauthorized access to &quot;certain&quot; internal Vercel systems.
The incident stemmed from the compromise of Context.ai, a third-party artificial intelligence (AI) tool, that was used by an employee at the company.
&quot;The attacker used that access to take over the employee&#039;s Vercel Google Workspace account, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjcLAcekric_be3bGt2lBu4NxiCcd3FZap2VzD0r9Z8zGegVjwixsexsGVGVmwvLwpaercKHyq9BFA7WV2a_DApLP7qpjg17hE8bu63FHsBoW1wFV0BJmATkuKIM1YU2bf8v9gRPM_tyw8RNINMSXiwzM5jbxjamO8HYm-VsVxgB0lbyRKr4kNuzzRY-JXq/s1600/breach.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 20 Apr 2026 08:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vercel, Breach, Tied, Context, Hack, Exposes, Limited, Customer, Credentials</media:keywords>
</item>

<item>
<title>Week in review: Acrobat Reader flaw exploited, Claude Mythos offensive capabilities and limits</title>
<link>https://block385.com/week-in-review-acrobat-reader-flaw-exploited-claude-mythos-offensive-capabilities-and-limits</link>
<guid>https://block385.com/week-in-review-acrobat-reader-flaw-exploited-claude-mythos-offensive-capabilities-and-limits</guid>
<description><![CDATA[ Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Bringing governance and visibility to machine and AI identities In this Help Net Security interview, Archit Lohokare, CEO of AppViewX, explains how the rise of AI marked a turning point where machine and AI agent identities began converging into a single problem. Drawing on his experience across IBM and CyberArk, he describes the shift from human-driven systems to autonomous machines. … More →
The post Week in review: Acrobat Reader flaw exploited, Claude Mythos offensive capabilities and limits appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/12/01112506/cybersecurity_week_in_review2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 19 Apr 2026 11:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Week, review:, Acrobat, Reader, flaw, exploited, Claude, Mythos, offensive, capabilities, and, limits</media:keywords>
</item>

<item>
<title>[Webinar] Eliminate Ghost Identities Before They Expose Your Enterprise Data</title>
<link>https://block385.com/webinar-eliminate-ghost-identities-before-they-expose-your-enterprise-data</link>
<guid>https://block385.com/webinar-eliminate-ghost-identities-before-they-expose-your-enterprise-data</guid>
<description><![CDATA[ In 2024, compromised service accounts and forgotten API keys were behind 68% of cloud breaches. Not phishing. Not weak passwords. Unmanaged non-human identities that nobody was watching.
For every employee in your org, there are 40 to 50 automated credentials: service accounts, API tokens, AI agent connections, and OAuth grants. When projects end or employees leave, most ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6vJpO9kksCQDpSksNkqDFNUCbXD70dMGYqI6P9S_XPMY5d8BR8PVdrsVQP1ZJO_-nzL6eQShM3Cap9heQ5kAglsPjfxwIcXPSsf_cfgUVnGQ2XzIWVOuo7JhxMjnHYDN6r9KlQ6LqZJisRZkjatnWChuzUkSlXRa1hFseUPq28PZ5gjGR7L2WzTFdZ3fM/s1600/ghost.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 18 Apr 2026 12:30:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Webinar, Eliminate, Ghost, Identities, Before, They, Expose, Your, Enterprise, Data</media:keywords>
</item>

<item>
<title>$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims</title>
<link>https://block385.com/1374m-hack-shuts-down-sanctioned-grinex-exchange-after-intelligence-claims</link>
<guid>https://block385.com/1374m-hack-shuts-down-sanctioned-grinex-exchange-after-intelligence-claims</guid>
<description><![CDATA[ Grinex, a Kyrgyzstan-incorporated cryptocurrency exchange sanctioned by the U.K. and the U.S. last year, said it&#039;s suspending operations after it blamed Western intelligence agencies for a $13.74 million hack.
The exchange said it fell victim to what it described as a large-scale cyber attack that bore hallmarks of foreign intelligence agency involvement. This attack led to the theft of over 1 ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPcUvJCFRqDmEr1ZDSaUJCAymmKwZOeXdmfPY6Eekp7tLOpqjXLKHilHOHlNyuxmennQE8H5oxuRTaCncC8hsoGYEloD8OrDlR1wpbxGivBBB7KdVX8kiv_pOzC6GQ7LNPKoJGkFklpW0XutuLRPjl3I5cPta1n-BqVyAdO1luW3EUR8jyiZEtVjVTGWUK/s1600/grinex.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 18 Apr 2026 12:30:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>13.74M, Hack, Shuts, Down, Sanctioned, Grinex, Exchange, After, Intelligence, Claims</media:keywords>
</item>

<item>
<title>Mirai Variant Nexcorium Exploits CVE&#45;2024&#45;3721 to Hijack TBK DVRs for DDoS Botnet</title>
<link>https://block385.com/mirai-variant-nexcorium-exploits-cve-2024-3721-to-hijack-tbk-dvrs-for-ddos-botnet</link>
<guid>https://block385.com/mirai-variant-nexcorium-exploits-cve-2024-3721-to-hijack-tbk-dvrs-for-ddos-botnet</guid>
<description><![CDATA[ Threat actors are exploiting security flaws in TBK DVR and end‑of‑life (EoL) TP-Link Wi-Fi routers to deploy Mirai-botnet variants on compromised devices, according to findings from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42.
The attack targeting TBK DVR devices has been found to exploit CVE-2024-3721 (CVSS score: 6.3), a medium-severity command injection vulnerability affecting ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6cxZZMfiWctk3Me9QO6UlzVRFab0SPGMTzThjpcPHCXm49bQ0rRvtG2W6gicJw4Mi1QUuv-yTDMK5GKJju3QicyjYJwdbA86Ok8w2oU5Vg28l4s0HAVv7_c03dStaM7OPd4Yq0khmm9MeQVUYnCYThMx4JvkCnZZ5PEtCXAA90vKfsAumsMAIw085JIsz/s1600/botnet-ddos.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 18 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mirai, Variant, Nexcorium, Exploits, CVE-2024-3721, Hijack, TBK, DVRs, for, DDoS, Botnet</media:keywords>
</item>

<item>
<title>Codex can now operate between apps. Where are the boundaries?</title>
<link>https://block385.com/codex-can-now-operate-between-apps-where-are-the-boundaries</link>
<guid>https://block385.com/codex-can-now-operate-between-apps-where-are-the-boundaries</guid>
<description><![CDATA[ OpenAI is rolling out a major update to the Codex desktop app for users signed in with ChatGPT. Personalization features, including context-aware suggestions and memory, will roll out to Enterprise, Edu, and users in the EU and UK soon. Computer use is initially available on macOS and will expand to EU and UK users in the near future. Screenshot of Codex computer use on Mac (Source: OpenAI) The update expands Codex into a more capable … More →
The post Codex can now operate between apps. Where are the boundaries? appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05155719/openai-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 23:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Codex, can, now, operate, between, apps., Where, are, the, boundaries</media:keywords>
</item>

<item>
<title>How NIST&amp;apos;s Cutback of CVE Handling Impacts Cyber Teams</title>
<link>https://block385.com/how-nists-cutback-of-cve-handling-impacts-cyber-teams</link>
<guid>https://block385.com/how-nists-cutback-of-cve-handling-impacts-cyber-teams</guid>
<description><![CDATA[ Industry and ad hoc coalitions appear poised to help fill the gap created by NIST&#039;s decision to cut back on CVE data enrichment. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf63750cb2e1d5266/69e26d60df4579bd291869e2/NIST_HQ_Grandbrothers_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, NISTs, Cutback, CVE, Handling, Impacts, Cyber, Teams</media:keywords>
</item>

<item>
<title>Tycoon 2FA Phishers Scatter, Adopt Device Code Phishing</title>
<link>https://block385.com/tycoon-2fa-phishers-scatter-adopt-device-code-phishing</link>
<guid>https://block385.com/tycoon-2fa-phishers-scatter-adopt-device-code-phishing</guid>
<description><![CDATA[ In embracing device code phishing, attackers trick victims into handing over account access by using a service&#039;s legitimate new-device login flow. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt70085bc1304b3cb3/69e2855c41f7f85ddb368bc3/QR_code-Harry_Wedzinga-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tycoon, 2FA, Phishers, Scatter, Adopt, Device, Code, Phishing</media:keywords>
</item>

<item>
<title>Every Old Vulnerability Is Now an AI Vulnerability</title>
<link>https://block385.com/every-old-vulnerability-is-now-an-ai-vulnerability</link>
<guid>https://block385.com/every-old-vulnerability-is-now-an-ai-vulnerability</guid>
<description><![CDATA[ AI&#039;s danger isn&#039;t that it&#039;s creating new bugs, it&#039;s that it&#039;s amplifying old ones. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc29c0d49db0e3dc1/69e15cd7061435b0d4675403/cute_robot_power_off_button.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 19:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Every, Old, Vulnerability, Now, Vulnerability</media:keywords>
</item>

<item>
<title>Three Microsoft Defender Zero&#45;Days Actively Exploited; Two Still Unpatched</title>
<link>https://block385.com/three-microsoft-defender-zero-days-actively-exploited-two-still-unpatched</link>
<guid>https://block385.com/three-microsoft-defender-zero-days-actively-exploited-two-still-unpatched</guid>
<description><![CDATA[ Huntress is warning that threat actors are exploiting three recently disclosed security flaws in Microsoft Defender to gain elevated privileges in compromised systems.
The activity involves the exploitation of three vulnerabilities that are codenamed BlueHammer (requires GitHub sign-in), RedSun, and UnDefend, all of which were released as zero-days by a researcher known as Chaotic Eclipse ( ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJ8x3Yg0CYomOu1IpHfhfmiqJtgaMSnnoE2tJR6RdXGIy1rLRTORge-ukCLYkEj6xzeGTvmuy-68qfU4me_nG7pvwZi21h7ycQFwY3OXCH1_p_g35BAYeaHdz3uRKJD2mQCjUIcxha2WzMePpup2VHarxZVxy3QNtaRAjET-2FK7GemiuvyI8MpNPFVyEQ/s1600/defender.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 16:30:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Three, Microsoft, Defender, Zero-Days, Actively, Exploited, Two, Still, Unpatched</media:keywords>
</item>

<item>
<title>Mozilla challenges enterprise AI providers with Thunderbolt, open&#45;source AI client under your control</title>
<link>https://block385.com/mozilla-challenges-enterprise-ai-providers-with-thunderbolt-open-source-ai-client-under-your-control</link>
<guid>https://block385.com/mozilla-challenges-enterprise-ai-providers-with-thunderbolt-open-source-ai-client-under-your-control</guid>
<description><![CDATA[ For organizations that want to keep company data within their own systems and have more control over how AI is deployed, Mozilla is offering an alternative to externally hosted AI services with Thunderbolt, an open-source AI client designed for self-hosted use. Thunderbolt is available through a waitlist, with native applications for web, macOS, Windows, Linux, iOS, and Android. Its source code is published on GitHub. Mozilla says Thunderbolt “gives organizations what proprietary AI services can’t,” … More →
The post Mozilla challenges enterprise AI providers with Thunderbolt, open-source AI client under your control appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16201730/mozilla_thunderbolt-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:50 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mozilla, challenges, enterprise, providers, with, Thunderbolt, open-source, client, under, your, control</media:keywords>
</item>

<item>
<title>Liongard upgrades LiongardIQ with AI access, live asset data, and deeper discovery</title>
<link>https://block385.com/liongard-upgrades-liongardiq-with-ai-access-live-asset-data-and-deeper-discovery</link>
<guid>https://block385.com/liongard-upgrades-liongardiq-with-ai-access-live-asset-data-and-deeper-discovery</guid>
<description><![CDATA[ Liongard has announced the expansion of LiongardIQ with new capabilities spanning programmatic AI integration, conversational querying, enhanced network discovery, and deeper identity mapping, extending its system of authority for asset intelligence across the full IT stack. Without a trusted foundation of asset intelligence, automation runs on assumptions, AI agents query stale data, and security gaps go undetected. LiongardIQ is that foundation, continuously discovering and monitoring every asset, identity, and configuration across the IT stack. “The … More →
The post Liongard upgrades LiongardIQ with AI access, live asset data, and deeper discovery appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:46 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Liongard, upgrades, LiongardIQ, with, access, live, asset, data, and, deeper, discovery</media:keywords>
</item>

<item>
<title>GitLab 18.11 brings agentic AI to security fixes, CI pipelines, and delivery analytics</title>
<link>https://block385.com/gitlab-1811-brings-agentic-ai-to-security-fixes-ci-pipelines-and-delivery-analytics</link>
<guid>https://block385.com/gitlab-1811-brings-agentic-ai-to-security-fixes-ci-pipelines-and-delivery-analytics</guid>
<description><![CDATA[ GitLab has released GitLab 18.11, expanding agentic AI across the entire software lifecycle with security remediation, pipeline configuration, and delivery analytics. AI-generated code moves faster than the systems around it can keep up with, creating the AI paradox: faster code generation without faster delivery, security, or operations to match. As code volume grows, so does the backlog of pipelines to configure, security findings to remediate, and delivery questions to answer. GitLab 18.11 helps address those … More →
The post GitLab 18.11 brings agentic AI to security fixes, CI pipelines, and delivery analytics appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:38 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GitLab, 18.11, brings, agentic, security, fixes, pipelines, and, delivery, analytics</media:keywords>
</item>

<item>
<title>Researcher drops two more Microsoft Defender zero&#45;days, all three now exploited in the wild</title>
<link>https://block385.com/researcher-drops-two-more-microsoft-defender-zero-days-all-three-now-exploited-in-the-wild</link>
<guid>https://block385.com/researcher-drops-two-more-microsoft-defender-zero-days-all-three-now-exploited-in-the-wild</guid>
<description><![CDATA[ The security researcher who earlier this month published a proof-of-concept (PoC) exploit for a zero-day privilege escalation vulnerability in Microsoft Defender is back with two more. The first, dubbed “RedSun,” is another privilege escalation flaw in the same platform. The second, “UnDefend,” allows a standard user to block Microsoft Defender from receiving signature updates or disable it entirely (if Microsoft pushes a major Defender update). And, according to Huntress researchers, all three exploitation techniques have … More →
The post Researcher drops two more Microsoft Defender zero-days, all three now exploited in the wild appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/03115429/microsoft-windows-defender-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:25 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researcher, drops, two, more, Microsoft, Defender, zero-days, all, three, now, exploited, the, wild</media:keywords>
</item>

<item>
<title>Google wipes out 602 million scam ads with Gemini on duty</title>
<link>https://block385.com/google-wipes-out-602-million-scam-ads-with-gemini-on-duty</link>
<guid>https://block385.com/google-wipes-out-602-million-scam-ads-with-gemini-on-duty</guid>
<description><![CDATA[ Google claims that its security teams work around the clock using its Gemini AI models to detect and stop harmful ads. “Bad actors are using generative AI to create deceptive ads at scale, and Gemini helps us detect and block them in real time” Keerat Sharma, VP and GM, Ads Privacy and Safety, Google, said. “Our models analyze hundreds of billions of signals — including account age, behavioral cues and campaign patterns — to stop … More →
The post Google wipes out 602 million scam ads with Gemini on duty appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/12/07063943/google_gemini.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, wipes, out, 602, million, scam, ads, with, Gemini, duty</media:keywords>
</item>

<item>
<title>Coast Guard&amp;apos;s New Cybersecurity Rules Offers Lessons for CISOs</title>
<link>https://block385.com/coast-guards-new-cybersecurity-rules-offers-lessons-for-cisos</link>
<guid>https://block385.com/coast-guards-new-cybersecurity-rules-offers-lessons-for-cisos</guid>
<description><![CDATA[ The Maritime Transportation Security Act (MTSA) requires plans to protect OT systems, audits by independent third parties, and a hybrid OT-security role. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6abfeadd95d5d9a7/69e150afd52b1acba510683c/maritime-shipping-GreenOak-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Coast, Guards, New, Cybersecurity, Rules, Offers, Lessons, for, CISOs</media:keywords>
</item>

<item>
<title>NIST Revamps CVE Framework to Focus on High&#45;Impact Vulnerabilities</title>
<link>https://block385.com/nist-revamps-cve-framework-to-focus-on-high-impact-vulnerabilities</link>
<guid>https://block385.com/nist-revamps-cve-framework-to-focus-on-high-impact-vulnerabilities</guid>
<description><![CDATA[ The National Institute of Standards and Technology carved a new path for vulnerability remediation by changing the way it prioritizes software flaws. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blta5e672c25e2a318e/689359079136f61896630252/vulnerability-ktdesign-AdobeStock.jpeg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 15:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NIST, Revamps, CVE, Framework, Focus, High-Impact, Vulnerabilities</media:keywords>
</item>

<item>
<title>Google Blocks 8.3B Policy&#45;Violating Ads in 2025, Launches Android 17 Privacy Overhaul</title>
<link>https://block385.com/google-blocks-83b-policy-violating-ads-in-2025-launches-android-17-privacy-overhaul</link>
<guid>https://block385.com/google-blocks-83b-policy-violating-ads-in-2025-launches-android-17-privacy-overhaul</guid>
<description><![CDATA[ Google this week announced a new set of Play policy updates to strengthen user privacy and protect businesses against fraud, even as it revealed it blocked or removed over 8.3 billion ads globally and suspended 24.9 million accounts in 2025.
The new policy updates relate to contact and location permissions in Android, allowing third-party apps to access the contact lists and a user&#039;s location in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj84jgyS7JCiumwEWR-XKLRuLv_sljuCRx-alsYQHKikYlefpZeL1Wqh3GEALkiLdX886cZVY22LQA_ETSoYLrNdEJ4115IkJtXq5v1EMvQdvU-_xS61E89OwwSWXvE-F6Lw6_DH17w0wHHnBfUgqFxsy5cI1rTzinKIgA-X3q08jMLOOci5fkkUbCeIeId/s1600/google-ads-android.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Blocks, 8.3B, Policy-Violating, Ads, 2025, Launches, Android, Privacy, Overhaul</media:keywords>
</item>

<item>
<title>NIST Limits CVE Enrichment After 263% Surge in Vulnerability Submissions</title>
<link>https://block385.com/nist-limits-cve-enrichment-after-263-surge-in-vulnerability-submissions</link>
<guid>https://block385.com/nist-limits-cve-enrichment-after-263-surge-in-vulnerability-submissions</guid>
<description><![CDATA[ The National Institute of Standards and Technology (NIST) has announced changes to the way it handles cybersecurity vulnerabilities and exposures (CVEs) listed in its National Vulnerability Database (NVD), stating it will only enrich those that fulfil certain conditions owing to an explosion in CVE submissions.
&quot;CVEs that do not meet those criteria will still be listed in the NVD but will not ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrjR1nq2z66LZ-KZoSSgEdNs30l3Wv4kqz4R4acFd3CW2tqG0EDILlATrje1-tvZhdjnU9rSRO4cQNmlQGelsfBGGiMl_m9kxotVRlBDFyMISCJIFUPN78Aam2GAYPL0Nljz4aU5XrrWz2QuxBz-cZvY7vr2zSQJNdgrz3IWLldTPG_n_9tJx22A3TBQzZ/s1600/nist-cve.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 10:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NIST, Limits, CVE, Enrichment, After, 263, Surge, Vulnerability, Submissions</media:keywords>
</item>

<item>
<title>Operation PowerOFF Seizes 53 DDoS Domains, Exposes 3 Million Criminal Accounts</title>
<link>https://block385.com/operation-poweroff-seizes-53-ddos-domains-exposes-3-million-criminal-accounts</link>
<guid>https://block385.com/operation-poweroff-seizes-53-ddos-domains-exposes-3-million-criminal-accounts</guid>
<description><![CDATA[ An international law enforcement operation has taken down 53 domains and arrested four people in connection with commercial distributed denial-of-service (DDoS) operations that were used by more than 75,000 cybercriminals.
The ongoing effort, dubbed Operation PowerOFF, disrupted access to the DDoS-for-hire services, took down the technical infrastructure supporting them, and obtained access to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgePkLgywRZdW-d26RoQHpyVUy3nKssYfrZuFEdZ-fjRzJHTpESHBPlLvUII_vjjeLVTn4G_TB_oH76mfzh5t4PoKyz_ZhXWBOnCAkssRVXvb_lAMkEdhlK4G9YE6IWvxUUDQ9KDeZSzurWEPKDoQAVozBVjwrRYtSjy6pSbenOhhctqh3NxELjQXeF7H7S/s1600/europol.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 10:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Operation, PowerOFF, Seizes, DDoS, Domains, Exposes, Million, Criminal, Accounts</media:keywords>
</item>

<item>
<title>Social media bans might steer kids into riskier corners of the internet</title>
<link>https://block385.com/social-media-bans-might-steer-kids-into-riskier-corners-of-the-internet</link>
<guid>https://block385.com/social-media-bans-might-steer-kids-into-riskier-corners-of-the-internet</guid>
<description><![CDATA[ Governments are moving to block children under 16 from social media in the name of safety. But once these measures move from policy to practice, they raise a harder question: what happens when protecting kids requires collecting more data than ever before and may put them at greater risk? Age checks spark debate over privacy and safety Last year, Australia became the first country to introduce a ban for those under 16. Following its example, … More →
The post Social media bans might steer kids into riskier corners of the internet appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/02/23151434/kids-school-1400.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 09:00:15 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Social, media, bans, might, steer, kids, into, riskier, corners, the, internet</media:keywords>
</item>

<item>
<title>Apple AirTag tracking can be misled by replayed Bluetooth signals</title>
<link>https://block385.com/apple-airtag-tracking-can-be-misled-by-replayed-bluetooth-signals</link>
<guid>https://block385.com/apple-airtag-tracking-can-be-misled-by-replayed-bluetooth-signals</guid>
<description><![CDATA[ Apple’s AirTag is designed to help users track lost items by relying on a vast network of nearby Apple devices. New research shows that this same system can be manipulated to display locations where an AirTag has never been. Relaying an AirTag’s BLE advertisments over the Internet injects false location reports into the Find My system How the attack works The Find My network depends on Bluetooth Low Energy (BLE) signals broadcast by AirTags. When … More →
The post Apple AirTag tracking can be misled by replayed Bluetooth signals appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16065713/apple-airtag-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 09:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, AirTag, tracking, can, misled, replayed, Bluetooth, signals</media:keywords>
</item>

<item>
<title>Android 17 Beta 4 arrives with post&#45;quantum cryptography and new memory limits</title>
<link>https://block385.com/android-17-beta-4-arrives-with-post-quantum-cryptography-and-new-memory-limits</link>
<guid>https://block385.com/android-17-beta-4-arrives-with-post-quantum-cryptography-and-new-memory-limits</guid>
<description><![CDATA[ Google shipped Android 17 Beta 4 on April 16, marking the last scheduled beta in the Android 17 release cycle. The build targets app compatibility testing and platform stability ahead of the final release, and it carries several behavior changes that developers need to account for before the stable version ships. Supported Pixel devices can enroll in the Android Beta program to receive the update over the air. Developers without a Pixel device can use … More →
The post Android 17 Beta 4 arrives with post-quantum cryptography and new memory limits appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/16083000/android-17-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 09:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Android, Beta, arrives, with, post-quantum, cryptography, and, new, memory, limits</media:keywords>
</item>

<item>
<title>New infosec products of the week: April 17, 2026</title>
<link>https://block385.com/new-infosec-products-of-the-week-april-17-2026</link>
<guid>https://block385.com/new-infosec-products-of-the-week-april-17-2026</guid>
<description><![CDATA[ Here’s a look at the most interesting products from the past week, featuring releases from Axonius, Broadcom, Siemens, and Sitehop. Axonius updates Asset Cloud with AI, exposure management, and asset trust standard Axonius has expanded its Asset Cloud with AI-powered remediation in Axonius Exposures, added support for IoT and OT environments via Axonius Cyber-Physical Assets, and introduced a new data trust standard with Axonius Verified Assets. Siemens expands Industrial Automation DataCenter with edge AI and … More →
The post New infosec products of the week: April 17, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/28091843/infosec-week-1200.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 07:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, infosec, products, the, week:, April, 17, 2026</media:keywords>
</item>

<item>
<title>Workplace stress in 2026 is still worse than before the pandemic</title>
<link>https://block385.com/workplace-stress-in-2026-is-still-worse-than-before-the-pandemic</link>
<guid>https://block385.com/workplace-stress-in-2026-is-still-worse-than-before-the-pandemic</guid>
<description><![CDATA[ Roughly 40% of employees worldwide said they experienced a lot of stress during the previous day, according to Gallup’s State of the Global Workplace 2026 report, a figure that has remained above pre-pandemic levels for several years. Daily anger stood at 22% globally, sadness at 23%, and loneliness at 22%. Together, these numbers point to a workforce that has not returned to the emotional baseline it held before 2020. Engagement at a five-year low The … More →
The post Workplace stress in 2026 is still worse than before the pandemic appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16095231/stress-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 07:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Workplace, stress, 2026, still, worse, than, before, the, pandemic</media:keywords>
</item>

<item>
<title>Apache ActiveMQ CVE&#45;2026&#45;34197 Added to CISA KEV Amid Active Exploitation</title>
<link>https://block385.com/apache-activemq-cve-2026-34197-added-to-cisa-kev-amid-active-exploitation</link>
<guid>https://block385.com/apache-activemq-cve-2026-34197-added-to-cisa-kev-amid-active-exploitation</guid>
<description><![CDATA[ A recently disclosed high-severity security flaw in Apache ActiveMQ Classic has come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
To that end, the agency has added the vulnerability, tracked as CVE-2026-34197 (CVSS score: 8.8), to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKAY7CueGuHevAtV544WN7RTKISrobQLFpjfi4kjdzP1I2BA3rnll69dv1kfvHYSCcU5tQISA0OOgcQVibKrl4o0AvtUyM9crfZuSb1XFH03iLtPglZeHn1e6S8urWxf_4CEH9-tCZdT9BBrvXOFygCxjO_AUmUXnzm4d37Q80fPw3lEn6Hb0_LWlP9XM5/s1600/apachemq.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 06:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apache, ActiveMQ, CVE-2026-34197, Added, CISA, KEV, Amid, Active, Exploitation</media:keywords>
</item>

<item>
<title>ImmuniWeb brings AI upgrades, post&#45;quantum detection and more in Q1 2026</title>
<link>https://block385.com/immuniweb-brings-ai-upgrades-post-quantum-detection-and-more-in-q1-2026</link>
<guid>https://block385.com/immuniweb-brings-ai-upgrades-post-quantum-detection-and-more-in-q1-2026</guid>
<description><![CDATA[ ImmuniWeb unveiled technical updates, new features and functionalities across all products available on the ImmuniWeb AI Platform. ImmuniWeb Discovery Launch of a dedicated Cyber Threat Intelligence (CTI) dashboard Advanced detection of exposed AI-related assets, services and software Enhanced detection of phishing websites thanks to finetuning of our AI models Better and faster detection of IoC thanks to the expansion of our honeypot network Improved detection of copyright and trademark infringements incidents New filters, additional triage … More →
The post ImmuniWeb brings AI upgrades, post-quantum detection and more in Q1 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 17 Apr 2026 01:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ImmuniWeb, brings, upgrades, post-quantum, detection, and, more, 2026</media:keywords>
</item>

<item>
<title>North Korea Uses ClickFix to Target macOS Users&amp;apos; Data</title>
<link>https://block385.com/north-korea-uses-clickfix-to-target-macos-users-data</link>
<guid>https://block385.com/north-korea-uses-clickfix-to-target-macos-users-data</guid>
<description><![CDATA[ Sapphire Sleet uses fake job offers and phony Zoom updates to deliver ClickFix attacks that steal credentials and sensitive data from Macs. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt5cc61f368315b744/69e10ffdc8863fd06c049539/Mac_Mouse_Click_Edwin_Remsberg_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>North, Korea, Uses, ClickFix, Target, macOS, Users, Data</media:keywords>
</item>

<item>
<title>&amp;apos;Harmless&amp;apos; Global Adware Transforms Into an AV Killer</title>
<link>https://block385.com/harmless-global-adware-transforms-into-an-av-killer</link>
<guid>https://block385.com/harmless-global-adware-transforms-into-an-av-killer</guid>
<description><![CDATA[ A benign looking update Dragon Boss pushed out in March 2025 established persistence via scheduled tasks and arranged for future payloads to be excluded from Windows Defender. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltcc23cf58a0283b13/69e0fbb3eb41a9b573b1d155/Adware-Artem_Medvediev-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Harmless, Global, Adware, Transforms, Into, Killer</media:keywords>
</item>

<item>
<title>Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic</title>
<link>https://block385.com/newly-discovered-powmix-botnet-hits-czech-workers-using-randomized-c2-traffic</link>
<guid>https://block385.com/newly-discovered-powmix-botnet-hits-czech-workers-using-randomized-c2-traffic</guid>
<description><![CDATA[ Cybersecurity researchers have warned of an active malicious campaign that&#039;s targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since at least December 2025.
&quot;PowMix employs randomized command-and-control (C2) beaconing intervals, rather than persistent connection to the C2 server, to evade the network signature detections,&quot; Cisco Talos ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjaSAtFbXFX7aYFcwPPrHEMwEZ4VJp2mJQuYo3B3Q2Zrot1co_ilMUWffYOUUFHFRO6zwHHjlMCMOJcbnc_iF69KLU_1LpMhcfFk5YV8A4cdIchhqR1NQGEvyzpHGidnbvqwq2Tg_Y77VwMCpeSSluD8sPRcusqiraqLMCvUCA-QvUv5nCuh2Ns1U2jxNR1/s1600/powmix.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 22:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Newly, Discovered, PowMix, Botnet, Hits, Czech, Workers, Using, Randomized, Traffic</media:keywords>
</item>

<item>
<title>Anthropic releases Claude Opus 4.7 with automated cybersecurity safeguards</title>
<link>https://block385.com/anthropic-releases-claude-opus-47-with-automated-cybersecurity-safeguards</link>
<guid>https://block385.com/anthropic-releases-claude-opus-47-with-automated-cybersecurity-safeguards</guid>
<description><![CDATA[ Software teams building agentic AI workflows have been pushing frontier models toward longer, unsupervised task runs. Claude Opus 4.7, now generally available from Anthropic, is aimed squarely at that demand, with particular gains in software engineering, multimodal processing, and the kind of instruction fidelity that matters when a model is running tasks autonomously over multiple steps. Opus 4.7 is available across all Claude products and the API, Amazon Bedrock, Google Cloud’s Vertex AI, and Microsoft … More →
The post Anthropic releases Claude Opus 4.7 with automated cybersecurity safeguards appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/03094356/claude-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 19:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Anthropic, releases, Claude, Opus, 4.7, with, automated, cybersecurity, safeguards</media:keywords>
</item>

<item>
<title>NIST admits defeat on NVD backlog, will enrich only highest&#45;risk CVEs going forward</title>
<link>https://block385.com/nist-admits-defeat-on-nvd-backlog-will-enrich-only-highest-risk-cves-going-forward</link>
<guid>https://block385.com/nist-admits-defeat-on-nvd-backlog-will-enrich-only-highest-risk-cves-going-forward</guid>
<description><![CDATA[ NIST is overhauling how it manages the National Vulnerability Database (NVD) and switching to a risk-based model that prioritizes “enrichment” of only the most critical CVE-numbered security vulnerabilities. “This change is driven by a surge in CVE submissions, which increased 263% between 2020 and 2025,” the National Institute of Standards and Technology said. “We don’t expect this trend to let up anytime soon.” A two-year struggle and a new approach NIST has been struggling to … More →
The post NIST admits defeat on NVD backlog, will enrich only highest-risk CVEs going forward appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/04/03121316/nist_nvd-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 19:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>NIST, admits, defeat, NVD, backlog, will, enrich, only, highest-risk, CVEs, going, forward</media:keywords>
</item>

<item>
<title>Two&#45;Factor Authentication Breaks Free from the Desktop</title>
<link>https://block385.com/two-factor-authentication-breaks-free-from-the-desktop</link>
<guid>https://block385.com/two-factor-authentication-breaks-free-from-the-desktop</guid>
<description><![CDATA[ Threat actors know how to bypass security systems outside of traditional IT environments. Implementing 2FA could provide a needed extra security barrier in the physical world. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltda93213c910e1221/69dfbf29f06161c424ab3b28/R5PNG0.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 19:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Two-Factor, Authentication, Breaks, Free, from, the, Desktop</media:keywords>
</item>

<item>
<title>Microsoft&amp;apos;s Original Windows Secure Boot Certificate Is Expiring</title>
<link>https://block385.com/microsofts-original-windows-secure-boot-certificate-is-expiring</link>
<guid>https://block385.com/microsofts-original-windows-secure-boot-certificate-is-expiring</guid>
<description><![CDATA[ The Secure Boot refresh is one of the largest coordinated security maintenance efforts across the Windows ecosystem, Microsoft said. Update those PCs soon. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltcf80cca68990f44f/67db1175b6f1566998db1a71/laptop_windows_desktop_Wachiwit_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 19:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsofts, Original, Windows, Secure, Boot, Certificate, Expiring</media:keywords>
</item>

<item>
<title>ThreatsDay Bulletin: Defender 0&#45;Day, SonicWall Brute&#45;Force, 17&#45;Year&#45;Old Excel RCE and 15 More Stories</title>
<link>https://block385.com/threatsday-bulletin-defender-0-daysonicwall-brute-force-17-year-old-excel-rce-and-15-more-stories</link>
<guid>https://block385.com/threatsday-bulletin-defender-0-daysonicwall-brute-force-17-year-old-excel-rce-and-15-more-stories</guid>
<description><![CDATA[ You know that feeling when you open your feed on a Thursday morning and it&#039;s just... a lot? Yeah. This week delivered. We&#039;ve got hackers getting creative in ways that are almost impressive if you ignore the whole &quot;crime&quot; part, ancient vulnerabilities somehow still ruining people&#039;s days, and enough supply chain drama to fill a season of television nobody asked for.
Not all bad though. Some  ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzTV_mwPjmV14aBlnHuLOX2yEZR6VGpmadgiPHtNBJV0KVNG_Oj2tnqE1cb3U9RhBXN-Mytte3jKs2n2dQwBhX2dYDETy5es4cGUkbW5bdIaV_hx8i3gWQhdaa7se1_Q8NY9t0q90EjUBNXt56_MxjT4YVV-R8D14jV3LequHu0llA84NnEK3PeU56Q54X/s1600/bull-main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 16:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ThreatsDay, Bulletin:, Defender, 0-Day,  SonicWall, Brute-Force, 17-Year-Old, Excel, RCE, and, More, Stories</media:keywords>
</item>

<item>
<title>[Webinar] Find and Eliminate Orphaned Non&#45;Human Identities in Your Environment</title>
<link>https://block385.com/webinar-find-and-eliminate-orphaned-non-human-identities-in-your-environment</link>
<guid>https://block385.com/webinar-find-and-eliminate-orphaned-non-human-identities-in-your-environment</guid>
<description><![CDATA[ In 2024, compromised service accounts and forgotten API keys were behind 68% of cloud breaches. Not phishing. Not weak passwords. Unmanaged non-human identities that nobody was watching.
For every employee in your org, there are 40 to 50 automated credentials: service accounts, API tokens, AI agent connections, andOAuth grants. When projects end or employees leave, most ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6vJpO9kksCQDpSksNkqDFNUCbXD70dMGYqI6P9S_XPMY5d8BR8PVdrsVQP1ZJO_-nzL6eQShM3Cap9heQ5kAglsPjfxwIcXPSsf_cfgUVnGQ2XzIWVOuo7JhxMjnHYDN6r9KlQ6LqZJisRZkjatnWChuzUkSlXRa1hFseUPq28PZ5gjGR7L2WzTFdZ3fM/s1600/ghost.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 16:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Webinar, Find, and, Eliminate, Orphaned, Non-Human, Identities, Your, Environment</media:keywords>
</item>

<item>
<title>Google Play is changing how Android apps access your contacts and location</title>
<link>https://block385.com/google-play-is-changing-how-android-apps-access-your-contacts-and-location</link>
<guid>https://block385.com/google-play-is-changing-how-android-apps-access-your-contacts-and-location</guid>
<description><![CDATA[ Google’s new set of Google Play policy updates and account transfer feature strengthen user privacy and protect businesses from fraud. Google is also expanding features for managing new contact and location policy changes to support a smoother, more predictable app review experience. By October, Play policy insights in Android Studio can help developers identify if their apps should use new features and will guide them on the steps to take. From October 27, new pre-review … More →
The post Google Play is changing how Android apps access your contacts and location appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/19093329/google-play-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 15:00:23 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Play, changing, how, Android, apps, access, your, contacts, and, location</media:keywords>
</item>

<item>
<title>Fortinet fixes critical FortiSandbox vulnerabilities (CVE&#45;2026&#45;39813, CVE&#45;2026&#45;39808)</title>
<link>https://block385.com/fortinet-fixes-critical-fortisandbox-vulnerabilities-cve-2026-39813-cve-2026-39808</link>
<guid>https://block385.com/fortinet-fixes-critical-fortisandbox-vulnerabilities-cve-2026-39813-cve-2026-39808</guid>
<description><![CDATA[ Two vulnerabilities (CVE-2026-39813, CVE-2026-39808) in FortiSandbox could be leveraged by unauthenticated attackers to bypass authentication and execute unauthorized code or commands on vulnerable systems. Both vulnerabilities can be triggered with a specially crafted HTTP request, putting unpatched FortiSandbox deployments at risk. About FortiSandbox FortiSandbox is Fortinet’s security solution for detecting and analyzing advanced threats. It does so by detonating suspicious files and URLs in an isolated environment and returning verdicts. Other Fortinet products – firewalls, … More →
The post Fortinet fixes critical FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/01/16140047/fortinet-1500-3.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 15:00:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fortinet, fixes, critical, FortiSandbox, vulnerabilities, CVE-2026-39813, CVE-2026-39808</media:keywords>
</item>

<item>
<title>Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution</title>
<link>https://block385.com/cisco-patches-four-critical-identity-services-webex-flaws-enabling-code-execution</link>
<guid>https://block385.com/cisco-patches-four-critical-identity-services-webex-flaws-enabling-code-execution</guid>
<description><![CDATA[ Cisco has announced patches to address four critical security flaws impacting Identity Services and Webex Services that could result in arbitrary code execution and allow an attacker to impersonate any user within the service.
The details of the vulnerabilities are below -

CVE-2026-20184 (CVSS score: 9.8) - An improper certificate validation in the integration of single sign-on (SSO) ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihdjDVphpsoBIBjhimILabg28ZsD4p-xNzJol1uD3SSIRBvkp-juko45B2sjKpQmJi-h2tHZf2yWAvuCOZRs3m3q4w5sj7x-MyXWosuKglLblipF_94T8f8OQ8_peVgqZTrnjxF8dPRLfv63K8zrbQYqh898b31p_2C37UO0DNAuR8cESZeo4XTFlsDs0C/s1600/cisco-flaws.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 14:30:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cisco, Patches, Four, Critical, Identity, Services, Webex, Flaws, Enabling, Code, Execution</media:keywords>
</item>

<item>
<title>Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT in Targeted Finance, Crypto Attacks</title>
<link>https://block385.com/obsidian-plugin-abuse-delivers-phantompulse-rat-in-targeted-finance-crypto-attacks</link>
<guid>https://block385.com/obsidian-plugin-abuse-delivers-phantompulse-rat-in-targeted-finance-crypto-attacks</guid>
<description><![CDATA[ A &quot;novel&quot; social engineering campaign has been observed abusing Obsidian, a cross-platform note-taking application, as an initial access vector to distribute a previously undocumented Windows remote access trojan called PHANTOMPULSE in attacks targeting individuals in the financial and cryptocurrency sectors.
Dubbed REF6598 by Elastic Security Labs, the activity has been found to leverage ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiNoBvtFhZbLfNE2AsVSzuOt5V9YMzAumIA2M9c7QVbp_i-xMwDIgVtDgCIi2bCYgH_PviS8P-Ap1k-8aVmHABqLzNGE9g014MM1gnfJEJPKbKczoCjPoI6PxZ77bNlz2dSlv8XqoVFyZZqQ6SWBue3rpRegb_k62HJkfMl39GHTBIIzZOGrv_iKbxOYV8E/s1600/el.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 14:30:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Obsidian, Plugin, Abuse, Delivers, PHANTOMPULSE, RAT, Targeted, Finance, Crypto, Attacks</media:keywords>
</item>

<item>
<title>Hidden Passenger? How Taboola Routes Logged&#45;In Banking Sessions to Temu</title>
<link>https://block385.com/hidden-passenger-how-taboola-routes-logged-in-banking-sessions-to-temu</link>
<guid>https://block385.com/hidden-passenger-how-taboola-routes-logged-in-banking-sessions-to-temu</guid>
<description><![CDATA[ A bank approved a Taboola pixel. That pixel quietly redirected logged-in users to a Temu tracking endpoint. This occurred without the bank’s knowledge, without user consent, and without a single security control registering a violation.

Read the full technical breakdown in the Security Intelligence Brief. Download now →
The &quot;First-Hop Bias&quot; Blind Spot
Most&amp; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiaSzIRGweO7UJkqOLQTUDsqPy53XtIWCzyLklGJLfFxhneZiFpxg8zJRXukUqEsT4TbdFwUZbvTfwuexfGuiYjcDQ-iZDjqwZ2lDlCIhgopZWevBpdi4rr6GxgXpU6MmFnzdMpq_WGdA9PRfaNw_7eDAOugAV1tccfmREgbXveM1N15G2_L9lFxCq1Pv0/s1600/reflectiz.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 14:30:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hidden, Passenger, How, Taboola, Routes, Logged-In, Banking, Sessions, Temu</media:keywords>
</item>

<item>
<title>Two US nationals jailed over scheme that generated $5 million for the North Korean regime</title>
<link>https://block385.com/two-us-nationals-jailed-over-scheme-that-generated-5-million-for-the-north-korean-regime</link>
<guid>https://block385.com/two-us-nationals-jailed-over-scheme-that-generated-5-million-for-the-north-korean-regime</guid>
<description><![CDATA[ Two US nationals have been sentenced for their role in a scheme that placed North Korean IT workers inside American companies under false identities. Over several years, the operation used stolen identities from at least 80 US individuals and brought in more than $5 million for the North Korean government. Kejia Wang was sentenced to 108 months in prison, and Zhenxing Wang to 92 months. Both pleaded guilty to wire fraud and money laundering charges, … More →
The post Two US nationals jailed over scheme that generated $5 million for the North Korean regime appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/10/03122711/north_korea-binary.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 13:00:25 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Two, nationals, jailed, over, scheme, that, generated, million, for, the, North, Korean, regime</media:keywords>
</item>

<item>
<title>Cargo theft malware actor spent a month inside a decoy network before researchers pulled the plug</title>
<link>https://block385.com/cargo-theft-malware-actor-spent-a-month-inside-a-decoy-network-before-researchers-pulled-the-plug</link>
<guid>https://block385.com/cargo-theft-malware-actor-spent-a-month-inside-a-decoy-network-before-researchers-pulled-the-plug</guid>
<description><![CDATA[ Proofpoint researchers executed a malicious payload from a threat actor known to target trucking and logistics companies in late February 2026, doing so inside a decoy environment. The environment stayed compromised for more than 30 days, long enough for researchers to watch the actor work through their tools, scripts, and decisions beyond the initial break-in. The attacker had previously been documented targeting transportation carriers through compromised load board platforms, which are online marketplaces connecting shippers … More →
The post Cargo theft malware actor spent a month inside a decoy network before researchers pulled the plug appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/06091056/danger-monitor-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 13:00:20 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cargo, theft, malware, actor, spent, month, inside, decoy, network, before, researchers, pulled, the, plug</media:keywords>
</item>

<item>
<title>Tails 7.6.2 patches vulnerability that could expose saved files</title>
<link>https://block385.com/tails-762-patches-vulnerability-that-could-expose-saved-files</link>
<guid>https://block385.com/tails-762-patches-vulnerability-that-could-expose-saved-files</guid>
<description><![CDATA[ The Tails Project released Tails v7.6.2, an emergency release of the popular open source secure portable operating system. What is Tails? Tails, which is based on Debian GNU/Linux, is aimed at users who want to preserve their online privacy and anonymity. The OS is installed on a dedicated USB stick and when plugged into a computer, it allows users to read and edit documents and images, watch videos, brows the web via the Tor internet … More →
The post Tails 7.6.2 patches vulnerability that could expose saved files appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2022/10/19082014/tails-os.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 13:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tails, 7.6.2, patches, vulnerability, that, could, expose, saved, files</media:keywords>
</item>

<item>
<title>EU cybersecurity standards are at risk if supplier ban passes</title>
<link>https://block385.com/eu-cybersecurity-standards-are-at-risk-if-supplier-ban-passes</link>
<guid>https://block385.com/eu-cybersecurity-standards-are-at-risk-if-supplier-ban-passes</guid>
<description><![CDATA[ Today, the European standards body ETSI sent a formal position paper to the European Commission, calling for changes to the proposed Cybersecurity Act 2 (CSA2), the EU’s planned revision to its existing cybersecurity certification framework. The paper focuses on two provisions: a proposed expansion of ENISA’s role in developing technical specifications, and a clause in Article 100(4)(a) that would bar entities from countries designated as posing cybersecurity concerns from participating in European standardization work tied … More →
The post EU cybersecurity standards are at risk if supplier ban passes appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/10/11093409/eu-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 11:00:40 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>cybersecurity, standards, are, risk, supplier, ban, passes</media:keywords>
</item>

<item>
<title>GitHub lays out copyright liability changes and upcoming DMCA review for developers</title>
<link>https://block385.com/github-lays-out-copyright-liability-changes-and-upcoming-dmca-review-for-developers</link>
<guid>https://block385.com/github-lays-out-copyright-liability-changes-and-upcoming-dmca-review-for-developers</guid>
<description><![CDATA[ A U.S. Supreme Court ruling issued in March has settled a question that has circulated among platform operators and developers for years: whether a service provider can be held liable for copyright infringement committed by its users without evidence of intent to contribute to that infringement. The answer, per the Court’s opinion in Cox v. Sony, is no. Liability requires conscious, culpable conduct. The standard endorsed by the Court is the same one advocated in … More →
The post GitHub lays out copyright liability changes and upcoming DMCA review for developers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16091321/github-developers-1200.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 11:00:32 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GitHub, lays, out, copyright, liability, changes, and, upcoming, DMCA, review, for, developers</media:keywords>
</item>

<item>
<title>Anthropic tests user trust with ID and selfie checks for Claude</title>
<link>https://block385.com/anthropic-tests-user-trust-with-id-and-selfie-checks-for-claude</link>
<guid>https://block385.com/anthropic-tests-user-trust-with-id-and-selfie-checks-for-claude</guid>
<description><![CDATA[ Anthropic announced identity verification for Claude using government ID and selfie checks, becoming the first major AI chatbot to do so, a move that may prove unpopular with users. Having built its reputation around privacy in the AI race, Anthropic risks undermining its positioning, as competitors such as OpenAI’s ChatGPT and Google’s Gemini do not require such verification. Earlier this year, Discord expanded age verification to include facial scans and ID checks, though it later … More →
The post Anthropic tests user trust with ID and selfie checks for Claude appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/16081836/claude-veritication-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 11:00:18 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Anthropic, tests, user, trust, with, and, selfie, checks, for, Claude</media:keywords>
</item>

<item>
<title>OpenAI updates Agents SDK, adds sandbox for safer code execution</title>
<link>https://block385.com/openai-updates-agents-sdk-adds-sandbox-for-safer-code-execution</link>
<guid>https://block385.com/openai-updates-agents-sdk-adds-sandbox-for-safer-code-execution</guid>
<description><![CDATA[ OpenAI’s updated Agents SDK helps developers build agents that inspect files, run commands, edit code, and handle tasks within controlled sandbox environments. The update provides standardized infrastructure for OpenAI models, a model-native harness that lets agents work with files and tools on a computer, and native sandbox execution for running tasks safely. The new harness and sandbox capabilities launch first in Python, with TypeScript support planned for a future release. Additional features, including code mode … More →
The post OpenAI updates Agents SDK, adds sandbox for safer code execution appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05154533/openai-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 11:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI, updates, Agents, SDK, adds, sandbox, for, safer, code, execution</media:keywords>
</item>

<item>
<title>UAC&#45;0247 Targets Ukrainian Clinics and Government in Data&#45;Theft Malware Campaign</title>
<link>https://block385.com/uac-0247-targets-ukrainian-clinics-and-government-in-data-theft-malware-campaign</link>
<guid>https://block385.com/uac-0247-targets-ukrainian-clinics-and-government-in-data-theft-malware-campaign</guid>
<description><![CDATA[ The Computer Emergencies Response Team of Ukraine (CERT-UA) has disclosed details of a new campaign that has targeted governments and municipal healthcare institutions, mainly clinics and emergency hospitals, to deliver malware capable of stealing sensitive data from Chromium-based web browsers and WhatsApp.
The activity, which was observed between March and April ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH3uHu3ez1qUhePM8e1rCVaEUwBzhu09tblZcAl6jlOEYHN1Zq2-rm-dyEOArGNUm63UjM-_Qs8XwFKUa46UxOwufTn4BmRlfv1xiwlxkk3XboMQu8d4fHpy5Vb5y_0zcpXw5Alg-V_Ud85gINtfz6pfOZWWcco9Dy0jkeRCPCF-ssY2zJjRge1d3PJf_c/s1600/uk.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 10:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>UAC-0247, Targets, Ukrainian, Clinics, and, Government, Data-Theft, Malware, Campaign</media:keywords>
</item>

<item>
<title>Product showcase: Ente Auth encrypts, backs up, and syncs 2FA</title>
<link>https://block385.com/product-showcase-ente-auth-encrypts-backs-up-and-syncs-2fa</link>
<guid>https://block385.com/product-showcase-ente-auth-encrypts-backs-up-and-syncs-2fa</guid>
<description><![CDATA[ Two-factor authentication (2FA) is an essential layer of protection for online accounts, and Ente Auth makes it easier to manage securely across devices. Ente Auth is a free, open-source authenticator app designed to generate and store one-time passcodes for 2FA. It supports setup through QR codes and manual entry, allowing users to add accounts and begin generating codes. Users can also import existing accounts from other authenticator apps, simplifying the transition without the need to … More →
The post Product showcase: Ente Auth encrypts, backs up, and syncs 2FA appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/15121000/ente_auth-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 09:00:50 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Product, showcase:, Ente, Auth, encrypts, backs, up, and, syncs, 2FA</media:keywords>
</item>

<item>
<title>What the EU AI Act requires for AI agent logging</title>
<link>https://block385.com/what-the-eu-ai-act-requires-for-ai-agent-logging</link>
<guid>https://block385.com/what-the-eu-ai-act-requires-for-ai-agent-logging</guid>
<description><![CDATA[ The EU AI Act is 144 pages long. The logging requirements that matter for AI agent developers sit across four articles that keep referencing each other. Here’s what they say, when the deadlines hit, and where the gaps are. Your agent is probably high-risk The Act doesn’t mention “AI agents” by name. What matters is what the system does. If your agent scores credit applications, filters resumes, decides who gets healthcare benefits, prices insurance, or … More →
The post What the EU AI Act requires for AI agent logging appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/03083348/eu-stars-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 09:00:31 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>What, the, Act, requires, for, agent, logging</media:keywords>
</item>

<item>
<title>Command integrity breaks in the LLM routing layer</title>
<link>https://block385.com/command-integrity-breaks-in-the-llm-routing-layer</link>
<guid>https://block385.com/command-integrity-breaks-in-the-llm-routing-layer</guid>
<description><![CDATA[ Systems that rely on LLM agents often send requests through intermediary routing services before reaching a model. These routers connect to different providers through a single endpoint and manage how requests are handled. This layer can influence what gets executed and what data is exposed. A recent study examined 28 paid routers and 400 free routers used to access model APIs. Request–response lifecycle through a malicious router Some routers are already altering commands In testing, … More →
The post Command integrity breaks in the LLM routing layer appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/20204427/llm-brain-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 09:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Command, integrity, breaks, the, LLM, routing, layer</media:keywords>
</item>

<item>
<title>6&#45;Year Ransomware Campaign Targets Turkish Homes &amp;amp;amp; SMBs</title>
<link>https://block385.com/6-year-ransomware-campaign-targets-turkish-homes-smbs</link>
<guid>https://block385.com/6-year-ransomware-campaign-targets-turkish-homes-smbs</guid>
<description><![CDATA[ While enterprises breaches make more headlines, smaller incidents tend to be under-reported, if at all, allowing campaigns to last longer with less disruption. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7f40f3c081eecf91/69dd9708c01884640b682358/Turkey-Ivan_Tsyrkunovich-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 09:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>6-Year, Ransomware, Campaign, Targets, Turkish, Homes, &amp;amp, SMBs</media:keywords>
</item>

<item>
<title>European AI spending set to hit $290 billion by 2029</title>
<link>https://block385.com/european-ai-spending-set-to-hit-290-billion-by-2029</link>
<guid>https://block385.com/european-ai-spending-set-to-hit-290-billion-by-2029</guid>
<description><![CDATA[ European enterprises are committing serious money to AI, and the numbers are accelerating. According to IDC’s Worldwide AI and Generative AI Spending Guide, AI spending across Europe will reach $290 billion by 2029, growing at a compound annual growth rate of 33.7%. Organizations across the continent are moving AI out of proof-of-concept projects and into core operations, with budgets reallocating toward multi-agent systems and AI-embedded enterprise strategies. Software leads on spending; AI platforms grow fastest … More →
The post European AI spending set to hit $290 billion by 2029 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/06/27095654/eu-ai.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 07:00:29 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>European, spending, set, hit, 290, billion, 2029</media:keywords>
</item>

<item>
<title>Wi&#45;Fi roaming security practices for access network providers and identity providers</title>
<link>https://block385.com/wi-fi-roaming-security-practices-for-access-network-providers-and-identity-providers</link>
<guid>https://block385.com/wi-fi-roaming-security-practices-for-access-network-providers-and-identity-providers</guid>
<description><![CDATA[ Public Wi-Fi roaming networks carry authentication credentials across multiple administrative boundaries, and the protocols governing that process vary widely in their security properties. The Wireless Broadband Alliance published a set of guidelines that specifies which authentication, encryption, and credential-handling practices operators should apply to networks running Passpoint and OpenRoaming. “What this work shows is that, by applying established best practices across authentication, encryption, identity privacy, signaling and federation governance, Wi-Fi can provide the level of … More →
The post Wi-Fi roaming security practices for access network providers and identity providers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/05092956/wireless-hand.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 07:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Wi-Fi, roaming, security, practices, for, access, network, providers, and, identity, providers</media:keywords>
</item>

<item>
<title>Windows is getting stronger RDP file protections to fight phishing attacks</title>
<link>https://block385.com/windows-is-getting-stronger-rdp-file-protections-to-fight-phishing-attacks</link>
<guid>https://block385.com/windows-is-getting-stronger-rdp-file-protections-to-fight-phishing-attacks</guid>
<description><![CDATA[ Microsoft has introduced new Windows protections starting with the April 2026 security update to reduce phishing attacks that abuse Remote Desktop (.rdp) files. With these updates, the Remote Desktop Connection app displays stronger warning dialogs before a connection is established, shows details about the remote system, and requires users to review any request to share local resources such as drives or the clipboard. RDP files define how a system connects to a remote computer and … More →
The post Windows is getting stronger RDP file protections to fight phishing attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/08/08114931/microsoft-windows1.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 03:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Windows, getting, stronger, RDP, file, protections, fight, phishing, attacks</media:keywords>
</item>

<item>
<title>Critical MCP Integration Flaw Puts NGINX at Risk</title>
<link>https://block385.com/critical-mcp-integration-flaw-puts-nginx-at-risk</link>
<guid>https://block385.com/critical-mcp-integration-flaw-puts-nginx-at-risk</guid>
<description><![CDATA[ Attackers can abuse the near-maximum severity flaw in nginx-ui to restart, create, modify, and delete NGINX configuration files. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt446b8eb1b9e96075/69e00259f061614772ab3b7e/mcp_Jack_the_sparow_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 16 Apr 2026 01:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, MCP, Integration, Flaw, Puts, NGINX, Risk</media:keywords>
</item>

<item>
<title>Navigating the Unique Security Risks of Asia&amp;apos;s Digital Supply Chain</title>
<link>https://block385.com/navigating-the-unique-security-risks-of-asias-digital-supply-chain</link>
<guid>https://block385.com/navigating-the-unique-security-risks-of-asias-digital-supply-chain</guid>
<description><![CDATA[ Regulatory differences, interconnected digital ecosystems, and the rise of AI have created a complex supply chain Asian organizations must wrangle. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6b40c5c605abfefc/69dfd2fef061610469ab3b48/digital_supply_chain_map_Aleksey_Funtap_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Navigating, the, Unique, Security, Risks, Asias, Digital, Supply, Chain</media:keywords>
</item>

<item>
<title>n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails</title>
<link>https://block385.com/n8n-webhooks-abused-since-october-2025-to-deliver-malware-via-phishing-emails</link>
<guid>https://block385.com/n8n-webhooks-abused-since-october-2025-to-deliver-malware-via-phishing-emails</guid>
<description><![CDATA[ Threat actors have been observed weaponizing n8n, a popular artificial intelligence (AI) workflow automation platform, to facilitate sophisticated phishing campaigns and deliver malicious payloads or fingerprint devices by sending automated emails.
&quot;By leveraging trusted infrastructure, these attackers bypass traditional security filters, turning productivity tools into delivery ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSXMJaHSQp1aJ8l7rKKtfILQtDMLWTUVOPwWqizQ-nRzb5JbG1BJOFKTs0NYGVQ0fBFTzLkjaY0bntn7UDnlyy502mDQJzvqFhTJwmYlctN551StWLJf8hnET4i8ZrwWvtzhswLW_2GoSI1zlMVRnI89aVrFU1lbes9p7fpYFjT9V7OxAmbmMW3UR-hv9_/s1600/webhook.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 20:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>n8n, Webhooks, Abused, Since, October, 2025, Deliver, Malware, via, Phishing, Emails</media:keywords>
</item>

<item>
<title>Prepping for &amp;apos;Q&#45;Day&amp;apos;: Why Quantum Risk Management Should Start Now</title>
<link>https://block385.com/prepping-for-q-day-why-quantum-risk-management-should-start-now</link>
<guid>https://block385.com/prepping-for-q-day-why-quantum-risk-management-should-start-now</guid>
<description><![CDATA[ Quantum computers are coming and may impact systems in unexpected ways, and it will &quot;take years to be fully quantum-safe, if ever,&quot; cryptography expert warns. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3bb6d1a7c39a8cb8/69df9d987f84f1210cd92dd6/quantum_TiratusPhaesuwan_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 19:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Prepping, for, Q-Day:, Why, Quantum, Risk, Management, Should, Start, Now</media:keywords>
</item>

<item>
<title>Audit: Big Tech Often Ignores CA Privacy Law Opt&#45;Out Requests</title>
<link>https://block385.com/audit-big-tech-often-ignores-ca-privacy-law-opt-out-requests</link>
<guid>https://block385.com/audit-big-tech-often-ignores-ca-privacy-law-opt-out-requests</guid>
<description><![CDATA[ Google, Meta, and Microsoft about half the time don&#039;t comply with requests to opt out of online tracking per a California law mandate, privacy watchdog finds. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4602d9695ec3e1f1/69655ab9ae1d94027b8f024c/HWP2C7.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 19:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Audit:, Big, Tech, Often, Ignores, Privacy, Law, Opt-Out, Requests</media:keywords>
</item>

<item>
<title>Webinar: The IT Leader’s Guide to AI Governance</title>
<link>https://block385.com/webinar-the-it-leaders-guide-to-ai-governance</link>
<guid>https://block385.com/webinar-the-it-leaders-guide-to-ai-governance</guid>
<description><![CDATA[ Generative AI is moving from experimentation to everyday enterprise use, often faster than governance models were designed to support. As adoption accelerates, organizations are navigating the evolving landscape with new questions around security, data privacy, compliance, and control, all while being asked to enable innovation at speed. This 30 to 35-minute conversation offers practical perspectives on how enterprises approach AI governance. Rather than laying down a single “right” answer, panelists focus on the tradeoffs teams … More →
The post Webinar: The IT Leader’s Guide to AI Governance appeared first on Help Net Security. ]]></description>
<enclosure url="https://a.storyblok.com/f/88751/1940x1160/6dd554e6a4/the-it-leaders-guide-to-ai-governance-og.png/m/1000x593/" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 17:00:50 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Webinar:, The, Leader’s, Guide, Governance</media:keywords>
</item>

<item>
<title>Tenable unveils OT discovery engine to expose cyber&#45;physical risks</title>
<link>https://block385.com/tenable-unveils-ot-discovery-engine-to-expose-cyber-physical-risks</link>
<guid>https://block385.com/tenable-unveils-ot-discovery-engine-to-expose-cyber-physical-risks</guid>
<description><![CDATA[ Tenable unveiled a new OT asset discovery engine that enables security teams to bring risks associated with cyber-physical systems (OT, IoT, and shadow IT) into a unified view of cyber exposure. With instant deployment and no additional IT overhead required, Tenable’s new VM-Native OT Discovery capability provides a low-friction entry point for organizations to gain comprehensive IT/OT visibility and accelerate AI-driven exposure management. According to Gartner, “Cyber and cyber-physical attacks are set to double over … More →
The post Tenable unveils OT discovery engine to expose cyber-physical risks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 17:00:48 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tenable, unveils, discovery, engine, expose, cyber-physical, risks</media:keywords>
</item>

<item>
<title>Bitdefender extends GravityZone with continuous email threat protection</title>
<link>https://block385.com/bitdefender-extends-gravityzone-with-continuous-email-threat-protection</link>
<guid>https://block385.com/bitdefender-extends-gravityzone-with-continuous-email-threat-protection</guid>
<description><![CDATA[ Bitdefender has launched GravityZone Extended Email Security, unifying email and endpoint protection in one platform. Built for organizations and MSPs, it uses an ICES approach to deliver continuous protection against modern email threats, including phishing, BEC, ransomware, impersonation, and insider attacks. “Email threats are growing more sophisticated and effective as total business email compromise-related payments crossed the $6 billion threshold in 2024,” according to Gartner. In a global survey of 1,200 IT and security professionals, … More →
The post Bitdefender extends GravityZone with continuous email threat protection appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 17:00:44 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bitdefender, extends, GravityZone, with, continuous, email, threat, protection</media:keywords>
</item>

<item>
<title>Broadcom introduces zero&#45;trust runtime for scalable AI agents</title>
<link>https://block385.com/broadcom-introduces-zero-trust-runtime-for-scalable-ai-agents</link>
<guid>https://block385.com/broadcom-introduces-zero-trust-runtime-for-scalable-ai-agents</guid>
<description><![CDATA[ Broadcom has announced VMware Tanzu Platform agent foundations, introducing a secure-by-default agentic runtime designed to accelerate the delivery of autonomous AI applications. By extending the trusted code-to-production simplicity of Tanzu Platform to AI agents, Broadcom is enabling enterprise developers to move beyond siloed AI experiments and into scalable, governed production on VMware Cloud Foundation (VCF). From experimental AI to enterprise reality As AI agents begin to handle both software execution and autonomous decision-making, they require … More →
The post Broadcom introduces zero-trust runtime for scalable AI agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 17:00:31 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Broadcom, introduces, zero-trust, runtime, for, scalable, agents</media:keywords>
</item>

<item>
<title>Capsule Security debuts with $7 million funding to secure AI agent behavior</title>
<link>https://block385.com/capsule-security-debuts-with-7-million-funding-to-secure-ai-agent-behavior</link>
<guid>https://block385.com/capsule-security-debuts-with-7-million-funding-to-secure-ai-agent-behavior</guid>
<description><![CDATA[ Capsule Security has launched from stealth with a $7 million seed round led by Lama Partners and Forgepoint Capital International. It prevents AI agents from being manipulated, misbehaving, or silently exfiltrating data when handling sensitive information and executing workflows. Capsule is advised by security juggernauts who have put their trust in the company’s innovative approach, including Chris Krebs, the first Director of CISA; Omer Grossman, former Global CIO at CyberArk; Jim Routh, former CISO across … More →
The post Capsule Security debuts with $7 million funding to secure AI agent behavior appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 17:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Capsule, Security, debuts, with, million, funding, secure, agent, behavior</media:keywords>
</item>

<item>
<title>Actively Exploited nginx&#45;ui Flaw (CVE&#45;2026&#45;33032) Enables Full Nginx Server Takeover</title>
<link>https://block385.com/actively-exploited-nginx-ui-flaw-cve-2026-33032-enables-full-nginx-server-takeover</link>
<guid>https://block385.com/actively-exploited-nginx-ui-flaw-cve-2026-33032-enables-full-nginx-server-takeover</guid>
<description><![CDATA[ A recently disclosed critical security flaw impacting nginx-ui, an open-source, web-based Nginx management tool, has come under active exploitation in the wild.
The vulnerability in question is CVE-2026-33032 (CVSS score: 9.8), an authentication bypass vulnerability that enables threat actors to seize control of the Nginx service. It has been codenamed MCPwn by Pluto Security.
&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-efZdYJpyjLdBQDLfJxWi6aiElSTIIzesGLR7SNMM0laIvBdFHioyAfxmOQkhV-bBV5SqCxRRhocp4-Q3EezvtE5Xp2aeNcFrP6d89jhOY2QiCVhhyMCMCVy39cE5YcTvg_7_tvXAEwI4N1g_eRKNzWwYtLH-k80d5he55NN2UK0sNNkbb0l35ix6MOBR/s1600/nui.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Actively, Exploited, nginx-ui, Flaw, CVE-2026-33032, Enables, Full, Nginx, Server, Takeover</media:keywords>
</item>

<item>
<title>April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More</title>
<link>https://block385.com/april-patch-tuesday-fixes-critical-flaws-across-sap-adobe-microsoft-fortinet-and-more</link>
<guid>https://block385.com/april-patch-tuesday-fixes-critical-flaws-across-sap-adobe-microsoft-fortinet-and-more</guid>
<description><![CDATA[ A number of critical vulnerabilities impacting products from Adobe, Fortinet, Microsoft, and SAP have taken center stage in April&#039;s Patch Tuesday releases.
Topping the list is an SQL injection vulnerability impacting SAP Business Planning and Consolidation and SAP Business Warehouse (CVE-2026-27681, CVSS score: 9.9) that could result in the execution of arbitrary database  ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-FBwJYevQ8Ner9ypyp5-H1XIPfa5guhQXC-W4llTZuBI072vjCoxKh9PUexQBZGJIeuZXoBAKboz9xz5Gzd0p1SiT5UME0wd0lTTOS6EIh3nJ6vsAeMzGmT0P38ry2ySiLc-je0e0YAZAPDYmhw3jSfqbExcsQW5nL8syaClAcSfZziU-KPneawQFfo6p/s1600/patches.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>April, Patch, Tuesday, Fixes, Critical, Flaws, Across, SAP, Adobe, Microsoft, Fortinet, and, More</media:keywords>
</item>

<item>
<title>Deterministic + Agentic AI: The Architecture Exposure Validation Requires</title>
<link>https://block385.com/deterministic-agentic-ai-the-architecture-exposure-validation-requires</link>
<guid>https://block385.com/deterministic-agentic-ai-the-architecture-exposure-validation-requires</guid>
<description><![CDATA[ Few technologies have moved from experimentation to boardroom mandate as quickly as AI. Across industries, leadership teams have embraced its broader potential, and boards, investors, and executives are already pushing organizations to adopt it across operational and security functions. Pentera’s AI Security and Exposure Report 2026 reflects that momentum: every CISO surveyed ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3s5QStAA0bgcCWhxktRnDbuCjGGiFi6NUz1Z9zVK8-4CkZ8FS82Sc5Qg_9-wKK98yThRDobcnyJcD63TIzW4OUTXzNrXTD6PXHoNMBJpgt02mi7K24qVMxfq_8zsG6kBupb8S0DygwxK2F33miTnFivZKSguCqCv82v3mxOAYWnHrcFHF7Y1iTPgV9i6u/s1600/validation-main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Deterministic, Agentic, AI:, The, Architecture, Exposure, Validation, Requires</media:keywords>
</item>

<item>
<title>OpenAI expands its cyber defense program with GPT&#45;5.4&#45;Cyber for vetted researchers</title>
<link>https://block385.com/openai-expands-its-cyber-defense-program-with-gpt-54-cyber-for-vetted-researchers</link>
<guid>https://block385.com/openai-expands-its-cyber-defense-program-with-gpt-54-cyber-for-vetted-researchers</guid>
<description><![CDATA[ Defending critical software has long depended on the ability to find and fix vulnerabilities faster than attackers can exploit them. OpenAI is expanding a program designed to give professional defenders prioritized access to AI tools built for that purpose. The company is scaling its Trusted Access for Cyber (TAC) program to thousands of verified individual defenders and hundreds of teams responsible for defending critical software. Alongside that expansion, OpenAI is releasing GPT-5.4-Cyber, a version of … More →
The post OpenAI expands its cyber defense program with GPT-5.4-Cyber for vetted researchers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05155719/openai-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 15:00:51 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI, expands, its, cyber, defense, program, with, GPT-5.4-Cyber, for, vetted, researchers</media:keywords>
</item>

<item>
<title>What changed in nginx 1.30.0 and what it means for your upstream config</title>
<link>https://block385.com/what-changed-in-nginx-1300-and-what-it-means-for-your-upstream-config</link>
<guid>https://block385.com/what-changed-in-nginx-1300-and-what-it-means-for-your-upstream-config</guid>
<description><![CDATA[ nginx 1.30.0 brings together features accumulated across the 1.29.x mainline series. The release covers a broad range of changes, from protocol support additions to security-relevant fixes and new configuration options. Keepalive to upstreams is now on by default One of the more operationally significant changes is that keepalive connections to upstream servers are now enabled by default, with the proxy HTTP version set to 1.1. Previously, operators had to configure this explicitly. The change affects … More →
The post What changed in nginx 1.30.0 and what it means for your upstream config appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/03/25161729/nginx-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 15:00:47 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>What, changed, nginx, 1.30.0, and, what, means, for, your, upstream, config</media:keywords>
</item>

<item>
<title>Raspberry Pi OS 6.2 disables passwordless sudo by default</title>
<link>https://block385.com/raspberry-pi-os-62-disables-passwordless-sudo-by-default</link>
<guid>https://block385.com/raspberry-pi-os-62-disables-passwordless-sudo-by-default</guid>
<description><![CDATA[ Raspberry Pi OS 6.2, based on the Trixie version, introduces small changes, bug fixes, and disables passwordless sudo by default for new installations. Screenshot of password prompt (Source: Raspberry Pi) “We continually review the security of Raspberry Pi OS to ensure it is sufficiently robust to withstand potential attacks. This is always a balance, as anything that makes the operating system more secure can inconvenience legitimate users to some extent, so we try to keep … More →
The post Raspberry Pi OS 6.2 disables passwordless sudo by default appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/29223248/access.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 15:00:41 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Raspberry, 6.2, disables, passwordless, sudo, default</media:keywords>
</item>

<item>
<title>Sitehop’s SAFEcore Edge enables ultra&#45;low&#45;latency, hardware&#45;enforced post&#45;quantum encryption</title>
<link>https://block385.com/sitehops-safecore-edge-enables-ultra-low-latency-hardware-enforced-post-quantum-encryption</link>
<guid>https://block385.com/sitehops-safecore-edge-enables-ultra-low-latency-hardware-enforced-post-quantum-encryption</guid>
<description><![CDATA[ Sitehop has launched SAFEcore Edge, a post-quantum encryption device, bringing quantum-resistant security to critical national infrastructure, financial services, and government networks at every point, however remote. From oil platforms and far-flung bank branches to autonomous vehicles, retail sites and official communications, the pocket-sized device is designed to operate where conventional security infrastructure cannot reach. SAFEcore Edge delivers hardware-enforced post-quantum encryption to the network edge, with up to 1,000 times lower latency than software-only solutions. This … More →
The post Sitehop’s SAFEcore Edge enables ultra-low-latency, hardware-enforced post-quantum encryption appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 15:00:28 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Sitehop’s, SAFEcore, Edge, enables, ultra-low-latency, hardware-enforced, post-quantum, encryption</media:keywords>
</item>

<item>
<title>Axonius updates Asset Cloud with AI, exposure management, and asset trust standard</title>
<link>https://block385.com/axonius-updates-asset-cloud-with-ai-exposure-management-and-asset-trust-standard</link>
<guid>https://block385.com/axonius-updates-asset-cloud-with-ai-exposure-management-and-asset-trust-standard</guid>
<description><![CDATA[ Axonius has expanded its Asset Cloud with AI-powered remediation in Axonius Exposures, added support for IoT and OT environments via Axonius Cyber-Physical Assets, and introduced a new data trust standard with Axonius Verified Assets. “Security environments have grown more distributed, more dynamic, and more complex, and when teams can’t fully understand their environment, they simply cannot act,” said Joe Diamond, president and interim CEO of Axonius. “Findings pile up because the data isn’t trusted, ownership … More →
The post Axonius updates Asset Cloud with AI, exposure management, and asset trust standard appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 15:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Axonius, updates, Asset, Cloud, with, AI, exposure, management, and, asset, trust, standard</media:keywords>
</item>

<item>
<title>Microsoft, Salesforce Patch AI Agent Data Leak Flaws</title>
<link>https://block385.com/microsoft-salesforce-patch-ai-agent-data-leak-flaws</link>
<guid>https://block385.com/microsoft-salesforce-patch-ai-agent-data-leak-flaws</guid>
<description><![CDATA[ Two recently fixed prompt injections in Salesforce Agentforce and Microsoft Copilot would have enabled an external attacker to leak sensitive data. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte7dc263e75be56e5/69de87e3a047c9fc38c21430/AI_magnifying_glass_Techa_Tungateja_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Salesforce, Patch, Agent, Data, Leak, Flaws</media:keywords>
</item>

<item>
<title>Microsoft Bets $10B to Boost Japan&amp;apos;s AI, Cybersecurity</title>
<link>https://block385.com/microsoft-bets-10b-to-boost-japans-ai-cybersecurity</link>
<guid>https://block385.com/microsoft-bets-10b-to-boost-japans-ai-cybersecurity</guid>
<description><![CDATA[ The deal aims to accelerate AI adoption, train workers, and develop cybersecurity partnerships — the latest move by a hyperscaler to compete for sovereign AI and data centers. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf92453227b9ab491/69deb699d8b50e4d46cce021/japan-map-investments-RRice-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Bets, 10B, Boost, Japans, AI, Cybersecurity</media:keywords>
</item>

<item>
<title>Microsoft Issues Patches for SharePoint Zero&#45;Day and 168 Other New Vulnerabilities</title>
<link>https://block385.com/microsoft-issues-patches-for-sharepoint-zero-day-and-168-other-new-vulnerabilities</link>
<guid>https://block385.com/microsoft-issues-patches-for-sharepoint-zero-day-and-168-other-new-vulnerabilities</guid>
<description><![CDATA[ Microsoft on Tuesday released updates to address a record 169 security flaws across its product portfolio, including one vulnerability that has been actively exploited in the wild.
Of these 169 vulnerabilities, 157 are rated Important, eight are rated Critical, three are rated Moderate, and one is rated Low in severity. Ninety-three of the flaws are ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKhAYMS4CZDglUzVBKPpIJJJjC7LSHIE8r8HSYTDvQtfuqIlLk-jorWPPNvMPaiuWSriWM2WP-cyKqr_TRwlOG65EY9ZZWuRYsrzcn05wg3mkQd_-j103HEjHaUryyOF7jWj6IuAM6VwCUloPq_9RMt959E-yG8qF4n1acw3OfY73fWw4p90V0ClaY4hjo/s1600/windows-update.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 12:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Issues, Patches, for, SharePoint, Zero-Day, and, 168, Other, New, Vulnerabilities</media:keywords>
</item>

<item>
<title>OpenAI Launches GPT&#45;5.4&#45;Cyber with Expanded Access for Security Teams</title>
<link>https://block385.com/openai-launches-gpt-54-cyber-with-expanded-access-for-security-teams</link>
<guid>https://block385.com/openai-launches-gpt-54-cyber-with-expanded-access-for-security-teams</guid>
<description><![CDATA[ OpenAI on Tuesday unveiled GPT-5.4-Cyber, a variant of its latest flagship model, GPT‑5.4, that&#039;s specifically optimized for defensive cybersecurity use cases, days after rival Anthropic unveiled its own frontier model, Mythos.
&quot;The progressive use of AI accelerates defenders – those responsible for keeping systems, data, and users safe – enabling them to find and fix problems ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgrjpxBjlnOwelWhtbcyO3kBGpQwkfPkbL7RytRsDo26AL5rMz4inD_rjZLSfjy5R6skvnpiOA5M1LoDaAW1bCz4Isy4RMffGJVzgm4kYy5N-V1ijfLhVHefPcneHVGZyXZRjbLZZBHQRe3_QKhKfb5hss3a5hFveU8v2WkKHq-2wUmY_ocysIGGMP8GxdV/s1600/gpt.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 08:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI, Launches, GPT-5.4-Cyber, with, Expanded, Access, for, Security, Teams</media:keywords>
</item>

<item>
<title>Microsoft ends desktop detour for sensitivity labels in Office web apps</title>
<link>https://block385.com/microsoft-ends-desktop-detour-for-sensitivity-labels-in-office-web-apps</link>
<guid>https://block385.com/microsoft-ends-desktop-detour-for-sensitivity-labels-in-office-web-apps</guid>
<description><![CDATA[ Microsoft is rolling out an update to Office for the web that removes a long-standing limitation around document protection, adding new control to browser-based apps. Specifying users in the Permissions dialog (Source: Microsoft) Users can now apply sensitivity labels with user-defined permissions directly in the web versions of Word, Excel, and PowerPoint. The change brings the web apps in line with capabilities that were previously limited to desktop versions. Previously, browser-based users could only open … More →
The post Microsoft ends desktop detour for sensitivity labels in Office web apps appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/08/12122858/ms-office.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 03:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, ends, desktop, detour, for, sensitivity, labels, Office, web, apps</media:keywords>
</item>

<item>
<title>Microsoft Bets $10 Billion to Boost Japan&amp;apos;s AI, Cybersecurity</title>
<link>https://block385.com/microsoft-bets-10-billion-to-boost-japans-ai-cybersecurity</link>
<guid>https://block385.com/microsoft-bets-10-billion-to-boost-japans-ai-cybersecurity</guid>
<description><![CDATA[ The deal aims to accelerate AI adoption, train workers, and develop cybersecurity partnerships — the latest move by a hyperscaler to compete for sovereign AI and data centers. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf92453227b9ab491/69deb699d8b50e4d46cce021/japan-map-investments-RRice-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 03:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Bets, 10, Billion, Boost, Japans, AI, Cybersecurity</media:keywords>
</item>

<item>
<title>Privilege Elevation Dominates Massive Microsoft Patch Update</title>
<link>https://block385.com/privilege-elevation-dominates-massive-microsoft-patch-update</link>
<guid>https://block385.com/privilege-elevation-dominates-massive-microsoft-patch-update</guid>
<description><![CDATA[ Elevation-of-privilege bugs accounted for more than half of the 165 vulnerabilities patched, with two zero-days in that mix. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0c595c01e195b02e/69dea89ff56bbb6d65296357/patch_tomeqs_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 15 Apr 2026 01:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Privilege, Elevation, Dominates, Massive, Microsoft, Patch, Update</media:keywords>
</item>

<item>
<title>EDR&#45;Killer Ecosystem Expansion Requires Stronger BYOVD Defenses</title>
<link>https://block385.com/edr-killer-ecosystem-expansion-requires-stronger-byovd-defenses</link>
<guid>https://block385.com/edr-killer-ecosystem-expansion-requires-stronger-byovd-defenses</guid>
<description><![CDATA[ Stopping EDR killers, which employ bring-your-own-vulnerable-driver (BYOVD) attack techniques, is difficult, but not impossible. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd7ec16a921a2009e/69de4b2fdf457957a7185c1d/edrkiller_ArtemisDiana_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>EDR-Killer, Ecosystem, Expansion, Requires, Stronger, BYOVD, Defenses</media:keywords>
</item>

<item>
<title>War Game Exercise Demonstrates How Social Media Manipulation Works</title>
<link>https://block385.com/war-game-exercise-demonstrates-how-social-media-manipulation-works</link>
<guid>https://block385.com/war-game-exercise-demonstrates-how-social-media-manipulation-works</guid>
<description><![CDATA[ In an educational game called &quot;Capture the Narrative,&quot; students created bots to sway a fictional election, simulating influence in real-world political scenarios. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt1de06bcc392cd3d2/69de27d006575b379cbdd89f/Wargames_TCDProdDB_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>War, Game, Exercise, Demonstrates, How, Social, Media, Manipulation, Works</media:keywords>
</item>

<item>
<title>Why Orgs Need to Test Networks to Withstand DDoS Attacks During Peak Loads</title>
<link>https://block385.com/why-orgs-need-to-test-networks-to-withstand-ddos-attacks-during-peak-loads</link>
<guid>https://block385.com/why-orgs-need-to-test-networks-to-withstand-ddos-attacks-during-peak-loads</guid>
<description><![CDATA[ Security teams can&#039;t test distributed denial-of-service defenses in a vacuum. They need to test during periods of high demand, such as tax filing deadlines. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc0c8d87f3c20fa1c/66169caf7b452bb8cbf7e896/DDoS_Dragon_Claws_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, Orgs, Need, Test, Networks, Withstand, DDoS, Attacks, During, Peak, Loads</media:keywords>
</item>

<item>
<title>Wargame Exercise Demonstrates How Social Media Manipulation Works</title>
<link>https://block385.com/wargame-exercise-demonstrates-how-social-media-manipulation-works</link>
<guid>https://block385.com/wargame-exercise-demonstrates-how-social-media-manipulation-works</guid>
<description><![CDATA[ In an educational game called &quot;Capture the Narrative,&quot; students created bots to sway a fictional election, simulating influence in real-world political scenarios. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt1de06bcc392cd3d2/69de27d006575b379cbdd89f/Wargames_TCDProdDB_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 21:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Wargame, Exercise, Demonstrates, How, Social, Media, Manipulation, Works</media:keywords>
</item>

<item>
<title>New PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released</title>
<link>https://block385.com/new-php-composer-flaws-enable-arbitrary-command-execution-patches-released</link>
<guid>https://block385.com/new-php-composer-flaws-enable-arbitrary-command-execution-patches-released</guid>
<description><![CDATA[ Two high-severity security vulnerabilities have been disclosed in Composer, a package manager for PHP, that, if successfully exploited, could result in arbitrary command execution.
The vulnerabilities have been described as command injection flaws affecting the Perforce VCS (version control software) driver. Details of the two flaws are below -

CVE-2026-40176 (CVSS ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgP-RqcuX8QuBEwVkchLNSjyIAqQEuFwy0prqQ1gGqxpBFESQLuCzgGB7-cjYhJrbLhbTk_j8G4NedN06plhhqLd_Rpd01mTh8XcOHjvQ_UuJqfjTROZeh40WlSN_7gzRL4yVKX-Aj0ui2gOxo9l70b3Dy5R6srKjne-gQXIhL7fNAHYZ7rDm6-yWl4-_JD/s1600/php-code.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 20:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, PHP, Composer, Flaws, Enable, Arbitrary, Command, Execution, —, Patches, Released</media:keywords>
</item>

<item>
<title>Testing reveals Claude Mythos’s offensive capabilities and limits</title>
<link>https://block385.com/testing-reveals-claude-mythoss-offensive-capabilities-and-limits</link>
<guid>https://block385.com/testing-reveals-claude-mythoss-offensive-capabilities-and-limits</guid>
<description><![CDATA[ Could Claude Mythos Preview, Anthropic’s latest large language model, be leveraged for fully automated cyber attacks? The UK government’s AI Security Institute (AISI) tested its capability to successfully engage in capture-the-flag (CTF) challenges and multi-step attack scenarios, and found that that while its cybersecurity capabilities exceed those of previously available models, it can’t reliably execute autonomous attacks on hardened networks. What is Claude Mythos Preview? Anthropic introduced Claude Mythos Preview to the public earlier this … More →
The post Testing reveals Claude Mythos’s offensive capabilities and limits appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/14143325/anthropic-view-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 19:00:31 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Testing, reveals, Claude, Mythos’s, offensive, capabilities, and, limits</media:keywords>
</item>

<item>
<title>OpenSSL 4.0.0 release cuts deprecated protocols and gains post&#45;quantum support</title>
<link>https://block385.com/openssl-400-release-cuts-deprecated-protocols-and-gains-post-quantum-support</link>
<guid>https://block385.com/openssl-400-release-cuts-deprecated-protocols-and-gains-post-quantum-support</guid>
<description><![CDATA[ OpenSSL 4.0.0 removes several long-deprecated features, adds support for Encrypted Client Hello, and introduces API-level changes that will require code updates for applications built against older versions. SSLv3, SSLv2 client hello, and engines are gone SSLv3 support has been removed. The protocol was deprecated in 2015, and OpenSSL had it disabled by default since version 1.1.0 in 2016. Support for the SSLv2 Client Hello has also been removed. The engine API, which provided a mechanism … More →
The post OpenSSL 4.0.0 release cuts deprecated protocols and gains post-quantum support appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/04/09095359/openssl-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 19:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenSSL, 4.0.0, release, cuts, deprecated, protocols, and, gains, post-quantum, support</media:keywords>
</item>

<item>
<title>AI&#45;Driven Pushpaganda Scam Exploits Google Discover to Spread Scareware and Ad Fraud</title>
<link>https://block385.com/ai-driven-pushpaganda-scam-exploits-google-discover-to-spread-scareware-and-ad-fraud</link>
<guid>https://block385.com/ai-driven-pushpaganda-scam-exploits-google-discover-to-spread-scareware-and-ad-fraud</guid>
<description><![CDATA[ Cybersecurity researchers have unmasked a novel ad fraud scheme that has been found to leverage search engine poisoning (SEO) techniques and artificial intelligence (AI)-generated content to push deceptive news stories into Google&#039;s Discover feed and trick users into enabling persistent browser notifications that lead to scareware and financial scams.
The campaign, which has been ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiON8Ew8R1EO7t3yoLoTFdM2hQsDW9AtBPPBcNuPup6ZmpGta3VyYlkhiqqRlW5CDWpnU_3IJ-EAbnV6nrfzJ4V3mdWIng75afS2TPvZOs-_MLc0a5lxiLwR5H-EWmi1C0ctYCBZSBNbF9CCGcdm7BrNaWunTp8QvBkmqJwq0Yvde9bQxbhooyIYaXRiebP/s1600/ad-fraud.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 18:30:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AI-Driven, Pushpaganda, Scam, Exploits, Google, Discover, Spread, Scareware, and, Fraud</media:keywords>
</item>

<item>
<title>Oligo enables real&#45;time exploit detection and blocking at application runtime</title>
<link>https://block385.com/oligo-enables-real-time-exploit-detection-and-blocking-at-application-runtime</link>
<guid>https://block385.com/oligo-enables-real-time-exploit-detection-and-blocking-at-application-runtime</guid>
<description><![CDATA[ Oligo Security has unveiled Runtime Exploit Blocking, a new capability that stops exploit attempts at the application layer in real time. By providing visibility into how applications execute and behave, Oligo identifies and blocks malicious activity at the point of execution, without killing containers or processes, or impacting the application. Attackers rely on repeatable exploit techniques to infiltrate organizations, with Mandiant reporting that exploitation has remained the leading initial access vector for six consecutive years. … More →
The post Oligo enables real-time exploit detection and blocking at application runtime appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 17:01:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Oligo, enables, real-time, exploit, detection, and, blocking, application, runtime</media:keywords>
</item>

<item>
<title>Claroty advances CPS security with Visibility Orchestration in xDome</title>
<link>https://block385.com/claroty-advances-cps-security-with-visibility-orchestration-in-xdome</link>
<guid>https://block385.com/claroty-advances-cps-security-with-visibility-orchestration-in-xdome</guid>
<description><![CDATA[ Claroty has revealed new Visibility Orchestration capabilities in its Saas offering Claroty xDome, transforming visibility from a vague concept into a quantifiable measurement that proves the value of a strong CPS protection program. Visibility Orchestration elevates organizations across the industrial, healthcare, commercial, and public sectors to a high-fidelity understanding of their CPS environments, enabling measurable, actionable improvements in data quality and security posture and safely orchestrated risk reduction. The rising threat of visibility blind spots … More →
The post Claroty advances CPS security with Visibility Orchestration in xDome appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 17:00:27 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claroty, advances, CPS, security, with, Visibility, Orchestration, xDome</media:keywords>
</item>

<item>
<title>W3LL phishing service sold for $500 dismantled by the FBI</title>
<link>https://block385.com/w3ll-phishing-service-sold-for-500-dismantled-by-the-fbi</link>
<guid>https://block385.com/w3ll-phishing-service-sold-for-500-dismantled-by-the-fbi</guid>
<description><![CDATA[ The W3LL phishing kit, a cybercrime tool used to impersonate legitimate login pages and steal usernames and passwords, has been dismantled by the FBI and Indonesian law enforcement authorities. Officials estimate the operation was tied to more than $20 million in attempted fraud. (Source: FBI) “For a fee of about $500, users could purchase access to the phishing kit and deploy fake websites designed to look nearly identical to trusted login portals,” the FBI said. … More →
The post W3LL phishing service sold for $500 dismantled by the FBI appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/10/16145632/phishing-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 17:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>W3LL, phishing, service, sold, for, 500, dismantled, the, FBI</media:keywords>
</item>

<item>
<title>Google Adds Rust&#45;Based DNS Parser into Pixel 10 Modem to Enhance Security</title>
<link>https://block385.com/google-adds-rust-based-dns-parser-into-pixel-10-modem-to-enhance-security</link>
<guid>https://block385.com/google-adds-rust-based-dns-parser-into-pixel-10-modem-to-enhance-security</guid>
<description><![CDATA[ Google has announced the integration of a Rust-based Domain Name System (DNS) parser into the modem firmware as part of its ongoing efforts to beef up the security of Pixel devices and push memory-safe code at a more foundational level.
&quot;The new Rust-based DNS parser significantly reduces our security risk by mitigating an entire class of vulnerabilities in a risky area, while also laying ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjblrgfLU8m4awyQDEqyzwguow-RuCp4UH1k5DBkrUrP87A7tsEQPPaLD_D9M4VXF5mSNrmp1eurx_QW-nVjM1nNnkyEIFyFiry3nxE0Wq3xrT0L06S6B11rEHcWzB7q78RRQySSxwLAVIncgqO5qhtY6b0A_LzYF8wtvH94G_TLQEn8UIivqrJNkH88Nf7/s1600/android-rust.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 16:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Adds, Rust-Based, DNS, Parser, into, Pixel, Modem, Enhance, Security</media:keywords>
</item>

<item>
<title>Binary Defense expands NightBeacon with threat&#45;aligned Detection Coverage Index</title>
<link>https://block385.com/binary-defense-expands-nightbeacon-with-threat-aligned-detection-coverage-index</link>
<guid>https://block385.com/binary-defense-expands-nightbeacon-with-threat-aligned-detection-coverage-index</guid>
<description><![CDATA[ Binary Defense has announced the launch of NightBeacon Detect, a new module within NightBeacon, the company’s AI-driven SOC platform. The first capability released is Detection Coverage Index, a confidence-based view of how well an organization is covered against specific threat actors, their tactics, techniques, and sub-techniques, and how that coverage changes over time. NightBeacon Detect solves the problem with how detection coverage is measured Security teams invest heavily in detection tools, rules, and telemetry, yet … More →
The post Binary Defense expands NightBeacon with threat-aligned Detection Coverage Index appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 15:00:57 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Binary, Defense, expands, NightBeacon, with, threat-aligned, Detection, Coverage, Index</media:keywords>
</item>

<item>
<title>Booking.com data breach: Customer reservation data exposed</title>
<link>https://block385.com/bookingcom-data-breach-customer-reservation-data-exposed</link>
<guid>https://block385.com/bookingcom-data-breach-customer-reservation-data-exposed</guid>
<description><![CDATA[ “Unauthorized third parties may have been able to access certain booking information associated with your reservation,” email alerts sent out by Booking.com over the weekend warn. The online travel agency did not say which system(s) were accessed by the unauthorized third parties nor explained the scope of the incident. They only said that they “recently noticed suspicious activity affecting a number of reservations” and that their investigation revealed that the attackers may have accessed name(s), … More →
The post Booking.com data breach: Customer reservation data exposed appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/14132441/booking-com-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 15:00:45 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Booking.com, data, breach:, Customer, reservation, data, exposed</media:keywords>
</item>

<item>
<title>DataVisor brings conversational AI agents to fraud and AML operations</title>
<link>https://block385.com/datavisor-brings-conversational-ai-agents-to-fraud-and-aml-operations</link>
<guid>https://block385.com/datavisor-brings-conversational-ai-agents-to-fraud-and-aml-operations</guid>
<description><![CDATA[ DataVisor has announced Vera, a suite of conversational AI agents designed to combat financial crime. Vera enables institutions to manage risk using natural language, allowing teams to issue instructions that AI agents execute across the fraud and AML lifecycle. By reducing manual workflows, the platform supports a more efficient and adaptive operating model for modern financial crime prevention. Fraudsters are weaponizing AI, scaling attacks, and exploiting vulnerabilities faster than humans can respond. DataVisor’s 2026 Fraud … More →
The post DataVisor brings conversational AI agents to fraud and AML operations appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 15:00:36 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DataVisor, brings, conversational, agents, fraud, and, AML, operations</media:keywords>
</item>

<item>
<title>Basic&#45;Fit hack compromises data of up to 1 million members</title>
<link>https://block385.com/basic-fit-hack-compromises-data-of-up-to-1-million-members</link>
<guid>https://block385.com/basic-fit-hack-compromises-data-of-up-to-1-million-members</guid>
<description><![CDATA[ Basic-Fit, a European gym chain, disclosed that hackers breached one of its internal systems, exposing members’ personal data in several countries. The company operates more than 2,150 clubs in 12 countries under two brands, with more than 5.8 million members. “The unauthorised access was detected by our system monitoring processes and was stopped within minutes of discovery. The members whose data is involved have been informed,” the company said in a statement. An investigation by … More →
The post Basic-Fit hack compromises data of up to 1 million members appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/14133556/basic-fit-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 15:00:18 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Basic-Fit, hack, compromises, data, million, members</media:keywords>
</item>

<item>
<title>DavMail 6.6.0 patches a regex flaw and advances its Microsoft Graph backend</title>
<link>https://block385.com/davmail-660-patches-a-regex-flaw-and-advances-its-microsoft-graph-backend</link>
<guid>https://block385.com/davmail-660-patches-a-regex-flaw-and-advances-its-microsoft-graph-backend</guid>
<description><![CDATA[ Organizations that run DavMail to bridge standard mail clients to Microsoft Exchange or Office 365 received an update this week. Version 6.6.0 addresses a code-scanning alert tied to a regex vulnerability, adjusts OAuth redirect handling to match a recent Microsoft change, and ships fixes across IMAP, SMTP, CalDAV, and CardDAV subsystems. A regex replacement closes a security alert The security change replaces a regular expression in the replaceIcal4Principal method with simple substring calls, resolving a … More →
The post DavMail 6.6.0 patches a regex flaw and advances its Microsoft Graph backend appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/08/19153210/email.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 15:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DavMail, 6.6.0, patches, regex, flaw, and, advances, its, Microsoft, Graph, backend</media:keywords>
</item>

<item>
<title>Mirax Android RAT Turns Devices into SOCKS5 Proxies, Reaching 220,000 via Meta Ads</title>
<link>https://block385.com/mirax-android-rat-turns-devices-into-socks5-proxies-reaching-220000-via-meta-ads</link>
<guid>https://block385.com/mirax-android-rat-turns-devices-into-socks5-proxies-reaching-220000-via-meta-ads</guid>
<description><![CDATA[ A nascent Android remote access trojan called Mirax has been observed actively targeting Spanish-speaking countries, with campaigns reaching more than 220,000 accounts on Facebook, Instagram, Messenger, and Threads through advertisements on Meta.
&quot;Mirax integrates advanced Remote Access Trojan (RAT) capabilities, allowing threat actors to fully interact with compromised devices in real ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSTMJQqqJsKQgPpv94bO9xAc_tQCEJXJrZGAEmCuyUghslqHdHDYmuVYqIVLGqMLi_ZuY_zEBoDdGDQRVAX0KyGq9QcuIzQ5LVbNLBnwUwW2R7IBg0gopxAI9ml44zJsKXEoc1ig8zRbVDBNK3B4LZRE0WljzIfwnSMHx8Mv1kWYTK5qnxOB1YYl_WNWMa/s1600/android-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 14:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mirax, Android, RAT, Turns, Devices, into, SOCKS5, Proxies, Reaching, 220, 000, via, Meta, Ads</media:keywords>
</item>

<item>
<title>AI adoption is outpacing the safeguards around it</title>
<link>https://block385.com/ai-adoption-is-outpacing-the-safeguards-around-it</link>
<guid>https://block385.com/ai-adoption-is-outpacing-the-safeguards-around-it</guid>
<description><![CDATA[ AI is becoming part of professional and private life, reaching mainstream adoption faster than the personal computer or the internet. These systems are tested in reasoning, safety, and real-world tasks, but the reliability of those measurements remains uncertain. The 2026 AI Index from Stanford’s Institute for Human-Centered Artificial Intelligence outlines the broader environment around this growth, including economic value, labor market effects, and the role of AI sovereignty. It also examines developments in science and … More →
The post AI adoption is outpacing the safeguards around it appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/20105115/ai-faces-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 13:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>adoption, outpacing, the, safeguards, around</media:keywords>
</item>

<item>
<title>Google to penalize sites that hijack the back button</title>
<link>https://block385.com/google-to-penalize-sites-that-hijack-the-back-button</link>
<guid>https://block385.com/google-to-penalize-sites-that-hijack-the-back-button</guid>
<description><![CDATA[ Google is broadening its spam policies to crack down on “back button hijacking,” a deceptive practice where websites interfere with browser navigation, blocking users from returning to the page they came from. Instead, users are usually redirected to pages they have not visited or are shown unsolicited recommendations or ads. “Back button hijacking interferes with the browser’s functionality, breaks the expected user journey, and results in user frustration. People report feeling manipulated and less willing … More →
The post Google to penalize sites that hijack the back button appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/08/16124958/google_search_malicious.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 13:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, penalize, sites, that, hijack, the, back, button</media:keywords>
</item>

<item>
<title>Analysis of 216M Security Findings Shows a 4x Increase In Critical Risk (2026 Report)</title>
<link>https://block385.com/analysis-of-216m-security-findings-shows-a-4x-increase-in-critical-risk-2026-report</link>
<guid>https://block385.com/analysis-of-216m-security-findings-shows-a-4x-increase-in-critical-risk-2026-report</guid>
<description><![CDATA[ OX Security recently analyzed 216 million security findings across 250 organizations over a 90-day period. The primary takeaway: while raw alert volume grew by 52% year-over-year, prioritized critical risk grew by nearly 400%.
The surge in AI-assisted development is creating a &quot;velocity gap&quot; where the density of high-impact vulnerabilities is scaling faster than ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4H3KkiSOm6TbNn7e0Ceu3-etqqeLci47PtX9T-0WGgdGScHfd2tfFamA6oyOi62wWwKF7KwF_wcqNACSvRVJvH__1YKoP_fP7T5LFdDqX8jxFph0NSaVJjFEVhb0bjNvn5IWayqMwKyRNbp9mmW7f2JLs7I3pTF8yLuhCOHsbnpNVLrEVq6Uq63j8508/s1600/derailed.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 12:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Analysis, 216M, Security, Findings, Shows, Increase, Critical, Risk, 2026, Report</media:keywords>
</item>

<item>
<title>108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users</title>
<link>https://block385.com/108-malicious-chrome-extensions-steal-google-and-telegram-data-affecting-20000-users</link>
<guid>https://block385.com/108-malicious-chrome-extensions-steal-google-and-telegram-data-affecting-20000-users</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a new campaign in which a cluster of 108 Google Chrome extensions has been found to communicate with the same command-and-control (C2) infrastructure with the goal of collecting user data and enabling browser-level abuse by injecting ads and arbitrary JavaScript code into every web page visited.
According to Socket, the extensions are published ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEOmjr311c0yBDI593joFXQLaRdpm6DY67lbFv83YcYlRHaJkpocwXjDZDsV9F9DM-SavZwCOZ-fg10ncUJyW3ODlfBjqG6aK_ytdBfvXFGLswxeJ69oiZXfhGKdCgVO0Angg_qlYB6oAZYo-JQRKn4toBGWcS7OTDwPV0rkus7eNw-9BllIGJa2nkeKXn/s1600/chrome-telegram.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 12:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>108, Malicious, Chrome, Extensions, Steal, Google, and, Telegram, Data, Affecting, 20, 000, Users</media:keywords>
</item>

<item>
<title>29 million leaked secrets in 2025: Why AI agents credentials are out of control</title>
<link>https://block385.com/29-million-leaked-secrets-in-2025-why-ai-agents-credentials-are-out-of-control</link>
<guid>https://block385.com/29-million-leaked-secrets-in-2025-why-ai-agents-credentials-are-out-of-control</guid>
<description><![CDATA[ AI agents need credentials to work. They authenticate with LLM platforms, connect to databases, call SaaS APIs, access cloud resources, and orchestrate across dozens of external services. Every integration point requires an identity. Most organizations are handling this badly, and the evidence is in the code. GitGuardian’s State of Secrets Sprawl Report found 28,649,024 new secrets exposed in public GitHub commits across 2025, a 34% year-over-year increase and the largest annual jump in the report’s … More →
The post 29 million leaked secrets in 2025: Why AI agents credentials are out of control appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/27111157/gitguardian-prevention-first_secrets_security.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 09:00:52 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>million, leaked, secrets, 2025:, Why, agents, credentials, are, out, control</media:keywords>
</item>

<item>
<title>Review: The Psychology of Information Security</title>
<link>https://block385.com/review-the-psychology-of-information-security</link>
<guid>https://block385.com/review-the-psychology-of-information-security</guid>
<description><![CDATA[ Security controls fail when they are designed without regard for the people who must use them. That is the central argument of Leron Zinatullin’s second edition, and it is an argument he builds methodically across 17 chapters that draw from organizational psychology, change management, and usability research. About the author Leron Zinatullin is the CISO of Constantinople, a provider of AI-native banking. He’s also a speaker and advisor to startups. He has led large scale, … More →
The post Review: The Psychology of Information Security appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/12155529/psychology_infosec-book.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 09:00:41 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Review:, The, Psychology, Information, Security</media:keywords>
</item>

<item>
<title>Agentic AI memory attacks spread across sessions and users, and most organizations aren’t ready</title>
<link>https://block385.com/agentic-ai-memory-attacks-spread-across-sessions-and-users-and-most-organizations-arent-ready</link>
<guid>https://block385.com/agentic-ai-memory-attacks-spread-across-sessions-and-users-and-most-organizations-arent-ready</guid>
<description><![CDATA[ In this Help Net Security interview, Idan Habler, AI Security Researcher at Cisco, breaks down a threat most security teams haven’t named yet: agentic memory as an attack surface. Habler walks through MemoryTrap, a disclosed and remediated method to compromise Claude Code’s memory, showing how a single poisoned memory object can spread across sessions, users, and subagents. He explains why AI memory needs the same governance as secrets and identities, and what organizations must rebuild … More →
The post Agentic AI memory attacks spread across sessions and users, and most organizations aren’t ready appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 09:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Agentic, memory, attacks, spread, across, sessions, and, users, and, most, organizations, aren’t, ready</media:keywords>
</item>

<item>
<title>ShowDoc RCE Flaw CVE&#45;2025&#45;0520 Actively Exploited on Unpatched Servers</title>
<link>https://block385.com/showdoc-rce-flaw-cve-2025-0520-actively-exploited-on-unpatched-servers</link>
<guid>https://block385.com/showdoc-rce-flaw-cve-2025-0520-actively-exploited-on-unpatched-servers</guid>
<description><![CDATA[ A critical security vulnerability impacting ShowDoc, a document management and collaboration service popular in China, has come under active exploitation in the wild.
The vulnerability in question is CVE-2025-0520 (aka CNVD-2020-26585), which carries a CVSS score of 9.4 out of 10.0.
It relates to a case of unrestricted file upload that stems from improper validation of ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjthzbWdOOZKL2JKvluG78cobCs7bGxvHsfzSMHt4XgX1OO9h-r7W_dlYCCDrCoKo2dAXhh264NTGUrFKBpM8pv0WcePn5gUp1atSJ4-iC4_wr0jmo7nDZ46JYCs8P_5DLs5RcHi81-L7Wiw35cLHNWqCPe50LJ1a3tqfxwfB3S3ufQjYQfUrfRDwMo1BYE/s1600/showdoc.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 08:30:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ShowDoc, RCE, Flaw, CVE-2025-0520, Actively, Exploited, Unpatched, Servers</media:keywords>
</item>

<item>
<title>CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software</title>
<link>https://block385.com/cisa-adds-6-known-exploited-flaws-in-fortinet-microsoft-and-adobe-software</link>
<guid>https://block385.com/cisa-adds-6-known-exploited-flaws-in-fortinet-microsoft-and-adobe-software</guid>
<description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added half a dozen security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The list of vulnerabilities is as follows -

CVE-2026-21643 (CVSS score: 9.1) -  An SQL injection vulnerability in  Fortinet FortiClient EMS that could allow an unauthenticated attacker to ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkkewWzrjyqzejet7cyCWdTUMfgjGZgkDpis6rUlh7qnyPpmcN1k_vVdKvziAZq2cOkFQDrJNM8E6WE8Cl7oPNdq94MOXJLa0nkbEmAFCB_MnjLQzTy-WjHGa6yuLhm7dPzuW3YEQeFIfOT1Tr25NgALeTL6vFDhzmJrCRMLL0GBpOhkwQm_Zirk_9aNjr/s1600/warning.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 08:30:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISA, Adds, Known, Exploited, Flaws, Fortinet, Microsoft, and, Adobe, Software</media:keywords>
</item>

<item>
<title>Cybersecurity jobs available right now: April 14, 2026</title>
<link>https://block385.com/cybersecurity-jobs-available-right-now-april-14-2026</link>
<guid>https://block385.com/cybersecurity-jobs-available-right-now-april-14-2026</guid>
<description><![CDATA[ Cyber Security Engineer/Application Security Specialist Tecnots | India | On-site – View job details As a Cyber Security Engineer/Application Security Specialist, you will integrate security into the SDLC, perform application security reviews, and support secure APIs, authentication, and data protection. You will embed security into CI/CD pipelines using SAST and DAST, enforce secure coding practices, and support remediation. You will secure cloud and on-prem environments, including Microsoft Azure, manage IAM and access controls, and handle … More →
The post Cybersecurity jobs available right now: April 14, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11140407/cybersecurity_jobs-3-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 07:00:20 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybersecurity, jobs, available, right, now:, April, 14, 2026</media:keywords>
</item>

<item>
<title>Zero trust at year two: What nobody planned for</title>
<link>https://block385.com/zero-trust-at-year-two-what-nobody-planned-for</link>
<guid>https://block385.com/zero-trust-at-year-two-what-nobody-planned-for</guid>
<description><![CDATA[ In this Help Net Security video, Jim Alkove, CEO of Oleria, walks through where zero trust programs typically stand one to two years in. Most organizations have made gains in endpoint security and network segmentation, but identity remains the stubborn problem. Identity sprawl, legacy system exceptions, and workforce friction each contribute to stalls that few programs anticipated. Alkove then turns to a challenge most teams are not prepared for: AI agents operating at scale. A … More →
The post Zero trust at year two: What nobody planned for appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11084626/zero-trust-1500-2.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 07:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Zero, trust, year, two:, What, nobody, planned, for</media:keywords>
</item>

<item>
<title>CSA: CISOs Should Prepare for Post&#45;Mythos Exploit Storm</title>
<link>https://block385.com/csa-cisos-should-prepare-for-post-mythos-exploit-storm</link>
<guid>https://block385.com/csa-cisos-should-prepare-for-post-mythos-exploit-storm</guid>
<description><![CDATA[ Security experts warn of an &quot;AI vulnerability storm&quot; triggered by the introduction of Anthropic&#039;s Claude Mythos in a new paper from the Cloud Security Alliance (CSA). ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4847d5811e1a5d6d/69dd4bee41dce10dda27cdb9/storm_Doug_McCutcheon_LGPL_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 01:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CSA:, CISOs, Should, Prepare, for, Post-Mythos, Exploit, Storm</media:keywords>
</item>

<item>
<title>Adobe Patches Actively Exploited Zero&#45;Day That Lingered for Months</title>
<link>https://block385.com/adobe-patches-actively-exploited-zero-day-that-lingered-for-months</link>
<guid>https://block385.com/adobe-patches-actively-exploited-zero-day-that-lingered-for-months</guid>
<description><![CDATA[ An attacker has been using maliciously crafted PDF files to exploit a zero-day in Adobe Acrobat and Reader for at least four months. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt8988803ceeda1900/69dd49a17d660065071bed39/adobe_PJ_McDonnell_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 14 Apr 2026 01:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Adobe, Patches, Actively, Exploited, Zero-Day, That, Lingered, for, Months</media:keywords>
</item>

<item>
<title>Empty Attestations: OT Lacks the Tools for Cryptographic Readiness</title>
<link>https://block385.com/empty-attestations-ot-lacks-the-tools-for-cryptographic-readiness</link>
<guid>https://block385.com/empty-attestations-ot-lacks-the-tools-for-cryptographic-readiness</guid>
<description><![CDATA[ OT asset owners are being asked by regulators to attest to their post-quantum cryptographic readiness without the appropriate tooling, resulting in paperwork dressed up to look like genuine security. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt763a68df93335d36/69dd3c843775488332820d53/Quantum_Cryptography_Nick_Gregory_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Empty, Attestations:, Lacks, the, Tools, for, Cryptographic, Readiness</media:keywords>
</item>

<item>
<title>JanelaRAT Malware Targets Latin American Banks with 14,739 Attacks in Brazil in 2025</title>
<link>https://block385.com/janelarat-malware-targets-latin-american-banks-with-14739-attacks-in-brazil-in-2025</link>
<guid>https://block385.com/janelarat-malware-targets-latin-american-banks-with-14739-attacks-in-brazil-in-2025</guid>
<description><![CDATA[ Banks and financial institutions in Latin American countries like Brazil and Mexico have continued to be the target of a malware family called JanelaRAT.
A modified version of BX RAT, JanelaRAT is known to steal financial and cryptocurrency data associated with specific financial entities, as well as track mouse inputs, log keystrokes, take screenshots, and collect system metadata.
&quot;One of the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMP1knUStbLpgNZ-k52a4ctZyxeERGEeqqVfX75PVTgtdu6XpoIlhHiFAwa4nTwg0089TuczQY5YZOgHOQk-TpVZNxs0piNVCPHsgBPSreTcKQ8gwISSDK7JI4oipfjfrnehwPCqWcyBnxobYaKM7TTu5SN23pUJ5K9fCbORLy2g_ZsSzkmxkp8VVdghfP/s1600/1000066319.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 22:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>JanelaRAT, Malware, Targets, Latin, American, Banks, with, 14, 739, Attacks, Brazil, 2025</media:keywords>
</item>

<item>
<title>Hackers hijacked CPUID downloads, served STX RAT to victims</title>
<link>https://block385.com/hackers-hijacked-cpuid-downloads-served-stx-rat-to-victims</link>
<guid>https://block385.com/hackers-hijacked-cpuid-downloads-served-stx-rat-to-victims</guid>
<description><![CDATA[ If you tried to download software from CPUID’s website late last week, you might have downloaded malware instead. “Investigations are still ongoing, but it appears that a secondary feature (basically a side API) was compromised for approximately six hours between April 9 and April 10, causing the main website to randomly display malicious links (our signed original files were not compromised),” Samuel Demeulemeester, a contributor to CPUID, stated on Friday, and apologized to affected users. … More →
The post Hackers hijacked CPUID downloads, served STX RAT to victims appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 21:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hackers, hijacked, CPUID, downloads, served, STX, RAT, victims</media:keywords>
</item>

<item>
<title>APT41 Delivers &amp;apos;Zero&#45;Detection&amp;apos; Backdoor to Harvest Cloud Credentials</title>
<link>https://block385.com/apt41-delivers-zero-detection-backdoor-to-harvest-cloud-credentials</link>
<guid>https://block385.com/apt41-delivers-zero-detection-backdoor-to-harvest-cloud-credentials</guid>
<description><![CDATA[ The prolific China-backed threat group is targeting AWS, Google, Azure, and Alibaba cloud environments and using typosquatting to obscure C2 communication. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt2e8cc931a1c1d4d4/69dcc2c014d9c34775418603/chinaiptheft_Pixels_Hunter_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 19:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>APT41, Delivers, Zero-Detection, Backdoor, Harvest, Cloud, Credentials</media:keywords>
</item>

<item>
<title>FBI and Indonesian Police Dismantle W3LL Phishing Network Behind $20M Fraud Attempts</title>
<link>https://block385.com/fbi-and-indonesian-police-dismantle-w3ll-phishing-network-behind-20m-fraud-attempts</link>
<guid>https://block385.com/fbi-and-indonesian-police-dismantle-w3ll-phishing-network-behind-20m-fraud-attempts</guid>
<description><![CDATA[ The U.S. Federal Bureau of Investigation (FBI), in partnership with the Indonesian National Police, has dismantled the infrastructure associated with a global phishing operation that leveraged an off-the-shelf toolkit called W3LL to steal thousands of victims&#039; account credentials and attempt more than $20 million in fraud.
In tandem, authorities detained the alleged developer, who has&amp; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgb77IQHAfOvWFPWb_cgV_YJGdRtNJJJWBcjYH6M6cCawBv2tQdybani7Qet_LGwH1tTBHJ2P3Lr6gWdY0sz3547YLzkSLWX3T2l84-A7ndRK3T55QblpJ-j2ovE9Lq0CoNb6ckWziwD2UjKP_awFJXbGr3yuZ1IMPndUyCo_WfoJ9nnyTPFf-K4HVy5A8g/s1600/well-fbi.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 18:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FBI, and, Indonesian, Police, Dismantle, W3LL, Phishing, Network, Behind, 20M, Fraud, Attempts</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More</title>
<link>https://block385.com/weekly-recap-fiber-optic-spying-windows-rootkit-ai-vulnerability-hunting-and-more</link>
<guid>https://block385.com/weekly-recap-fiber-optic-spying-windows-rootkit-ai-vulnerability-hunting-and-more</guid>
<description><![CDATA[ Monday is back, and the weekend’s backlog of chaos is officially hitting the fan. We are tracking a critical zero-day that has been quietly living in your PDFs for months, plus some aggressive state-sponsored meddling in infrastructure that is finally coming to light. It is one of those mornings where the gap between a quiet shift and a full-blown incident response is basically ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZNd-YcwKXoD_PmPblT00GaI9GQJvtJTHZk-5RBS1QEtLRupE9KKh-ogAP61b-cLzJm90PHDoRVnhiUzxlqcn-3gB2EtBG2TYxt8erP8UmLj3t1L_9Ykh3vfbCXFBXAoeylbbTeK7jxJIDmqCqThPziWi0XOzbyMZ-UEWGl_PhP4xePoRbsm_RqpUKmQNW/s1600/recaps-main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 16:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>⚡, Weekly, Recap:, Fiber, Optic, Spying, Windows, Rootkit, Vulnerability, Hunting, and, More</media:keywords>
</item>

<item>
<title>Google makes it harder to exploit Pixel 10 modem firmware</title>
<link>https://block385.com/google-makes-it-harder-to-exploit-pixel-10-modem-firmware</link>
<guid>https://block385.com/google-makes-it-harder-to-exploit-pixel-10-modem-firmware</guid>
<description><![CDATA[ Google is working to improve the security of Pixel phones by focusing on the cellular baseband modem, a part of the device that handles communication with mobile networks and processes external data. In the Pixel 9, the company introduced measures to reduce memory-related vulnerabilities. With the Pixel 10, the approach goes further by integrating a DNS parser written in the Rust programming language into the modem firmware. The DNS protocol is known for helping browsers … More →
The post Google makes it harder to exploit Pixel 10 modem firmware appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/13102025/google_pixel_10-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 15:00:40 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, makes, harder, exploit, Pixel, modem, firmware</media:keywords>
</item>

<item>
<title>Rockstar Games receives “pay or leak” warning after cyberattack</title>
<link>https://block385.com/rockstar-games-receives-pay-or-leak-warning-after-cyberattack</link>
<guid>https://block385.com/rockstar-games-receives-pay-or-leak-warning-after-cyberattack</guid>
<description><![CDATA[ Rockstar Games, the developer behind titles such as Grand Theft Auto and Red Dead Redemption, has confirmed a cyberattack claimed by hacking group ShinyHunters, which says it accessed the company’s Snowflake environment and obtained data. The attackers exploited Anodot, a third-party SaaS platform used for cloud cost monitoring and analytics, as the entry point and are reported to have extracted authentication tokens, enabling access to a connected Snowflake account without exploiting vulnerabilities in Snowflake itself. … More →
The post Rockstar Games receives “pay or leak” warning after cyberattack appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/13121948/rockstar_games-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 15:00:24 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Rockstar, Games, receives, “pay, leak”, warning, after, cyberattack</media:keywords>
</item>

<item>
<title>$12 million frozen, 20,000 victims identified in crypto scam crackdown</title>
<link>https://block385.com/12-million-frozen-20000-victims-identified-in-crypto-scam-crackdown</link>
<guid>https://block385.com/12-million-frozen-20000-victims-identified-in-crypto-scam-crackdown</guid>
<description><![CDATA[ More than $12 million has been frozen, and over 20,000 victims have been identified in an international law enforcement operation targeting cryptocurrency and investment scammers. Authorities also uncovered more than $45 million in suspected cryptocurrency fraud losses worldwide. One UK victim identified during the operation is thought to have lost more than £52,000 to the fraud. According to the FBI’s report, cryptocurrency remained a central element in fraud-related activity, with losses totaling $11.3 billion. Investment … More →
The post $12 million frozen, 20,000 victims identified in crypto scam crackdown appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/16112525/crypto_scams.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 15:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>12, million, frozen, 20, 000, victims, identified, crypto, scam, crackdown</media:keywords>
</item>

<item>
<title>Your MTTD Looks Great. Your Post&#45;Alert Gap Doesn&amp;apos;t</title>
<link>https://block385.com/your-mttd-looks-great-your-post-alert-gap-doesnt</link>
<guid>https://block385.com/your-mttd-looks-great-your-post-alert-gap-doesnt</guid>
<description><![CDATA[ Anthropic restricted its Mythos Preview model last week after it autonomously found and exploited zero-day vulnerabilities in every major operating system and browser. Palo Alto Networks&#039; Wendi Whitmorewarned that similar capabilities are weeks or months from proliferation. CrowdStrike&#039;s 2026 Global Threat Report puts average eCrime breakout time at 29 minutes. Mandiant&#039;s M-Trends 2026 ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6yIgStY_TVvAIztG3gjTOWA2HNY1juzcSFQVACCzI1G1EU97z9wTsAO9HJECkmv0RcAYSxu4xSALf9jELTrtC9ruDKbMS5DPq2U2TYXLtvxZ1F4sRaQ2KIe-FfGpB8kZEhs1LEuOvaEnvGO-50RM227cjDVRFdBaXeC8r5WPOQHG3n2SB8ui3USopqHM/s1600/pro.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 14:30:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, MTTD, Looks, Great., Your, Post-Alert, Gap, Doesnt</media:keywords>
</item>

<item>
<title>MITRE releases a shared fraud&#45;cyber framework built from real attack data</title>
<link>https://block385.com/mitre-releases-a-shared-fraud-cyber-framework-built-from-real-attack-data</link>
<guid>https://block385.com/mitre-releases-a-shared-fraud-cyber-framework-built-from-real-attack-data</guid>
<description><![CDATA[ Financial fraud losses in the United States reached $16.6 billion in 2024, up from $4.2 billion in 2020. Behind those numbers is a structural problem: the teams responsible for stopping fraud, fraud investigators and cybersecurity analysts, have historically operated separately, using different tools, different terminology, and different mental models of how attacks unfold. The MITRE Fight Fraud Framework, known as F3, is a behavior-based model designed to give both teams a common structure for describing, … More →
The post MITRE releases a shared fraud-cyber framework built from real attack data appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/05/08124824/mitre-2024-2.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 13:01:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>MITRE, releases, shared, fraud-cyber, framework, built, from, real, attack, data</media:keywords>
</item>

<item>
<title>ZeroID: Open&#45;source identity platform for autonomous AI agents</title>
<link>https://block385.com/zeroid-open-source-identity-platform-for-autonomous-ai-agents</link>
<guid>https://block385.com/zeroid-open-source-identity-platform-for-autonomous-ai-agents</guid>
<description><![CDATA[ ZeroID is an open-source identity platform that implements an identity and credentialing layer specifically for autonomous agents and multi-agent systems. The attribution problem The core issue ZeroID targets is attribution in agentic workflows. When an orchestrator agent spawns sub-agents to carry out parts of a task, each sub-agent may call APIs, write files, or execute shell commands. Existing approaches offer limited traceability: shared service accounts carry no delegation trail, and standard OAuth 2.0 and OIDC … More →
The post ZeroID: Open-source identity platform for autonomous AI agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/10100726/zeroid-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 13:01:01 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ZeroID:, Open-source, identity, platform, for, autonomous, agents</media:keywords>
</item>

<item>
<title>Fixing vulnerability data quality requires fixing the architecture first</title>
<link>https://block385.com/fixing-vulnerability-data-quality-requires-fixing-the-architecture-first</link>
<guid>https://block385.com/fixing-vulnerability-data-quality-requires-fixing-the-architecture-first</guid>
<description><![CDATA[ In this Help Net Security interview, Art Manion, Deputy Director at Tharros, examines why vulnerability data across repositories stays inconsistent and hard to trust. The problem starts with systems not designed to collect or manage that data well. They introduce the idea of Minimum Viable Vulnerability Enumeration (MVVE), a minimum set of assertions needed to confirm two systems describe the same vulnerability, and find no true minimum exists. Assertions vary by case and change over … More →
The post Fixing vulnerability data quality requires fixing the architecture first appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/07125354/art_manion-2-tharros.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 13:00:54 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fixing, vulnerability, data, quality, requires, fixing, the, architecture, first</media:keywords>
</item>

<item>
<title>Seized VerifTools servers expose 915,655 fake IDs, 8 arrested</title>
<link>https://block385.com/seized-veriftools-servers-expose-915655-fake-ids-8-arrested</link>
<guid>https://block385.com/seized-veriftools-servers-expose-915655-fake-ids-8-arrested</guid>
<description><![CDATA[ On April 7 and 8, Dutch police arrested eight suspects in a nationwide operation targeting users of the VerifTools platform as part of an identity fraud investigation. The suspects, all men aged 20 to 34, are accused of identity fraud, forgery, and cybercrime-related offenses. During searches, officers seized smartphones, laptops, cash, cryptocurrency, and weapons or items resembling them. How VerifTools operated The case traces back to August 27, 2025, when the Dutch National Police, working … More →
The post Seized VerifTools servers expose 915,655 fake IDs, 8 arrested appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/20083245/arrested.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 13:00:42 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Seized, VerifTools, servers, expose, 915, 655, fake, IDs, arrested</media:keywords>
</item>

<item>
<title>Adobe issues emergency fix for Acrobat Reader flaw exploited in the wild (CVE&#45;2026&#45;34621)</title>
<link>https://block385.com/adobe-issues-emergency-fix-for-acrobat-reader-flaw-exploited-in-the-wild-cve-2026-34621</link>
<guid>https://block385.com/adobe-issues-emergency-fix-for-acrobat-reader-flaw-exploited-in-the-wild-cve-2026-34621</guid>
<description><![CDATA[ Adobe has pushed out an emergency security update for Adobe Acrobat Reader, patching a zero-day vulnerability (CVE-2026-34621) exploited in the wild since November 2025. About CVE-2026-34621 CVE-2026-34621 is a critical prototype pollution vulnerability – a type of vulnerability that occurs in JavaScript and allows attackers to add or modify an application’s JavaScript objects and properties. CVE-2026-34621 can lead to arbitrary code execution in the context of the current user, but it cannot be triggered remotely. … More →
The post Adobe issues emergency fix for Acrobat Reader flaw exploited in the wild (CVE-2026-34621) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/09/12140336/adobe-reader-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 13:00:29 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Adobe, issues, emergency, fix, for, Acrobat, Reader, flaw, exploited, the, wild, CVE-2026-34621</media:keywords>
</item>

<item>
<title>Siemens expands Industrial Automation DataCenter with edge AI and cybersecurity</title>
<link>https://block385.com/siemens-expands-industrial-automation-datacenter-with-edge-ai-and-cybersecurity</link>
<guid>https://block385.com/siemens-expands-industrial-automation-datacenter-with-edge-ai-and-cybersecurity</guid>
<description><![CDATA[ Siemens will present the next generation of its Industrial Automation DataCenter, a custom-configured data center for IT needs in production, expanding its turnkey solution into an AI-ready platform. Structure of the Siemens Industrial Automation DataCenter and its Remote Industrial Operations Services (Source: Siemens AG) In partnership with NVIDIA and in collaboration with Palo Alto Networks, Siemens delivers secure NVIDIA computing infrastructure at the edge for powerful AI acceleration, alongside NVIDIA BlueField data processing units (DPUs) … More →
The post Siemens expands Industrial Automation DataCenter with edge AI and cybersecurity appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 13:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Siemens, expands, Industrial, Automation, DataCenter, with, edge, and, cybersecurity</media:keywords>
</item>

<item>
<title>North Korea&amp;apos;s APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware</title>
<link>https://block385.com/north-koreas-apt37-uses-facebook-social-engineering-to-deliver-rokrat-malware</link>
<guid>https://block385.com/north-koreas-apt37-uses-facebook-social-engineering-to-deliver-rokrat-malware</guid>
<description><![CDATA[ The North Korean hacking group tracked as APT37 (aka ScarCruft) has been attributed to a fresh multi-stage, social engineering campaign in which threat actors approached targets on Facebook and added them as friends on the social media platform, turning the trust-building exercise into a delivery channel for a remote access trojan called RokRAT.
&quot;The threat actor used two Facebook ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhm-HTAVB66ntSv8R4Bgh9szlrPPh6ah0eJGTDheDntj2w9bW9XzWcgs2CAGsN_C8DS7T4M7V8q18_DtgMZu3mJONEewq_oWlpefdtwp6BgudRjw2Z68jXoP8tHCdxSyvZ-xvVuPlh-xpxEeIRHk1v2mq5KqZxS1z316ncG5j2Q9HQe_bJhIJE4XWONvyYL/s1600/telegram.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 12:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>North, Koreas, APT37, Uses, Facebook, Social, Engineering, Deliver, RokRAT, Malware</media:keywords>
</item>

<item>
<title>OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident</title>
<link>https://block385.com/openai-revokes-macos-app-certificate-after-malicious-axios-supply-chain-incident</link>
<guid>https://block385.com/openai-revokes-macos-app-certificate-after-malicious-axios-supply-chain-incident</guid>
<description><![CDATA[ OpenAI revealed a GitHub Actions workflow used to sign its macOS apps, which downloaded the malicious Axios library on March 31, but noted that no user data or internal system was compromised.
&quot;Out of an abundance of caution, we are taking steps to protect the process that certifies our macOS applications are legitimate OpenAI apps,&quot; OpenAI said in a post last week. &quot;We found ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjE5gb0KURzHAgdXMKzxbNFW1AJ8G2ezWXrHrLReEmbX6BKaG3-tIjiDVcjk-4nIZ3Kg2_564qiWXVVGcERIi4vaUvjqG-BuENXb7i6P3M2rdOHz-S9DOcKIHZ-pa1odUyUdTI-lLify_9CRXYcZu3hyY2LXeTMp1wMRr7mnu7yQdIIjGrFXCAecG4-XVpS/s1600/openai.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 10:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI, Revokes, macOS, App, Certificate, After, Malicious, Axios, Supply, Chain, Incident</media:keywords>
</item>

<item>
<title>Bringing governance and visibility to machine and AI identities</title>
<link>https://block385.com/bringing-governance-and-visibility-to-machine-and-ai-identities</link>
<guid>https://block385.com/bringing-governance-and-visibility-to-machine-and-ai-identities</guid>
<description><![CDATA[ In this Help Net Security interview, Archit Lohokare, CEO of AppViewX, explains how the rise of AI marked a turning point where machine and AI agent identities began converging into a single problem. Drawing on his experience across IBM and CyberArk, he describes the shift from human-driven systems to autonomous machines. Lohokare also shares how AppViewX, together with Eos, is building a unified approach that combines CLM, PKI, and agentic governance to secure these identities. … More →
The post Bringing governance and visibility to machine and AI identities appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/10082116/archit_lohokare-2-appviewx.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 07:00:23 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bringing, governance, and, visibility, machine, and, identities</media:keywords>
</item>

<item>
<title>Why manual certificate management is running out of time</title>
<link>https://block385.com/why-manual-certificate-management-is-running-out-of-time</link>
<guid>https://block385.com/why-manual-certificate-management-is-running-out-of-time</guid>
<description><![CDATA[ In this video, John Murray, Senior Vice President of Sales at GlobalSign, explains what’s changing in the certificate industry and what companies need to do about it. Certificate validity periods are shrinking, which means companies will need to rotate certificates far more often than before. Small and mid-sized businesses are the most exposed. Smaller teams, more generalist staff, and manual processes won’t hold up as rotation speeds increase. Murray walks through what a certificate lifecycle … More →
The post Why manual certificate management is running out of time appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/10093242/globalsign-1200.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 07:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, manual, certificate, management, running, out, time</media:keywords>
</item>

<item>
<title>The fully free Linux OS Trisquel gets a major update with version 12.0 Ecne</title>
<link>https://block385.com/the-fully-free-linux-os-trisquel-gets-a-major-update-with-version-120-ecne</link>
<guid>https://block385.com/the-fully-free-linux-os-trisquel-gets-a-major-update-with-version-120-ecne</guid>
<description><![CDATA[ Trisquel GNU/Linux, a free operating system aimed at home users, small enterprises, and educational centers, released version 12.0. The release, codenamed Ecne, is declared production-ready and builds on the previous version, Aramo, with changes to packaging, the kernel, security, and available software. APT 3.0 and repository format changes Ecne ships with APT 3.0, which brings adoption of the deb822 repository format across all installation paths. The change covers the text-based netinstall, the graphical Ubiquity installer, … More →
The post The fully free Linux OS Trisquel gets a major update with version 12.0 Ecne appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Mon, 13 Apr 2026 01:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, fully, free, Linux, Trisquel, gets, major, update, with, version, 12.0, Ecne</media:keywords>
</item>

<item>
<title>Week in review: Windows zero&#45;day exploit leaked, Patch Tuesday forecast</title>
<link>https://block385.com/week-in-review-windows-zero-day-exploit-leaked-patch-tuesday-forecast</link>
<guid>https://block385.com/week-in-review-windows-zero-day-exploit-leaked-patch-tuesday-forecast</guid>
<description><![CDATA[ Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Cloudflare moves up its post-quantum deadline as researchers narrow the path to Q-Day Cloudflare announced it is targeting 2029 to complete post-quantum security across its entire product suite, including post-quantum authentication. The company is following a revised roadmap that Google also adopted after announcing that it had improved the quantum algorithm used to break elliptic curve cryptography. Google stopped short … More →
The post Week in review: Windows zero-day exploit leaked, Patch Tuesday forecast appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/25124834/cybersecurity-week-review-3-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Sun, 12 Apr 2026 11:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Week, review:, Windows, zero-day, exploit, leaked, Patch, Tuesday, forecast</media:keywords>
</item>

<item>
<title>CPUID Breach Distributes STX RAT via Trojanized CPU&#45;Z and HWMonitor Downloads</title>
<link>https://block385.com/cpuid-breach-distributes-stx-rat-via-trojanized-cpu-z-and-hwmonitor-downloads</link>
<guid>https://block385.com/cpuid-breach-distributes-stx-rat-via-trojanized-cpu-z-and-hwmonitor-downloads</guid>
<description><![CDATA[ Unknown threat actors compromised CPUID (&quot;cpuid[.]com&quot;), a website that hosts popular hardware monitoring tools like CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor, for less than 24 hours to serve malicious executables for the software and deploy a remote access trojan called STX RAT.
The incident lasted from approximately April 9, 15:00 UTC, to about April 10, 10:00 UTC, with ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCPq2en6ihCNpYdSr5mWkN43O4Rl3tXYz77I2achAfYSy7Emoaj8fNqmFHLOydg6Ai6DwDKBEKD91ywcO9eT2t-rrFxEiThe79Rsa4dap_UcNZSEdWl9NRGeaMqP_vsbWnKf2mMNHQ86cabK4wlspLPWRHMJ7Gj5guX6ynx57RhsDLbJeSDAdPR_BjGFNU/s1600/downloads.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 12 Apr 2026 08:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CPUID, Breach, Distributes, STX, RAT, via, Trojanized, CPU-Z, and, HWMonitor, Downloads</media:keywords>
</item>

<item>
<title>Adobe Patches Actively Exploited Acrobat Reader Flaw CVE&#45;2026&#45;34621</title>
<link>https://block385.com/adobe-patches-actively-exploited-acrobat-reader-flaw-cve-2026-34621</link>
<guid>https://block385.com/adobe-patches-actively-exploited-acrobat-reader-flaw-cve-2026-34621</guid>
<description><![CDATA[ Adobe has released emergency updates to fix a critical security flaw in Acrobat Reader that has come under active exploitation in the wild.
The vulnerability, assigned the CVE identifier CVE-2026-34621, carries a CVSS score of 8.6 out of 10.0. Successful exploitation of the flaw could allow an attacker to run malicious code on affected installations.
It has been described as ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhg1374h3OcQ3MPg1BngGcQC6U8eVWUh3Ye84l6WpQKxC1a8_x1Mpp0K8-0DDfJU0YtVqWoUZcNE-bJ_bsfraWWWfafJoP8pF7jDlcb8L4LqNDYWtbhoaDcSbpcmEwNjDi0hzkie5VVRmqntS8uZe4hrAd4IDcc0CO95Bsj8y1rP7LhfPsCkvQIkOtx-B7D/s1600/adobe-adobe.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 12 Apr 2026 08:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Adobe, Patches, Actively, Exploited, Acrobat, Reader, Flaw, CVE-2026-34621</media:keywords>
</item>

<item>
<title>Citizen Lab: Law Enforcement Used Webloc to Track 500 Million Devices via Ad Data</title>
<link>https://block385.com/citizen-lab-law-enforcement-used-webloc-to-track-500-million-devices-via-ad-data</link>
<guid>https://block385.com/citizen-lab-law-enforcement-used-webloc-to-track-500-million-devices-via-ad-data</guid>
<description><![CDATA[ Hungarian domestic intelligence, the national police in El Salvador, and several U.S. law enforcement and police departments have been attributed to the use of an advertising-based global geolocation surveillance system called Webloc.
The tool was developed by Israeli company Cobwebs Technologies and is now sold by its successor Penlink after the two firms merged in July 2023 ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJjyKn2cWWKQvAjaegOP6UqdtgG4Cr6nQdwobWhvYvaSKO-VGcFFSSAvT6ngpo8T9n0BitFhLNKPv669Qp3I_2ZajEs3DbveUT5qhc4zVWHRbjJH4fv0_84_FNhPFnN7EPFa9szLDP6B5G-1owBpAGGFILLSX4q8ZobwLXjI9CPn0DfExp6y0_33OdtmkV/s1600/location-data.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 11 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Citizen, Lab:, Law, Enforcement, Used, Webloc, Track, 500, Million, Devices, via, Data</media:keywords>
</item>

<item>
<title>Hims Breach Exposes the Most Sensitive Kinds of PHI</title>
<link>https://block385.com/hims-breach-exposes-the-most-sensitive-kinds-of-phi</link>
<guid>https://block385.com/hims-breach-exposes-the-most-sensitive-kinds-of-phi</guid>
<description><![CDATA[ Threat actors breached the telehealth brand, and now they may know who&#039;s bald, overweight, and impotent. What could they do with that information? ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc8a4286a526b27e8/69d95405a50214ae0ba38e24/hims_ZUMAPressInc._Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hims, Breach, Exposes, the, Most, Sensitive, Kinds, PHI</media:keywords>
</item>

<item>
<title>Your Next Breach Will Look Like Business as Usual</title>
<link>https://block385.com/your-next-breach-will-look-like-business-as-usual</link>
<guid>https://block385.com/your-next-breach-will-look-like-business-as-usual</guid>
<description><![CDATA[ These are the fundamental detection model shifts cybersecurity teams need to make to keep up with the rising number of credential-based attacks. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt331a3aad1718e6b2/69d856203032b2ee7b4bf00d/login_page_Yuen_Man_Cheung_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, Next, Breach, Will, Look, Like, Business, Usual</media:keywords>
</item>

<item>
<title>Orange Business Reimagines Enterprise Voice Communications With Trust and AI</title>
<link>https://block385.com/orange-business-reimagines-enterprise-voice-communications-with-trust-and-ai</link>
<guid>https://block385.com/orange-business-reimagines-enterprise-voice-communications-with-trust-and-ai</guid>
<description><![CDATA[  ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt850556f866500627/654a5a8e05eb4d040a046894/325351_DR23_Graphics_General_Large_Text_v1.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 19:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Orange, Business, Reimagines, Enterprise, Voice, Communications, With, Trust, and</media:keywords>
</item>

<item>
<title>FINRA Launches Financial Intelligence Fusion Center to Combat Cybersecurity and Fraud Threats</title>
<link>https://block385.com/finra-launches-financial-intelligence-fusion-center-to-combat-cybersecurity-and-fraud-threats</link>
<guid>https://block385.com/finra-launches-financial-intelligence-fusion-center-to-combat-cybersecurity-and-fraud-threats</guid>
<description><![CDATA[  ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt850556f866500627/654a5a8e05eb4d040a046894/325351_DR23_Graphics_General_Large_Text_v1.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 19:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FINRA, Launches, Financial, Intelligence, Fusion, Center, Combat, Cybersecurity, and, Fraud, Threats</media:keywords>
</item>

<item>
<title>ClickFix campaign delivers Mac malware via fake Apple page</title>
<link>https://block385.com/clickfix-campaign-delivers-mac-malware-via-fake-apple-page</link>
<guid>https://block385.com/clickfix-campaign-delivers-mac-malware-via-fake-apple-page</guid>
<description><![CDATA[ Security researchers at Jamf have uncovered a new ClickFix-style attack targeting Mac users via a fake Apple-themed webpage offering instructions on how to “reclaim disk space on your Mac”. The malicious page (Source: Jamf) ClickFix for everybody ClickFix is a social engineering technique that cons victims into running malicious commands on their own machine, usually by pretending the commands are needed to fix a problem or perform routine upkeep. This technique was initially aimed at … More →
The post ClickFix campaign delivers Mac malware via fake Apple page appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 17:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ClickFix, campaign, delivers, Mac, malware, via, fake, Apple, page</media:keywords>
</item>

<item>
<title>Can Anthropic Keep Its Exploit&#45;Writing AI Out of the Wrong Hands?</title>
<link>https://block385.com/can-anthropic-keep-its-exploit-writing-ai-out-of-the-wrong-hands</link>
<guid>https://block385.com/can-anthropic-keep-its-exploit-writing-ai-out-of-the-wrong-hands</guid>
<description><![CDATA[ Its Mythos Preview model, which can allegedly find and exploit critical zero-days, also comes with certain controls, the vendor said. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc730ba5941b1717e/69d7fd1a31c96813522990cd/Anthropic_logo_Adrian_Vidal_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 17:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Can, Anthropic, Keep, Its, Exploit-Writing, Out, the, Wrong, Hands</media:keywords>
</item>

<item>
<title>Industrial Controllers Still Vulnerable As Conflicts Move to Cyber</title>
<link>https://block385.com/industrial-controllers-still-vulnerable-as-conflicts-move-to-cyber</link>
<guid>https://block385.com/industrial-controllers-still-vulnerable-as-conflicts-move-to-cyber</guid>
<description><![CDATA[ The US government warns programmable logic controllers are being targeted, and research turns up 179 vulnerable operational technology (OT) devices. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt9a6765cc1f632f66/69d817beee4441c1fd401ac2/industrial-facility-with-worker-1st_footage-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Industrial, Controllers, Still, Vulnerable, Conflicts, Move, Cyber</media:keywords>
</item>

<item>
<title>GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs</title>
<link>https://block385.com/glassworm-campaign-uses-zig-dropper-to-infect-multiple-developer-ides</link>
<guid>https://block385.com/glassworm-campaign-uses-zig-dropper-to-infect-multiple-developer-ides</guid>
<description><![CDATA[ Cybersecurity researchers have flagged yet another evolution of the ongoing GlassWorm campaign, which employs a new Zig dropper that&#039;s designed to stealthily infect all integrated development environments (IDEs) on a developer&#039;s machine.
The technique has been discovered in an Open VSX extension named &quot;specstudio.code-wakatime-activity-tracker,&quot; which masquerades as WakaTime, a ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioOU2XpKmyRPz5kTr4GhD1YLJ2t7F6yv7bQD1upkiwmGwmzirnDAz92GvtjckyoBhBjaRqeR9XPm6e0yHdKLowfDDgZNkRlCvCneJEncgiviFu7PgD4wQg3Bo5JDhgg6JTytg_fY2M-iKeykCLebOdStW4A76JKnPbEQazihNOhKOdM9Ou8keMBh4IY4jo/s1600/software.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 16:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GlassWorm, Campaign, Uses, Zig, Dropper, Infect, Multiple, Developer, IDEs</media:keywords>
</item>

<item>
<title>Poisoned “Office 365” search results lead to stolen paychecks</title>
<link>https://block385.com/poisoned-office-365-search-results-lead-to-stolen-paychecks</link>
<guid>https://block385.com/poisoned-office-365-search-results-lead-to-stolen-paychecks</guid>
<description><![CDATA[ A financially motivated hacking group is targeting Canadian employees with a sophisticated campaign designed to covertly redirect their salary payments into attacker-controlled bank accounts, Microsoft researchers discovered. SEO poisoning and malvertising + phishing + AiTM The group, which Microsoft tracks as Storm-2755, begins by poisoning search engine results and running malicious ads against generic queries like “Office 365”, or even common misspellings like “Office 265.” Victims who click through land on a convincing but fake … More →
The post Poisoned “Office 365” search results lead to stolen paychecks appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 15:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Poisoned, “Office, 365”, search, results, lead, stolen, paychecks</media:keywords>
</item>

<item>
<title>Browser Extensions Are the New AI Consumption Channel That No One Is Talking About</title>
<link>https://block385.com/browser-extensions-are-the-new-ai-consumption-channel-that-no-one-is-talking-about</link>
<guid>https://block385.com/browser-extensions-are-the-new-ai-consumption-channel-that-no-one-is-talking-about</guid>
<description><![CDATA[ While much of the discussion on AI security centers around protecting ‘shadow’ AI and GenAI consumption, there&#039;s a wide-open window nobody&#039;s guarding: AI browser extensions. 
A new report from LayerX exposes just how deep this blind spot goes, and why AI extensions may be the most dangerous AI threat surface in your network that isn&#039;t on anyone&#039;s  ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhj9DUEjhk2fpOJYkJSEMuXQKjwHL1MhXzLniQFjNXvUV_iJEcMwk4MacWDYrrCg096uqXg7pJVZYgagJF58e28tr2lOkZsGqpXbnKfnDVStpGIz2fBGvXayNRfbWWaJ2QueaZoYp72PNJHF6g0W4FPBhbw75r_Dm2cuRr1zCmHFHges6gPQ55gr3hI17TM/s1600/layerx.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 14:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Browser, Extensions, Are, the, New, Consumption, Channel, That, One, Talking, About</media:keywords>
</item>

<item>
<title>Marimo RCE Flaw CVE&#45;2026&#45;39987 Exploited Within 10 Hours of Disclosure</title>
<link>https://block385.com/marimo-rce-flaw-cve-2026-39987-exploited-within-10-hours-of-disclosure</link>
<guid>https://block385.com/marimo-rce-flaw-cve-2026-39987-exploited-within-10-hours-of-disclosure</guid>
<description><![CDATA[ A critical security vulnerability in Marimo, an open-source Python notebook for data science and analysis, has been exploited within 10 hours of public disclosure, according to findings from Sysdig.
The vulnerability in question is CVE-2026-39987 (CVSS score: 9.3), a pre-authenticated remote code execution vulnerability impacting all versions of Marimo prior to and including ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLOQ2mcgefzP_nej8R2XYY5eLnbFWle2koFcBGH6gyLGu10rBVnI3f3oHUmafvlbNJFc8N50ghG-0d_MP-oLzJcZpObdY8MU67qbCc36iWMApPM0Z6QfMrklCirpFSnyXZeMyHIdD4NyfixepzOZ72qiadKBmUvdkNuzPs-QbZnuSUMBaxA0sWYmTT63v-/s1600/marimo.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 14:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Marimo, RCE, Flaw, CVE-2026-39987, Exploited, Within, Hours, Disclosure</media:keywords>
</item>

<item>
<title>Health insurance lead sites sell personal data within seconds of form submission</title>
<link>https://block385.com/health-insurance-lead-sites-sell-personal-data-within-seconds-of-form-submission</link>
<guid>https://block385.com/health-insurance-lead-sites-sell-personal-data-within-seconds-of-form-submission</guid>
<description><![CDATA[ Lead generation websites that offer health insurance quotes collect sensitive personal data and sell it to multiple buyers within seconds of a user clicking submit. A study by researchers at UC Davis, Stanford University, and Maastricht University mapped this process across 105 health insurance lead generation sites and monitored what happened to the data over 60 days. The researchers created 210 synthetic user profiles, each with a unique phone number and email address, and submitted … More →
The post Health insurance lead sites sell personal data within seconds of form submission appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/09130128/spam-privacy-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 13:00:53 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Health, insurance, lead, sites, sell, personal, data, within, seconds, form, submission</media:keywords>
</item>

<item>
<title>What vibe hunting gets right about AI threat hunting, and where it breaks down</title>
<link>https://block385.com/what-vibe-hunting-gets-right-about-ai-threat-hunting-and-where-it-breaks-down</link>
<guid>https://block385.com/what-vibe-hunting-gets-right-about-ai-threat-hunting-and-where-it-breaks-down</guid>
<description><![CDATA[ In this Help Net Security interview, Aqsa Taylor, Chief Security Evangelist, Exaforce, explains vibe hunting, an AI-driven approach to threat detection that inverts traditional hypothesis-driven methods. Instead of analysts defining attack vectors upfront, the AI scans datasets for anomalous patterns and surfaces potential threats. Taylor draws a firm line on responsibility: analysts must be able to explain their reasoning. When they cannot, the AI is steering the hunt. She also addresses enrichment, junior analyst development, … More →
The post What vibe hunting gets right about AI threat hunting, and where it breaks down appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/08065801/aqsa_taylor-2-exaforce.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 13:00:52 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>What, vibe, hunting, gets, right, about, threat, hunting, and, where, breaks, down</media:keywords>
</item>

<item>
<title>April 2026 Patch Tuesday forecast: Spring&#45;cleaning of a preview</title>
<link>https://block385.com/april-2026-patch-tuesday-forecast-spring-cleaning-of-a-preview</link>
<guid>https://block385.com/april-2026-patch-tuesday-forecast-spring-cleaning-of-a-preview</guid>
<description><![CDATA[ I just blinked and the first quarter of the year is GONE. Where does the time go? I looked back at my article from last month where I touched on the use of AI and some of the vulnerabilities associated with it and realized it was good precursor to some themes at RSAC this year. AI was certainly the focus this year, with almost everyone having some form of AI connection to their products (some … More →
The post April 2026 Patch Tuesday forecast: Spring-cleaning of a preview appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/07/07160340/patch_tuesday-2024-2.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 13:00:51 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>April, 2026, Patch, Tuesday, forecast:, Spring-cleaning, preview</media:keywords>
</item>

<item>
<title>Apiiro CLI turns AI coding assistants into full&#45;stack security engineers</title>
<link>https://block385.com/apiiro-cli-turns-ai-coding-assistants-into-full-stack-security-engineers</link>
<guid>https://block385.com/apiiro-cli-turns-ai-coding-assistants-into-full-stack-security-engineers</guid>
<description><![CDATA[ The Apiiro CLI brings the Apiiro platform to your terminal and to your AI coding assistants, giving them six native security capabilities: scanning, risk management, remediation, an AI security analyst (via Apiiro Guardian Agent), AI Threat Modeling, and prompt enrichment. It installs in seconds on macOS, Linux, and Windows via brew, direct download, or RPM. Apiiro CLI ships with agent skills, structured capability definitions that AI coding assistants like Claude Code and Cursor can read … More →
The post Apiiro CLI turns AI coding assistants into full-stack security engineers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 13:00:49 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apiiro, CLI, turns, coding, assistants, into, full-stack, security, engineers</media:keywords>
</item>

<item>
<title>Little Snitch for Linux shows what your apps are connecting to</title>
<link>https://block385.com/little-snitch-for-linux-shows-what-your-apps-are-connecting-to</link>
<guid>https://block385.com/little-snitch-for-linux-shows-what-your-apps-are-connecting-to</guid>
<description><![CDATA[ Network monitoring on Linux has long been a gap for users who want per-process visibility into outbound connections. Existing tools either operate at the command line or were designed for server security rather than desktop privacy. Objective Development, the Austrian company behind the macOS firewall utility Little Snitch, released a Linux version of the tool. It is free and, according to the company, will remain so. Architecture choices The kernel component uses eBPF for traffic … More →
The post Little Snitch for Linux shows what your apps are connecting to appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/10103540/little_snitch-for_linux-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 13:00:48 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Little, Snitch, for, Linux, shows, what, your, apps, are, connecting</media:keywords>
</item>

<item>
<title>To counter cookie theft, Chrome ships device&#45;bound session credentials</title>
<link>https://block385.com/to-counter-cookie-theft-chrome-ships-device-bound-session-credentials</link>
<guid>https://block385.com/to-counter-cookie-theft-chrome-ships-device-bound-session-credentials</guid>
<description><![CDATA[ Cookie theft follows a well-established pattern. Infostealer malware infiltrates a device, extracts authentication cookies, and exfiltrates them to an attacker-controlled server. Because cookies often have extended lifetimes, attackers can access accounts without passwords, then bundle and sell the stolen credentials. Once malware gains access to a machine, it can read the local files and memory where browsers store authentication cookies. What DBSC does Google’s Device Bound Session Credentials (DBSC) is now entering public availability for … More →
The post To counter cookie theft, Chrome ships device-bound session credentials appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/10112054/cookie-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 13:00:43 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>counter, cookie, theft, Chrome, ships, device-bound, session, credentials</media:keywords>
</item>

<item>
<title>Gmail’s end&#45;to&#45;end encryption comes to mobile, no extra apps required</title>
<link>https://block385.com/gmails-end-to-end-encryption-comes-to-mobile-no-extra-apps-required</link>
<guid>https://block385.com/gmails-end-to-end-encryption-comes-to-mobile-no-extra-apps-required</guid>
<description><![CDATA[ Google has expanded Gmail client-side encryption to Android and iOS devices, allowing users to engage with their organization’s most sensitive data on mobile devices while ensuring data remains compliant with sovereignty and compliance requirements. This feature is available for Enterprise Plus users with the Assured Controls or Assured Controls Plus add-on. Composing a E2EE message in Gmail (Source: Google) With this update, users can compose, send, and read encrypted messages directly in the Gmail app. … More →
The post Gmail’s end-to-end encryption comes to mobile, no extra apps required appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/04/02134941/gmail-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 13:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Gmail’s, end-to-end, encryption, comes, mobile, extra, apps, required</media:keywords>
</item>

<item>
<title>Google Rolls Out DBSC in Chrome 146 to Block Session Theft on Windows</title>
<link>https://block385.com/google-rolls-out-dbsc-in-chrome-146-to-block-session-theft-on-windows</link>
<guid>https://block385.com/google-rolls-out-dbsc-in-chrome-146-to-block-session-theft-on-windows</guid>
<description><![CDATA[ Google has made Device Bound Session Credentials (DBSC) generally available to all Windows users of its Chrome web browser, months after it began testing the security feature in open beta.
The public availability is currently limited to Windows users on Chrome 146, with macOS expansion planned in an upcoming Chrome release.
&quot;This project represents a significant ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiC-kFnk6uDzN76983rxMJBgJzi5ByxqZ0SM5RAfG1171e3I_lRUCBHIZ0kmMRkxERMiWEO9WRX3D6mkadUuRhw69KYHi4VzPrIa4s4IVilNmFANa2EMbuk1blKF_4ChwqIBuTb4FLj_dqhTDUDsivEnw8OmDL85giaaJTiqATwZArXUq6_3_X7tfd_RLbV/s1600/chrome-cookies.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 10:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Rolls, Out, DBSC, Chrome, 146, Block, Session, Theft, Windows</media:keywords>
</item>

<item>
<title>Backdoored Smart Slider 3 Pro Update Distributed via Compromised Nextend Servers</title>
<link>https://block385.com/backdoored-smart-slider-3-pro-update-distributed-via-compromised-nextend-servers</link>
<guid>https://block385.com/backdoored-smart-slider-3-pro-update-distributed-via-compromised-nextend-servers</guid>
<description><![CDATA[ Unknown threat actors have hijacked the update system for the Smart Slider 3 Pro plugin for WordPress and Joomla to push a poisoned version containing a backdoor.
The incident impacts Smart Slider 3 Pro version 3.5.1.35 for WordPress, per WordPress security company Patchstack. Smart Slider 3 is a popular WordPress slider plugin with more than 800,000 active installations across its free and Pro  ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPUQqw4JQlrmSih69TSpC28TmE2G1rOMs1k_jrdeQbXFFNV6nPvlVQh9oMIwtOLiVJVUxYZFZ0RDiXmLDOPXpF-pbaStwjml7hxE-OITfsVlk2wA-nKUOpcn9R7FjQe03OInZdN2p8GmkFXAvYBbDeU_IDX1wuQ4iqc46lM6SraDPXhbEcCt-LNL0YTck/s1600/slider.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 10:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Backdoored, Smart, Slider, Pro, Update, Distributed, via, Compromised, Nextend, Servers</media:keywords>
</item>

<item>
<title>EngageLab SDK Flaw Exposed 50M Android Users, Including 30M Crypto Wallet Installs</title>
<link>https://block385.com/engagelab-sdk-flaw-exposed-50m-android-users-including-30m-crypto-wallet-installs</link>
<guid>https://block385.com/engagelab-sdk-flaw-exposed-50m-android-users-including-30m-crypto-wallet-installs</guid>
<description><![CDATA[ Details have emerged about a now-patched security vulnerability in a widely used third-party Android software development kit (SDK) called EngageLab SDK that could have put millions of cryptocurrency wallet users at risk.
&quot;This flaw allows apps on the same device to bypass Android security sandbox and gain unauthorized access to private data,&quot; the Microsoft Defender ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigi73Eo-lmEoLh8BcTJmWW5GrmLrm49pUkkl8zyxIg1YTEncbgCaY-wXarkWZuipJhJEubcJx-VEiHOv_NrMtPw1BoEU3Ni8gXNcKcbWX4TqBU8pikOAkRdCl-r_XvLz4oXmQ2IpY25bWzLFkXh_hezhx0jgUYiuRvrYVxhW-6x5J7m84HH_VeRtRzTGbW/s1600/vul-app.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 08:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>EngageLab, SDK, Flaw, Exposed, 50M, Android, Users, Including, 30M, Crypto, Wallet, Installs</media:keywords>
</item>

<item>
<title>New infosec products of the week: April 10, 2026</title>
<link>https://block385.com/new-infosec-products-of-the-week-april-10-2026</link>
<guid>https://block385.com/new-infosec-products-of-the-week-april-10-2026</guid>
<description><![CDATA[ Here’s a look at the most interesting products from the past week, featuring releases from Advenica, Intruder, Mallory, and Secureframe. Mallory brings contextual threat intelligence to security operations Mallory is launching an AI-native threat intelligence platform that monitors thousands of threat sources, contextualizes them against your actual attack surface, and puts that intelligence to work across hunting, detection, and exposure management use cases. One platform. Answers, not alerts. Secureframe expands Comply with User Access Reviews … More →
The post New infosec products of the week: April 10, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/28091843/infosec-week-1200.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 07:00:28 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, infosec, products, the, week:, April, 10, 2026</media:keywords>
</item>

<item>
<title>Product showcase: Session, a messenger without phone numbers or metadata</title>
<link>https://block385.com/product-showcase-session-a-messenger-without-phone-numbers-or-metadata</link>
<guid>https://block385.com/product-showcase-session-a-messenger-without-phone-numbers-or-metadata</guid>
<description><![CDATA[ Instant messaging has been around for decades, but it became widely adopted with the emergence of smartphones. Earlier, communication was limited to basic text messages. Messaging expanded to include photos, videos, and video calls without relying on telecom networks, as long as there is a reliable data connection. Privacy and metadata concerns With the growth of communication, privacy and security concerns became more prominent. Companies responded by encrypting message content to protect user data. End-to-end … More →
The post Product showcase: Session, a messenger without phone numbers or metadata appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/08142808/session_messenger-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 07:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Product, showcase:, Session, messenger, without, phone, numbers, metadata</media:keywords>
</item>

<item>
<title>Russia&amp;apos;s &amp;apos;Fancy Bear&amp;apos; APT Continues Its Global Onslaught</title>
<link>https://block385.com/russias-fancy-bear-apt-continues-its-global-onslaught</link>
<guid>https://block385.com/russias-fancy-bear-apt-continues-its-global-onslaught</guid>
<description><![CDATA[ Victims don&#039;t need to match the cybercrime group&#039;s technical sophistication, experts say. But patching and some form of zero trust are now non-negotiable. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltee215733d1f4849e/69d6b1253032b219f34bebeb/Grizzly_bear_photo-fox_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 10 Apr 2026 01:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Russias, Fancy, Bear, APT, Continues, Its, Global, Onslaught</media:keywords>
</item>

<item>
<title>&amp;apos;BlueHammer&amp;apos; Windows Zero&#45;Day Exploit Signals Microsoft Bug Disclosure Issues</title>
<link>https://block385.com/bluehammer-windows-zero-day-exploit-signals-microsoft-bug-disclosure-issues</link>
<guid>https://block385.com/bluehammer-windows-zero-day-exploit-signals-microsoft-bug-disclosure-issues</guid>
<description><![CDATA[ Under the alias &#039;Chaotic Eclipse,&#039; a researcher released a PoC exploit for a zero-day flaw that allows for system takeover by a local user, citing an undisclosed beef with Microsoft. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6c31ced607e735b5/69d4f2975553ecd2bca00f8a/Hammernails_MichaelFlippo_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 23:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>BlueHammer, Windows, Zero-Day, Exploit, Signals, Microsoft, Bug, Disclosure, Issues</media:keywords>
</item>

<item>
<title>EngageLab SDK Flaw Exposed 50M Android Users, Including 30M Crypto Wallets</title>
<link>https://block385.com/engagelab-sdk-flaw-exposed-50m-android-users-including-30m-crypto-wallets</link>
<guid>https://block385.com/engagelab-sdk-flaw-exposed-50m-android-users-including-30m-crypto-wallets</guid>
<description><![CDATA[ Details have emerged about a now-patched security vulnerability in a widely used third-party Android software development kit (SDK) called EngageLab SDK that could have put millions of cryptocurrency wallet users at risk.
&quot;This flaw allows apps on the same device to bypass Android security sandbox and gain unauthorized access to private data,&quot; the Microsoft Defender ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigi73Eo-lmEoLh8BcTJmWW5GrmLrm49pUkkl8zyxIg1YTEncbgCaY-wXarkWZuipJhJEubcJx-VEiHOv_NrMtPw1BoEU3Ni8gXNcKcbWX4TqBU8pikOAkRdCl-r_XvLz4oXmQ2IpY25bWzLFkXh_hezhx0jgUYiuRvrYVxhW-6x5J7m84HH_VeRtRzTGbW/s1600/vul-app.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 22:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>EngageLab, SDK, Flaw, Exposed, 50M, Android, Users, Including, 30M, Crypto, Wallets</media:keywords>
</item>

<item>
<title>Do Ceasefires Slow Cyberattacks? History Suggests Not</title>
<link>https://block385.com/do-ceasefires-slow-cyberattacks-history-suggests-not</link>
<guid>https://block385.com/do-ceasefires-slow-cyberattacks-history-suggests-not</guid>
<description><![CDATA[ The cybersecurity community is waiting with bated breath to see if Iranian hackers will honor a ceasefire that doesn&#039;t actually name or directly involve them. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4f984646e283dc63/69d7e0dab4e85cb34394103b/US_Iran_flags-Karen_Hovsepyan-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 21:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ceasefires, Slow, Cyberattacks, History, Suggests, Not</media:keywords>
</item>

<item>
<title>UAT&#45;10362 Targets Taiwanese NGOs with LucidRook Malware in Spear&#45;Phishing Campaigns</title>
<link>https://block385.com/uat-10362-targets-taiwanese-ngos-with-lucidrook-malware-in-spear-phishing-campaigns</link>
<guid>https://block385.com/uat-10362-targets-taiwanese-ngos-with-lucidrook-malware-in-spear-phishing-campaigns</guid>
<description><![CDATA[ A previously undocumented threat cluster dubbed UAT-10362 has been attributed to spear-phishing campaigns targeting Taiwanese non-governmental organizations (NGOs) and suspected universities to deploy a new Lua-based malware called LucidRook.
&quot;LucidRook is a sophisticated stager that embeds a Lua interpreter and Rust-compiled libraries within a dynamic-link library (DLL) to download and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4smwzOHJUhoy2YQYZQpTIp9u5xk7vywCOtewG6WfLl1S3h1EO25k8GY6WSHovGYwTn4vo9uMFcoNX6XDa0-BC0mXJrTdSHtWGJDP1GIXqGvRnlqnqyPwzxxPFyjLx9yxEn1oeWs4r8fqq5xlS__yUA3nwf0DpZBiUh86FUx71PRBGbAP0gaNFAILqYgbT/s1600/phish.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 20:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>UAT-10362, Targets, Taiwanese, NGOs, with, LucidRook, Malware, Spear-Phishing, Campaigns</media:keywords>
</item>

<item>
<title>Russia&amp;apos;s Forest Blizzard Nabs Rafts of Logins via SOHO Routers</title>
<link>https://block385.com/russias-forest-blizzard-nabs-rafts-of-logins-via-soho-routers-5641</link>
<guid>https://block385.com/russias-forest-blizzard-nabs-rafts-of-logins-via-soho-routers-5641</guid>
<description><![CDATA[ Heard of fileless malware? How about malwareless cyber espionage? Russia&#039;s APT28 is spying on global organizations by modifying just one DNS setting in vulnerable routers. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6f8022c4798db6b6/69d6c0b5f017ad2a52b62767/forest_blizzard-Lukas_Jonaitis-alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 19:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Russias, Forest, Blizzard, Nabs, Rafts, Logins, via, SOHO, Routers</media:keywords>
</item>

<item>
<title>Mallory brings contextual threat intelligence to security operations</title>
<link>https://block385.com/mallory-brings-contextual-threat-intelligence-to-security-operations</link>
<guid>https://block385.com/mallory-brings-contextual-threat-intelligence-to-security-operations</guid>
<description><![CDATA[ Mallory is launching an AI-native threat intelligence platform, purpose-built to answer the questions CISOs and their teams are asking every day: What are the real threat vectors for our organization? What’s actually exploitable in our environment right now? What should we proactively fix? The platform monitors thousands of threat sources, contextualizes them against your actual attack surface, and puts that intelligence to work across hunt, detection, and exposure management use cases. One platform. Answers, not … More →
The post Mallory brings contextual threat intelligence to security operations appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 17:00:57 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mallory, brings, contextual, threat, intelligence, security, operations</media:keywords>
</item>

<item>
<title>Claude helps researcher dig up decade&#45;old Apache ActiveMQ RCE vulnerability (CVE&#45;2026&#45;34197)</title>
<link>https://block385.com/claude-helps-researcher-dig-up-decade-old-apache-activemq-rce-vulnerability-cve-2026-34197</link>
<guid>https://block385.com/claude-helps-researcher-dig-up-decade-old-apache-activemq-rce-vulnerability-cve-2026-34197</guid>
<description><![CDATA[ In the latest demonstration of how AI assistants can help with bug hunting, Horizon3.ai researcher Naveen Sunkavally used Claude to unearth CVE-2026-34197, a remote code execution vulnerability in Apache ActiveMQ that’s been introduced in the codebase 13 years ago. The vulnerability was patched in late March 2026 and there’s currently no indication that it is being actively exploited by attackers. Neveretheless, with ActiveMQ vulnerabilities having been previously leveraged for ransomware and malware attacks, organizations should … More →
The post Claude helps researcher dig up decade-old Apache ActiveMQ RCE vulnerability (CVE-2026-34197) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/11/21122152/apache_activemq.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 17:00:40 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, helps, researcher, dig, decade-old, Apache, ActiveMQ, RCE, vulnerability, CVE-2026-34197</media:keywords>
</item>

<item>
<title>113,000 explicit prompts from AI girlfriend platform exposed, many linked to user IDs</title>
<link>https://block385.com/113000-explicit-prompts-from-ai-girlfriend-platform-exposed-many-linked-to-user-ids</link>
<guid>https://block385.com/113000-explicit-prompts-from-ai-girlfriend-platform-exposed-many-linked-to-user-ids</guid>
<description><![CDATA[ MyLovely.AI, an AI girlfriend platform, suffered a data breach that exposed over 100,000 users. MyLovely.AI allows people to create personalized not safe for work (NSFW) content and engage in real-time conversations with AI-generated companions, often involving highly personal prompts and interactions. According to Have I Been Pwned, the breach exposed email addresses, user-created prompts, links to the resulting AI-generated images, and a limited number of social media profiles, including Discord and X usernames. Based on … More →
The post 113,000 explicit prompts from AI girlfriend platform exposed, many linked to user IDs appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/09142509/mylovelyai-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 17:00:20 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>113, 000, explicit, prompts, from, girlfriend, platform, exposed, many, linked, user, IDs</media:keywords>
</item>

<item>
<title>Claude Managed Agents bring execution and control to AI agent workflows</title>
<link>https://block385.com/claude-managed-agents-bring-execution-and-control-to-ai-agent-workflows</link>
<guid>https://block385.com/claude-managed-agents-bring-execution-and-control-to-ai-agent-workflows</guid>
<description><![CDATA[ Anthropic’s Claude Managed Agents are a suite of composable APIs for building and deploying cloud-hosted agents at scale, handling sandboxed code execution, checkpointing, credential management, scoped permissions, and end-to-end tracing for you. Developers can define tasks, tools, and permissions within a managed environment, while the platform handles execution and state management. The product is currently available in public beta on the Claude Platform. “Until now, building agents meant spending development cycles on secure infrastructure, state … More →
The post Claude Managed Agents bring execution and control to AI agent workflows appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/09151136/claude_managed_agents-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 17:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Managed, Agents, bring, execution, and, control, agent, workflows</media:keywords>
</item>

<item>
<title>ThreatsDay Bulletin: Hybrid P2P Botnet, 13&#45;Year&#45;Old Apache RCE and 18 More Stories</title>
<link>https://block385.com/threatsday-bulletin-hybrid-p2p-botnet-13-year-old-apache-rce-and-18-more-stories</link>
<guid>https://block385.com/threatsday-bulletin-hybrid-p2p-botnet-13-year-old-apache-rce-and-18-more-stories</guid>
<description><![CDATA[ Thursday. Another week, another batch of things that probably should&#039;ve been caught sooner but weren&#039;t.
This one&#039;s got some range — old vulnerabilities getting new life, a few &quot;why was that even possible&quot; moments, attackers leaning on platforms and tools you&#039;d normally trust without thinking twice. Quiet escalations more than loud zero-days, but the kind that matter more in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6d4nK1zoWjzSmbdUmGPSycMwGmzcYM2XRrFH_ueobgO_8j7hwRdv8Ct856gg_k29HqAOw1-HGCtPpxyGDcuQIKY53ATLKb8bQCsJR5b_Jf8VqX1igItYBIe4iQazqSRe5fmFrFXS1fCcKdz6enbI6zYngIztjJ_UI262_ynNGJrd1EB_OUV1ZKYVl04-h/s1600/threatsdays-main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 16:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ThreatsDay, Bulletin:, Hybrid, P2P, Botnet, 13-Year-Old, Apache, RCE, and, More, Stories</media:keywords>
</item>

<item>
<title>Intruder expands cloud security with agentless container image scanning</title>
<link>https://block385.com/intruder-expands-cloud-security-with-agentless-container-image-scanning</link>
<guid>https://block385.com/intruder-expands-cloud-security-with-agentless-container-image-scanning</guid>
<description><![CDATA[ Intruder has announced the release of Container Image Scanning, a new upgrade to its cloud security capabilities that automatically scans container images for vulnerabilities, granting customers actionable insight into container risk without deploying and maintaining scanning agents across their estates. Leveraging existing integrations with major cloud providers, Intruder supports Amazon Web Services Elastic Container Registry, Google Cloud Artifact Registry and Azure Container Registry. New images and updated versions are scanned daily for vulnerabilities, and users … More →
The post Intruder expands cloud security with agentless container image scanning appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 15:00:48 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Intruder, expands, cloud, security, with, agentless, container, image, scanning</media:keywords>
</item>

<item>
<title>Acrobat Reader zero&#45;day exploited in the wild for many months</title>
<link>https://block385.com/acrobat-reader-zero-day-exploited-in-the-wild-for-many-months</link>
<guid>https://block385.com/acrobat-reader-zero-day-exploited-in-the-wild-for-many-months</guid>
<description><![CDATA[ Unknown attackers have exploited a zero-day Adobe Acrobat Reader vulnerability since November 2025 and possibly even earlier, security researcher Haifei Li has discovered. PDF files carry the exploit Haifei Li is one of the creators of EXPMON, a sandbox-based cybersecurity system for detecting advanced file-based exploits. It does so by analyzing suspicious files submitted through its public web interface or API. “Just few weeks ago, on March 26, someone submitted a PDF sample to EXPMON. … More →
The post Acrobat Reader zero-day exploited in the wild for many months appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 15:00:17 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Acrobat, Reader, zero-day, exploited, the, wild, for, many, months</media:keywords>
</item>

<item>
<title>OPSWAT adds predictive AI engine to MetaDefender for pre&#45;execution threat detection</title>
<link>https://block385.com/opswat-adds-predictive-ai-engine-to-metadefender-for-pre-execution-threat-detection</link>
<guid>https://block385.com/opswat-adds-predictive-ai-engine-to-metadefender-for-pre-execution-threat-detection</guid>
<description><![CDATA[ OPSWAT has announced OPSWAT Predictive Alin AI, its first proprietary AI-based threat detection engine for the MetaDefender Platform. This AI-based innovation introduces a new category of capability within the MetaDefender Platform, a high-confidence predictive layer that works alongside existing detection and prevention engines to assess malicious intent before execution, driving greater efficiency across the platform. This enables organizations to act immediately, while minimizing the operational impacts of false positives. “At OPSWAT, we’ve always believed that … More →
The post OPSWAT adds predictive AI engine to MetaDefender for pre-execution threat detection appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 15:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OPSWAT, adds, predictive, engine, MetaDefender, for, pre-execution, threat, detection</media:keywords>
</item>

<item>
<title>Bitter&#45;Linked Hack&#45;for&#45;Hire Campaign Targets Journalists Across MENA Region</title>
<link>https://block385.com/bitter-linked-hack-for-hire-campaign-targets-journalists-across-mena-region</link>
<guid>https://block385.com/bitter-linked-hack-for-hire-campaign-targets-journalists-across-mena-region</guid>
<description><![CDATA[ An apparent hack-for-hire campaign likely orchestrated by a threat actor with suspected ties to the Indian government targeted journalists, activists, and government officials across the Middle East and North Africa (MENA), according to findings from Access Now, Lookout, and SMEX.
Two of the targets included prominent Egyptian journalists and government critics, Mostafa ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlfEPPxKdPdQANFPwRrggWpWL4wPe22B_Hdr5FpqDGHKTwN95xiQVwqqN896q_CkYvn-wrbDTXMl6wZ_aMD0YwEyRAI_9lzSZj_cg9-RhoNXMh-j16cA0n4CIT5y29FkOWFrQoV8oCv5OtZhMlhAKwqcgirImTOXoVzsJY76y6l-EWn86dAJfYNBy1ejW4/s1600/phone-hacking.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 14:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bitter-Linked, Hack-for-Hire, Campaign, Targets, Journalists, Across, MENA, Region</media:keywords>
</item>

<item>
<title>The Hidden Security Risks of Shadow AI in Enterprises</title>
<link>https://block385.com/the-hidden-security-risks-of-shadow-ai-in-enterprises</link>
<guid>https://block385.com/the-hidden-security-risks-of-shadow-ai-in-enterprises</guid>
<description><![CDATA[ As AI tools become more accessible, employees are adopting them without formal approval from IT and security teams. While these tools may boost productivity, automate tasks, or fill gaps in existing workflows, they also operate outside the visibility of security teams, bypassing controls and creating new blind spots in what is known as shadow AI. While similar to the phenomenon of ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO6OQHlRJgIjpCieiOfi48Mexu0Puimw_dz6w0h1spC2ZjcqifD2YPod5wd1AtUhr-e7CtAAoZ0bnRGnCH-BZRz4pDlB5Db2hJ4vFqsq5jc42UI4VTGXkxD8gNX1Ods9PpQZL4lk84RNL6EDSeI4YFCdjBgKSqKGimsqcsjekAAmr8CGYr3a2wPkchNYA/s1600/keeper.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Hidden, Security, Risks, Shadow, Enterprises</media:keywords>
</item>

<item>
<title>Adobe Reader Zero&#45;Day Exploited via Malicious PDFs Since December 2025</title>
<link>https://block385.com/adobe-reader-zero-day-exploited-via-malicious-pdfs-since-december-2025</link>
<guid>https://block385.com/adobe-reader-zero-day-exploited-via-malicious-pdfs-since-december-2025</guid>
<description><![CDATA[ Threat actors have been exploiting a previously unknown zero-day vulnerability in Adobe Reader using maliciously crafted PDF documents since at least December 2025.
The finding, detailed by EXPMON&#039;s Haifei Li, has been described as a highly-sophisticated PDF exploit. The artifact (&quot;Invoice540.pdf&quot;) first appeared on the VirusTotal platform on November 28, 2025. A second  ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwKu6NdwE0kgawNywNJK7cGCEdRfzOKwsH9AeIT7zJ49RPq_KJAG3SyjH44SS8Zsd-gAUFDFKnfdpaFH8sAZT9wevB2fS0QVk-gCp8xg7j1XcwGJzv05xpoMN4O-oiEd1v3U3kuqW8cTGk0QlHPPS5GgifHq5DBgrE9R_6GxqxYb1erEN_qvAnUG6VFkx0/s1600/adobe.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Adobe, Reader, Zero-Day, Exploited, via, Malicious, PDFs, Since, December, 2025</media:keywords>
</item>

<item>
<title>WhatsApp brings long&#45;awaited privacy feature to filter who can reach you</title>
<link>https://block385.com/whatsapp-brings-long-awaited-privacy-feature-to-filter-who-can-reach-you</link>
<guid>https://block385.com/whatsapp-brings-long-awaited-privacy-feature-to-filter-who-can-reach-you</guid>
<description><![CDATA[ After years of waiting, WhatsApp is set to roll out a username feature that will allow people to connect and communicate without sharing their phone numbers. This means more privacy and better control over phone number visibility by choosing a unique username. WhatsApp username feature (Source: WABetaInfo) The feature will become available to a limited number of people who install the latest version of the app over the coming months. “Note that this feature is … More →
The post WhatsApp brings long-awaited privacy feature to filter who can reach you appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/05/16103838/whatsapp-2023.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 13:00:28 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>WhatsApp, brings, long-awaited, privacy, feature, filter, who, can, reach, you</media:keywords>
</item>

<item>
<title>Advenica’s File Scanner Kiosk scans USB media for malware</title>
<link>https://block385.com/advenicas-file-scanner-kiosk-scans-usb-media-for-malware</link>
<guid>https://block385.com/advenicas-file-scanner-kiosk-scans-usb-media-for-malware</guid>
<description><![CDATA[ Advenica announced the File Scanner Kiosk, a system that scans USB media for malware and helps businesses reduce infection risk. With the reliance on external media for file transfers, organisations face increased vulnerability to malware. The File Scanner Kiosk addresses this challenge by providing an automated, reliable, and efficient way to scan USB media for malware before they enter a secure network. The system uses advanced antivirus technologies to detect and alert users to potential … More →
The post Advenica’s File Scanner Kiosk scans USB media for malware appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 13:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Advenica’s, File, Scanner, Kiosk, scans, USB, media, for, malware</media:keywords>
</item>

<item>
<title>Prompt injection tags along as GenAI enters daily government use</title>
<link>https://block385.com/prompt-injection-tags-along-as-genai-enters-daily-government-use</link>
<guid>https://block385.com/prompt-injection-tags-along-as-genai-enters-daily-government-use</guid>
<description><![CDATA[ Routine use of GenAI has moved into daily operations in state and territorial government environments, placing new security risks within common workflows. A Center for Internet Security (CIS) report, Prompt Injections: The Inherent Threat to Generative AI, identifies prompt injection as a persistent concern tied to that adoption. Adoption expands exposure Use of AI tools has increased in government IT teams. A 2025 NASCIO survey of 51 state and territorial CIOs found that 82% reported … More →
The post Prompt injection tags along as GenAI enters daily government use appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/05/27124549/eye-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 11:01:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Prompt, injection, tags, along, GenAI, enters, daily, government, use</media:keywords>
</item>

<item>
<title>Phishers sneak through using GitHub and Jira’s own mail delivery infrastructure</title>
<link>https://block385.com/phishers-sneak-through-using-github-and-jiras-own-mail-delivery-infrastructure</link>
<guid>https://block385.com/phishers-sneak-through-using-github-and-jiras-own-mail-delivery-infrastructure</guid>
<description><![CDATA[ Attackers are abusing the notification systems of SaaS platforms like GitHub and Jira to send phishing and spam emails, Cisco Talos researchers are warning. “Because the emails are dispatched from the platform’s own infrastructure, they satisfy all standard authentication requirements (SPF, DKIM, and DMARC), effectively neutralizing the primary gatekeepers of modern email security,” they note. “By decoupling the malicious intent from the technical infrastructure, attackers successfully deliver phishing content with a ‘seal of approval’ that … More →
The post Phishers sneak through using GitHub and Jira’s own mail delivery infrastructure appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/04174349/phishing-awareness.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 11:01:01 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Phishers, sneak, through, using, GitHub, and, Jira’s, own, mail, delivery, infrastructure</media:keywords>
</item>

<item>
<title>Asqav: Open&#45;source SDK for AI agent governance</title>
<link>https://block385.com/asqav-open-source-sdk-for-ai-agent-governance</link>
<guid>https://block385.com/asqav-open-source-sdk-for-ai-agent-governance</guid>
<description><![CDATA[ AI agents are executing consequential tasks autonomously, often across multiple systems and with little record of what they did or why. Asqav, a Python SDK released under the MIT license, addresses that gap by attaching a cryptographic signature to each agent action and linking entries into a hash chain. The signing algorithm is ML-DSA-65, standardized under FIPS 204 and designed to remain secure against quantum computing attacks. Each signature also carries an RFC 3161 timestamp. … More →
The post Asqav: Open-source SDK for AI agent governance appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/07155903/asqav-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 11:00:50 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Asqav:, Open-source, SDK, for, agent, governance</media:keywords>
</item>

<item>
<title>AI agent intent is a starting point, not a security strategy</title>
<link>https://block385.com/ai-agent-intent-is-a-starting-point-not-a-security-strategy</link>
<guid>https://block385.com/ai-agent-intent-is-a-starting-point-not-a-security-strategy</guid>
<description><![CDATA[ In this Help Net Security interview, Itamar Apelblat, CEO of Token Security, walks through findings from the company’s research, which shows that 65% of agentic chatbots have never been used yet still hold live access credentials. He explains why organizations treat AI agents more like quick experiments than governed identities, and why that creates risks similar to orphaned service accounts, only harder to see. The conversation covers why 51% of external agent actions still rely … More →
The post AI agent intent is a starting point, not a security strategy appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/07091618/itamar_apelblat-2-token_security.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 11:00:37 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>agent, intent, starting, point, not, security, strategy</media:keywords>
</item>

<item>
<title>Meta’s Muse Spark takes AI a step closer to personal superintelligence</title>
<link>https://block385.com/metas-muse-spark-takes-ai-a-step-closer-to-personal-superintelligence</link>
<guid>https://block385.com/metas-muse-spark-takes-ai-a-step-closer-to-personal-superintelligence</guid>
<description><![CDATA[ Meta Superintelligence Labs has introduced Muse Spark, a natively multimodal reasoning model with support for tool use, visual chain of thought, and multi-agent orchestration. The release includes a Contemplating mode, which is rolling out gradually and orchestrates multiple agents that reason in parallel. Prompt: Can you turn this into a sudoku game that I can play in the web? (Source: Meta) Capabilities Meta positions Muse Spark as part of its push toward personal superintelligence that … More →
The post Meta’s Muse Spark takes AI a step closer to personal superintelligence appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 11:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Meta’s, Muse, Spark, takes, step, closer, personal, superintelligence</media:keywords>
</item>

<item>
<title>Russia&amp;apos;s Forest Blizzard Nabs Rafts of Logins Via SOHO Routers</title>
<link>https://block385.com/russias-forest-blizzard-nabs-rafts-of-logins-via-soho-routers</link>
<guid>https://block385.com/russias-forest-blizzard-nabs-rafts-of-logins-via-soho-routers</guid>
<description><![CDATA[ Heard of fileless malware? How about malwareless cyber espionage? Russia&#039;s APT28 is spying on global organizations by modifying just one DNS setting in vulnerable routers. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6f8022c4798db6b6/69d6c0b5f017ad2a52b62767/forest_blizzard-Lukas_Jonaitis-alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 05:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Russias, Forest, Blizzard, Nabs, Rafts, Logins, Via, SOHO, Routers</media:keywords>
</item>

<item>
<title>Threat Actors Get Crafty With Emojis to Escape Detection</title>
<link>https://block385.com/threat-actors-get-crafty-with-emojis-to-escape-detection</link>
<guid>https://block385.com/threat-actors-get-crafty-with-emojis-to-escape-detection</guid>
<description><![CDATA[ When 🤖 means &quot;bot available,&quot; 🧰 signifies &quot;toolkit,&quot; or 💰💰💰 translates to &quot;big ransom,&quot; bad actors can evade filters and keep it all on the down-low. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3ca396442631220c/69d6b8da3590806b7f56a367/emoji_vectorfusionart_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 09 Apr 2026 01:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Threat, Actors, Get, Crafty, With, Emojis, Escape, Detection</media:keywords>
</item>

<item>
<title>BlueHammer: Windows zero&#45;day exploit leaked</title>
<link>https://block385.com/bluehammer-windows-zero-day-exploit-leaked</link>
<guid>https://block385.com/bluehammer-windows-zero-day-exploit-leaked</guid>
<description><![CDATA[ A buggy but functional proof-of-concept (PoC) exploit for an unpatched Windows local privilege escalation vulnerability dubbed BlueHammer has been published on GitHub by someone who goes by the handle Chaotic Eclipse and Nightmare Eclipse. Several security researchers have fixed the bugs in the exploit and made it work on patched Windows 10, 11, and Windows Server systems, and the question now is whether Microsoft is planning or working on a fix. The BlueHammer PoC exploit … More →
The post BlueHammer: Windows zero-day exploit leaked appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/03115429/microsoft-windows-defender-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 23:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>BlueHammer:, Windows, zero-day, exploit, leaked</media:keywords>
</item>

<item>
<title>AI&#45;Led Remediation Crisis Prompts HackerOne to Pause Bug Bounties</title>
<link>https://block385.com/ai-led-remediation-crisis-prompts-hackerone-to-pause-bug-bounties</link>
<guid>https://block385.com/ai-led-remediation-crisis-prompts-hackerone-to-pause-bug-bounties</guid>
<description><![CDATA[ Discovery used to be the bottleneck for open source bugs, but with automated discovery, remediation&#039;s the bottleneck, which bounties don&#039;t fund. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf5d2451b79a4ca9d/69d691ec31c96816d0298bdd/hacker_Hlib_Shabashnyi_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AI-Led, Remediation, Crisis, Prompts, HackerOne, Pause, Bug, Bounties</media:keywords>
</item>

<item>
<title>New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy</title>
<link>https://block385.com/new-chaos-variant-targets-misconfigured-cloud-deployments-adds-socks-proxy</link>
<guid>https://block385.com/new-chaos-variant-targets-misconfigured-cloud-deployments-adds-socks-proxy</guid>
<description><![CDATA[ Cybersecurity researchers have flagged a new variant ofmalware called Chaosthat&#039;scapable of hitting misconfigured cloud deployments, marking an expansion of the botnet&#039;s targeting infrastructure.
&quot;Chaos malware is increasingly targeting misconfigured cloud deployments, expanding beyond its traditional focus on routers and edge devices,&quot; Darktrace said in a new report. ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjO6ntnqBUePhV2XQEQmTFh-IjdPR64u_T9ODhO3RY_BAv_8YohhRCwMg6OO9UKlvJJCd7rs1c391fbNZ59qDsSujaFJuso3h_94xKo2BX2L5Jj-osBqZ3VglM5kbgzt6OJGtkiNx4Am6NbgzrHtUa7fbdnfei8_xeJao4yvlMp3HkCurz9aNJkg9Xv934/s1600/cloud.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 22:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Chaos, Variant, Targets, Misconfigured, Cloud, Deployments, Adds, SOCKS, Proxy</media:keywords>
</item>

<item>
<title>Trellix strengthens data security for the GenAI era</title>
<link>https://block385.com/trellix-strengthens-data-security-for-the-genai-era</link>
<guid>https://block385.com/trellix-strengthens-data-security-for-the-genai-era</guid>
<description><![CDATA[ Trellix announced enhanced data security capabilities and a strategic framework designed to help organizations confidently adopt generative AI while protecting sensitive data from exposure and loss. “The rapid adoption of AI tools across the enterprise is creating new and often invisible data risks,” said Alex Au Yeung, CPO, Trellix. “Trellix brings together policy, visibility, and enforcement in a unified framework to help customers control how data is used across both sanctioned and shadow AI.” In … More →
The post Trellix strengthens data security for the GenAI era appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 21:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Trellix, strengthens, data, security, for, the, GenAI, era</media:keywords>
</item>

<item>
<title>Masjesu Botnet Emerges as DDoS&#45;for&#45;Hire Service Targeting Global IoT Devices</title>
<link>https://block385.com/masjesu-botnet-emerges-as-ddos-for-hire-service-targeting-global-iot-devices</link>
<guid>https://block385.com/masjesu-botnet-emerges-as-ddos-for-hire-service-targeting-global-iot-devices</guid>
<description><![CDATA[ Cybersecurity researchers have lifted the curtain on a stealthy botnet that&#039;s designed for distributed denial-of-service (DDoS) attacks.
Called Masjesu, the botnet has been advertised via Telegram as a DDoS-for-hire service since it first surfaced in 2023. It&#039;s capable of targeting a wide range of IoT devices, such as routers and gateways, spanning multiple architectures.
&quot;Built for ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVrpJtAgJfASiMYseJhDzJoT1ly7iXa_e_Y_4TBhGIkVGCJ_ZLDM-tGb1Y9NWcOpOcH-xUZUfDiM0fuvUIabEa_5xSbgGjgL8U4FPE99W-V6-oFRAG1ziEZeiJPYrkSZZrwu0jQDjhdUfKsiSxPgZbyZgF1A-cUOqUK3aJpSOQgeSZWogg1X9r77IANDey/s1600/ddos-for-hire.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 20:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Masjesu, Botnet, Emerges, DDoS-for-Hire, Service, Targeting, Global, IoT, Devices</media:keywords>
</item>

<item>
<title>Fraud Rockets Higher in Mobile&#45;First Latin America</title>
<link>https://block385.com/fraud-rockets-higher-in-mobile-first-latin-america</link>
<guid>https://block385.com/fraud-rockets-higher-in-mobile-first-latin-america</guid>
<description><![CDATA[ Cyber-fraudsters move quickly from compromised devices to account takeover to funds transfer, shifting money before many financial institutions can react. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltb8e829d85e5c398e/69d5706583421899916b4908/brazil-digital-flag-Skorzewiak-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 19:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fraud, Rockets, Higher, Mobile-First, Latin, America</media:keywords>
</item>

<item>
<title>APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies</title>
<link>https://block385.com/apt28-deploys-prismex-malware-in-campaign-targeting-ukraine-and-nato-allies</link>
<guid>https://block385.com/apt28-deploys-prismex-malware-in-campaign-targeting-ukraine-and-nato-allies</guid>
<description><![CDATA[ The Russian threat actor known as APT28 (aka Forest Blizzard and Pawn Storm) has been linked to a fresh spear-phishing campaign targeting Ukraine and its allies to deploy a previously undocumented malware suite codenamed PRISMEX.
&quot;PRISMEX combines advanced steganography, component object model (COM) hijacking, and legitimate cloud service abuse for command-and-control,&quot; Trend Micro ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBiilqDko4PDmo2Iu-E-25PRzUJ2LygbHdv1RsdA31AkJBL9QB3AzdxV_4j-jo2Xf9wXwlienf17HO_uJyiue3JOWNfTFdln4gXJcounilzPxOsIXpN5g6imDW3ta0jt4Ck3UYinAmWwHZqfxYhjuaFnOIowTmZbNedv3AmS7Qlze1-tD2gkJBuUxTzSml/s1600/nato.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 18:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>APT28, Deploys, PRISMEX, Malware, Campaign, Targeting, Ukraine, and, NATO, Allies</media:keywords>
</item>

<item>
<title>Full Sail University to Open IBM Cyber Defense Range Powered by AWS and Cloud Range on Campus</title>
<link>https://block385.com/full-sail-university-to-open-ibm-cyber-defense-range-powered-by-aws-and-cloud-range-on-campus</link>
<guid>https://block385.com/full-sail-university-to-open-ibm-cyber-defense-range-powered-by-aws-and-cloud-range-on-campus</guid>
<description><![CDATA[  ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt850556f866500627/654a5a8e05eb4d040a046894/325351_DR23_Graphics_General_Large_Text_v1.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 17:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Full, Sail, University, Open, IBM, Cyber, Defense, Range, Powered, AWS, and, Cloud, Range, Campus</media:keywords>
</item>

<item>
<title>Niobium Introduces The Fog</title>
<link>https://block385.com/niobium-introduces-the-fog</link>
<guid>https://block385.com/niobium-introduces-the-fog</guid>
<description><![CDATA[  ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt850556f866500627/654a5a8e05eb4d040a046894/325351_DR23_Graphics_General_Large_Text_v1.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 17:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Niobium, Introduces, The, Fog</media:keywords>
</item>

<item>
<title>Pluralsight Launches SecureReady to Help Organizations Build Job&#45;Ready Cybersecurity Teams</title>
<link>https://block385.com/pluralsight-launches-secureready-to-help-organizations-build-job-ready-cybersecurity-teams</link>
<guid>https://block385.com/pluralsight-launches-secureready-to-help-organizations-build-job-ready-cybersecurity-teams</guid>
<description><![CDATA[  ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt850556f866500627/654a5a8e05eb4d040a046894/325351_DR23_Graphics_General_Large_Text_v1.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 17:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Pluralsight, Launches, SecureReady, Help, Organizations, Build, Job-Ready, Cybersecurity, Teams</media:keywords>
</item>

<item>
<title>Iranian Threat Actors Disrupt US Critical Infrastructure Via Exposed PLCs</title>
<link>https://block385.com/iranian-threat-actors-disrupt-us-critical-infrastructure-via-exposed-plcs</link>
<guid>https://block385.com/iranian-threat-actors-disrupt-us-critical-infrastructure-via-exposed-plcs</guid>
<description><![CDATA[ Attackers compromised Internet-facing OT devices and caused file and display manipulation, operational disruption, and financial losses across sectors. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf78624b1d77fea5d/69d630b2a8e6234a48182a2f/iran1800_Hakan_Gider_alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 17:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Iranian, Threat, Actors, Disrupt, Critical, Infrastructure, Via, Exposed, PLCs</media:keywords>
</item>

<item>
<title>Social engineering attacks on open source developers are escalating</title>
<link>https://block385.com/social-engineering-attacks-on-open-source-developers-are-escalating</link>
<guid>https://block385.com/social-engineering-attacks-on-open-source-developers-are-escalating</guid>
<description><![CDATA[ North Korean hackers spent weeks socially engineering an Axios maintainer through a fake Slack workspace, a cloned company identity, and a fabricated Microsoft Teams call that tricked him into installing a RAT posings as a software update. They used the access they gained to inject malware into npm packages downloaded 100+ million times a week. Now, a fresh Open Source Security Foundation (OpenSSF) advisory warns unknown attackers are using a similar approach to target other … More →
The post Social engineering attacks on open source developers are escalating appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 15:00:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Social, engineering, attacks, open, source, developers, are, escalating</media:keywords>
</item>

<item>
<title>Shrinking the IAM Attack Surface through Identity Visibility and Intelligence Platforms (IVIP)</title>
<link>https://block385.com/shrinking-the-iam-attack-surface-through-identity-visibility-and-intelligence-platforms-ivip</link>
<guid>https://block385.com/shrinking-the-iam-attack-surface-through-identity-visibility-and-intelligence-platforms-ivip</guid>
<description><![CDATA[ The Fragmented State of Modern Enterprise Identity
Enterprise IAM is approaching a breaking point. As organizations scale, identity becomes increasingly fragmented across thousands of applications, decentralized teams, machine identities, and autonomous systems. 
The result is Identity Dark Matter: identity activity that sits outside the visibility of centralized IAM and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBk9NZe_ohGdUGAoq15K_dOgD1oLAfVbW296B80LqWpzR3Cal5Zerxl9gJCmrK9g9WROjalAzzvElgqRAm-2WtyxAJLfisSZ7b5S_HwDR4QvJnuO5H3g3W3Qd-_OAG-lcmsjCQ3K0bj5_5BRcY-B8euArXK8_lAvFxJf0h6CyHW0ZfXtCgZPqRA7ShNbU/s1600/orchid.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Shrinking, the, IAM, Attack, Surface, through, Identity, Visibility, and, Intelligence, Platforms, IVIP</media:keywords>
</item>

<item>
<title>Secureframe expands Comply with User Access Reviews for automated governance</title>
<link>https://block385.com/secureframe-expands-comply-with-user-access-reviews-for-automated-governance</link>
<guid>https://block385.com/secureframe-expands-comply-with-user-access-reviews-for-automated-governance</guid>
<description><![CDATA[ Secureframe has announced the launch of User Access Reviews, a new capability within Secureframe Comply. Access reviews are the primary mechanism organizations use to validate that the right people have the appropriate access, but the process has historically been manual, fragmented, and difficult to audit. Most teams still conduct access reviews using exported spreadsheets and email threads, creating accountability gaps and leaving security incidents waiting to happen. User Access Reviews eliminates that risk. The new … More →
The post Secureframe expands Comply with User Access Reviews for automated governance appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 13:00:44 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Secureframe, expands, Comply, with, User, Access, Reviews, for, automated, governance</media:keywords>
</item>

<item>
<title>Flatpak 1.16.4 fixes sandbox escape and three other security flaws</title>
<link>https://block385.com/flatpak-1164-fixes-sandbox-escape-and-three-other-security-flaws</link>
<guid>https://block385.com/flatpak-1164-fixes-sandbox-escape-and-three-other-security-flaws</guid>
<description><![CDATA[ Flatpak, a Linux application sandboxing and distribution framework, released version 1.16.4, patching four security vulnerabilities. The most severe fix addresses a complete sandbox escape that leads to host file access and code execution in the host context, tracked as CVE-2026-34078. File system exposure Two additional fixes address file system exposure on the host. CVE-2026-34079 prevents arbitrary file deletion on the host filesystem. GHSA-2fxp-43j9-pwvc prevents arbitrary read-access to files in the system-helper context. The fourth fix, … More →
The post Flatpak 1.16.4 fixes sandbox escape and three other security flaws appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/08102356/flatpak-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 13:00:35 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Flatpak, 1.16.4, fixes, sandbox, escape, and, three, other, security, flaws</media:keywords>
</item>

<item>
<title>Chaos malware expands from routers to Linux cloud servers</title>
<link>https://block385.com/chaos-malware-expands-from-routers-to-linux-cloud-servers</link>
<guid>https://block385.com/chaos-malware-expands-from-routers-to-linux-cloud-servers</guid>
<description><![CDATA[ Chaos, Go-based malware first documented by Lumen’s Black Lotus Labs, has historically targeted routers and edge devices. A new variant observed in March 2026 shows the malware operating against misconfigured Linux cloud servers, a category of infrastructure the botnet had not previously prioritized. Darktrace’s malware research team documented the compromise through its CloudyPots program, a global honeypot network the company runs to capture attacker behavior across a range of services and cloud platforms. One honeypot … More →
The post Chaos malware expands from routers to Linux cloud servers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/08112218/chaos_malware-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 13:00:26 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Chaos, malware, expands, from, routers, Linux, cloud, servers</media:keywords>
</item>

<item>
<title>Iranian cyber activity hits US energy, water, and government networks</title>
<link>https://block385.com/iranian-cyber-activity-hits-us-energy-water-and-government-networks</link>
<guid>https://block385.com/iranian-cyber-activity-hits-us-energy-water-and-government-networks</guid>
<description><![CDATA[ U.S. government agencies on Tuesday warned American organizations about ongoing cyber activity targeting OT and PLC devices, including those manufactured by Rockwell Automation and Allen-Bradley, across multiple critical infrastructure sectors. The activity has been attributed to Iranian-affiliated APT actors seeking to disrupt operations in the United States. Disruptions across critical sectors The advisory, issued by federal cybersecurity and law enforcement agencies, said the activity aligns with heightened geopolitical tensions involving Iran, the United States, and … More →
The post Iranian cyber activity hits US energy, water, and government networks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/25082414/critical-infrastructure-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 13:00:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Iranian, cyber, activity, hits, energy, water, and, government, networks</media:keywords>
</item>

<item>
<title>Anthropic&amp;apos;s Claude Mythos Finds Thousands of Zero&#45;Day Flaws Across Major Systems</title>
<link>https://block385.com/anthropics-claude-mythos-finds-thousands-of-zero-day-flaws-across-major-systems</link>
<guid>https://block385.com/anthropics-claude-mythos-finds-thousands-of-zero-day-flaws-across-major-systems</guid>
<description><![CDATA[ Artificial Intelligence (AI) company Anthropic announced a new cybersecurity initiative called Project Glasswing that will use a preview version of its new frontier model, Claude Mythos, to find and address security vulnerabilities.
The model will be used by a small set of organizations, including Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike,&amp; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihvGfSh39Lhl5ird3iuR-T4gkaVejmXgtJ4VwbkLxAqG2hBZWkqQ8LR5k8wfuapt8oUdtifp8Le-uA6Xep8kGe3BRCx5qM1vY9DiMCnMgTFeFK8bc0wBSUR62TjZgPZ9dviGiM8-4-xW1N-ZGSDxIY0uJLFmEKDt1Z9rbttd7Lg_mma6Kt_2qk89vjq9Ed/s1600/claude-mythos.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 12:30:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Anthropics, Claude, Mythos, Finds, Thousands, Zero-Day, Flaws, Across, Major, Systems</media:keywords>
</item>

<item>
<title>N. Korean Hackers Spread 1,700 Malicious Packages Across npm, PyPI, Go, Rust</title>
<link>https://block385.com/n-korean-hackers-spread-1700-malicious-packages-across-npm-pypi-go-rust</link>
<guid>https://block385.com/n-korean-hackers-spread-1700-malicious-packages-across-npm-pypi-go-rust</guid>
<description><![CDATA[ The North Korea-linked persistent campaign known as Contagious Interview has spread its tentacles by publishing malicious packages targeting the Go, Rust, and PHP ecosystems.
&quot;The threat actor&#039;s packages were designed to impersonate legitimate developer tooling [...], while quietly functioning as malware loaders, extending Contagious Interview’s established playbook into a coordinated ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiJCapdeJ9Q-yAbFZ7EG69FNg_jPvK7YptY2C7TN6txlcPM_bvVrcbqN1bi-vy2IFi8Ai485K-DZblHR8XwZxdch90kWSv48wjvZF7oj0wy0IMd-B7VPuSiUbSFSJKAlErnSUZWjyVOf-Fyy-LqlxLbGLA7rxIkxlgc6_WRyCNH3XWDLb5GtnmjvxFjUrt/s1600/pack.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Korean, Hackers, Spread, 1, 700, Malicious, Packages, Across, npm, PyPI, Go, Rust</media:keywords>
</item>

<item>
<title>6G network design puts AI at the center of spectrum, routing, and fault management</title>
<link>https://block385.com/6g-network-design-puts-ai-at-the-center-of-spectrum-routing-and-fault-management</link>
<guid>https://block385.com/6g-network-design-puts-ai-at-the-center-of-spectrum-routing-and-fault-management</guid>
<description><![CDATA[ Wireless network operators are preparing for a generation of infrastructure where AI is built into the architecture from the start. Sixth-generation networks, expected to reach commercial development over the coming decade, are being designed with AI at the center of how spectrum is allocated, traffic is routed, and failures are detected. A paper by researchers at Harokopio University of Athens examines how different AI techniques map to specific layers of 6G network design, from the … More →
The post 6G network design puts AI at the center of spectrum, routing, and fault management appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 09:00:29 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>network, design, puts, the, center, spectrum, routing, and, fault, management</media:keywords>
</item>

<item>
<title>What managing partners should ask AI vendors before signing any contract</title>
<link>https://block385.com/what-managing-partners-should-ask-ai-vendors-before-signing-any-contract</link>
<guid>https://block385.com/what-managing-partners-should-ask-ai-vendors-before-signing-any-contract</guid>
<description><![CDATA[ In this Help Net Security interview, Kumar Ravi is the Chief Security &amp; Resilience Officer at TMF Group, argues that over-privileged access and weak workflow controls pose more danger than ransomware attacks, precisely because they accumulate quietly and go unnoticed. He addresses the tension between legal privilege and timely threat-sharing, the challenge of managing fourth-party vendor risk, and the questions firms should ask before adopting AI-native tools. His broader argument: security needs to sit at … More →
The post What managing partners should ask AI vendors before signing any contract appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/07083649/kumar_ravi-2-tmf_group2.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 09:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>What, managing, partners, should, ask, vendors, before, signing, any, contract</media:keywords>
</item>

<item>
<title>Iran&#45;Linked Hackers Disrupt U.S. Critical Infrastructure by Targeting Internet&#45;Exposed PLCs</title>
<link>https://block385.com/iran-linked-hackers-disrupt-us-critical-infrastructure-by-targeting-internet-exposed-plcs</link>
<guid>https://block385.com/iran-linked-hackers-disrupt-us-critical-infrastructure-by-targeting-internet-exposed-plcs</guid>
<description><![CDATA[ Iran-affiliated cyber actors are targeting internet-facing operational technology (OT) devices across critical infrastructures in the U.S., including programmable logic controllers (PLCs), cybersecurity and intelligence agencies warned Tuesday.
&quot;These attacks have led to diminished PLC functionality, manipulation of display data and, in some cases, operational disruption and financial ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBiMBUkucAS1NG7NHlk46hGqNyjv5iU5w1Z6HVNXgQywcDfTSOdtQWSqYA5ccSojgRB45ScYHFfyPWqe_9QbOZYo6u6V5qUAcRQIm4CfIDvkRqhs7rtPhmD7yNR4bn_StYbNZm2UWqXfeqXCUeDL1eneK7VyGnHfGbk3EatILzs_fKtRN6VxF8vnKDgQL_/s1600/plc.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 08:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Iran-Linked, Hackers, Disrupt, U.S., Critical, Infrastructure, Targeting, Internet-Exposed, PLCs</media:keywords>
</item>

<item>
<title>Cybersecurity jobs available right now: April 8, 2026</title>
<link>https://block385.com/cybersecurity-jobs-available-right-now-april-8-2026</link>
<guid>https://block385.com/cybersecurity-jobs-available-right-now-april-8-2026</guid>
<description><![CDATA[ Application Security Engineer Liebherr Group | Germany | On-site – View job details As an Application Security Engineer, you will implement security testing tools such as SAST, DAST, and IAST, perform vulnerability assessments and penetration testing, and collaborate with developers to remediate issues and enforce secure coding practices. You will automate security testing in CI/CD pipelines, monitor threats and incidents, and maintain security documentation and compliance requirements. Application Security Engineer II AppFolio | USA | … More →
The post Cybersecurity jobs available right now: April 8, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11140413/cybersecurity_jobs-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 07:00:44 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybersecurity, jobs, available, right, now:, April, 2026</media:keywords>
</item>

<item>
<title>Anthropic’s new AI model finds and exploits zero&#45;days across every major OS and browser</title>
<link>https://block385.com/anthropics-new-ai-model-finds-and-exploits-zero-days-across-every-major-os-and-browser</link>
<guid>https://block385.com/anthropics-new-ai-model-finds-and-exploits-zero-days-across-every-major-os-and-browser</guid>
<description><![CDATA[ Automated vulnerability discovery tools have existed for decades, and the gap between finding a bug and building a working exploit has always slowed attackers. That gap is now substantially narrower. Anthropic’s Claude Mythos Preview, a new general-purpose language model being made available only to a limited group of critical industry partners and open source developers, can autonomously identify zero-day vulnerabilities and then construct working exploits across every major operating system and major web browser. Anthropic’s … More →
The post Anthropic’s new AI model finds and exploits zero-days across every major OS and browser appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/11120920/anthropic-1-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 07:00:39 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Anthropic’s, new, model, finds, and, exploits, zero-days, across, every, major, and, browser</media:keywords>
</item>

<item>
<title>Cybercriminals move deeper into networks, hiding in edge infrastructure</title>
<link>https://block385.com/cybercriminals-move-deeper-into-networks-hiding-in-edge-infrastructure</link>
<guid>https://block385.com/cybercriminals-move-deeper-into-networks-hiding-in-edge-infrastructure</guid>
<description><![CDATA[ Attack activity is moving toward infrastructure outside endpoint visibility. Proxy networks support a wide range of operations, edge devices serve as initial access points, and GenAI speeds up how attackers assemble and rebuild their tooling. Lumen’s 2026 Threatscape Report describes this pattern in criminal and nation-state activity. “Threat intelligence is needed to find the adversary as early as possible and as close to the point of origination as possible,” said Chris Kissel, IDC VP, Security … More →
The post Cybercriminals move deeper into networks, hiding in edge infrastructure appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/12/02114808/hands-dark-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 07:00:29 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybercriminals, move, deeper, into, networks, hiding, edge, infrastructure</media:keywords>
</item>

<item>
<title>OpenSSL 3.6.2 lands with eight CVE fixes</title>
<link>https://block385.com/openssl-362-lands-with-eight-cve-fixes</link>
<guid>https://block385.com/openssl-362-lands-with-eight-cve-fixes</guid>
<description><![CDATA[ OpenSSL 3.6.2 patches eight CVEs across a range of components. The project rates the most severe issue in the release as Moderate. What got fixed The release fixes incorrect failure handling in RSA KEM RSASVE encapsulation (CVE-2026-31790) and a loss of key agreement group tuple structure when the DEFAULT keyword is used in server-side configuration of the key-agreement group list (CVE-2026-2673). An out-of-bounds read in AES-CFB-128 on x86-64 CPUs with AVX-512 support (CVE-2026-28386) is also … More →
The post OpenSSL 3.6.2 lands with eight CVE fixes appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/04/09095359/openssl-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 07:00:17 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenSSL, 3.6.2, lands, with, eight, CVE, fixes</media:keywords>
</item>

<item>
<title>Cybercrime losses break the $20 billion mark</title>
<link>https://block385.com/cybercrime-losses-break-the-20-billion-mark</link>
<guid>https://block385.com/cybercrime-losses-break-the-20-billion-mark</guid>
<description><![CDATA[ Online crime continues to generate rising financial losses, with totals reaching $20.877 billion in 2025. The FBI’s Internet Crime Complaint Center (IC3) report shows a 26% increase in total reported losses from the previous year. (Source: FBI) More than one million complaints were submitted during the year, with fraud accounting for the majority of losses. Cyber-enabled fraud totaled $17.7 billion, representing 85% of all reported financial damage. Complaint counts show a different pattern. Phishing or … More →
The post Cybercrime losses break the $20 billion mark appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/25153028/cybercrime-1500-2.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 08 Apr 2026 01:00:15 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybercrime, losses, break, the, 20, billion, mark</media:keywords>
</item>

<item>
<title>Storm&#45;1175 Deploys Medusa Ransomware at &amp;apos;High Velocity&amp;apos;</title>
<link>https://block385.com/storm-1175-deploys-medusa-ransomware-at-high-velocity</link>
<guid>https://block385.com/storm-1175-deploys-medusa-ransomware-at-high-velocity</guid>
<description><![CDATA[ Microsoft says the financially motivated cybercrime group has exploited N-day and zero-day vulnerabilities in campaigns predicated on speed. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4758c90a86b6e8ad/69d55d246ef500ddf73c9699/medusa_CarloBollo_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 23:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Storm-1175, Deploys, Medusa, Ransomware, High, Velocity</media:keywords>
</item>

<item>
<title>Grafana Patches AI Bug That Could Have Leaked User Data</title>
<link>https://block385.com/grafana-patches-ai-bug-that-could-have-leaked-user-data</link>
<guid>https://block385.com/grafana-patches-ai-bug-that-could-have-leaked-user-data</guid>
<description><![CDATA[ By hiding malicious instructions on an attacker-controlled Web page, AI could ingest orders as benign and return sensitive data to the attacker&#039;s server. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt95fa0225faa25bcb/69d5570d4647646f679c5429/prompt_injection_GK_Images_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 23:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Grafana, Patches, Bug, That, Could, Have, Leaked, User, Data</media:keywords>
</item>

<item>
<title>Axios Attack Shows Complex Social Engineering Is Industrialized</title>
<link>https://block385.com/axios-attack-shows-complex-social-engineering-is-industrialized</link>
<guid>https://block385.com/axios-attack-shows-complex-social-engineering-is-industrialized</guid>
<description><![CDATA[ The attack on the popular NPM package Axios is just one of many targeting maintainers and has shone a light on how threat actors can scale sophisticated social engineering campaigns. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt2af675b79749ae8f/69d40b83f54849446e9987de/oil_refinery_Arterra_Picture_Library_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 21:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Axios, Attack, Shows, Complex, Social, Engineering, Industrialized</media:keywords>
</item>

<item>
<title>Russian State&#45;Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign</title>
<link>https://block385.com/russian-state-linked-apt28-exploits-soho-routers-in-global-dns-hijacking-campaign</link>
<guid>https://block385.com/russian-state-linked-apt28-exploits-soho-routers-in-global-dns-hijacking-campaign</guid>
<description><![CDATA[ The Russia-linked threat actor known as APT28 (aka Forest Blizzard) has been linked to a new campaign that has compromised insecure MikroTik and TP-Link routers and modified their settings to turn them into malicious infrastructure under their control as part of a cyber espionage campaign since at least May 2025.
The large-scale exploitation campaign has been codenamed  ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj6xcrxyaKNQYXfVN-AHFfiSrJ_8SwW3v7MgKlJNBi-E5WIwT3ZNrNm4fcT0JZKHHLH9fbtMKdYhG_2DBHxkIy7-EydaWvEeeo4LDRPgAJ1K8i-YFeD9a0gPnw92xfN4FU3k7rQUhizsFLL8fiAo2YOw-ql-Ru07KtBUoA__B_fGYW4I6jnnn-OPwxoXnCx/s1600/router.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 20:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Russian, State-Linked, APT28, Exploits, SOHO, Routers, Global, DNS, Hijacking, Campaign</media:keywords>
</item>

<item>
<title>AI&#45;enabled device code phishing campaign exploits OAuth flow for account takeover</title>
<link>https://block385.com/ai-enabled-device-code-phishing-campaign-exploits-oauth-flow-for-account-takeover</link>
<guid>https://block385.com/ai-enabled-device-code-phishing-campaign-exploits-oauth-flow-for-account-takeover</guid>
<description><![CDATA[ A phishing campaign that bypasses the standard 15-minute expiration window through automation and dynamic code generation, leveraging the OAuth Device Code Authentication flow to compromise organizational accounts at scale, has been observed by the Microsoft Defender Security Research team. The campaign uses AI-assisted infrastructure and end-to-end automation. Attack overview Device Code Authentication is a legitimate OAuth flow designed for devices that cannot support a standard interactive login. In this model, a code is presented on … More →
The post AI-enabled device code phishing campaign exploits OAuth flow for account takeover appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/10/16145632/phishing-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 19:00:34 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AI-enabled, device, code, phishing, campaign, exploits, OAuth, flow, for, account, takeover</media:keywords>
</item>

<item>
<title>Cloudflare moves up its post&#45;quantum deadline as researchers narrow the path to Q&#45;Day</title>
<link>https://block385.com/cloudflare-moves-up-its-post-quantum-deadline-as-researchers-narrow-the-path-to-q-day</link>
<guid>https://block385.com/cloudflare-moves-up-its-post-quantum-deadline-as-researchers-narrow-the-path-to-q-day</guid>
<description><![CDATA[ Cloudflare announced it is targeting 2029 to complete post-quantum security across its entire product suite, including post-quantum authentication. The company is following a revised roadmap that Google also adopted after announcing that it had improved the quantum algorithm used to break elliptic curve cryptography. Google stopped short of publishing the algorithm, disclosing only a zero-knowledge proof of its existence. The same day, a company called Oratomic published a resource estimate for breaking RSA-2048 and P-256 … More →
The post Cloudflare moves up its post-quantum deadline as researchers narrow the path to Q-Day appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/03153102/cloudflare-red.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 19:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cloudflare, moves, its, post-quantum, deadline, researchers, narrow, the, path, Q-Day</media:keywords>
</item>

<item>
<title>Acronis MDR by TRU brings 24/7 managed detection and response to MSPs</title>
<link>https://block385.com/acronis-mdr-by-tru-brings-247-managed-detection-and-response-to-msps</link>
<guid>https://block385.com/acronis-mdr-by-tru-brings-247-managed-detection-and-response-to-msps</guid>
<description><![CDATA[ Acronis has announced the launch of Acronis MDR by Acronis TRU, a globally available 24/7/365 managed detection and response (MDR) service. Built specifically for managed service providers (MSPs) of all sizes, the service provides threat detection, incident response, and cyber resilience powered by the Acronis Threat Research Unit (TRU). With this offering, MSPs can expand their security capabilities and deliver scalable protection without the complexity or cost of operating an in-house security operations center. As … More →
The post Acronis MDR by TRU brings 24/7 managed detection and response to MSPs appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 19:00:21 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Acronis, MDR, TRU, brings, 247, managed, detection, and, response, MSPs</media:keywords>
</item>

<item>
<title>Russian hackers hijack internet traffic using vulnerable routers</title>
<link>https://block385.com/russian-hackers-hijack-internet-traffic-using-vulnerable-routers</link>
<guid>https://block385.com/russian-hackers-hijack-internet-traffic-using-vulnerable-routers</guid>
<description><![CDATA[ The Russian state cyber group APT28 has been compromising routers to hijack web traffic and spy on victims, the UK’s The National Cyber Security Centre (NCSC) has warned. Attackers are exploiting vulnerable routers to alter DHCP and DNS settings, redirecting traffic through servers they control. “We assess that APT28 is almost certainly the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Centre (GTsSS) Military Intelligence Unit 26165.” said NCSC. Since 2024, APT28 … More →
The post Russian hackers hijack internet traffic using vulnerable routers appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/21101257/russia-uk-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 19:00:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Russian, hackers, hijack, internet, traffic, using, vulnerable, routers</media:keywords>
</item>

<item>
<title>Docker CVE&#45;2026&#45;34040 Lets Attackers Bypass Authorization and Gain Host Access</title>
<link>https://block385.com/docker-cve-2026-34040-lets-attackers-bypass-authorization-and-gain-host-access</link>
<guid>https://block385.com/docker-cve-2026-34040-lets-attackers-bypass-authorization-and-gain-host-access</guid>
<description><![CDATA[ A high-severity security vulnerability has been disclosed in Docker Engine that could permit an attacker to bypass authorization plugins (AuthZ) under specific circumstances.
The vulnerability, tracked as CVE-2026-34040 (CVSS score: 8.8), stems from an incomplete fix for CVE-2024-41110, a maximum-severity vulnerability in the same component that came to light in July 2024.
&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1fiR51KBq7hNIR1D2V9e0jituEJTVutYd8b9v6KR0YdA30xWCSKJo3nfIykSdYSjZNe7gvNj3Wf3HidhZ24n-piDo8LhrE6ctyZrcLYNcJwCSP0KEe7G0Fl_xJm676Dv-4bFEh63Vv_xZ1zb9qOKhfeWFN5IexOHligHBCTHyVLAMDl0aeL2olDxnjfch/s1600/ai-chat.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 18:30:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Docker, CVE-2026-34040, Lets, Attackers, Bypass, Authorization, and, Gain, Host, Access</media:keywords>
</item>

<item>
<title>Lies, Damned Lies, and Cybersecurity Metrics</title>
<link>https://block385.com/lies-damned-lies-and-cybersecurity-metrics</link>
<guid>https://block385.com/lies-damned-lies-and-cybersecurity-metrics</guid>
<description><![CDATA[ A panel of five C-suite leaders discuss how cybersecurity success is measured and why it isn&#039;t improving results. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt2569e353af1be41f/69d47533006e7a7f735aaf62/clipboard-paulaphoto-AdobeStock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Lies, Damned, Lies, and, Cybersecurity, Metrics</media:keywords>
</item>

<item>
<title>RSAC 2026: How AI Is Reshaping Cybersecurity Faster Than Ever</title>
<link>https://block385.com/rsac-2026-how-ai-is-reshaping-cybersecurity-faster-than-ever</link>
<guid>https://block385.com/rsac-2026-how-ai-is-reshaping-cybersecurity-faster-than-ever</guid>
<description><![CDATA[ Dark Reading&#039;s Kelly Jackson Higgins shares insights on the past, present, and future of cybersecurity after attending RSAC 2026 Conference. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt13b8cd0ffe1e58f9/69d479deaf91601506053f59/earth1800_Buradaki_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>RSAC, 2026:, How, Reshaping, Cybersecurity, Faster, Than, Ever</media:keywords>
</item>

<item>
<title>Human vs AI: Debates Shape RSAC 2026 Cybersecurity Trends</title>
<link>https://block385.com/human-vs-ai-debates-shape-rsac-2026-cybersecurity-trends</link>
<guid>https://block385.com/human-vs-ai-debates-shape-rsac-2026-cybersecurity-trends</guid>
<description><![CDATA[ As AI dominated RSAC 2026, CISOs and industry leaders debated its role in security, from agentic applications to the challenges of scaling human involvement in decision-making. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt8cc6dfee21157b59/69d021415c46191fe418a614/AI1800_Science_Photo_Library_ALAMY.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Human, AI:, Debates, Shape, RSAC, 2026, Cybersecurity, Trends</media:keywords>
</item>

<item>
<title>Focusing on the People in Cybersecurity at RSAC 2026 Conference</title>
<link>https://block385.com/focusing-on-the-people-in-cybersecurity-at-rsac-2026-conference</link>
<guid>https://block385.com/focusing-on-the-people-in-cybersecurity-at-rsac-2026-conference</guid>
<description><![CDATA[ AI dominated the RSAC 2026 Conference and showed it&#039;s still humans in cybersecurity who matter most. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt79de1ac137dc7200/69d3f4d558d26eee5e1c3d8d/AI_Human_High_Five_Andriy_Popov_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 17:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Focusing, the, People, Cybersecurity, RSAC, 2026, Conference</media:keywords>
</item>

<item>
<title>Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign</title>
<link>https://block385.com/over-1000-exposed-comfyui-instances-targeted-in-cryptomining-botnet-campaign</link>
<guid>https://block385.com/over-1000-exposed-comfyui-instances-targeted-in-cryptomining-botnet-campaign</guid>
<description><![CDATA[ An active campaign has been observed targeting internet-exposed instances running ComfyUI, a popular stable diffusion platform, to enlist them into a cryptocurrency mining and proxy botnet.
&quot;A purpose-built Python scanner continuously sweeps major cloud IP ranges for vulnerable targets, automatically installing malicious nodes via ComfyUI-Manager if no exploitable node is already ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiNAquH2CuNdKvNbKqIsmTqg2Rpb5SRn8zxBKdQliREzpq_Byd0ye0aD8IFVa1JUj09QnQVJVnAVET30DX0jRBK1LBXJ-16QC_GoiYDH2ibCfoYcttx3McOurmn9e4cSugeNgEQa-oVqR13I9K1h6ktgggudmT3u88I_iN_ksHQvuS2N0u0uGlUNTW_Tv9l/s1600/compfyui.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 16:30:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Over, 1, 000, Exposed, ComfyUI, Instances, Targeted, Cryptomining, Botnet, Campaign</media:keywords>
</item>

<item>
<title>[Webinar] How to Close Identity Gaps in 2026 Before AI Exploits Enterprise Risk</title>
<link>https://block385.com/webinar-how-to-close-identity-gaps-in-2026-before-ai-exploits-enterprise-risk</link>
<guid>https://block385.com/webinar-how-to-close-identity-gaps-in-2026-before-ai-exploits-enterprise-risk</guid>
<description><![CDATA[ In the rapid evolution of the 2026 threat landscape, a frustrating paradox has emerged for CISOs and security leaders: Identity programs are maturing, yet the risk is actually increasing.
According to new research from the Ponemon Institute, hundreds of applications within the typical enterprise remain disconnected from centralized identity systems. These &quot;dark ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRHgJL0SczODx5PAnF85b8b0mRpiOOkIQdOWvhivyXu6H8UeZKH9ZUdaeW5IuU59q2hjMNioQWQ5vk1Km8yinGGc8GA079qvhTtFsp9PV76Kmp-3lpKh2zi3vgd_-6dFcOI6i1YHs7VkJ-p-HvOEuOwkjooBVSvYFOrVqXqNhZShZy3IUeD6BVHVvUIj50/s1600/webinar-cerby.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 14:30:15 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Webinar, How, Close, Identity, Gaps, 2026, Before, Exploits, Enterprise, Risk</media:keywords>
</item>

<item>
<title>The Hidden Cost of Recurring Credential Incidents</title>
<link>https://block385.com/the-hidden-cost-of-recurring-credential-incidents</link>
<guid>https://block385.com/the-hidden-cost-of-recurring-credential-incidents</guid>
<description><![CDATA[ When talking about credential security, the focus usually lands on breach prevention. This makes sense when IBM’s 2025 Cost of a Data Breach Report puts the average cost of a breach at $4.4 million. Avoiding even one major incident is enough to justify most security investments, but that headline figure obscures the more persistent problems caused by recurring credential ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgKmTyBv8aWjZuBbedJ5TZkS6Y66K940b-vB3d1MoHwX2AXWb8xmabo8pN7pcFBicVbmRmK22bzd9nX3XceGzlcmkfej9nF5VJk1srniaJ2F28JEmeFynSREG8A_XMQBSSba4Rb6nn41RCXPT6p5a23xaEoM9Jxb4yvqStcl9j9cofRrotYh2dvxtrM7uc/s1600/out.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 14:30:15 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Hidden, Cost, Recurring, Credential, Incidents</media:keywords>
</item>

<item>
<title>Google study finds LLMs are embedded at every stage of abuse detection</title>
<link>https://block385.com/google-study-finds-llms-are-embedded-at-every-stage-of-abuse-detection</link>
<guid>https://block385.com/google-study-finds-llms-are-embedded-at-every-stage-of-abuse-detection</guid>
<description><![CDATA[ Online platforms are running large language models at every stage of LLM content moderation, from generating training data to auditing their own systems for bias. Researchers at Google mapped how this is happening across what the authors call the Abuse Detection Lifecycle, a four-stage framework covering labeling, detection, review and appeals, and auditing. Earlier moderation systems, built on models like BERT and RoBERTa fine-tuned on static hate-speech datasets, could identify explicit slurs with reasonable accuracy. … More →
The post Google study finds LLMs are embedded at every stage of abuse detection appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/21130045/google-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 13:01:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, study, finds, LLMs, are, embedded, every, stage, abuse, detection</media:keywords>
</item>

<item>
<title>How Mimecast brings enterprise&#45;grade email protection to API deployment</title>
<link>https://block385.com/how-mimecast-brings-enterprise-grade-email-protection-to-api-deployment</link>
<guid>https://block385.com/how-mimecast-brings-enterprise-grade-email-protection-to-api-deployment</guid>
<description><![CDATA[ In this Help Net Security video, Andrew Williams, Senior Product Manager at Mimecast, walks through the company’s API-based email security protection for Microsoft 365 and Google Workspace environments. The video covers a core problem: AI-generated phishing and business email compromise are slipping past native Microsoft 365 controls. According to Mimecast’s State of Human Risk report, 64% of organizations know their built-in email security has gaps. Mimecast’s API solution connects via Microsoft Graph API in minutes, … More →
The post How Mimecast brings enterprise-grade email protection to API deployment appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/02/09140915/email-1600.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 13:00:59 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, Mimecast, brings, enterprise-grade, email, protection, API, deployment</media:keywords>
</item>

<item>
<title>The case for fixing CWE weakness patterns instead of patching one bug at a time</title>
<link>https://block385.com/the-case-for-fixing-cwe-weakness-patterns-instead-of-patching-one-bug-at-a-time</link>
<guid>https://block385.com/the-case-for-fixing-cwe-weakness-patterns-instead-of-patching-one-bug-at-a-time</guid>
<description><![CDATA[ In this Help Net Security interview, Alec Summers, MITRE CVE/CWE Project Lead, discusses how CWE is moving from a background reference into active use in vulnerability disclosure. More CVE records now include CWE mappings from CNAs, which tends to produce more precise root-cause data. Automation tools help analysts map weaknesses faster, but can reinforce bad patterns if trained on poor examples. Summers argues that fixing weakness patterns reduces recurring work for security teams, even those … More →
The post The case for fixing CWE weakness patterns instead of patching one bug at a time appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/05202021/alec_summers-2-mitre.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 13:00:45 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, case, for, fixing, CWE, weakness, patterns, instead, patching, one, bug, time</media:keywords>
</item>

<item>
<title>OpenAI opens applications for an external AI safety research fellowship</title>
<link>https://block385.com/openai-opens-applications-for-an-external-ai-safety-research-fellowship</link>
<guid>https://block385.com/openai-opens-applications-for-an-external-ai-safety-research-fellowship</guid>
<description><![CDATA[ OpenAI is accepting applications for a paid fellowship program that will fund external researchers to work on safety and alignment questions related to advanced AI systems. The program, called the OpenAI Safety Fellowship, runs from September 14, 2026 through February 5, 2027. Applications close May 3, with successful applicants notified by July 25. The fellowship is open to researchers, engineers, and practitioners from outside OpenAI. Priority research areas include safety evaluation, ethics, robustness, scalable mitigations, … More →
The post OpenAI opens applications for an external AI safety research fellowship appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05155719/openai-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 13:00:34 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI, opens, applications, for, external, safety, research, fellowship</media:keywords>
</item>

<item>
<title>Comp AI: The open&#45;source way to get compliant with SOC 2, ISO 27001, HIPAA and GDPR</title>
<link>https://block385.com/comp-ai-the-open-source-way-to-get-compliant-with-soc-2-iso-27001-hipaa-and-gdpr</link>
<guid>https://block385.com/comp-ai-the-open-source-way-to-get-compliant-with-soc-2-iso-27001-hipaa-and-gdpr</guid>
<description><![CDATA[ Getting a startup through a SOC 2 audit has long meant months of manual evidence collection, policy writing, and repeated back-and-forth with auditors. A growing number of compliance platforms have moved to automate parts of that process, and Comp AI is now doing it with an open-source codebase that organizations can inspect, modify, and self-host. Comp AI is an open-source compliance platform targeting SOC 2, ISO 27001, HIPAA, and GDPR. It automates evidence collection, policy … More →
The post Comp AI: The open-source way to get compliant with SOC 2, ISO 27001, HIPAA and GDPR appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/07102053/comp_ai-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 13:00:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Comp, AI:, The, open-source, way, get, compliant, with, SOC, ISO, 27001, HIPAA, and, GDPR</media:keywords>
</item>

<item>
<title>GitHub Copilot CLI gets a second&#45;opinion feature built on cross&#45;model review</title>
<link>https://block385.com/github-copilot-cli-gets-a-second-opinion-feature-built-on-cross-model-review</link>
<guid>https://block385.com/github-copilot-cli-gets-a-second-opinion-feature-built-on-cross-model-review</guid>
<description><![CDATA[ Coding agents make decisions in sequence: a plan is drafted, implemented, then tested. Any error introduced early compounds as subsequent steps build on the same flawed assumption. Self-reflection is a recognized mitigation technique, and one GitHub Copilot already supports, but a model reviewing its own output is still constrained by the same training data and blind spots that produced it. GitHub addressed that constraint this week with the release of Rubber Duck, a cross-model review … More →
The post GitHub Copilot CLI gets a second-opinion feature built on cross-model review appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/07/18100104/github-2-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 13:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>GitHub, Copilot, CLI, gets, second-opinion, feature, built, cross-model, review</media:keywords>
</item>

<item>
<title>New GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit&#45;Flips</title>
<link>https://block385.com/new-gpubreach-attack-enables-full-cpu-privilege-escalation-via-gddr6-bit-flips</link>
<guid>https://block385.com/new-gpubreach-attack-enables-full-cpu-privilege-escalation-via-gddr6-bit-flips</guid>
<description><![CDATA[ New academic research has identified multiple RowHammer attacks against high-performance graphics processing units (GPUs) that could be exploited to escalate privileges and, in some cases, even take full control of a host.
The efforts have been codenamed GPUBreach, GDDRHammer, and GeForge.
GPUBreach goes a step further than GPUHammer, demonstrating for the first time that ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjD7E4oEicfW1OaHztWEuM4qrsJFnHRPJ41f8R-2VeKUFV3Y59XaBUctumc2R91miQ3dMPnwkEcpPMqFErKmPRJhS3VRceve1GOSGGUsP6WHGIfoQAuVV10JVy312CxGYvmb2xA_eQtuO69bNb-1NzYln9P4xbsFDoPgWG3BEdri4sRRj415XQr1NENZBh0/s1600/grpu.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 12:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, GPUBreach, Attack, Enables, Full, CPU, Privilege, Escalation, via, GDDR6, Bit-Flips</media:keywords>
</item>

<item>
<title>China&#45;Linked Storm&#45;1175 Exploits Zero&#45;Days to Rapidly Deploy Medusa Ransomware</title>
<link>https://block385.com/china-linked-storm-1175-exploits-zero-days-to-rapidly-deploy-medusa-ransomware</link>
<guid>https://block385.com/china-linked-storm-1175-exploits-zero-days-to-rapidly-deploy-medusa-ransomware</guid>
<description><![CDATA[ A China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to orchestrate &quot;high-velocity&quot; attacks and break into susceptible internet-facing systems.
&quot;The threat actor&#039;s high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhN-ulbNH0WxLgcWOo1fnNpmYNLvHo4VW23VmfdGvDlcbd9IvuUBKMp1hY21B2NlBxtCNa5FCPEzjxPaLpOhz2uXR22uAmgHF0n-wJMb6DZmPFPjlC2QsYb0Vi4qvqmVzPcOmMr8NbwGSYYrceDknuVJ6xnzcDUUrmwO_ObAeq_Pmwf8AHeFlcQFwwpb-H3/s1600/medusa.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 10:30:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>China-Linked, Storm-1175, Exploits, Zero-Days, Rapidly, Deploy, Medusa, Ransomware</media:keywords>
</item>

<item>
<title>Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed</title>
<link>https://block385.com/flowise-ai-agent-builder-under-active-cvss-100-rce-exploitation-12000-instances-exposed</link>
<guid>https://block385.com/flowise-ai-agent-builder-under-active-cvss-100-rce-exploitation-12000-instances-exposed</guid>
<description><![CDATA[ Threat actors are exploiting a maximum-severity security flaw in Flowise, an open-source artificial intelligence (AI) platform, according to new findings from VulnCheck.
The vulnerability in question is CVE-2025-59528 (CVSS score: 10.0), a code injection vulnerability that could result in remote code execution.
&quot;The CustomMCP node allows users to input configuration settings for connecting ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCGR6ZfT0_UppVPQsgk7lwTbzfybdDFY-HeJi9F6VE6HuN7-Ja-lpveDnPA-kcS7x8l1oZ0lUqPoEFdRTOMt0Z8H6EeT_NadV_P7bjlh8Je6Q-T5KAlOCzOWt-LyY3jY8RsTlRTUzuXsVwf_gs-_KyXw8G_LcFz2dY-2P9XozQWy2p9PneNGUMctvpIZYM/s1600/flowise.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 08:30:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Flowise, Agent, Builder, Under, Active, CVSS, 10.0, RCE, Exploitation, 12, 000, Instances, Exposed</media:keywords>
</item>

<item>
<title>AI&#45;Assisted Supply Chain Attack Targets GitHub</title>
<link>https://block385.com/ai-assisted-supply-chain-attack-targets-github</link>
<guid>https://block385.com/ai-assisted-supply-chain-attack-targets-github</guid>
<description><![CDATA[ PRT-scan is the second in recent months where a threat actor appears to have leveraged AI for automated targeting of a widespread GitHub misconfiguration. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltb66926d4c6158b6c/69d41ea59d80127a3038fb86/github_PJ_McDonnell_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 01:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AI-Assisted, Supply, Chain, Attack, Targets, GitHub</media:keywords>
</item>

<item>
<title>Axios Attack Shows Social Complex Engineering Is Industrialized</title>
<link>https://block385.com/axios-attack-shows-social-complex-engineering-is-industrialized</link>
<guid>https://block385.com/axios-attack-shows-social-complex-engineering-is-industrialized</guid>
<description><![CDATA[ The attack on the popular NPM package Axios is just one of many targeting maintainers and has shone a light on how threat actors can scale sophisticated social engineering campaigns. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt2af675b79749ae8f/69d40b83f54849446e9987de/oil_refinery_Arterra_Picture_Library_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 07 Apr 2026 01:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Axios, Attack, Shows, Social, Complex, Engineering, Industrialized</media:keywords>
</item>

<item>
<title>Fortinet Issues Emergency Patch for FortiClient Zero&#45;Day</title>
<link>https://block385.com/fortinet-issues-emergency-patch-for-forticlient-zero-day</link>
<guid>https://block385.com/fortinet-issues-emergency-patch-for-forticlient-zero-day</guid>
<description><![CDATA[ The authentication bypass flaw, tracked as CVE-2026-35616, is the latest in a series of Fortinet vulnerabilities that have been exploited in the wild. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blta136b3187f54aba9/69d402a467101a067adcc450/fortinet_SipaUSA_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 23:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fortinet, Issues, Emergency, Patch, for, FortiClient, Zero-Day</media:keywords>
</item>

<item>
<title>Iran&#45;Linked Password&#45;Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations</title>
<link>https://block385.com/iran-linked-password-spraying-campaign-targets-300-israeli-microsoft-365-organizations</link>
<guid>https://block385.com/iran-linked-password-spraying-campaign-targets-300-israeli-microsoft-365-organizations</guid>
<description><![CDATA[ An Iran-nexus threat actor is suspected to be behind a password-spraying campaign targeting Microsoft 365 environments in Israel and the U.A.E. amid ongoing conflict in the Middle East.
The activity, assessed to be ongoing, was carried out in three distinct attack waves that took place on March 3, March 13, and March 23, 2026, per Check Point.
&quot;The campaign is primarily ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgf4g-Zhhi4P6IHkSqUlU3EzCQNKPJ1nV3mWfQAtS6gfGu6H7wuq5OgVXGvF1IM2afayopX3b0zj4bjVDYaO7dBc4rl0A0Y6GND1VkbLdug_ULVW6a6P7iNlhUFGwMsRSDHqbodsc8EeLcg2nXxDPXO0h8RABu_jr9o-5cx8g5GTXxFgDOx9PTRQIFECpL/s1600/iran.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 22:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Iran-Linked, Password-Spraying, Campaign, Targets, 300, Israeli, Microsoft, 365, Organizations</media:keywords>
</item>

<item>
<title>DPRK&#45;Linked Hackers Use GitHub as C2 in Multi&#45;Stage Attacks Targeting South Korea</title>
<link>https://block385.com/dprk-linked-hackers-use-github-as-c2-in-multi-stage-attacks-targeting-south-korea</link>
<guid>https://block385.com/dprk-linked-hackers-use-github-as-c2-in-multi-stage-attacks-targeting-south-korea</guid>
<description><![CDATA[ Threat actors likely associated with the Democratic People&#039;s Republic of Korea (DPRK) have been observed using GitHub as command-and-control (C2) infrastructure in multi-stage attacks targeting organizations in South Korea.
The attack chain, per Fortinet FortiGuard Labs, involves obfuscated Windows shortcut (LNK) files acting as the starting point to drop a decoy PDF ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh23Q23hk6n_d_f9evdsf7JVcn5OswTUqwd0B8EvWdftPQXN4K1V6nHICk_MvzLf4jUfCCHpUmaZIzECekbKf3PQ2w2gRlY-AphdBRZgyJHq7XQsyIS_vp6iT_fVLoDQ1TFA4DBLT32Q1sTY_WHjGRtzaYMOqMNThcg8JodZ-Aozj2OO21DQLj2agEojjdp/s1600/github.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DPRK-Linked, Hackers, Use, GitHub, Multi-Stage, Attacks, Targeting, South, Korea</media:keywords>
</item>

<item>
<title>Automated Credential Harvesting Campaign Exploits React2Shell Flaw</title>
<link>https://block385.com/automated-credential-harvesting-campaign-exploits-react2shell-flaw</link>
<guid>https://block385.com/automated-credential-harvesting-campaign-exploits-react2shell-flaw</guid>
<description><![CDATA[ An emerging threat cluster tracked as UAT-10608 is exploiting vulnerable Web-exposed Next.js apps and using an automated tool to exfiltrate credentials, secrets, and other system data. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd8e96d3db38c0b12/69d39a16d1f628212adfd236/maliciouscode_Victor_Koldunov_Alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 19:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Automated, Credential, Harvesting, Campaign, Exploits, React2Shell, Flaw</media:keywords>
</item>

<item>
<title>Multi&#45;OS Cyberattacks: How SOCs Close a Critical Risk in 3 Steps</title>
<link>https://block385.com/multi-os-cyberattacks-how-socs-close-a-critical-risk-in-3-steps</link>
<guid>https://block385.com/multi-os-cyberattacks-how-socs-close-a-critical-risk-in-3-steps</guid>
<description><![CDATA[ Your attack surface no longer lives on one operating system, and neither do the campaigns targeting it. In enterprise environments, attackers move across Windows endpoints, executive MacBooks, Linux infrastructure, and mobile devices, taking advantage of the fact that many SOC workflows are still fragmented by platform. 
For security leaders, this creates a ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixIItKplcozAxhBXqaAcKz33D_p67WELaaBHZDIxGe7-qkKNWIITVvI4a3jSB_A17z89_XvJMprYsmkylYUvuWW4GeMWTWgBCWLWc3i_zPx4XtlW1PJDcbt1doyrUQlE1oeYbSNrmk1XZx-ROkvMyVvaLuryZ8k7MSnBbGEtQLledLStXEcyoapR4wAiA/s1600/cyberattacks.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 18:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Multi-OS, Cyberattacks:, How, SOCs, Close, Critical, Risk, Steps</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: Axios Hack, Chrome 0&#45;Day, Fortinet Exploits, Paragon Spyware and More</title>
<link>https://block385.com/weekly-recap-axios-hack-chrome-0-day-fortinet-exploits-paragon-spyware-and-more</link>
<guid>https://block385.com/weekly-recap-axios-hack-chrome-0-day-fortinet-exploits-paragon-spyware-and-more</guid>
<description><![CDATA[ This week had real hits. The key software got tampered with. Active bugs showed up in the tools people use every day. Some attacks didn’t even need much effort because the path was already there.
One weak spot now spreads wider than before. What starts small can reach a lot of systems fast. New bugs, faster use, less time to react.
That’s this week. Read&amp; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZyEpyaWHYHm8-TyNZQgYtoAqrsAUDZ0_onxgp1BUSV0khgAkwy7S9fMT75sRAm2blJXN6xw6i4r0fXP_hayN2Afrr7ul6egJc2nvFJUoWqmy0iJCr5JdK9-915pCFpEtRdlOMb-BYexGAPQPdKnGjWPbPlfGFx5qOo5Dhzfjes7_k-s5bYgFDEyMCT5BJ/s1600/recaps.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 18:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>⚡, Weekly, Recap:, Axios, Hack, Chrome, 0-Day, Fortinet, Exploits, Paragon, Spyware, and, More</media:keywords>
</item>

<item>
<title>Shadow AI in Healthcare is Here to Stay</title>
<link>https://block385.com/shadow-ai-in-healthcare-is-here-to-stay</link>
<guid>https://block385.com/shadow-ai-in-healthcare-is-here-to-stay</guid>
<description><![CDATA[ Medical professionals are not going to stop using AI tools to manage growing workloads. Organizations should prioritize bolstering security protocols to limit their blast radius. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltde629170050540bf/69d3bfede71d00488aef3088/3D3JNWF.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 17:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Shadow, Healthcare, Here, Stay</media:keywords>
</item>

<item>
<title>OWASP GenAI Security Project Gets Update, New Tools Matrix</title>
<link>https://block385.com/owasp-genai-security-project-gets-update-new-tools-matrix</link>
<guid>https://block385.com/owasp-genai-security-project-gets-update-new-tools-matrix</guid>
<description><![CDATA[ In recognition of 21 generative AI risks, the standards groups recommends that companies take separate but linked approaches to defending GenAI and agentic AI systems. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf77840e96b8ff6fe/69cfd0235177db0069ab33b4/AI-security-in-blue-black-TippaPatt-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 17:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OWASP, GenAI, Security, Project, Gets, Update, New, Tools, Matrix</media:keywords>
</item>

<item>
<title>How LiteLLM Turned Developer Machines Into Credential Vaults for Attackers</title>
<link>https://block385.com/how-litellm-turned-developer-machines-into-credential-vaults-for-attackers</link>
<guid>https://block385.com/how-litellm-turned-developer-machines-into-credential-vaults-for-attackers</guid>
<description><![CDATA[ The most active piece of enterprise infrastructure in the company is the developer workstation. That laptop is where credentials are created, tested, cached, copied, and reused across services, bots, build tools, and now local AI agents.
In March 2026, the TeamPCP threat actor proved just how valuable developer machines are. Their supply chain attack on ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhbMDHeEKBkLDrqXHQ8NZfqd3KdR2hzLuhCEQuQKp0yXA20kmu7JR385GZdV94U615EVunwKkJkDSHlqeoEiu5pB4uElhCSO_vOXWsVUUJvgNkmZE1Z22o_yIapvMEOwvqaG7B31S4ojGPnDwGVqd7zgdtg53IS0AsTkHJRBOvdwf726Fypp5CP7m-3rtc/s1600/liteLLM-breach.gif" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 16:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>How, LiteLLM, Turned, Developer, Machines, Into, Credential, Vaults, for, Attackers</media:keywords>
</item>

<item>
<title>Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools</title>
<link>https://block385.com/qilin-and-warlock-ransomware-use-vulnerable-drivers-to-disable-300-edr-tools</link>
<guid>https://block385.com/qilin-and-warlock-ransomware-use-vulnerable-drivers-to-disable-300-edr-tools</guid>
<description><![CDATA[ Threat actors associated with Qilin and Warlock ransomware operations have been observed using the bring your own vulnerable driver (BYOVD) technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro.
Qilin attacks analyzed by Talos have been found to deploy a malicious DLL named &quot;msimg32.dll,&quot; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtrUKOrJ2Y_pSYHNcKDjbrBsZa2igYlNorTwmH31JNSjdA7VP84kXj23nmkk7DTqlrCUsfCjNo6xt-niyZeKeCR7VtBzMWW9eNUKzU0WGnpmw2yYjHBdboP2uF2UA8CCsdclyeDlRJcU7DEOD8OrFthlhQX-OkgePmyT__ZDQA4IXgRYbnNtp21MoleCTU/s1600/lock-ransomware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 12:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Qilin, and, Warlock, Ransomware, Use, Vulnerable, Drivers, Disable, 300, EDR, Tools</media:keywords>
</item>

<item>
<title>BKA Identifies REvil Leaders Behind 130 German Ransomware Attacks</title>
<link>https://block385.com/bka-identifies-revil-leaders-behind-130-german-ransomware-attacks</link>
<guid>https://block385.com/bka-identifies-revil-leaders-behind-130-german-ransomware-attacks</guid>
<description><![CDATA[ Germany&#039;s Federal Criminal Police Office (aka BKA or the Bundeskriminalamt) has unmasked the real identity of the main threat actors associated with the now-defunct REvil (aka Sodinokibi) ransomware-as-a-service (RaaS) operation.
The threat actor, who went by the alias UNKN, functioned as a representative of the group, advertising the ransomware in June 2019 on the XSS cybercrime forum. He  ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgsBHK8DX9E30isZVcn1e-a6p8bmNUAki0SmUh1Tkt9dP8L3D4_WcwT64CI5OVuh1brb1Z4pff7onp90K76ktHbs6-H6Kr0rq9Q2f03oW91e3mA5dN5XdLDyWNns5NcfXw7BKFzH28SbpaFo9l8TmMeZ7Mt6o1ePanKeFYGa8V1S9Rez_E30SIAx2yvfuNl/s1600/revil-ransomware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 10:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>BKA, Identifies, REvil, Leaders, Behind, 130, German, Ransomware, Attacks</media:keywords>
</item>

<item>
<title>Product showcase: Proton Authenticator is an end&#45;to&#45;end encrypted, open source 2FA app</title>
<link>https://block385.com/product-showcase-proton-authenticator-is-an-end-to-end-encrypted-open-source-2fa-app</link>
<guid>https://block385.com/product-showcase-proton-authenticator-is-an-end-to-end-encrypted-open-source-2fa-app</guid>
<description><![CDATA[ Proton Authenticator is a free and open-source two-factor authentication (2FA) app that generates time-based one-time passwords (TOTP) to help secure online accounts. It is available on Windows, macOS, Linux, iOS, and Android, allowing users to access their verification codes across devices. The app is designed to work without ads or tracking. A Proton account is optional and mainly used for encrypted sync between devices. How Proton Authenticator works Setup starts with installing the app from … More →
The post Product showcase: Proton Authenticator is an end-to-end encrypted, open source 2FA app appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/03061940/proton_autentication-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 09:00:26 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Product, showcase:, Proton, Authenticator, end-to-end, encrypted, open, source, 2FA, app</media:keywords>
</item>

<item>
<title>Residential proxies make a mockery of IP&#45;based defenses</title>
<link>https://block385.com/residential-proxies-make-a-mockery-of-ip-based-defenses</link>
<guid>https://block385.com/residential-proxies-make-a-mockery-of-ip-based-defenses</guid>
<description><![CDATA[ Attack traffic moved through ordinary home and mobile connections in ways that limited the usefulness of IP reputation on its own. GreyNoise observed 4 billion malicious sessions during a 90-day period and described activity that appeared indistinguishable from normal user traffic at the network level. Residential proxies routed traffic through consumer broadband, mobile data, and small-business connections. These same IP ranges were used by employees, customers, and partners, which made it difficult to separate malicious … More →
The post Residential proxies make a mockery of IP-based defenses appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/05122802/network-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 09:00:16 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Residential, proxies, make, mockery, IP-based, defenses</media:keywords>
</item>

<item>
<title>CISOs grapple with AI demands within flat budgets</title>
<link>https://block385.com/cisos-grapple-with-ai-demands-within-flat-budgets</link>
<guid>https://block385.com/cisos-grapple-with-ai-demands-within-flat-budgets</guid>
<description><![CDATA[ Security spending continues to edge upward across large organizations, though the changes remain gradual and tightly managed. The 2026 RH-ISAC CISO Benchmark reflects a steady environment where budgets expand in small steps, even as AI becomes a routine part of security operations. Budget growth stays measured Spending levels increased during 2025 across both IT and security. Average IT spend as a share of revenue rose to 3.9% from 3.2% the year before. Security spend followed … More →
The post CISOs grapple with AI demands within flat budgets appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/06/25140016/ciso-see-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 07:00:22 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CISOs, grapple, with, demands, within, flat, budgets</media:keywords>
</item>

<item>
<title>IT talent looks the other way as wireless security incidents pile up</title>
<link>https://block385.com/it-talent-looks-the-other-way-as-wireless-security-incidents-pile-up</link>
<guid>https://block385.com/it-talent-looks-the-other-way-as-wireless-security-incidents-pile-up</guid>
<description><![CDATA[ Enterprise wireless networks are supporting a growing mix of devices and applications, increasing operational demand and security exposure. The 2026 Cisco State of Wireless report reflects these conditions through rising incident rates, higher costs, and ongoing staffing challenges. Wireless investment continues to increase. Most organizations expanded spending over the past 5 years, and a large share expects further growth in the next several years. Expectations for returns are also rising, with more organizations anticipating stronger … More →
The post IT talent looks the other way as wireless security incidents pile up appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/05092956/wireless-hand.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 06 Apr 2026 07:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>talent, looks, the, other, way, wireless, security, incidents, pile</media:keywords>
</item>

<item>
<title>$285 Million Drift Hack Traced to Six&#45;Month DPRK Social Engineering Operation</title>
<link>https://block385.com/285-million-drift-hack-traced-to-six-month-dprk-social-engineering-operation</link>
<guid>https://block385.com/285-million-drift-hack-traced-to-six-month-dprk-social-engineering-operation</guid>
<description><![CDATA[ Drift has revealed that the April 1, 2026, attack that led to the theft of $285 million was the culmination of a months-long targeted and meticulously planned social engineering operation undertaken by the Democratic People&#039;s Republic of Korea (DPRK) that began in the fall of 2025.
The Solana-based decentralized exchange described it as &quot;an attack six months in the ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2eFUAGb2m5vs6mOwArunSX0lzBpR8Ag24yQhUtaYxrcHx2V46YcocY9oei-HH89QSB-HTxXta3bLH70_n6zMCRD949ttVsKlt4WnzSZ0rl1v4Suj3A7xftqjQSEXDq_cfLCIcMuENqoFeD9zBW0qZXr1owIEQEqzSNkaKfHFsGF35-lseSZbc0MGLRRWu/s1600/drift-hack.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 05 Apr 2026 22:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>285, Million, Drift, Hack, Traced, Six-Month, DPRK, Social, Engineering, Operation</media:keywords>
</item>

<item>
<title>Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited</title>
<link>https://block385.com/week-in-review-axios-npm-supply-chain-compromise-critical-forticlient-ems-bugs-exploited</link>
<guid>https://block385.com/week-in-review-axios-npm-supply-chain-compromise-critical-forticlient-ems-bugs-exploited</guid>
<description><![CDATA[ Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Financial groups lay out a plan to fight AI identity attacks Generative AI tools have brought the cost of deepfake production low enough that criminals and state-sponsored actors now use them routinely against financial institutions. A joint paper from the American Bankers Association, the Better Identity Coalition, and the Financial Services Sector Coordinating Council lays out the scale of the … More →
The post Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/07/16184416/week-in-review2.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 05 Apr 2026 13:00:15 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Week, review:, Axios, npm, supply, chain, compromise, critical, FortiClient, EMS, bugs, exploited</media:keywords>
</item>

<item>
<title>36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants</title>
<link>https://block385.com/36-malicious-npm-packages-exploited-redis-postgresql-to-deploy-persistent-implants</link>
<guid>https://block385.com/36-malicious-npm-packages-exploited-redis-postgresql-to-deploy-persistent-implants</guid>
<description><![CDATA[ Cybersecurity researchers have discovered 36 malicious packages in the npm registry that are disguised as Strapi CMS plugins but come with different payloads to facilitate Redis and PostgreSQL exploitation, deploy reverse shells, harvest credentials, and drop a persistent implant.
&quot;Every package contains three files (package.json, index.js, postinstall.js), has no description, repository, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9axxKrcvcFkL99SIB2AlrcEW2RIZ1Ff8PollH7XYSWrYSOgoPXKlF5rsdgyr9BSWVUa5oP07faI_DvxNyUk_rpuz5i2xuiEdlU-e929rCWpkLjDGRs4EBjzfBWQRJVtrWNtR-EKvWsR-PPO-Yfei5ONMyumlI12R7OHmIrsyzJtB5SJRTCSuKiyJQnTfK/s1600/database.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 05 Apr 2026 08:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Malicious, npm, Packages, Exploited, Redis, PostgreSQL, Deploy, Persistent, Implants</media:keywords>
</item>

<item>
<title>Fortinet Patches Actively Exploited CVE&#45;2026&#45;35616 in FortiClient EMS</title>
<link>https://block385.com/fortinet-patches-actively-exploited-cve-2026-35616-in-forticlient-ems</link>
<guid>https://block385.com/fortinet-patches-actively-exploited-cve-2026-35616-in-forticlient-ems</guid>
<description><![CDATA[ Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the wild.
The vulnerability, tracked as CVE-2026-35616 (CVSS score: 9.1), has been described as a pre-authentication API access bypass leading to privilege escalation.
&quot;An improper access control vulnerability [CWE-284] in FortiClient EMS may allow an ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh61_DDvLhdLZ8tHMrmQ8XlQ1vWwnEk-2lmYFnjw_1ZvJ4IUB4G7ffXU8pSd7JDknP0bqyaVVOTb1HJ62ujlQ_zfG3Lc7XMtLKUuZTO6v4jgrdqon90wrix6EaQNKtou3yz7Txf3ni5JOVn-D1-OcHB7e-UDxQI2ifZOBHAeDwFBnwAfanSeFn8EyP8oilj/s1600/fortinet.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sun, 05 Apr 2026 08:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fortinet, Patches, Actively, Exploited, CVE-2026-35616, FortiClient, EMS</media:keywords>
</item>

<item>
<title>FortiClient EMS zero&#45;day exploited, emergency hotfixes available (CVE&#45;2026&#45;35616)</title>
<link>https://block385.com/forticlient-ems-zero-day-exploited-emergency-hotfixes-available-cve-2026-35616</link>
<guid>https://block385.com/forticlient-ems-zero-day-exploited-emergency-hotfixes-available-cve-2026-35616</guid>
<description><![CDATA[ Defused Cyber has spotted a critical Fortinet FortiClient Endpoint Management Server (EMS) zero-day vulnerability (CVE-2026-35616) being exploited in the wild. This time around, the confirmation of active exploitation came almost immediately from Fortinet, as well. “Fortinet has observed [CVE-2026-35616] to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6,” the company stated in a security advisory published on Saturday. About CVE-2026-35616 On Monday, Defused Cyber … More →
The post FortiClient EMS zero-day exploited, emergency hotfixes available (CVE-2026-35616) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/21163736/fortinet-man-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Sat, 04 Apr 2026 19:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>FortiClient, EMS, zero-day, exploited, emergency, hotfixes, available, CVE-2026-35616</media:keywords>
</item>

<item>
<title>Inconsistent Privacy Labels Don&amp;apos;t Tell Users What They Are Getting</title>
<link>https://block385.com/inconsistent-privacy-labels-dont-tell-users-what-they-are-getting</link>
<guid>https://block385.com/inconsistent-privacy-labels-dont-tell-users-what-they-are-getting</guid>
<description><![CDATA[ Data privacy labels are a great idea for mobile apps, but the current versions just aren&#039;t good enough. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt41107f0839743052/69d0356a4d3fefd8f0031c47/mobile-privacy-aphithana-chitmongkolthong-alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Sat, 04 Apr 2026 01:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Inconsistent, Privacy, Labels, Dont, Tell, Users, What, They, Are, Getting</media:keywords>
</item>

<item>
<title>Apple Breaks Precedent, Patches DarkSword for iOS 18</title>
<link>https://block385.com/apple-breaks-precedent-patches-darksword-for-ios-18</link>
<guid>https://block385.com/apple-breaks-precedent-patches-darksword-for-ios-18</guid>
<description><![CDATA[ Even organizations with users unwilling or unable to adopt iOS 26 can now protect themselves from a severe mobile OS-cracking tool. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7015711bd72ffc83/69cff44a7535beaa9fb4616c/Apple_progress_bar-JENYA-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 21:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Breaks, Precedent, Patches, DarkSword, for, iOS</media:keywords>
</item>

<item>
<title>China&#45;Linked TA416 Targets European Governments with PlugX and OAuth&#45;Based Phishing</title>
<link>https://block385.com/china-linked-ta416-targets-european-governments-with-plugx-and-oauth-based-phishing</link>
<guid>https://block385.com/china-linked-ta416-targets-european-governments-with-plugx-and-oauth-based-phishing</guid>
<description><![CDATA[ A China-aligned threat actor has set its sights on European government and diplomatic organizations since mid-2025, following a two-year period of minimal targeting in the region.
The campaign has been attributed to TA416, a cluster of activity that overlaps with DarkPeony, RedDelta, Red Lich, SmugX, UNC6384, and Vertigo Panda.
&quot;This TA416 activity included multiple ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgi-dKCldJqtZI1CocMVxHNKusU5tcnMKjx7mzG9EfehvGacnTy4tsTfZLMfhyphenhyphenC5W210OxrxijBNAP8UumXAZH15ZSOM4x8xb9VTIHxN1HCouzROU0pn7sCJki9zJOkk9_8SRns73KxO1KvxUY4YgKGbbme6ZcKdbt4cqSHUkG5WQQPgDDTx_OLRbms35Dv/s1600/chinese-hackers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>China-Linked, TA416, Targets, European, Governments, with, PlugX, and, OAuth-Based, Phishing</media:keywords>
</item>

<item>
<title>Microsoft Details Cookie&#45;Controlled PHP Web Shells Persisting via Cron on Linux Servers</title>
<link>https://block385.com/microsoft-details-cookie-controlled-php-web-shells-persisting-via-cron-on-linux-servers</link>
<guid>https://block385.com/microsoft-details-cookie-controlled-php-web-shells-persisting-via-cron-on-linux-servers</guid>
<description><![CDATA[ Threat actors are increasingly using HTTP cookies as a control channel for PHP-based web shells on Linux servers and to achieve remote code execution, according to findings from the Microsoft Defender Security Research Team.
&quot;Instead of exposing command execution through URL parameters or request bodies, these web shells rely on threat actor-supplied cookie values to gate execution, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_2zEf8l08MTElI1sGlJPVVWtscud2RAXdsivOvcby3pO4NUWMBioT3FNaFL7Bw0GeEqnX_WqY10FVqXhVNBTOrl0UMPoyun7AvshwpvfJIdfdJ0yJ1V2mz7ZHQDE9motXuuW6urvTJYu0kLGvpZf10Qx1hNeobD4YV25tJY9nvNoW9Sqd8nSsWK7NWQP0/s1600/php-linux.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 20:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Details, Cookie-Controlled, PHP, Web, Shells, Persisting, via, Cron, Linux, Servers</media:keywords>
</item>

<item>
<title>Windows Security app gets Secure Boot certificate status indicators as 2026 expiration approaches</title>
<link>https://block385.com/windows-security-app-gets-secure-boot-certificate-status-indicators-as-2026-expiration-approaches</link>
<guid>https://block385.com/windows-security-app-gets-secure-boot-certificate-status-indicators-as-2026-expiration-approaches</guid>
<description><![CDATA[ Microsoft’s Secure Boot certificates, issued in 2011, are approaching expiration in 2026. To help IT administrators track whether devices have received replacement certificates, Microsoft has added new status indicators to the Windows Security app, under Device security &gt; Secure Boot. Updated 2023 certificates are being delivered automatically through Windows Update to consumer devices and some business devices. The new app indicators show whether a given device has received those updates, what its current certificate state … More →
The post Windows Security app gets Secure Boot certificate status indicators as 2026 expiration approaches appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/11132343/windows-1500-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 19:00:31 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Windows, Security, app, gets, Secure, Boot, certificate, status, indicators, 2026, expiration, approaches</media:keywords>
</item>

<item>
<title>Cisco IMC auth bypass vulnerability allows attackers to alter user passwords (CVE&#45;2026&#45;20093)</title>
<link>https://block385.com/cisco-imc-auth-bypass-vulnerability-allows-attackers-to-alter-user-passwords-cve-2026-20093</link>
<guid>https://block385.com/cisco-imc-auth-bypass-vulnerability-allows-attackers-to-alter-user-passwords-cve-2026-20093</guid>
<description><![CDATA[ Cisco has fixed ten vulnerabilities affecting its Integrated Management Controller (IMC), the most critical of which (CVE-2026-20093) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system as Admin. Cisco ICM riddled with vulnerabilities Cisco Integrated Management Controller is a built-in hardware management system used in Cisco servers. It allows administrators to remotely control, monitor, and troubleshoot a server, even if the operating system isn’t running. (That’s because Cisco IMC … More →
The post Cisco IMC auth bypass vulnerability allows attackers to alter user passwords (CVE-2026-20093) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/01/23130953/cisco-1500-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 19:00:15 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cisco, IMC, auth, bypass, vulnerability, allows, attackers, alter, user, passwords, CVE-2026-20093</media:keywords>
</item>

<item>
<title>Blast Radius of TeamPCP Attacks Expands Amid Hacker Infighting</title>
<link>https://block385.com/blast-radius-of-teampcp-attacks-expands-amid-hacker-infighting</link>
<guid>https://block385.com/blast-radius-of-teampcp-attacks-expands-amid-hacker-infighting</guid>
<description><![CDATA[ As organizations disclose breaches tied to TeamPCP&#039;s supply chain attacks, ShinyHunters and Lapsus$ are getting involved, taking credit, and creating a murky situation for enterprises. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt521dd4163ce7b43a/69cfd9e44d3fef6aef031bbc/breaches_hirunlaowisit_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 19:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Blast, Radius, TeamPCP, Attacks, Expands, Amid, Hacker, Infighting</media:keywords>
</item>

<item>
<title>Claude Source Code Leak Highlights Big Supply Chain Missteps</title>
<link>https://block385.com/claude-source-code-leak-highlights-big-supply-chain-missteps</link>
<guid>https://block385.com/claude-source-code-leak-highlights-big-supply-chain-missteps</guid>
<description><![CDATA[ Or, why the software supply chain should be treated as critical infrastructure with guardrails built in at every layer. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltdceec94ca4ee78d7/69cede0b5553ec3f3ca007ad/AI-powered-software-supply-chain-Summit_Art_Creations-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 19:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Source, Code, Leak, Highlights, Big, Supply, Chain, Missteps</media:keywords>
</item>

<item>
<title>Picking Up &amp;apos;Skull Vibrations&amp;apos;? Could Be XR Headset Authentication</title>
<link>https://block385.com/picking-up-skull-vibrations-could-be-xr-headset-authentication</link>
<guid>https://block385.com/picking-up-skull-vibrations-could-be-xr-headset-authentication</guid>
<description><![CDATA[ &quot;Skull vibration harmonics generated by vital signs&quot; can be used to sign in to VR, AR, and MR headsets, according to emerging research. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt673e9c40508ebe1e/69cecafa5c46194cc718a313/Skull_painting_Peter_Horree_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 17:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Picking, Skull, Vibrations, Could, Headset, Authentication</media:keywords>
</item>

<item>
<title>Source Code Leaks Highlight Lack of Supply Chain Oversight</title>
<link>https://block385.com/source-code-leaks-highlight-lack-of-supply-chain-oversight</link>
<guid>https://block385.com/source-code-leaks-highlight-lack-of-supply-chain-oversight</guid>
<description><![CDATA[ Or, why the software supply chain should be treated as critical infrastructure with guardrails built in at every layer. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltdceec94ca4ee78d7/69cede0b5553ec3f3ca007ad/AI-powered-software-supply-chain-Summit_Art_Creations-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 17:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Source, Code, Leaks, Highlight, Lack, Supply, Chain, Oversight</media:keywords>
</item>

<item>
<title>Chainguard Unveils Factory 2.0 to Automate Hardening the Software Supply Chain</title>
<link>https://block385.com/chainguard-unveils-factory-20-to-automate-hardening-the-software-supply-chain</link>
<guid>https://block385.com/chainguard-unveils-factory-20-to-automate-hardening-the-software-supply-chain</guid>
<description><![CDATA[ The rebuilt Chainguard platform adds deeper security designed to continuously reconcile open-source artifacts across containers, libraries, Actions and skills. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc232543381a9006f/693207a41ab840449642b8fb/factory-robots-assemble-batteries-IM_Imagery-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 17:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Chainguard, Unveils, Factory, 2.0, Automate, Hardening, the, Software, Supply, Chain</media:keywords>
</item>

<item>
<title>CrowdStrike Next&#45;Gen SIEM Can Now Ingest Microsoft Defender Telemetry</title>
<link>https://block385.com/crowdstrike-next-gen-siem-can-now-ingest-microsoft-defender-telemetry</link>
<guid>https://block385.com/crowdstrike-next-gen-siem-can-now-ingest-microsoft-defender-telemetry</guid>
<description><![CDATA[ Once CrowdStrike’s nemesis, Microsoft is now a collaborator. A shared interest in Formula 1 helped thaw the years-long fierce rivalry. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0bdf16aa665784b3/689f7412dc6d053d5644680d/edr_MauriceNorbert_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CrowdStrike, Next-Gen, SIEM, Can, Now, Ingest, Microsoft, Defender, Telemetry</media:keywords>
</item>

<item>
<title>UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack</title>
<link>https://block385.com/unc1069-social-engineering-of-axios-maintainer-led-to-npm-supply-chain-attack</link>
<guid>https://block385.com/unc1069-social-engineering-of-axios-maintainer-led-to-npm-supply-chain-attack</guid>
<description><![CDATA[ The maintainer of the Axios npm package has confirmed that the supply chain compromise was the result of a highly-targeted social engineering campaign orchestrated by North Korean threat actors tracked as UNC1069.
Maintainer Jason Saayman said the attackers tailored their social engineering efforts &quot;specifically to me&quot; by first approaching him under the guise of the founder of a ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzgZRu55MSbdanW8-1PyCciQIyWUcB9Dv4WhQQEELGJqahN5q7MyrDJKQ77e-9-fNetZJZiaJKERrgMWTGcQ-4TKhzhWE6veQp5w3wxhUnjq3NPMifbpdn1VLYpx5nngu4GsgPknNfAV8CNTGq_L_PBri4s3xz4hp8yt7OPin9Q-Kq_xcBNqzbgHx5SkrU/s1600/supplychain.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>UNC1069, Social, Engineering, Axios, Maintainer, Led, npm, Supply, Chain, Attack</media:keywords>
</item>

<item>
<title>Why Third&#45;Party Risk Is the Biggest Gap in Your Clients&amp;apos; Security Posture</title>
<link>https://block385.com/why-third-party-risk-is-the-biggest-gap-in-your-clients-security-posture</link>
<guid>https://block385.com/why-third-party-risk-is-the-biggest-gap-in-your-clients-security-posture</guid>
<description><![CDATA[ The next major breach hitting your clients probably won&#039;t come from inside their walls. It&#039;ll come through a vendor they trust, a SaaS tool their finance team signed up for, or a subcontractor nobody in IT knows about. That&#039;s the new attack surface, and most organizations are underprepared for it.
Cynomi&#039;s new guide, Securing the Modern Perimeter: The Rise of Third-Party ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVOZWf-jO2_HykRTz3eVXj5HliZeT5oLJzIB9b4aX4fX_0nV9zUgCHL_WU9qxq7Uipi77Sf7I0DfRNGpmI0DwAZTusda6siewFmPGUnLjPIrsUDwagoy7PyaUlpR6anmdXp3OoTMB5aYEBlwKUt_zqRF0rxNQLub2TFqfqitAQdKXMA0ZPBwEV2hzJr1I/s1600/cynomi.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, Third-Party, Risk, the, Biggest, Gap, Your, Clients, Security, Posture</media:keywords>
</item>

<item>
<title>Claude Code source leak exploited to spread malware</title>
<link>https://block385.com/claude-code-source-leak-exploited-to-spread-malware</link>
<guid>https://block385.com/claude-code-source-leak-exploited-to-spread-malware</guid>
<description><![CDATA[ A source code leak involving Anthropic’s Claude Code tool quickly escalated into a cybersecurity threat, as attackers seized on the exposed files to lure developers into downloading malware disguised as “unlocked” versions of the software. Leaked Claude Code source code used as lure On March 31, 2026, Anthropic accidentally exposed online the source code of its Claude Code tool. The leak was detected by security researcher Chaofan Shou, whose post on X drew widespread attention. … More →
The post Claude Code source leak exploited to spread malware appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11083747/malware-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 13:00:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Code, source, leak, exploited, spread, malware</media:keywords>
</item>

<item>
<title>New SparkCat Variant in iOS, Android Apps Steals Crypto Wallet Recovery Phrase Images</title>
<link>https://block385.com/new-sparkcat-variant-in-ios-android-apps-steals-crypto-wallet-recovery-phrase-images</link>
<guid>https://block385.com/new-sparkcat-variant-in-ios-android-apps-steals-crypto-wallet-recovery-phrase-images</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a new version of the SparkCat malware on the Apple App Store and Google Play Store, more than a year after the trojan was discovered targeting both the mobile operating systems.
The malware has been found to conceal itself within seemingly benign apps, such as enterprise messengers and food delivery services, while ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2s09d3X9qYABLHP5v1u9iyjRN5p28u6xvnL0qkKR1-s1CsqtIDAWeQCFKQ9S4Mde1ueUmzcjNA9SAzWN-lDWwbmTmmlwbbLkyKx-EJc2-bjhKlEsChsp3iZ6watrZ4I8LJdL_p0vatW4NrXntcs6_xdReGEQJMUCgfAFo-ZfCy_jDsxEZgPMx1T9e1e0L/s1600/mobile-wallet-seed.jpg" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, SparkCat, Variant, iOS, Android, Apps, Steals, Crypto, Wallet, Recovery, Phrase, Images</media:keywords>
</item>

<item>
<title>Drift Loses $285 Million in Durable Nonce Social Engineering Attack Linked to DPRK</title>
<link>https://block385.com/drift-loses-285-million-in-durable-nonce-social-engineering-attack-linked-to-dprk</link>
<guid>https://block385.com/drift-loses-285-million-in-durable-nonce-social-engineering-attack-linked-to-dprk</guid>
<description><![CDATA[ Solana-based decentralized exchange Drift has confirmed that attackers drained about $285 million from the platform during a security incident that took place on April 1, 2026.
&quot;Earlier today, a malicious actor gained unauthorized access to Drift Protocol through a novel attack involving durable nonces, resulting in a rapid takeover of Drift’s Security Council administrative powers,&quot; the&amp; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUiYsLIirEMJ6RmQKL7LnI8V0CmqL2qggZITpbnhuDXgXPAsXZ7cGv1KBjp1VBfeBVjUHypgPIC1DENjD735MO9gZQVPZO_xI424cuWoRowXBNflIs3rteCoCpdMPeTo5y2-I67CKALepuLYF-OfTplaTVBtextDcgCTW81sGmhT710Uu-37ouNh6MJjfk/s1600/drift-1.png" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Drift, Loses, 285, Million, Durable, Nonce, Social, Engineering, Attack, Linked, DPRK</media:keywords>
</item>

<item>
<title>Which messaging app takes the most limited approach to permissions on Android?</title>
<link>https://block385.com/which-messaging-app-takes-the-most-limited-approach-to-permissions-on-android</link>
<guid>https://block385.com/which-messaging-app-takes-the-most-limited-approach-to-permissions-on-android</guid>
<description><![CDATA[ Messaging apps handle sensitive conversations, contacts, and media, and their behavior on a device varies in ways that affect privacy. An analysis of Android versions of Messenger, Signal, and Telegram shows that differences in permissions, background activity, and system exposure shape how much data each app can access and how often it communicates. Permissions define access to device and user data The three apps take different approaches. Telegram has the lowest total number of permissions … More →
The post Which messaging app takes the most limited approach to permissions on Android? appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/05111353/mobile-apps-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 11:00:59 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Which, messaging, app, takes, the, most, limited, approach, permissions, Android</media:keywords>
</item>

<item>
<title>Microsoft releases open&#45;source toolkit to govern autonomous AI agents</title>
<link>https://block385.com/microsoft-releases-open-source-toolkit-to-govern-autonomous-ai-agents</link>
<guid>https://block385.com/microsoft-releases-open-source-toolkit-to-govern-autonomous-ai-agents</guid>
<description><![CDATA[ AI agents can book travel, execute financial transactions, write and run code, and manage infrastructure without human intervention at each step. Frameworks like LangChain, AutoGen, CrewAI, and Azure AI Foundry Agent Service have made this kind of autonomy straightforward to deploy. The governance infrastructure to match that autonomy has lagged behind. Microsoft released the Agent Governance Toolkit to address that gap. What the toolkit contains The Agent Governance Toolkit is a seven-package system available in … More →
The post Microsoft releases open-source toolkit to govern autonomous AI agents appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/03060530/agent-governance-toolkit-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 11:00:43 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, releases, open-source, toolkit, govern, autonomous, agents</media:keywords>
</item>

<item>
<title>Trivy supply chain attack enabled European Commission cloud breach</title>
<link>https://block385.com/trivy-supply-chain-attack-enabled-european-commission-cloud-breach</link>
<guid>https://block385.com/trivy-supply-chain-attack-enabled-european-commission-cloud-breach</guid>
<description><![CDATA[ CERT-EU confirmed that ShinyHunters are behind the recent breach of the cloud infrastructure underpinning websites of the European Commission, and that they stole and subsequently leaked approximately 340 GB of data. “Analysis of the published dataset has so far confirmed the presence of personal data, including lists of names, last names, usernames, and email addresses, predominantly from the European Commission’s websites but potentially pertaining to users across multiple Union entities,” European Union’s CERT said. “The … More →
The post Trivy supply chain attack enabled European Commission cloud breach appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/03083348/eu-stars-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 11:00:29 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Trivy, supply, chain, attack, enabled, European, Commission, cloud, breach</media:keywords>
</item>

<item>
<title>APERION releases SmartFlow SDK for secure, on&#45;prem AI governance without cloud reliance</title>
<link>https://block385.com/aperion-releases-smartflow-sdk-for-secure-on-prem-ai-governance-without-cloud-reliance</link>
<guid>https://block385.com/aperion-releases-smartflow-sdk-for-secure-on-prem-ai-governance-without-cloud-reliance</guid>
<description><![CDATA[ APERION launched SmartFlow SDK, providing a secure, on-premises path for enterprises migrating away from compromised cloud-based AI gateways. The launch coincides with a 200% increase in web traffic since the March 24 LiteLLM supply chain attack that compromised an estimated 36% of all cloud environments. LiteLLM was the victim of a supply chain attack in which the threat actor group TeamPCP compromised the most widely used open-source LLM proxy in the Python ecosystem through a … More →
The post APERION releases SmartFlow SDK for secure, on-prem AI governance without cloud reliance appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 11:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>APERION, releases, SmartFlow, SDK, for, secure, on-prem, governance, without, cloud, reliance</media:keywords>
</item>

<item>
<title>New infosec products of the month: March 2026</title>
<link>https://block385.com/new-infosec-products-of-the-month-march-2026</link>
<guid>https://block385.com/new-infosec-products-of-the-month-march-2026</guid>
<description><![CDATA[ Here’s a look at the most interesting products from the past month, featuring releases from Beazley, Bonfy.AI, Mend.io, Mimecast, NinjaOne, Novee, Intel 471, Singulr AI, Stellar Cyber, Teleport, and Vicarius. Beazley Exposure Management platform identifies external exposures and prioritizes cyber risk Beazley Security has announced its Exposure Management product, which delivers continuous, automated discovery and intelligence-driven exposure notifications to help security teams accelerate risk mitigation in an era where AI-assisted attackers have compressed the time … More →
The post New infosec products of the month: March 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/28092100/infosec-month-1200.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 07:00:44 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, infosec, products, the, month:, March, 2026</media:keywords>
</item>

<item>
<title>Click, wait, repeat: Digital trust erodes one login at a time</title>
<link>https://block385.com/click-wait-repeat-digital-trust-erodes-one-login-at-a-time</link>
<guid>https://block385.com/click-wait-repeat-digital-trust-erodes-one-login-at-a-time</guid>
<description><![CDATA[ Sign-up forms that drag on, login steps that repeat, and access requests that take longer than expected have become a normal part of using digital services. These moments rarely stand out on their own, and over time they influence how people judge the systems they rely on. The 2026 Thales Digital Trust Index reflects that environment, where trust is built or lost through everyday interactions. Most consumers have encountered problems when using websites or apps, … More →
The post Click, wait, repeat: Digital trust erodes one login at a time appeared first on Help Net Security. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 07:00:14 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Click, wait, repeat:, Digital, trust, erodes, one, login, time</media:keywords>
</item>

<item>
<title>AWS, Wasabi, Cloudflare, and Backblaze go head&#45;to&#45;head in new cloud storage test</title>
<link>https://block385.com/aws-wasabi-cloudflare-and-backblaze-go-head-to-head-in-new-cloud-storage-test</link>
<guid>https://block385.com/aws-wasabi-cloudflare-and-backblaze-go-head-to-head-in-new-cloud-storage-test</guid>
<description><![CDATA[ Cloud storage buyers rarely get vendor-provided performance data that includes the vendor’s own weak spots. Backblaze’s Q1 2026 Performance Stats report, attempts to do exactly that, sharing benchmark results for Backblaze B2, AWS S3, Cloudflare R2, and Wasabi Object Storage across US-East and EU-Central regions, and including results where Backblaze’s own rate limits affected the numbers. The report is the second in a quarterly series. Backblaze publishes its full methodology and states that tests run … More →
The post AWS, Wasabi, Cloudflare, and Backblaze go head-to-head in new cloud storage test appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/08/15142441/cloud-data-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Fri, 03 Apr 2026 03:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AWS, Wasabi, Cloudflare, and, Backblaze, head-to-head, new, cloud, storage, test</media:keywords>
</item>

<item>
<title>Not Toying Around: Hasbro Attack May Take &amp;apos;Weeks&amp;apos; to Remediate</title>
<link>https://block385.com/not-toying-around-hasbro-attack-may-take-weeks-to-remediate</link>
<guid>https://block385.com/not-toying-around-hasbro-attack-may-take-weeks-to-remediate</guid>
<description><![CDATA[ The company&#039;s 8-K filing notes &quot;unauthorized access&quot; and that it&#039;s activated business continuity plans and taken some systems offline. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltb4eb373845e02c10/69cec4d10268bec52dd83c55/Operation-Kerry_Taylor-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Not, Toying, Around:, Hasbro, Attack, May, Take, Weeks, Remediate</media:keywords>
</item>

<item>
<title>Security Bosses Are All&#45;In on AI. Here&amp;apos;s Why</title>
<link>https://block385.com/security-bosses-are-all-in-on-ai-heres-why</link>
<guid>https://block385.com/security-bosses-are-all-in-on-ai-heres-why</guid>
<description><![CDATA[ CISOs are bullish on AI and have big plans to roll out future tools. We talk to Reddit CISO Frederick Lee and leading analyst Dave Gruber about how AI is working out in the real world, as well as its future promise. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt0469f94bd17817ff/6642699959fdc64aa5f9c5fa/dark-reading-confidential-logo-sq.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 23:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Security, Bosses, Are, All-In, AI., Heres, Why</media:keywords>
</item>

<item>
<title>Hackers Exploit CVE&#45;2025&#45;55182 to Breach 766 Next.js Hosts, Steal Credentials</title>
<link>https://block385.com/hackers-exploit-cve-2025-55182-to-breach-766-nextjs-hosts-steal-credentials</link>
<guid>https://block385.com/hackers-exploit-cve-2025-55182-to-breach-766-nextjs-hosts-steal-credentials</guid>
<description><![CDATA[ A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services (AWS) secrets, shell command history, Stripe API keys, and GitHub tokens at scale.
Cisco Talos has attributed the operation to a threat cluster it tracks as ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8T48UROZtSjRXtkxVcNT2VmXbB1texWQPAqLbm06uwmJ8VsYFb_HeXOnZx9uz9QL-LB3aWdwcLm9TbuRler7w7jjXJlL_tQweQualaW4XEVav7Ysulqx_CJyc9a0P1dO1a69W_eQhroxV1LA_p5VB9T38Xubc3zXHgwd-4sAAc2whuv4ElnC5WtFSn7SH/s1600/nextjs.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 22:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hackers, Exploit, CVE-2025-55182, Breach, 766, Next.js, Hosts, Steal, Credentials</media:keywords>
</item>

<item>
<title>New Red Hat subscription simplifies long&#45;term enterprise Linux support</title>
<link>https://block385.com/new-red-hat-subscription-simplifies-long-term-enterprise-linux-support</link>
<guid>https://block385.com/new-red-hat-subscription-simplifies-long-term-enterprise-linux-support</guid>
<description><![CDATA[ Red Hat has announced Red Hat Enterprise Linux Extended Life Cycle Premium, a new subscription that provides a predictable 14-year life cycle for major Red Hat Enterprise Linux releases. This stand-alone subscription consolidates extended support, simplifying the management of multiple support streams. It helps organizations maintain their most sensitive, change-averse workloads on a single, hardened foundation for more than a decade. As enterprises deploy full-scale production, the underlying infrastructure relies on consistency. Frequent minor release … More →
The post New Red Hat subscription simplifies long-term enterprise Linux support appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 19:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Red, Hat, subscription, simplifies, long-term, enterprise, Linux, support</media:keywords>
</item>

<item>
<title>OpenSSH 10.3 patches five security bugs and drops legacy rekeying support</title>
<link>https://block385.com/openssh-103-patches-five-security-bugs-and-drops-legacy-rekeying-support</link>
<guid>https://block385.com/openssh-103-patches-five-security-bugs-and-drops-legacy-rekeying-support</guid>
<description><![CDATA[ OpenSSH 10.3 shipped carrying five security fixes alongside feature additions and a set of behavior changes that will break compatibility with older SSH implementations that do not support rekeying. Rekeying compatibility removed SSH clients and servers that lack rekeying support will fail when they attempt to interoperate with OpenSSH going forward. The project removed the bug-compatibility code that previously allowed such implementations to keep working. Deployments running non-standard or legacy SSH software should verify rekeying … More →
The post OpenSSH 10.3 patches five security bugs and drops legacy rekeying support appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2019/06/09094033/openssh.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 19:00:23 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenSSH, 10.3, patches, five, security, bugs, and, drops, legacy, rekeying, support</media:keywords>
</item>

<item>
<title>Software supply chain hacks trigger wave of intrusions, data theft</title>
<link>https://block385.com/software-supply-chain-hacks-trigger-wave-of-intrusions-data-theft</link>
<guid>https://block385.com/software-supply-chain-hacks-trigger-wave-of-intrusions-data-theft</guid>
<description><![CDATA[ After linking the Axios npm supply chain attack to North Korean hackers, Google researchers warned that “hundreds of thousands of stolen secrets could potentially be circulating” as a result of this and the Trivy, KICS, LiteLLM, and Telnyx supply chain attacks (linked to TeamPCP). “This could enable further software supply chain attacks, software as a service (SaaS) environment compromises (leading to downstream customer compromises), ransomware and extortion events, and cryptocurrency theft over the near term,” … More →
The post Software supply chain hacks trigger wave of intrusions, data theft appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/27170627/pressure-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 19:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Software, supply, chain, hacks, trigger, wave, intrusions, data, theft</media:keywords>
</item>

<item>
<title>RSAC 2026: AI Dominates, But Community Remains Key to Security</title>
<link>https://block385.com/rsac-2026-ai-dominates-but-community-remains-key-to-security</link>
<guid>https://block385.com/rsac-2026-ai-dominates-but-community-remains-key-to-security</guid>
<description><![CDATA[ As AI took center stage at this year&#039;s conference, experts debated automation, oversight and the evolving role of human intelligence in cybersecurity — despite the US government&#039;s notable absence. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7c4a998794182807/69cdf0ad19dc583a4e26ec0f/conference1800_sebastien_bonaime_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 19:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>RSAC, 2026:, Dominates, But, Community, Remains, Key, Security</media:keywords>
</item>

<item>
<title>Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise</title>
<link>https://block385.com/cisco-patches-98-cvss-imc-and-ssm-flaws-allowing-remote-system-compromise</link>
<guid>https://block385.com/cisco-patches-98-cvss-imc-and-ssm-flaws-allowing-remote-system-compromise</guid>
<description><![CDATA[ Cisco has released updates to address a critical security flaw in the Integrated Management Controller (IMC) that, if successfully exploited, could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system with elevated privileges.
The vulnerability, tracked as CVE-2026-20093, carries a CVSS score of 9.8 out of a maximum of 10.0.
&quot;This ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjH6wuST9R8voZTpCC-v5LSwd4O7vlbuRDhXMzcSw9iu0k2JvFOao-3Jr2o9iCs0jqX3pIqHvcYo_n-5Ad80WXeQXKV_DTgJUN0A6nl9f73BA1U0wRoZBqgySfDR6Uk7KD8jXzw2BFLGvusf-96qsINw9jT4PnglZohYM2VhSsdHcpw-cl6vwAekfE-KD_H/s1600/cisco-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 18:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cisco, Patches, 9.8, CVSS, IMC, and, SSM, Flaws, Allowing, Remote, System, Compromise</media:keywords>
</item>

<item>
<title>Geopolitics, AI, and Cybersecurity: Insights From RSAC 2026</title>
<link>https://block385.com/geopolitics-ai-and-cybersecurity-insights-from-rsac-2026</link>
<guid>https://block385.com/geopolitics-ai-and-cybersecurity-insights-from-rsac-2026</guid>
<description><![CDATA[ AI-driven threats, global leadership shifts, and the future of cybersecurity in a rapidly evolving landscape were among the discussions at RSAC 2026 Conference. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt52c682d1b06fcea2/69cc3ebb4642d5670041150e/quantum_computing1800_jvphoto_alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 17:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Geopolitics, AI, and, Cybersecurity:, Insights, From, RSAC, 2026</media:keywords>
</item>

<item>
<title>Bank Trojan &amp;apos;Casbaneiro&amp;apos; Worms Through Latin America</title>
<link>https://block385.com/bank-trojan-casbaneiro-worms-through-latin-america</link>
<guid>https://block385.com/bank-trojan-casbaneiro-worms-through-latin-america</guid>
<description><![CDATA[ Augmented Marauder&#039;s multipronged banking-Trojan cyber campaigns are targeting Spanish speakers, evading detection, and replicating rapidly. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt16cb4a90b4357a88/69cd468c610d0ab0477bd007/Worm_carnival_ride-Hugo_Oliveira-Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 17:00:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Bank, Trojan, Casbaneiro, Worms, Through, Latin, America</media:keywords>
</item>

<item>
<title>ThreatsDay Bulletin: Pre&#45;Auth Chains, Android Rootkits, CloudTrail Evasion &amp;amp; 10 More Stories</title>
<link>https://block385.com/threatsday-bulletin-pre-auth-chains-android-rootkits-cloudtrail-evasion-10-more-stories</link>
<guid>https://block385.com/threatsday-bulletin-pre-auth-chains-android-rootkits-cloudtrail-evasion-10-more-stories</guid>
<description><![CDATA[ The latest ThreatsDay Bulletin is basically a cheat sheet for everything breaking on the internet right now. No corporate fluff or boring lectures here, just a quick and honest look at the messy reality of keeping systems safe this week.
Things are moving fast. The list includes researchers chaining small bugs together to create massive backdoors, old software flaws ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEht9hzOUmn8npVxC_AyWUe1DLsv1VkWHox2PmDxZnVuG_XnQt7R5l7CZHlYu9m9BcwAib4L0j0x877sDuCF2shmSH3ef0Me-m0sbKDtu-ZEw5RLqLGNsjGJ0o-b_CuKtFg86fMFb-GKVBud7S8PfpsoL4HCqEZypO1NcWfx6ljXcUhC5O4GIjRbhRcG-fIi/s1600/threatsday.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>ThreatsDay, Bulletin:, Pre-Auth, Chains, Android, Rootkits, CloudTrail, Evasion, More, Stories</media:keywords>
</item>

<item>
<title>Tracking drones with the 5G tower down the street</title>
<link>https://block385.com/tracking-drones-with-the-5g-tower-down-the-street</link>
<guid>https://block385.com/tracking-drones-with-the-5g-tower-down-the-street</guid>
<description><![CDATA[ Drone detection in cities is expensive. Dedicated radar installations are cost-prohibitive at scale, cameras have limited range and stop working well at night, and LiDAR systems have the same cost problem as radar. A group of researchers at the University of Science and Technology of China spent the past year working on a different approach: using 5G-Advanced base stations that are already in the ground to do the job instead. The 5G-A base station Active … More →
The post Tracking drones with the 5G tower down the street appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/21184245/drone-tech.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 15:01:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Tracking, drones, with, the, tower, down, the, street</media:keywords>
</item>

<item>
<title>Trust, friction, and ROI: A CISO’s take on making security work for the business</title>
<link>https://block385.com/trust-friction-and-roi-a-cisos-take-on-making-security-work-for-the-business</link>
<guid>https://block385.com/trust-friction-and-roi-a-cisos-take-on-making-security-work-for-the-business</guid>
<description><![CDATA[ In this Help Net Security interview, John O’Rourke, CISO at PPG, talks about what it means for security to drive business value. He explains how mature security programs reduce friction in sales cycles and M&amp;A processes, and how trust is built over time. O’Rourke also addresses how buyer sophistication has raised the bar for suppliers, why less-regulated industries lag behind their more-regulated counterparts, and which companies will benefit from foundational security investments. The interview covers … More →
The post Trust, friction, and ROI: A CISO’s take on making security work for the business appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/01171141/john_orourke-2-ppg.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 15:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Trust, friction, and, ROI:, CISO’s, take, making, security, work, for, the, business</media:keywords>
</item>

<item>
<title>TrueConf zero&#45;day vulnerability exploited to target government networks</title>
<link>https://block385.com/trueconf-zero-day-vulnerability-exploited-to-target-government-networks</link>
<guid>https://block385.com/trueconf-zero-day-vulnerability-exploited-to-target-government-networks</guid>
<description><![CDATA[ Suspected China-nexus attackers have leveraged a zero-day vulnerability (CVE-2026-3502) in the TrueConf client application to distribute malware within government networks in Southeast Asia, Check Point researchers discovered. Malicious client update attack chain (Source: Check Point) Trusted update mechanism turned into attack vector TrueConf is a videoconferencing platform designed to run on private local networks (LANs) without internet access, which makes it attractive to government departments, defense institutions, and critical infrastructure operators. Consequently, the solution is … More →
The post TrueConf zero-day vulnerability exploited to target government networks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/25153046/malware-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 15:00:18 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TrueConf, zero-day, vulnerability, exploited, target, government, networks</media:keywords>
</item>

<item>
<title>DarkSword exploit forces Apple to loosen its patching policy</title>
<link>https://block385.com/darksword-exploit-forces-apple-to-loosen-its-patching-policy</link>
<guid>https://block385.com/darksword-exploit-forces-apple-to-loosen-its-patching-policy</guid>
<description><![CDATA[ Apple has extended security updates to a wider range of devices still running iOS 18, aiming to protect users from the DarkSword exploit kit. This is not the first time Apple has backported fixes for older devices based on vulnerability severity. Allowing iOS 18 users to receive patches without upgrading to iOS 26, however, signals a shift in its long-standing security approach following the discovery of the DarkSword and Coruna exploit kits. When iOS 26 … More →
The post DarkSword exploit forces Apple to loosen its patching policy appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/20114617/apple1.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 15:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DarkSword, exploit, forces, Apple, loosen, its, patching, policy</media:keywords>
</item>

<item>
<title>Ransomware Will Hit Hospitals. Rehearsals Are Key to Defense</title>
<link>https://block385.com/ransomware-will-hit-hospitals-rehearsals-are-key-to-defense</link>
<guid>https://block385.com/ransomware-will-hit-hospitals-rehearsals-are-key-to-defense</guid>
<description><![CDATA[ A chief medical information officer provided a peek into what hospitals face when they inevitably suffer a ransomware attack—whether it leads to short or long-term outages. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt9b5b97c6c5a88d9c/655f53bc09902b040ae06301/hospital_hack_Oleckii_Mach_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 15:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Ransomware, Will, Hit, Hospitals., Rehearsals, Are, Key, Defense</media:keywords>
</item>

<item>
<title>Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners</title>
<link>https://block385.com/researchers-uncover-mining-operation-using-iso-lures-to-spread-rats-and-crypto-miners</link>
<guid>https://block385.com/researchers-uncover-mining-operation-using-iso-lures-to-spread-rats-and-crypto-miners</guid>
<description><![CDATA[ A financially motivated operation codenamed REF1695 has been observed leveraging fake installers to deploy remote access trojans (RATs) and cryptocurrency miners since November 2023.
&quot;Beyond cryptomining, the threat actor monetizes infections through CPA (Cost Per Action) fraud, directing victims to content locker pages under the guise of software registration,&quot; Elastic ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpKoZinOy6MS9s0nTi1TV12H46KUmgkxu0kGinPE7yyq7Vpo9lmmcz30e5ve0yCk2T0ETCedeV6aXs0iEjI1rOykcXwBPa2a11yb75bjgjad7WKkKgsUAv0lO1tuZ8vVnYZtuiUHKqwM6Z6bxGtheJIhuWW5W6lKjo0FaHZf7ewPO_SFuKAjPKMh_sqDB2/s1600/monero.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Researchers, Uncover, Mining, Operation, Using, ISO, Lures, Spread, RATs, and, Crypto, Miners</media:keywords>
</item>

<item>
<title>The State of Trusted Open Source Report</title>
<link>https://block385.com/the-state-of-trusted-open-source-report</link>
<guid>https://block385.com/the-state-of-trusted-open-source-report</guid>
<description><![CDATA[ In December 2025, we shared the first-ever The State of Trusted Open Source report, featuring insights from our product data and customer base on open source consumption across our catalog of container image projects, versions, images, language libraries, and builds. These insights shed light on what teams pull, deploy, and maintain day to day, alongside the vulnerabilities and ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5yI578d17vaAxuCMW2SLrz3ibI4ibSfdDCfum-B3VZ0Ukyd79Eue2VR8ofUCBpISSXsL8biYdRFyuMm78T6PTU7U1w_6jJK3qV7ohPRSt3NGDTtAkseitLCaEZVHqcVIhFZABPlyAP8KPV-JMlnlq42Flgl7lB2Rs5hkIQYVYtc0Z15Yd0WKaYSu7CLM/s1600/devsecops.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 14:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, State, Trusted, Open, Source, Report</media:keywords>
</item>

<item>
<title>WhatsApp Alerts 200 Users After Fake iOS App Installed Spyware; Italian Firm Faces Action</title>
<link>https://block385.com/whatsapp-alerts-200-users-after-fake-ios-app-installed-spyware-italian-firm-faces-action</link>
<guid>https://block385.com/whatsapp-alerts-200-users-after-fake-ios-app-installed-spyware-italian-firm-faces-action</guid>
<description><![CDATA[ Meta-owned messaging platform WhatsApp said it alerted about 200 users who were tricked into installing a bogus version of its iOS app that was infected with spyware.
According to reports from Italian newspaper La Repubblica and news agency ANSA, the vast majority of the targets are located in Italy. It&#039;s assessed that the threat actors behind the activity used social engineering ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH1Qe0E88MYHp7xg6ApE5TypZK__02tmUnhvX60svA9npwirnTJbAb-Wl4rvLo3gq3kX1l9JUXDgXZJ0yPGNZlUo8n5DG1-pqONNFQIA2epqNdU7tNGZSJPJCthWLHtnDdO8jWQ5YzwY7TWUn_9SJP5pu0vHX2i3-L0zM5dZscSR4wAUPWAN1fm-3zgOGE/s1600/whatsapp-alert.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 12:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>WhatsApp, Alerts, 200, Users, After, Fake, iOS, App, Installed, Spyware, Italian, Firm, Faces, Action</media:keywords>
</item>

<item>
<title>Apple Expands iOS 18.7.7 Update to More Devices to Block DarkSword Exploit</title>
<link>https://block385.com/apple-expands-ios-1877-update-to-more-devices-to-block-darksword-exploit</link>
<guid>https://block385.com/apple-expands-ios-1877-update-to-more-devices-to-block-darksword-exploit</guid>
<description><![CDATA[ Apple on Wednesday expanded the availability of iOS 18.7.7 and iPadOS 18.7.7 to a broader range of devices to protect users from the risk posed by a recently disclosed exploit kit known as DarkSword.
&quot;We enabled the availability of iOS 18.7.7 for more devices on April 1, 2026, so users with Automatic Updates turned on can automatically receive important security ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOPIq2XjzxLFTE4iwZWuKsLifOBVn0sVZv2vDEl0D3eXsyiW8ePJH7ukb29zq7gb7-7fJy8WjCRC5e-sYoMLXT4ZE-12llaj0H76qjygPmEl7cuGiC4jrLaMdDX5M55YsuYhdtbn8k5gCosH-JwHU3H-b7ho_5Lvg4pjoKf2Lz39lOumTGuxldWK1YQvfJ/s1600/apple-update.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 10:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, Expands, iOS, 18.7.7, Update, More, Devices, Block, DarkSword, Exploit</media:keywords>
</item>

<item>
<title>Your customer passed authentication. So why are they sending money to a scammer?</title>
<link>https://block385.com/your-customer-passed-authentication-so-why-are-they-sending-money-to-a-scammer</link>
<guid>https://block385.com/your-customer-passed-authentication-so-why-are-they-sending-money-to-a-scammer</guid>
<description><![CDATA[ In this Help Net Security video, Lenny Gusel, Head of Fraud Solutions in North America at Feedzai, explains how customer identity and access management has converged with digital fraud detection, and why treating them as separate systems creates real risk. The core idea is continuous, contextual trust. Where traditional IAM grants access at a single point in time, fraud systems track behavior throughout an entire session, reading device signals, network context, and how a user … More →
The post Your customer passed authentication. So why are they sending money to a scammer? appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/25153040/fraud-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 07:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Your, customer, passed, authentication., why, are, they, sending, money, scammer</media:keywords>
</item>

<item>
<title>Microsoft adds high&#45;volume email sending to Exchange Online</title>
<link>https://block385.com/microsoft-adds-high-volume-email-sending-to-exchange-online</link>
<guid>https://block385.com/microsoft-adds-high-volume-email-sending-to-exchange-online</guid>
<description><![CDATA[ Organizations that rely on Exchange Online for internal communications have long needed a way to send large volumes of automated messages, such as payroll notifications, IT alerts, and security advisories, without running into the sending limits designed for person-to-person email. Microsoft has addressed that with the general availability of High Volume Email (HVE) in Exchange Online. What High Volume Email does HVE is a tenant-native capability built for application-to-person messaging within an organization. It uses … More →
The post Microsoft adds high-volume email sending to Exchange Online appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2023/03/28180944/exchange-hands.jpg" length="49398" type="image/jpeg"/>
<pubDate>Thu, 02 Apr 2026 07:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, adds, high-volume, email, sending, Exchange, Online</media:keywords>
</item>

<item>
<title>LatAm&amp;apos;s Self&#45;Taught Cyber Talent Overlooked Amid Cyberattack Glut</title>
<link>https://block385.com/latams-self-taught-cyber-talent-overlooked-amid-cyberattack-glut</link>
<guid>https://block385.com/latams-self-taught-cyber-talent-overlooked-amid-cyberattack-glut</guid>
<description><![CDATA[ A newly released study exclusively shared with Dark Reading details the unique circumstances that make up Latin America&#039;s labor pool, and why organizations may want to expand their talent search. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt966676b376c5678d/69cd3771d8123450aa850b8c/help_wanted_sign_Thomas_Kyhn_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>LatAms, Self-Taught, Cyber, Talent, Overlooked, Amid, Cyberattack, Glut</media:keywords>
</item>

<item>
<title>Google&amp;apos;s Vertex AI Is Over&#45;Privileged. That&amp;apos;s a Problem</title>
<link>https://block385.com/googles-vertex-ai-is-over-privileged-thats-a-problem</link>
<guid>https://block385.com/googles-vertex-ai-is-over-privileged-thats-a-problem</guid>
<description><![CDATA[ Palo Alto Networks researchers show how attackers could exploit AI agents on Google&#039;s Vertex AI to steal data and break into restricted cloud infrastructure. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4e41a8645f65857e/69cc23a696a9929cb14154a7/agent_Krot_Studio_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 21:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Googles, Vertex, Over-Privileged., Thats, Problem</media:keywords>
</item>

<item>
<title>CERT&#45;UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails</title>
<link>https://block385.com/cert-ua-impersonation-campaign-spread-agewheeze-malware-to-1-million-emails</link>
<guid>https://block385.com/cert-ua-impersonation-campaign-spread-agewheeze-malware-to-1-million-emails</guid>
<description><![CDATA[ The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new phishing campaign in which the cybersecurity agency itself was impersonated to distribute a remote administration tool known as AGEWHEEZE.
As part of the attacks, the threat actors, tracked as UAC-0255, sent emails on March 26 and 27, 2026, posing as CERT-UA to distribute a password-protected ZIP archive ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4SwwNEiRJL3-C8lgR_Sj7XKNGuxhA-uAdcUZBQRRzmC16xbgg4bYkHTBz2VTfXOle8Su66hHz8vDXIOOQ2nFXlNo8wOIVWYGmVW-c9X4Luqx1-qFCiLmOMzUzwW8T5g0S73q4sr66bEAhjy9BrGmiz_pj52J3ug92X8hO5gMR6j9v_Fg8Iqu8lzqczge3/s1600/cert.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 20:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CERT-UA, Impersonation, Campaign, Spread, AGEWHEEZE, Malware, Million, Emails</media:keywords>
</item>

<item>
<title>Cybercriminals take aim at Hasbro, weeks of recovery ahead</title>
<link>https://block385.com/cybercriminals-take-aim-at-hasbro-weeks-of-recovery-ahead</link>
<guid>https://block385.com/cybercriminals-take-aim-at-hasbro-weeks-of-recovery-ahead</guid>
<description><![CDATA[ Hasbro, an American toy maker with more than 5,000 employees, confirmed a cyberattack and proactively took certain systems offline. The intrusion was detected on March 28, and the company promptly activated its incident response protocols. The company said the investigation is ongoing with support from third-party cybersecurity professionals as it works to determine the scope of the incident, while business continuity measures remain in place to support order processing, shipping, and other operations. “The need … More →
The post Cybercriminals take aim at Hasbro, weeks of recovery ahead appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/01172151/hasbro-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 19:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybercriminals, take, aim, Hasbro, weeks, recovery, ahead</media:keywords>
</item>

<item>
<title>Cyberattacks Intensify Pressure on Latin American Governments</title>
<link>https://block385.com/cyberattacks-intensify-pressure-on-latin-american-governments</link>
<guid>https://block385.com/cyberattacks-intensify-pressure-on-latin-american-governments</guid>
<description><![CDATA[ Cyber threats across Latin America are increasingly targeting government systems, from disruptive attacks in Puerto Rico to a surge of probes against Colombia’s health sector. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd944c0c271c1a53c/69cc3b692ac613751c3f5b90/colombia-flag-tech-HTGanzo-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 19:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cyberattacks, Intensify, Pressure, Latin, American, Governments</media:keywords>
</item>

<item>
<title>Venom Stealer MaaS Platform Commoditizes ClickFix Attacks</title>
<link>https://block385.com/venom-stealer-maas-platform-commoditizes-clickfix-attacks</link>
<guid>https://block385.com/venom-stealer-maas-platform-commoditizes-clickfix-attacks</guid>
<description><![CDATA[ A new service on the cybercrime market provides automated capabilities to create persistent information-stealing social engineering attacks. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt9b317f5ffbb0f24e/69ccf217d3f84532a9e458ab/snake_Gerry_Pearce_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 19:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Venom, Stealer, MaaS, Platform, Commoditizes, ClickFix, Attacks</media:keywords>
</item>

<item>
<title>CIS Benchmarks March 2026 Update</title>
<link>https://block385.com/cis-benchmarks-march-2026-update</link>
<guid>https://block385.com/cis-benchmarks-march-2026-update</guid>
<description><![CDATA[ The following CIS Benchmarks and CIS Build Kits have been updated or recently released. The Center for Internet Security has highlighted the major updates below. Each Benchmark and Build Kit includes a changelog that references all changes. Updated CIS Benchmarks overview CIS Microsoft Windows 11 Enterprise Benchmark v5.0.0 CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.0 CIS Apache Cassandra 5.0 Benchmark v1.1.0 CIS Apache Cassandra 4.1 Benchmark v1.2.0 CIS Apache Cassandra 4.0 Benchmark v1.3.0 CIS Microsoft … More →
The post CIS Benchmarks March 2026 Update appeared first on Help Net Security. ]]></description>
<enclosure url="https://www.cisecurity.org/-/jssmedia/project/cisecurity/cisecurity/data/media/img/insights_images/blog_post_img/2026/03/benchmarks-2.png" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 17:00:42 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>CIS, Benchmarks, March, 2026, Update</media:keywords>
</item>

<item>
<title>Exabeam expands ABA to detect AI agent threats across ChatGPT, Copilot, and Gemini</title>
<link>https://block385.com/exabeam-expands-aba-to-detect-ai-agent-threats-across-chatgpt-copilot-and-gemini</link>
<guid>https://block385.com/exabeam-expands-aba-to-detect-ai-agent-threats-across-chatgpt-copilot-and-gemini</guid>
<description><![CDATA[ Exabeam has announced the expansion of Exabeam Agent Behavior Analytics (ABA). Without direct visibility into how employees use AI assistants, what they query, what data they share, how frequently they interact, and from where, organizations cannot establish a baseline for normal AI behavior, investigate potential misuse, or detect emerging agentic insider threats. New support to detect agent behavior in OpenAI ChatGPT and Microsoft Copilot, alongside existing visibility into Google Gemini, transforms these agentic services into … More →
The post Exabeam expands ABA to detect AI agent threats across ChatGPT, Copilot, and Gemini appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 17:00:29 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Exabeam, expands, ABA, detect, agent, threats, across, ChatGPT, Copilot, and, Gemini</media:keywords>
</item>

<item>
<title>North Korean hackers linked to Axios npm supply chain compromise</title>
<link>https://block385.com/north-korean-hackers-linked-to-axios-npm-supply-chain-compromise</link>
<guid>https://block385.com/north-korean-hackers-linked-to-axios-npm-supply-chain-compromise</guid>
<description><![CDATA[ The software supply chain attack that resulted in the compromise of npm packages of Axios, an extremely popular HTTP client library, is believed to be the work of financially-motivated North Korean attackers. Links to UNC1069 On March 31, 2026, unknown attackers managed to publish two backdoored Axios npm packages after gaining access to a maintainer’s npm account. The malicious versions introduced a hidden dependency containing a post-install script, and this script executed automatically during installation … More →
The post North Korean hackers linked to Axios npm supply chain compromise appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/24203710/north_korea-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 17:00:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>North, Korean, hackers, linked, Axios, npm, supply, chain, compromise</media:keywords>
</item>

<item>
<title>Microsoft Warns of WhatsApp&#45;Delivered VBS Malware Hijacking Windows via UAC Bypass</title>
<link>https://block385.com/microsoft-warns-of-whatsapp-delivered-vbs-malware-hijacking-windows-via-uac-bypass</link>
<guid>https://block385.com/microsoft-warns-of-whatsapp-delivered-vbs-malware-hijacking-windows-via-uac-bypass</guid>
<description><![CDATA[ Microsoft is calling attention to a new campaign that has leveraged WhatsApp messages to distribute malicious Visual Basic Script (VBS) files.
The activity, beginning in late February 2026, leverages these scripts to initiate a multi-stage infection chain for establishing persistence and enabling remote access. It&#039;s currently not known what lures the threat actors use to trick users into ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgq1lOqG2e9eetuSt3ne59NkxH-r0lCjnTmodLlbXt29w5AH_utoClwW1RfvpY5rC7vqb1rVBR4ApELx1ROFvmuMpPpk_9R7tshflL0WwPRuD25vu1gzaFuuldwTzAbcb1m7y7TBsTLr863BQhLHdJGwRUmVzuLayR1gTnkmG_XCraID8EuzUzeeVLtgp7p/s1600/whatsapp-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Microsoft, Warns, WhatsApp-Delivered, VBS, Malware, Hijacking, Windows, via, UAC, Bypass</media:keywords>
</item>

<item>
<title>Block the Prompt, Not the Work: The End of &amp;quot;Doctor No&amp;quot;</title>
<link>https://block385.com/block-the-prompt-not-the-work-the-end-of-doctor-no</link>
<guid>https://block385.com/block-the-prompt-not-the-work-the-end-of-doctor-no</guid>
<description><![CDATA[ There is a character that keeps appearing in enterprise security departments, and most CISOs know exactly who that is. It doesn’t build. It doesn’t enable. Its entire function is to say &quot;No.&quot;
No to ChatGPT.
No to DeepSeek.
No to the file-sharing tool the product team swears by.
For years, this looked like security. But in 2026, &quot;Doctor No&quot; is no longer just a management headache &amp; ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvlo2Z4APlfxw_Y81FpX62ySlxihctfAGwiT0WYd1bPrdk5sMFO8w7__xRzVqn9vYqFpE4TSS80iuNQZ9SgcR4Hz8f6WYFhD5OaoRmY-sD20cYox6Tx-_xbhiawEh0cy3YNvv9iD75BIsW5NNA8tafY4inhGtFBer5pan0xjr-vyLZmHyIFHc-LaTNcMZC/s1600/red.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Block, the, Prompt, Not, the, Work:, The, End, Doctor, No</media:keywords>
</item>

<item>
<title>Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures</title>
<link>https://block385.com/casbaneiro-phishing-targets-latin-america-and-europe-using-dynamic-pdf-lures</link>
<guid>https://block385.com/casbaneiro-phishing-targets-latin-america-and-europe-using-dynamic-pdf-lures</guid>
<description><![CDATA[ A multi-pronged phishing campaign is targeting Spanish-speaking users in organizations across Latin America and Europe to deliver Windows banking trojans like Casbaneiro (aka Metamorfo) via another malware called Horabot.
The activity has been attributed to a Brazilian cybercrime threat actor tracked as Augmented Marauder and Water Saci. The e-crime group was first documented by Trend Micro in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpJd0tgZX0EzqjxkNOrJsyGRUV4N21qsJC30j2VYYargUXl2tPz_BidXWWmAG9Wfb5f683WOOle2CElerewagtzAAI8sbcJ9XrCbtgcSRtWF-itSYXH4hbTKvOIrjW9PKSgqi00rOrFCHRWzkWaWmP0qPH0vjrJ2LbbcXgl9aQv3n3tzcT45pdSPMcP54S/s1600/pdf-malware.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Casbaneiro, Phishing, Targets, Latin, America, and, Europe, Using, Dynamic, PDF, Lures</media:keywords>
</item>

<item>
<title>New Chrome Zero&#45;Day CVE&#45;2026&#45;5281 Under Active Exploitation — Patch Released</title>
<link>https://block385.com/new-chrome-zero-day-cve-2026-5281-under-active-exploitation-patch-released</link>
<guid>https://block385.com/new-chrome-zero-day-cve-2026-5281-under-active-exploitation-patch-released</guid>
<description><![CDATA[ Google on Thursday released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild.
The high-severity vulnerability, CVE-2026-5281 (CVSS score: N/A), concerns a use-after-free bug in Dawn, an open-source and cross-platform implementation of the WebGPU standard.
&quot;Use-after-free in Dawn in Google Chrome prior ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyWMOJn1hR_Pua9p7XXWPbTqgrYvXyaNEXlnlLUQ0duD4P-W9fGyvbuprkiN0IMEE5_2vzt5mc603V4l_G5eH5KpKFgmk-lARuEXxcQVIgCNb-NPJghF3wvF9Wf8mF3kEJUY0TA6a3aBDw87MC9RivwM9ZVRfLRpwwNqaP67cU8nvtO8RKGsi5OsFIgSVn/s1600/chrome-exploit.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 16:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Chrome, Zero-Day, CVE-2026-5281, Under, Active, Exploitation, —, Patch, Released</media:keywords>
</item>

<item>
<title>Google fixes Chrome zero&#45;day with in&#45;the&#45;wild exploit (CVE&#45;2026&#45;5281)</title>
<link>https://block385.com/google-fixes-chrome-zero-day-with-in-the-wild-exploit-cve-2026-5281</link>
<guid>https://block385.com/google-fixes-chrome-zero-day-with-in-the-wild-exploit-cve-2026-5281</guid>
<description><![CDATA[ Google has fixed 21 vulnerabilities affecting its popular Chrome browser, among them a zero-day (CVE-2026-5281) with an in-the-wild exploit. About CVE-2026-5281 As per usual, information about the fixed zero-day is limited, and there’s no details about the exploit (or how/if it’s being used by attackers). CVE-2026-5281’s official description says it’s a use-after-free (UAF) vulnerability in Dawn, an open-source and cross-platform implementation of the WebGPU standard that’s used in Chromium and Chromium-based browsers. The vulnerability affects … More →
The post Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/23114819/google_chrome-3-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 15:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, fixes, Chrome, zero-day, with, in-the-wild, exploit, CVE-2026-5281</media:keywords>
</item>

<item>
<title>The Forgotten Endpoint: Security Risks of Dormant Devices</title>
<link>https://block385.com/the-forgotten-endpoint-security-risks-of-dormant-devices</link>
<guid>https://block385.com/the-forgotten-endpoint-security-risks-of-dormant-devices</guid>
<description><![CDATA[ Technology Talk: That forgotten notebook holds plenty of secrets to enterprise access. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt276c235ceefbedff/68a726ba354427802eb7e425/Headset_on_laptop_(1800)_Brian_Jackson_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Forgotten, Endpoint:, Security, Risks, Dormant, Devices</media:keywords>
</item>

<item>
<title>Are We Training AI Too Late?</title>
<link>https://block385.com/are-we-training-ai-too-late</link>
<guid>https://block385.com/are-we-training-ai-too-late</guid>
<description><![CDATA[ Ask the Expert: Cybersecurity teams need to expand their field of view to include new, unique threat sources, rather than relying on past, proven threat actors. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3e1142f17df77fe0/69ccf95619dc583b9126e8a4/teach-AI-besjunior-AdobeStock_290088902CP.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 15:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Are, Training, Too, Late</media:keywords>
</item>

<item>
<title>3 Reasons Attackers Are Using Your Trusted Tools Against You (And Why You Don’t See It Coming)</title>
<link>https://block385.com/3-reasons-attackers-are-using-your-trusted-tools-against-you-and-why-you-dont-see-it-coming</link>
<guid>https://block385.com/3-reasons-attackers-are-using-your-trusted-tools-against-you-and-why-you-dont-see-it-coming</guid>
<description><![CDATA[ For years, cybersecurity has followed a familiar model: block malware, stop the attack. Now, attackers are moving on to what’s next.
Threat actors now use malware less frequently in favor of what’s already inside your environment, including abusing trusted tools, native binaries, and legitimate admin utilities to move laterally, escalate privileges, and persist without raising alarms. Most ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnuThJU5o7fpNxZwlNpyZFxPX9Y7rDp2TF2zUrPTRMhLEcnv7UQfdVgoAJ5gh8-JpgNvnJOG5dbOABLCmemzmYazgTwPTxScbn9vlwlCouNIuKZvmaeE3mcza5ceAfKBfpkbeAUKcOd9eZoBWXgjEvuDAORSPICahRqIz4g0BkwD84YZwB547OHBLsoZs/s1600/main.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 14:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Reasons, Attackers, Are, Using, Your, Trusted, Tools, Against, You, And, Why, You, Don’t, See, Coming</media:keywords>
</item>

<item>
<title>Egnyte expands Content Cloud with AI Governance and built&#45;in Assistant</title>
<link>https://block385.com/egnyte-expands-content-cloud-with-ai-governance-and-built-in-assistant</link>
<guid>https://block385.com/egnyte-expands-content-cloud-with-ai-governance-and-built-in-assistant</guid>
<description><![CDATA[ Egnyte has announced two major additions to the Egnyte Content Cloud: AI Safeguards, which give organizations granular control over how AI interacts with sensitive content, and an AI Assistant that acts as a built-in collaborator across Egnyte workspaces. AI Safeguards As organizations accelerate AI adoption, ungoverned access to sensitive content by AI systems represents a growing and underappreciated risk. Egnyte’s AI Safeguards addresses this directly by embedding AI controls into the same platform that already … More →
The post Egnyte expands Content Cloud with AI Governance and built-in Assistant appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 11:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Egnyte, expands, Content, Cloud, with, Governance, and, built-in, Assistant</media:keywords>
</item>

<item>
<title>Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069</title>
<link>https://block385.com/google-attributes-axios-npm-supply-chain-attack-to-north-korean-group-unc1069</link>
<guid>https://block385.com/google-attributes-axios-npm-supply-chain-attack-to-north-korean-group-unc1069</guid>
<description><![CDATA[ Google has formally attributed the supply chain compromise of the popular Axios npm package to a financially motivated North Korean threat activity cluster tracked as UNC1069.
&quot;We have attributed the attack to a suspected North Korean threat actor we track as UNC1069,&quot; John Hultquist, chief analyst at Google Threat Intelligence Group (GTIG), told The Hacker News in a statement.
&quot;North Korean ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4u0-_Mq5eI-6nWqV9d-E4BTvsdeDTEcK8Bo7pHnANyD6m8b8d5dPcx86sb1P-PjfLce84hgNF8ja8y2tvnYjlmvE4VGzyvAyGqd6TGOxYei3Oz-F_IvVEDxAvamRe4acysr0FqtfWgbLbDhBQxy6ovy2_V47P2d-1qDZig0pcPPnxTCEGfTzKnUXnJEgU/s1600/axios-northkorea.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Attributes, Axios, npm, Supply, Chain, Attack, North, Korean, Group, UNC1069</media:keywords>
</item>

<item>
<title>Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms</title>
<link>https://block385.com/claude-code-source-leaked-via-npm-packaging-error-anthropic-confirms</link>
<guid>https://block385.com/claude-code-source-leaked-via-npm-packaging-error-anthropic-confirms</guid>
<description><![CDATA[ Anthropic on Tuesday confirmed that internal code for its popular artificial intelligence (AI) coding assistant, Claude Code, had been inadvertently released due to a human error.
&quot;No sensitive customer data or credentials were involved or exposed,&quot; an Anthropic spokesperson said in a statement shared with CNBC News. &quot;This was a release packaging issue caused by human error, not a security ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj39e4BXzk1M6BK7XEJcfogVbdwnYJjie08kNTAeW5T46Tn8UvbbaYGrrEpgw1Pa4IpJYeGe8AR7T_UCp4_vWYTcG-c5DY0HNlHW-8SbYkscVvjAKjKR3gHmlWAQONEx8kg_ANVfOr8OsQ7uTm-XWHW1PNfusxBj-Tn2kn-V2EedPykA3ESB66doPXxGzT8/s1600/claude-code.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Claude, Code, Source, Leaked, via, npm, Packaging, Error, Anthropic, Confirms</media:keywords>
</item>

<item>
<title>Mimecast makes enterprise email security deployable in minutes</title>
<link>https://block385.com/mimecast-makes-enterprise-email-security-deployable-in-minutes</link>
<guid>https://block385.com/mimecast-makes-enterprise-email-security-deployable-in-minutes</guid>
<description><![CDATA[ Most organizations running Microsoft 365 rely on native email controls as their primary line of defense. According to Mimecast research, 38% of organizations depend exclusively on those native controls for collaboration security, and 64% say those controls are insufficient against the threat landscape. Ranjan Singh, Chief Product and Technology Officer at Mimecast, outlines how the company’s API-based approach delivers protection on par with a traditional Secure Email Gateway without requiring infrastructure changes, and why that … More →
The post Mimecast makes enterprise email security deployable in minutes appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/04/31081147/ranjan_singh-2-mimecast.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 09:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Mimecast, makes, enterprise, email, security, deployable, minutes</media:keywords>
</item>

<item>
<title>Malware detectors trained on one dataset often stumble on another</title>
<link>https://block385.com/malware-detectors-trained-on-one-dataset-often-stumble-on-another</link>
<guid>https://block385.com/malware-detectors-trained-on-one-dataset-often-stumble-on-another</guid>
<description><![CDATA[ Machine learning models built to catch malware on Windows systems are typically evaluated on data that closely resembles their training set. In practice, the malware arriving on enterprise endpoints looks different, comes from different sources, and in many cases has been deliberately obfuscated to evade detection. A study from researchers at the Polytechnic of Porto tests what happens when that gap is made explicit, and the results have direct implications for organizations relying on static … More →
The post Malware detectors trained on one dataset often stumble on another appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/07/09065945/eyes.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 07:00:20 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Malware, detectors, trained, one, dataset, often, stumble, another</media:keywords>
</item>

<item>
<title>Financial groups lay out a plan to fight AI identity attacks</title>
<link>https://block385.com/financial-groups-lay-out-a-plan-to-fight-ai-identity-attacks</link>
<guid>https://block385.com/financial-groups-lay-out-a-plan-to-fight-ai-identity-attacks</guid>
<description><![CDATA[ Generative AI tools have brought the cost of deepfake production low enough that criminals and state-sponsored actors now use them routinely against financial institutions. A joint paper from the American Bankers Association, the Better Identity Coalition, and the Financial Services Sector Coordinating Council lays out the scale of the problem and calls on federal and state policymakers to act across various areas. Deepfake incidents in the fintech sector increased 700% in 2023 compared to 2022. … More →
The post Financial groups lay out a plan to fight AI identity attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/10/28162754/face-glitch-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 07:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Financial, groups, lay, out, plan, fight, identity, attacks</media:keywords>
</item>

<item>
<title>Axios NPM Package Compromised in Precision Attack</title>
<link>https://block385.com/axios-npm-package-compromised-in-precision-attack</link>
<guid>https://block385.com/axios-npm-package-compromised-in-precision-attack</guid>
<description><![CDATA[ The NPM package for Axios, a popular JavaScript HTTP client library, was briefly compromised this week, possibly by North Korean threat actors. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt284d08f3234710b6/69cc29efc0030f6e262faa34/bullseye_chris_brignell_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Wed, 01 Apr 2026 01:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Axios, NPM, Package, Compromised, Precision, Attack</media:keywords>
</item>

<item>
<title>Crypto industry may be running out of time to prepare for quantum attacks</title>
<link>https://block385.com/crypto-industry-may-be-running-out-of-time-to-prepare-for-quantum-attacks</link>
<guid>https://block385.com/crypto-industry-may-be-running-out-of-time-to-prepare-for-quantum-attacks</guid>
<description><![CDATA[ Google’s latest research suggests the cryptocurrency industry may have less time than expected to prepare for quantum computing. In a whitepaper, Google examines risks to elliptic curve cryptography, the system securing most blockchain networks. The researchers revisit earlier assumptions about how difficult it would be for a quantum computer to break these protections, concluding that the required resources may be lower than previously estimated. “To share this research responsibly, we engaged with the U.S. government … More →
The post Crypto industry may be running out of time to prepare for quantum attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/06/17145137/quantum_computing-1500-1.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 23:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Crypto, industry, may, running, out, time, prepare, for, quantum, attacks</media:keywords>
</item>

<item>
<title>Google&amp;apos;s Vertex AI Has an Over&#45;Privileged Problem</title>
<link>https://block385.com/googles-vertex-ai-has-an-over-privileged-problem</link>
<guid>https://block385.com/googles-vertex-ai-has-an-over-privileged-problem</guid>
<description><![CDATA[ Palo Alto researchers show how attackers could exploit AI agents on Google&#039;s Vertex AI to steal data and break into restricted cloud infrastructure. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4e41a8645f65857e/69cc23a696a9929cb14154a7/agent_Krot_Studio_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Googles, Vertex, Has, Over-Privileged, Problem</media:keywords>
</item>

<item>
<title>TeamPCP Breaches Cloud, SaaS Instances With Stolen Credentials</title>
<link>https://block385.com/teampcp-breaches-cloud-saas-instances-with-stolen-credentials</link>
<guid>https://block385.com/teampcp-breaches-cloud-saas-instances-with-stolen-credentials</guid>
<description><![CDATA[ The threat group&#039;s shift to speedy attacks on AWS, Azure, and SaaS instances shows organizations need to respond quickly to compromised credentials. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc0adc75ba38320bc/69cc20666d4b6c62a6224f3a/cloud_RanczAndrei_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 23:00:03 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TeamPCP, Breaches, Cloud, SaaS, Instances, With, Stolen, Credentials</media:keywords>
</item>

<item>
<title>Android Developer Verification Rollout Begins Ahead of September Enforcement</title>
<link>https://block385.com/android-developer-verification-rollout-begins-ahead-of-september-enforcement</link>
<guid>https://block385.com/android-developer-verification-rollout-begins-ahead-of-september-enforcement</guid>
<description><![CDATA[ Google on Monday said it&#039;s officially rolling out Android developer verification to all developers to combat the problem of bad actors distributing harmful apps while &quot;hiding behind anonymity.&quot;
The development comes ahead of a planned verification mandate that goes into effect in Brazil, Indonesia, Singapore, and Thailand this September, before it expands globally next year.
As part of this ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipVNIw-uYi9MySm3LytKQD-PQgAh4NdQleZDyr_EC4zBRuNzOf2qjlvwgPMg8qsq1sopzgKv1gOlJuQCEs9dq8jwQVdonLibQPm_hJX8ZzOwfgyF6cuoixyotcpY-CvQp3E8fBAzqDRbWmfaCzuc96CH5FwzH7FJaaiVgYjgoC-x6RZOlgfHxFuwqQeq7G/s1600/android-dev.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 22:30:07 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Android, Developer, Verification, Rollout, Begins, Ahead, September, Enforcement</media:keywords>
</item>

<item>
<title>TrueConf Zero&#45;Day Exploited in Attacks on Southeast Asian Government Networks</title>
<link>https://block385.com/trueconf-zero-day-exploited-in-attacks-on-southeast-asian-government-networks</link>
<guid>https://block385.com/trueconf-zero-day-exploited-in-attacks-on-southeast-asian-government-networks</guid>
<description><![CDATA[ A high-severity security flaw in the TrueConf client video conferencing software has been exploited in the wild as a zero-day as part of a campaign targeting government entities in Southeast Asia dubbed TrueChaos.
The vulnerability in question is CVE-2026-3502 (CVSS score: 7.8), a lack of integrity check when fetching application update code, allowing an attacker to distribute a tampered update, ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYf7jS0dDRAhfWGLbRiA4eQt-Q3BL8gcG_bDoNQ1dfcZt3Ike4qAlE9lUiSH__y3kdi-MI2kfu-O-PdDf6iCov7VIVBPEkRVJOhx88uNgXTuI-rztvbwFXE9BKwJEsNSKux0yynwxlsDMCzCwyngLOSxWTAZjDFYKvpjyEsnPbRYbGtmC6zGmrMpP-SnqA/s1600/trueconf.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 20:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TrueConf, Zero-Day, Exploited, Attacks, Southeast, Asian, Government, Networks</media:keywords>
</item>

<item>
<title>DoControl provides security coverage for Google Gemini Gems</title>
<link>https://block385.com/docontrol-provides-security-coverage-for-google-gemini-gems</link>
<guid>https://block385.com/docontrol-provides-security-coverage-for-google-gemini-gems</guid>
<description><![CDATA[ DoControl announced new capabilities that provide visibility, monitoring, and automated control for Google Gemini Gems, a newly introduced feature within Google Gemini that enables teams to create customizable AI GPTs. With this launch, DoControl is the first platform to provide comprehensive security coverage for Google Gemini Gems, ensuring organizations can safely adopt this new technology without compromising control over their data. Addressing the next wave of AI security risk Google Gemini Gems are customizable GPTs … More →
The post DoControl provides security coverage for Google Gemini Gems appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:34 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DoControl, provides, security, coverage, for, Google, Gemini, Gems</media:keywords>
</item>

<item>
<title>Codenotary AgentMon monitors agentic AI activity and behavior</title>
<link>https://block385.com/codenotary-agentmon-monitors-agentic-ai-activity-and-behavior</link>
<guid>https://block385.com/codenotary-agentmon-monitors-agentic-ai-activity-and-behavior</guid>
<description><![CDATA[ Codenotary launched AgentMon, an enterprise-grade monitoring designed specifically for agentic networks, providing organizations with real-time visibility into the security, performance and cost of AI-driven agents operating across the enterprise. As adoption of AI accelerates, agentic systems, semi-autonomous software agents that act on behalf of users and applications, are becoming embedded across business operations. The market for AI agents expected to grow at a 45% CAGR over the next five years, reports consulting firm BCG. AgentMon … More →
The post Codenotary AgentMon monitors agentic AI activity and behavior appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:30 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Codenotary, AgentMon, monitors, agentic, activity, and, behavior</media:keywords>
</item>

<item>
<title>Amazon sends AI agents into pen testing and DevOps</title>
<link>https://block385.com/amazon-sends-ai-agents-into-pen-testing-and-devops</link>
<guid>https://block385.com/amazon-sends-ai-agents-into-pen-testing-and-devops</guid>
<description><![CDATA[ Amazon’s latest AI capabilities bring on-demand penetration testing through the AWS Security Agent, alongside the AWS DevOps Agent. “These agents are changing the way we secure and operate software. AWS Security Agent compresses penetration testing timelines from 2-6 weeks to 1-2 days. AWS DevOps agent gives teams 3–5x faster incident resolution so they can spend less time on incident resolution and more time innovating”, said Swami Sivasubramanian, VP, AI Amazon Web Services. AWS Security Agent … More →
The post Amazon sends AI agents into pen testing and DevOps appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/12/09102531/aws-1500-key2.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:22 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Amazon, sends, agents, into, pen, testing, and, DevOps</media:keywords>
</item>

<item>
<title>Pondurance MDR Essentials uses autonomous SOC to tackle AI&#45;driven attacks</title>
<link>https://block385.com/pondurance-mdr-essentials-uses-autonomous-soc-to-tackle-ai-driven-attacks</link>
<guid>https://block385.com/pondurance-mdr-essentials-uses-autonomous-soc-to-tackle-ai-driven-attacks</guid>
<description><![CDATA[ Pondurance announced MDR Essentials, MDR Essentials, an MDR service providing an autonomous SOC that reduces the time from threat detection to containment by 90%. Threat actors today use AI to attack at machine-speed, making it difficult for traditional cybersecurity solutions to accurately detect and contain cyber threats before they can become breaches. A recent paper from PwC notes that “in AI-driven SOCs, threats can be blocked in seconds, autonomously.” Pondurance’s MDR Essentials with the Kanati … More →
The post Pondurance MDR Essentials uses autonomous SOC to tackle AI-driven attacks appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Pondurance, MDR, Essentials, uses, autonomous, SOC, tackle, AI-driven, attacks</media:keywords>
</item>

<item>
<title>AI and Quantum Are Forcing a Rethink of Digital Trust</title>
<link>https://block385.com/ai-and-quantum-are-forcing-a-rethink-of-digital-trust</link>
<guid>https://block385.com/ai-and-quantum-are-forcing-a-rethink-of-digital-trust</guid>
<description><![CDATA[ In a conversation with Dark Reading’s Terry Sweeney, DigiCert CEO Amit Sinha explains how AI-driven identities and quantum threats are reshaping the foundations of digital trust. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>and, Quantum, Are, Forcing, Rethink, Digital, Trust</media:keywords>
</item>

<item>
<title>AI&#45;Driven Code Surge Is Forcing a Rethink of AppSec</title>
<link>https://block385.com/ai-driven-code-surge-is-forcing-a-rethink-of-appsec</link>
<guid>https://block385.com/ai-driven-code-surge-is-forcing-a-rethink-of-appsec</guid>
<description><![CDATA[ In a conversation with Dark Reading’s Terry Sweeney, Black Duck CEO Jason Schmitt explains how AI is reshaping application security and why it must evolve to keep pace. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AI-Driven, Code, Surge, Forcing, Rethink, AppSec</media:keywords>
</item>

<item>
<title>Iran Deploys &amp;apos;Pseudo&#45;Ransomware,&amp;apos; Revives Pay2Key Operations</title>
<link>https://block385.com/iran-deploys-pseudo-ransomware-revives-pay2key-operations</link>
<guid>https://block385.com/iran-deploys-pseudo-ransomware-revives-pay2key-operations</guid>
<description><![CDATA[ Iranian APTs are blurring the lines between state-sponsored and cybercriminal activities to target high-impact US organizations. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltea953d17d8a9625a/69cb9dbb871fcd599c9b5bc4/muhammadtoqeer-iran-cyber-flag-shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Iran, Deploys, Pseudo-Ransomware, Revives, Pay2Key, Operations</media:keywords>
</item>

<item>
<title>Rethinking Vulnerability Management Strategies for Mid&#45;Market Security</title>
<link>https://block385.com/rethinking-vulnerability-management-strategies-for-mid-market-security</link>
<guid>https://block385.com/rethinking-vulnerability-management-strategies-for-mid-market-security</guid>
<description><![CDATA[ Intruder&#039;s Chris Wallis argues mid-market teams should prioritize CVE remediation speed over vulnerability counts, while expanding defenses beyond CVEs to include attack surface management. ]]></description>
<enclosure url="" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 19:00:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Rethinking, Vulnerability, Management, Strategies, for, Mid-Market, Security</media:keywords>
</item>

<item>
<title>Android developers just got a new verification layer</title>
<link>https://block385.com/android-developers-just-got-a-new-verification-layer</link>
<guid>https://block385.com/android-developers-just-got-a-new-verification-layer</guid>
<description><![CDATA[ To help prevent malicious actors from spreading harmful apps while hiding behind anonymity, Google is rolling out developer verification to all Android developers. The company is also introducing app registration, which links apps to verified developer identities. Developers can still choose where to distribute their apps (Source: Google) Developers can begin completing verification now through the Android Developer Console and Play Console, ahead of user-facing changes scheduled for later this year. Developers who distribute apps … More →
The post Android developers just got a new verification layer appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/31115330/android-verification.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:01:35 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Android, developers, just, got, new, verification, layer</media:keywords>
</item>

<item>
<title>Axios npm packages backdoored in supply chain attack</title>
<link>https://block385.com/axios-npm-packages-backdoored-in-supply-chain-attack</link>
<guid>https://block385.com/axios-npm-packages-backdoored-in-supply-chain-attack</guid>
<description><![CDATA[ An unknown attacker has compromised the GitHub and npm accounts of the main developer of Axios, a widely used HTTP client library, and published npm packages backdoored with a malicious dependency that triggered the installation of droppers and remote access trojans. How the attack unfolded On March 30, 2026, with an account using a separate throwaway ProtonMail address, the attacker published on NPM a trojanized copy of the popular crypto-js JavaScript library of crypto standards. … More →
The post Axios npm packages backdoored in supply chain attack appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/09082404/npm-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:01:31 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Axios, npm, packages, backdoored, supply, chain, attack</media:keywords>
</item>

<item>
<title>Apple counters ClickFix attacks with macOS Terminal warning</title>
<link>https://block385.com/apple-counters-clickfix-attacks-with-macos-terminal-warning</link>
<guid>https://block385.com/apple-counters-clickfix-attacks-with-macos-terminal-warning</guid>
<description><![CDATA[ Apple has added a new security feature in macOS Tahoe 26.4 that warns users before they enter commands in Terminal that could cause harm. The goal is to stop ClickFix attacks, a social engineering trick that gets users to run malicious commands themselves. According to ESET, ClickFix activity jumped by more than 500% in the first half of 2025, making it the second-most common attack vector after phishing. The ClickFix tactic takes its name from … More →
The post Apple counters ClickFix attacks with macOS Terminal warning appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/20114620/apple2.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:01:26 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Apple, counters, ClickFix, attacks, with, macOS, Terminal, warning</media:keywords>
</item>

<item>
<title>Windows 11 gets a rebuilt console engine with regex search, Sixel images and a 10x speed boost</title>
<link>https://block385.com/windows-11-gets-a-rebuilt-console-engine-with-regex-search-sixel-images-and-a-10x-speed-boost</link>
<guid>https://block385.com/windows-11-gets-a-rebuilt-console-engine-with-regex-search-sixel-images-and-a-10x-speed-boost</guid>
<description><![CDATA[ Microsoft released Windows 11 Insider Preview Build 29558.1000 to the Canary Channel, part of the optional 29500 build series. The build carries a set of changes focused on the Windows Console, a handful of bug fixes, and small improvements to Settings and disk utilities. A rebuilt console The bulk of this build centers on the Windows Console, which is part of the open-source Windows Terminal project on GitHub. Microsoft is pulling accumulated contributions from that … More →
The post Windows 11 gets a rebuilt console engine with regex search, Sixel images and a 10x speed boost appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/31144435/windows11-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:01:18 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Windows, gets, rebuilt, console, engine, with, regex, search, Sixel, images, and, 10x, speed, boost</media:keywords>
</item>

<item>
<title>Download: 2026 SANS Identity Threats &amp;amp; Defenses Survey</title>
<link>https://block385.com/download-2026-sans-identity-threats-defenses-survey</link>
<guid>https://block385.com/download-2026-sans-identity-threats-defenses-survey</guid>
<description><![CDATA[ New research from the 2026 SANS Identity Threats &amp; Defenses Survey shows that 55% of organizations experienced an identity-related compromise last year, while 26% reported MFA fatigue as a factor in identity attacks. Download the report to learn: Why identity compromises remain common How attackers abuse authentication systems using valid credentials Where organizations struggle to detect and contain identity threats Download the full report to see how identity attacks are evolving.
The post Download: 2026 SANS Identity Threats &amp; Defenses Survey appeared first on Help Net Security. ]]></description>
<enclosure url="https://resources.enzoic.com/hs-fs/hubfs/SANS-1.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:01:04 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Download:, 2026, SANS, Identity, Threats, Defenses, Survey</media:keywords>
</item>

<item>
<title>New Bitdefender assessment helps organizations identify and eliminate hidden internal attack paths</title>
<link>https://block385.com/new-bitdefender-assessment-helps-organizations-identify-and-eliminate-hidden-internal-attack-paths</link>
<guid>https://block385.com/new-bitdefender-assessment-helps-organizations-identify-and-eliminate-hidden-internal-attack-paths</guid>
<description><![CDATA[ Bitdefender has announced the Bitdefender Internal Attack Surface Assessment, a complimentary evaluation that helps organizations identify and reduce hidden internal cyber risks caused by unnecessary user access to applications, tools, and operating system utilities commonly exploited in attacks. The assessment provides organizations with a data-driven view of their internal attack surface and offers actionable guidance to help prioritize and remediate exposure. Businesses face growing challenges defending against Living-Off-the-Land (LOTL), fileless, and other non-malware attack techniques, … More →
The post New Bitdefender assessment helps organizations identify and eliminate hidden internal attack paths appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:00:54 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>New, Bitdefender, assessment, helps, organizations, identify, and, eliminate, hidden, internal, attack, paths</media:keywords>
</item>

<item>
<title>Hacker stripped more than $50 million from Uranium crypto exchange, spent it on trading cards</title>
<link>https://block385.com/hacker-stripped-more-than-50-million-from-uranium-crypto-exchange-spent-it-on-trading-cards</link>
<guid>https://block385.com/hacker-stripped-more-than-50-million-from-uranium-crypto-exchange-spent-it-on-trading-cards</guid>
<description><![CDATA[ US prosecutors have charged a Maryland man in connection with two hacks of the Uranium Finance cryptocurrency exchange that led to losses exceeding $50 million. Jonathan Spalletta, also known as “Cthulhon” and “Jspalletta,” is accused of abusing vulnerabilities in Uranium Finance smart contracts to siphon assets from the platform. If convicted, he could face up to 10 years in prison for computer fraud and 20 years for money laundering. “As alleged, Jonathan Spalletta repeatedly hacked … More →
The post Hacker stripped more than $50 million from Uranium crypto exchange, spent it on trading cards appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/09/16112525/crypto_scams.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:00:41 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hacker, stripped, more, than, 50, million, from, Uranium, crypto, exchange, spent, trading, cards</media:keywords>
</item>

<item>
<title>Foxit flags hidden security risks in PDFs with new tool</title>
<link>https://block385.com/foxit-flags-hidden-security-risks-in-pdfs-with-new-tool</link>
<guid>https://block385.com/foxit-flags-hidden-security-risks-in-pdfs-with-new-tool</guid>
<description><![CDATA[ Foxit Software introduced a new capability designed to uncover hidden security risks inside PDFs as part of its latest PDF Editor 2026.1 release for Windows and macOS. The update is led by PDF Action Inspector, a new tool that proactively scans documents for embedded JavaScript and self-modifying behaviors — threats that can bypass redaction, expose sensitive data, or alter document output without detection. As organizations rely on PDFs to share critical infrastructure, these risks have … More →
The post Foxit flags hidden security risks in PDFs with new tool appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:00:26 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Foxit, flags, hidden, security, risks, PDFs, with, new, tool</media:keywords>
</item>

<item>
<title>EvilTokens ramps up device code phishing targeting Microsoft 365 users</title>
<link>https://block385.com/eviltokens-ramps-up-device-code-phishing-targeting-microsoft-365-users</link>
<guid>https://block385.com/eviltokens-ramps-up-device-code-phishing-targeting-microsoft-365-users</guid>
<description><![CDATA[ Security researchers report a notable increase in device code phishing activity aimed at Microsoft 365 users, and have attributed this rise to the availability of EvilTokens, a new, specialized phishing toolkit that’s being offered as-a-service via Telegram. What is device code phishing? Device code phishing is a type of attack where attackers trick users into logging into their account by using a real authentication flow, then steal their access and refresh tokens. Microsoft provides the … More →
The post EvilTokens ramps up device code phishing targeting Microsoft 365 users appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/08/08143621/microsoft-365-phishing.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>EvilTokens, ramps, device, code, phishing, targeting, Microsoft, 365, users</media:keywords>
</item>

<item>
<title>Black Hat USA</title>
<link>https://block385.com/black-hat-usa</link>
<guid>https://block385.com/black-hat-usa</guid>
<description><![CDATA[  ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt89877e9bb04a9e15/69c6ee0e1eae740fa6bfca88/623600_BHUS26_Web_Ads_One_Liner_300x250.png" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 17:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Black, Hat, USA</media:keywords>
</item>

<item>
<title>Vertex AI Vulnerability Exposes Google Cloud Data and Private Artifacts</title>
<link>https://block385.com/vertex-ai-vulnerability-exposes-google-cloud-data-and-private-artifacts</link>
<guid>https://block385.com/vertex-ai-vulnerability-exposes-google-cloud-data-and-private-artifacts</guid>
<description><![CDATA[ Cybersecurity researchers have disclosed a security &quot;blind spot&quot; in Google Cloud&#039;s Vertex AI platform that could allow artificial intelligence (AI) agents to be weaponized by an attacker to gain unauthorized access to sensitive data and compromise an organization&#039;s cloud environment.
According to Palo Alto Networks Unit 42, the issue relates to how the Vertex AI permission model can be misused ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLtnrJRJvkUE-IMtV6DuDmg7t1XhaGyItG6cXmd2cz0-3sd8fgZi5jHZE9valO1-CdJjGcqkkeHxNPM2Y7lLK0lrtJXOEwXscylBbYfyCXtvvAfGeFR5Q7Zwv0Mxsg-iiEjbaN2junJWYJmJmUEBuFDjRXH_X9gYYwR4Jyu-79dMfL1MQPLpKU6O6PtN_R/s1600/google-vertex.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 16:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Vertex, Vulnerability, Exposes, Google, Cloud, Data, and, Private, Artifacts</media:keywords>
</item>

<item>
<title>The AI Arms Race – Why Unified Exposure Management Is Becoming a Boardroom Priority</title>
<link>https://block385.com/the-ai-arms-race-why-unified-exposure-management-is-becoming-a-boardroom-priority</link>
<guid>https://block385.com/the-ai-arms-race-why-unified-exposure-management-is-becoming-a-boardroom-priority</guid>
<description><![CDATA[ The cybersecurity landscape is accelerating at an unprecedented rate. What is emerging is not simply a rise in the number of vulnerabilities or tools, but a dramatic increase in speed. Speed of attack, speed of exploitation, and speed of change across modern environments.
This is the defining challenge of the new era of digital warfare: the weaponization of Artificial Intelligence. Threat actors ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1pgefAVGqPo1F0pVFtbxdewmfgaNvrqH-R-BydTTpenzbOZGvoJMA7wwiXzhDBcxvhEm91tK9CsPBiB24g7WHylYCzuO8XI9tCraDla-ePrNFsli1YYrtjQr6dxN7mQHbuw57EtS1mrUeS3GfNYCuM-7s1MDbW5oUS2tY0kkV8_TNP3jDKPPgUXSJTr8/s1600/ai-power.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 16:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, Arms, Race, –, Why, Unified, Exposure, Management, Becoming, Boardroom, Priority</media:keywords>
</item>

<item>
<title>Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains</title>
<link>https://block385.com/silver-fox-expands-asia-cyber-campaign-with-atlascross-rat-and-fake-domains</link>
<guid>https://block385.com/silver-fox-expands-asia-cyber-campaign-with-atlascross-rat-and-fake-domains</guid>
<description><![CDATA[ Chinese-speaking users are the target of an active campaign that uses typosquatted domains impersonating trusted software brands to deliver a previously undocumented remote access trojan named AtlasCross RAT.
&quot;The operation covers VPN clients, encrypted messengers, video conferencing tools, cryptocurrency trackers, and e-commerce applications, with eleven confirmed delivery domains impersonating ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgQmoJ2iwUTLR-DicdD0xa7_oYXgpGalL3L_-4LyX9YMApiotQC-omFlhdcQByUQat1YJdd7ElMqhp8FDYpoaljcvVmCFPXS4yRRh0_KnKa6FgqoEpiaKHJhoecKKap1MgoPWw1a6H7LfJrYo9m_YXqh3BaoES1tPEmuCbgO3snV34jtkrK7j8t4Qk30jj/s1600/cyberattacks-asia.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 16:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Silver, Fox, Expands, Asia, Cyber, Campaign, with, AtlasCross, RAT, and, Fake, Domains</media:keywords>
</item>

<item>
<title>Google Drive now detects ransomware and helps restore affected files</title>
<link>https://block385.com/google-drive-now-detects-ransomware-and-helps-restore-affected-files</link>
<guid>https://block385.com/google-drive-now-detects-ransomware-and-helps-restore-affected-files</guid>
<description><![CDATA[ To help organizations minimize the impact of malware attacks on personal computers, Google launched ransomware detection and file restoration in beta in September 2025. These features are now generally available. End user alert in Drive for desktop when ransomware is detected (Source: Google) “Compared to the beta version, we can now detect more types of ransomware encryption and do so faster. Our latest AI model detects 14× more infections, providing broader protection,” the company said … More →
The post Google Drive now detects ransomware and helps restore affected files appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/31093230/google-drive-ransomware-recovery.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 13:00:45 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Google, Drive, now, detects, ransomware, and, helps, restore, affected, files</media:keywords>
</item>

<item>
<title>Rspamd 4.0.0 ships memory savings, a new scan protocol, and a required migration step</title>
<link>https://block385.com/rspamd-400-ships-memory-savings-a-new-scan-protocol-and-a-required-migration-step</link>
<guid>https://block385.com/rspamd-400-ships-memory-savings-a-new-scan-protocol-and-a-required-migration-step</guid>
<description><![CDATA[ The open-source spam filtering platform Rspamd released version 4.0.0, delivering infrastructure changes across its scan protocol, memory model, hash storage, and configuration system. Several of the changes are breaking, and at least one requires a migration step before upgrade. A new scan protocol The release introduces a /checkv3 endpoint that replaces HTTP headers with structured JSON or msgpack for metadata transport. The new endpoint uses multipart/form-data for requests and multipart/mixed for responses, supports per-part zstd … More →
The post Rspamd 4.0.0 ships memory savings, a new scan protocol, and a required migration step appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/10/02095747/rspamd-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 13:00:32 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Rspamd, 4.0.0, ships, memory, savings, new, scan, protocol, and, required, migration, step</media:keywords>
</item>

<item>
<title>Intel puts its data center performance knowledge on GitHub</title>
<link>https://block385.com/intel-puts-its-data-center-performance-knowledge-on-github</link>
<guid>https://block385.com/intel-puts-its-data-center-performance-knowledge-on-github</guid>
<description><![CDATA[ Intel engineers have published a centralized repository of data center performance knowledge on GitHub, giving practitioners direct access to tuning guides, configuration recommendations, and optimization recipes that previously required hunting across forums and scattered documentation. The repository, called Optimization Zone, is open-source and publicly accessible at GitHub. It covers software, workloads, performance analysis tools, and hardware configurations for Intel architectures. Built from customer feedback Intel engineers say the content grew from recurring questions and problems … More →
The post Intel puts its data center performance knowledge on GitHub appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/03/31120620/intel-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 13:00:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Intel, puts, its, data, center, performance, knowledge, GitHub</media:keywords>
</item>

<item>
<title>Axios Supply Chain Attack Pushes Cross&#45;Platform RAT via Compromised npm Account</title>
<link>https://block385.com/axios-supply-chain-attack-pushes-cross-platform-rat-via-compromised-npm-account</link>
<guid>https://block385.com/axios-supply-chain-attack-pushes-cross-platform-rat-via-compromised-npm-account</guid>
<description><![CDATA[ The popular HTTP client known as Axios has suffered a supply chain attack after two newly published versions of the npm package introduced a malicious dependency.
Versions 1.14.1 and 0.30.4 of Axios have been found to inject &quot;plain-crypto-js&quot; version 4.2.1 as a fake dependency.
According to StepSecurity, the two versions were published using the compromised npm credentials of the primary Axios ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdY8iKA7o-K-4HkIjPMiBRWAn5vCvSNDu1sm09t10vWMzXO6cIblLHQyu1no-KBhq4W7EWS03zqvI4n_k9mYWCDsCVoiX4cwsV9T862WTq1yGb6VkX1ZGTa7MKZE43llbF9n2Py1mC2yhCIfRlXGkvya_NQ9lX7vZ32YW8pHZlw1dPZcI9eCrgysiWqSSR/s1600/Axios-attack.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 10:30:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Axios, Supply, Chain, Attack, Pushes, Cross-Platform, RAT, via, Compromised, npm, Account</media:keywords>
</item>

<item>
<title>The art of making technical risk make sense to executives</title>
<link>https://block385.com/the-art-of-making-technical-risk-make-sense-to-executives</link>
<guid>https://block385.com/the-art-of-making-technical-risk-make-sense-to-executives</guid>
<description><![CDATA[ In this Help Net Security video, Jay Miller, CISO at Paessler, explains how security leaders can communicate technical risk to executives and board members in terms they understand. The focus is on business impact: financial loss, compliance fines, reputation damage, and productivity. Miller walks through three principles: describe impact in plain language, come prepared with data and a clear narrative, and be transparent about what happened and what still needs fixing. He uses real examples, … More →
The post The art of making technical risk make sense to executives appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/01/16143628/ciso-1500-3.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 09:00:25 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, art, making, technical, risk, make, sense, executives</media:keywords>
</item>

<item>
<title>Why I’m done calling humans the weakest link</title>
<link>https://block385.com/why-im-done-calling-humans-the-weakest-link</link>
<guid>https://block385.com/why-im-done-calling-humans-the-weakest-link</guid>
<description><![CDATA[ Cybersecurity has long suffered from a people problem, but not in the way we often hear about. As industry that is based on enabling communication across the globe via the internet and many types of devices, many of us practitioners are very bad at communicating to people. A primary example is the phrase “humans are the weakest link” which is well known phrase in our industry. This phrase implies that if it were not for … More →
The post Why I’m done calling humans the weakest link appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/02154535/identity-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 09:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Why, I’m, done, calling, humans, the, weakest, link</media:keywords>
</item>

<item>
<title>Cybersecurity jobs available right now: March 31, 2026</title>
<link>https://block385.com/cybersecurity-jobs-available-right-now-march-31-2026</link>
<guid>https://block385.com/cybersecurity-jobs-available-right-now-march-31-2026</guid>
<description><![CDATA[ Android Malware Research Director Alice | Israel | On-site – View job details As an Android Malware Research Director, you will establish operational processes, workflows, and quality standards for the team, while integrating the function into existing infrastructure. You will act as the primary client interface, managing relationships, presenting research findings, and ensuring client satisfaction. Cloud Information Security Engineer HedgeServ | Ireland | Hybrid – View job details As a Cloud Information Security Engineer, you … More →
The post Cybersecurity jobs available right now: March 31, 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/11140410/cybersecurity_jobs-4-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 07:00:23 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Cybersecurity, jobs, available, right, now:, March, 31, 2026</media:keywords>
</item>

<item>
<title>Hottest cybersecurity open&#45;source tools of the month: March 2026</title>
<link>https://block385.com/hottest-cybersecurity-open-source-tools-of-the-month-march-2026</link>
<guid>https://block385.com/hottest-cybersecurity-open-source-tools-of-the-month-march-2026</guid>
<description><![CDATA[ Presented here is a curated selection of noteworthy open-source cybersecurity solutions that have drawn recognition for their ability to enhance security postures across diverse settings. BlacksmithAI: Open-source AI-powered penetration testing framework BlacksmithAI is an open-source penetration testing framework that uses multiple AI agents to execute different stages of a security assessment lifecycle. BlacksmithAI runs as a hierarchical system in which an orchestrator coordinates task execution across specialized agents. mquire: Open-source Linux memory forensics tool Linux … More →
The post Hottest cybersecurity open-source tools of the month: March 2026 appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/09/09085108/open-source_cybersec_tools-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 07:00:08 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Hottest, cybersecurity, open-source, tools, the, month:, March, 2026</media:keywords>
</item>

<item>
<title>AI&#45;Powered &amp;apos;DeepLoad&amp;apos; Malware Steals Credentials, Evades Detection</title>
<link>https://block385.com/ai-powered-deepload-malware-steals-credentials-evades-detection</link>
<guid>https://block385.com/ai-powered-deepload-malware-steals-credentials-evades-detection</guid>
<description><![CDATA[ The massive amount of junk code that hides the malware&#039;s logic from security scans was almost certainly generated by AI, researchers say. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd7991d1fb5c4ce7a/69cadd3f7edf53802a560b21/obfuscate_Grenar_shutterstock.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 01:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>AI-Powered, DeepLoad, Malware, Steals, Credentials, Evades, Detection</media:keywords>
</item>

<item>
<title>F5 BIG&#45;IP Vulnerability Reclassified as RCE, Under Exploitation</title>
<link>https://block385.com/f5-big-ip-vulnerability-reclassified-as-rce-under-exploitation</link>
<guid>https://block385.com/f5-big-ip-vulnerability-reclassified-as-rce-under-exploitation</guid>
<description><![CDATA[ CVE-2025-53521 was initially disclosed in October as a high-severity denial-of-service (DoS) flaw, but new information has revealed the bug is actually much more dangerous. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt785465f8bc714950/69caef686b45b775670507cc/f5_SOPAImagesLimited_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Tue, 31 Mar 2026 01:00:02 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>BIG-IP, Vulnerability, Reclassified, RCE, Under, Exploitation</media:keywords>
</item>

<item>
<title>Fortinet BIG&#45;IP Vulnerability Reclassified as RCE, Under Exploitation</title>
<link>https://block385.com/fortinet-big-ip-vulnerability-reclassified-as-rce-under-exploitation</link>
<guid>https://block385.com/fortinet-big-ip-vulnerability-reclassified-as-rce-under-exploitation</guid>
<description><![CDATA[ CVE-2025-53521 was initially disclosed in October as a high-severity denial-of-service (DoS) flaw, but new information has revealed the bug is actually much more dangerous. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt73055c0402a34817/69cac108ccfbe565fcf46617/fortinet_DannyNebraska_Alamy.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 23:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Fortinet, BIG-IP, Vulnerability, Reclassified, RCE, Under, Exploitation</media:keywords>
</item>

<item>
<title>Manufacturing and Healthcare Share Struggles with Passwords</title>
<link>https://block385.com/manufacturing-and-healthcare-share-struggles-with-passwords</link>
<guid>https://block385.com/manufacturing-and-healthcare-share-struggles-with-passwords</guid>
<description><![CDATA[ The two key economic sectors struggle with security for a reason: Many insiders view access management as a roadblock, while attackers see it as a way in. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltfeef2e04a3809da9/69caa596264d1e7cab110238/2BXKGWT.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 23:00:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Manufacturing, and, Healthcare, Share, Struggles, with, Passwords</media:keywords>
</item>

<item>
<title>OpenAI Patches ChatGPT Data Exfiltration Flaw and Codex GitHub Token Vulnerability</title>
<link>https://block385.com/openai-patches-chatgpt-data-exfiltration-flaw-and-codex-github-token-vulnerability</link>
<guid>https://block385.com/openai-patches-chatgpt-data-exfiltration-flaw-and-codex-github-token-vulnerability</guid>
<description><![CDATA[ A previously unknown vulnerability in OpenAI ChatGPT allowed sensitive conversation data to be exfiltrated without user knowledge or consent, according to new findings from Check Point.
&quot;A single malicious prompt could turn an otherwise ordinary conversation into a covert exfiltration channel, leaking user messages, uploaded files, and other sensitive content,&quot; the cybersecurity company said in ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSleuSc-PdTH7u0CSOLasljqQ-HO4A5sIqzvVeeVlGlqynCVYSdgU1c-7zoVavi1OADQiN3-_KS93PbMbmc4daNULqCXV21ChjnRUvqXIPT9mnLRCmbHdVy0YeaMnRuzGBAo8JoJPE5Wnzl3Sf0b_3d1-OV6VB3PKhKy_olGs9mi1YLIOJnAl7uQkYkdjI/s1600/cpr.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 22:30:09 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>OpenAI, Patches, ChatGPT, Data, Exfiltration, Flaw, and, Codex, GitHub, Token, Vulnerability</media:keywords>
</item>

<item>
<title>Storm Brews Over Critical, No&#45;Click Telegram Flaw</title>
<link>https://block385.com/storm-brews-over-critical-no-click-telegram-flaw</link>
<guid>https://block385.com/storm-brews-over-critical-no-click-telegram-flaw</guid>
<description><![CDATA[ The vulnerability, which is allegedly triggered by a corrupted sticker in the messaging app, received a 9.8 CVSS score, but Telegram denies it exists. ]]></description>
<enclosure url="https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt40cf7580a2e25f90/69ca6e49750cbc5170c0018c/telegram_Pitor_Adamowicz_Alamy.png" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 21:00:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Storm, Brews, Over, Critical, No-Click, Telegram, Flaw</media:keywords>
</item>

<item>
<title>DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials</title>
<link>https://block385.com/deepload-malware-uses-clickfix-and-wmi-persistence-to-steal-browser-credentials</link>
<guid>https://block385.com/deepload-malware-uses-clickfix-and-wmi-persistence-to-steal-browser-credentials</guid>
<description><![CDATA[ A new campaign has leveraged the ClickFix social engineering tactic as a way to distribute a previously undocumented malware loader referred to as DeepLoad.
&quot;It likely uses AI-assisted obfuscation and process injection to evade static scanning, while credential theft starts immediately and captures passwords and sessions even if the primary loader is blocked,&quot; ReliaQuest researchers Thassanai ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2icgdVOmzM5pZsm88HvvmzcWKRBBXvG94z4fSZMEVPzb7GDoJ_MGDckeaK2dYVEoId5bhMbBtB0bTc0xWJshdOQ-fJEUH5nPIo028Cpm1bmmR1Qlrv5M6atg6oMz0wc0hX4phKfXivitHkWqMiE_Rl7PaD0qIrGMyaq9D_QwAMm62Bw5iaMBlHvwAnIa_/s1600/deepload.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 20:30:06 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>DeepLoad, Malware, Uses, ClickFix, and, WMI, Persistence, Steal, Browser, Credentials</media:keywords>
</item>

<item>
<title>Coro launches MCP capabilities to simplify security operations through AI workflows</title>
<link>https://block385.com/coro-launches-mcp-capabilities-to-simplify-security-operations-through-ai-workflows</link>
<guid>https://block385.com/coro-launches-mcp-capabilities-to-simplify-security-operations-through-ai-workflows</guid>
<description><![CDATA[ Coro has announced new Model Context Protocol (MCP) capabilities that extend its AI-driven security platform beyond the Coro interface, allowing users to access, analyze, and take action on security data directly from tools like ChatGPT, Claude, and other AI environments. Coro enables teams to interact with and act on security data without switching tools or navigating complex dashboards, which is important for organizations increasingly relying on AI assistants to manage daily workflows. Coro’s MCP integration … More →
The post Coro launches MCP capabilities to simplify security operations through AI workflows appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 19:00:42 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Coro, launches, MCP, capabilities, simplify, security, operations, through, workflows</media:keywords>
</item>

<item>
<title>Diligent automates time&#45;consuming steps in third&#45;party reviews</title>
<link>https://block385.com/diligent-automates-time-consuming-steps-in-third-party-reviews</link>
<guid>https://block385.com/diligent-automates-time-consuming-steps-in-third-party-reviews</guid>
<description><![CDATA[ Diligent launched of Third-Party Risk Intel, an agentic due diligence and intelligence solution that automates the most time-consuming steps of third-party reviews, delivering up to 80% time savings for compliance, legal, and procurement teams. The launch builds on the company’s recent acquisition of 3rdRisk, an AI-native third-party risk management solution that gives organizations a near real-time view of their external ecosystem, how critical vendors are performing, and what that means for their overall risk posture. … More →
The post Diligent automates time-consuming steps in third-party reviews appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 19:00:34 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Diligent, automates, time-consuming, steps, third-party, reviews</media:keywords>
</item>

<item>
<title>TeamPCP’s attack spree slows, but threat escalates with ransomware pivot</title>
<link>https://block385.com/teampcps-attack-spree-slows-but-threat-escalates-with-ransomware-pivot</link>
<guid>https://block385.com/teampcps-attack-spree-slows-but-threat-escalates-with-ransomware-pivot</guid>
<description><![CDATA[ TeamPCP’s destructive run of supply chain breaches has stopped, for now: it has been three days since the group published malicious versions of Telnyx’s SDK on PyPI, and there haven’t been reports of new open-source project compromises. Partnership with emerging RaaS operation “The prior operational cadence was aggressive – a new target every 1-3 days (Trivy [on] March 19, CanisterWorm [on] March 20-22, Checkmarx [on] March 23, LiteLLM [on] March 24, Telnyx [on] March 27),” … More →
The post TeamPCP’s attack spree slows, but threat escalates with ransomware pivot appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/11/06180224/digital-supply-chain-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 19:00:20 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>TeamPCP’s, attack, spree, slows, but, threat, escalates, with, ransomware, pivot</media:keywords>
</item>

<item>
<title>RSAC 2026 is back, and the certificate automation gap is impossible to ignore</title>
<link>https://block385.com/rsac-2026-is-back-and-the-certificate-automation-gap-is-impossible-to-ignore</link>
<guid>https://block385.com/rsac-2026-is-back-and-the-certificate-automation-gap-is-impossible-to-ignore</guid>
<description><![CDATA[ RSAC 2026 Conference marked a return to form, more vibrant and better attended than any show I can recall over the past decade. The audience was distinctly international, with strong representation from North America, Europe and Latin America, and it was refreshing to see the energy and overall vibe of the show return to what I remember from RSA at its peak. As expected, hot topics centered on how AI is transforming cybersecurity, alongside growing … More →
The post RSAC 2026 is back, and the certificate automation gap is impossible to ignore appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/02/17183613/discussion-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 19:00:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>RSAC, 2026, back, and, the, certificate, automation, gap, impossible, ignore</media:keywords>
</item>

<item>
<title>⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More</title>
<link>https://block385.com/weekly-recap-telecom-sleeper-cells-llm-jailbreaks-apple-forces-uk-age-checks-and-more</link>
<guid>https://block385.com/weekly-recap-telecom-sleeper-cells-llm-jailbreaks-apple-forces-uk-age-checks-and-more</guid>
<description><![CDATA[ Some weeks are loud. This one was quieter but not in a good way. Long-running operations are finally hitting courtrooms, old attack methods are showing up in new places, and research that stopped being theoretical right around the time defenders stopped paying attention.
There&#039;s a bit of everything this week. Persistence plays, legal wins, influence ops, and at least one thing that looks boring ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2e5F9xrNGflqGG3Z7UcoPHMKZnF1j1FJBpwnPfV0MBCUweDKegb97Kcry4OK2kQgx0bQ91Lhem0BdasOpiN9UoKz7rNTAVgBuJzbM9jCaF4APqUsXlkiZfbC35xNWAd0z7T0qZoTN3GdVW9exy7BcEIjV64hinG5pxmbX69KdF_u7qXUpuEZZX_R8vaMP/s1600/recapss.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 16:30:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>⚡, Weekly, Recap:, Telecom, Sleeper, Cells, LLM, Jailbreaks, Apple, Forces, U.K., Age, Checks, and, More</media:keywords>
</item>

<item>
<title>3 SOC Process Fixes That Unlock Tier 1 Productivity</title>
<link>https://block385.com/3-soc-process-fixes-that-unlock-tier-1-productivity</link>
<guid>https://block385.com/3-soc-process-fixes-that-unlock-tier-1-productivity</guid>
<description><![CDATA[ What is really slowing Tier 1 down: the threat itself or the process around it? In many SOCs, the biggest delays do not come from the threat alone. They come from fragmented workflows, manual triage steps, and limited visibility early in the investigation. Fixing those process gaps can help Tier 1 move faster, reduce unnecessary escalations, and improve how the entire SOC responds under pressure ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFh5EaxE3C26MNKxziPoKvAK16f1ctGNYf_S1E7IY1tfyazizZwtmHaqHaTHSqBwWAMtENhtk5K1GzWLRln80K-vm2S9lkVeE3tpfQeVTaptm_T8kNoeCFLDbJLKMwqNsmD9y2iUDnLUJw4b6BQpST8M5h3dk7yRGyBcrl29nD8rw045i5roI91mRrEQs/s1600/soc.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 16:30:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SOC, Process, Fixes, That, Unlock, Tier, Productivity</media:keywords>
</item>

<item>
<title>Second data breach at European Commission this year leaves open questions over resilience</title>
<link>https://block385.com/second-data-breach-at-european-commission-this-year-leaves-open-questions-over-resilience</link>
<guid>https://block385.com/second-data-breach-at-european-commission-this-year-leaves-open-questions-over-resilience</guid>
<description><![CDATA[ The European Commission confirmed that a cyberattack impacted cloud infrastructure hosting its web presence on the Europa.eu platform. Authorities said the cyberattack was discovered on 24 March, and early findings from the ongoing investigation suggest data were taken from the affected websites.There is no indication that the Commission’s internal systems were compromised. “The Commission’s swift response ensured the incident was contained and risk mitigation measures were implemented to protect services and data, without disrupting the … More →
The post Second data breach at European Commission this year leaves open questions over resilience appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/01/21142123/eu-people-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 15:00:37 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Second, data, breach, European, Commission, this, year, leaves, open, questions, over, resilience</media:keywords>
</item>

<item>
<title>Critical Fortinet FortiClient EMS bug under active attack (CVE&#45;2026&#45;21643)</title>
<link>https://block385.com/critical-fortinet-forticlient-ems-bug-under-active-attack-cve-2026-21643</link>
<guid>https://block385.com/critical-fortinet-forticlient-ems-bug-under-active-attack-cve-2026-21643</guid>
<description><![CDATA[ A critical SQL injection vulnerability (CVE-2026-21643) in Fortinet FortiClient Endpoint Management Server (EMS), a management server for FortiClient endpoint agents on various platforms, is under active exploitation. The warning comes from Defused Cyber, which helps organizations deploy honeypots/fake assets, and uses them as well to capture real attack attempts and exploits and provide early warning threat intelligence. “Currently marked as not exploited on CISA and other Known Exploited Vulnerabilities (KEV) lists, [CVE-2026-21643] has seen first … More →
The post Critical Fortinet FortiClient EMS bug under active attack (CVE-2026-21643) appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2025/01/16140047/fortinet-1500-3.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 15:00:29 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Critical, Fortinet, FortiClient, EMS, bug, under, active, attack, CVE-2026-21643</media:keywords>
</item>

<item>
<title>IPVanish Threat Protection Pro blocks malicious activity before they reach the user</title>
<link>https://block385.com/ipvanish-threat-protection-pro-blocks-malicious-activity-before-they-reach-the-user</link>
<guid>https://block385.com/ipvanish-threat-protection-pro-blocks-malicious-activity-before-they-reach-the-user</guid>
<description><![CDATA[ IPVanish launched Threat Protection Pro, a new feature for Windows and macOS that is designed to provide always-on digital security. Threat Protection Pro is powered by cybersecurity technology from VIPRE, bringing over 25 years of threat intelligence and security expertise into the IPVanish app to deliver advanced, real-time protection against malicious websites, downloads, ads, and trackers, regardless of whether the VPN connection is active. This launch marks the latest advancement in IPVanish’s evolution as a … More →
The post IPVanish Threat Protection Pro blocks malicious activity before they reach the user appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/11/28150559/hns-large_logo.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 15:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>IPVanish, Threat, Protection, Pro, blocks, malicious, activity, before, they, reach, the, user</media:keywords>
</item>

<item>
<title>The State of Secrets Sprawl 2026: 9 Takeaways for CISOs</title>
<link>https://block385.com/the-state-of-secrets-sprawl-2026-9-takeaways-for-cisos</link>
<guid>https://block385.com/the-state-of-secrets-sprawl-2026-9-takeaways-for-cisos</guid>
<description><![CDATA[ Secrets sprawl isn&#039;t slowing down: in 2025, it accelerated faster than most security teams anticipated. GitGuardian&#039;s State of Secrets Sprawl 2026 report analyzed billions of commits across public GitHub and uncovered 29 million new hardcoded secrets in 2025 alone, a 34% increase year over year and the largest single-year jump ever recorded.
This year&#039;s findings reveal three core trends: AI has ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4tVpFBDvdU-vz8vM1T6SJZwd3AiySFqEyonUutxGPNimXEqTVOKN-pCI_lF5Ti2GngFUPtEphVI4Qep03CBciF7NhaWEIKYdDfkVY-VleTTcqYJvcMTKrd-EJ4kh2zLk3cY7pqqxI7bfEghuxGAV7lwUPjTD6nTa5dKj5e8_RJD9UjHn12015puG8P4o/s1600/key.gif" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 14:30:13 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>The, State, Secrets, Sprawl, 2026:, Takeaways, for, CISOs</media:keywords>
</item>

<item>
<title>Android 17 tweaks location privacy with one&#45;time access</title>
<link>https://block385.com/android-17-tweaks-location-privacy-with-one-time-access</link>
<guid>https://block385.com/android-17-tweaks-location-privacy-with-one-time-access</guid>
<description><![CDATA[ Google introduced a suite of location privacy features in Android 17 Beta 3 to give users more control and provide developers with tools for data minimization and product safety. Location button overview Android 17 introduces a new UI element called the location button, designed for one-time access to precise location. This feature supports common tasks that do not require persistent or background access, such as finding nearby places or tagging content. Users can customize location … More →
The post Android 17 tweaks location privacy with one-time access appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2026/02/16083000/android-17-1500.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 13:00:12 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Android, tweaks, location, privacy, with, one-time, access</media:keywords>
</item>

<item>
<title>Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels</title>
<link>https://block385.com/russian-ctrl-toolkit-delivered-via-malicious-lnk-files-hijacks-rdp-via-frp-tunnels</link>
<guid>https://block385.com/russian-ctrl-toolkit-delivered-via-malicious-lnk-files-hijacks-rdp-via-frp-tunnels</guid>
<description><![CDATA[ Cybersecurity researchers have discovered a remote access toolkit of Russian-origin that&#039;s distributed via malicious Windows shortcut (LNK) files that are disguised as private key folders.
The CTRL toolkit, according to Censys, is custom-built using .NET and includes various executables&quot; to facilitate credential phishing, keylogging, Remote Desktop Protocol (RDP) hijacking, and reverse tunneling ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh05CEOtp0cIlsi1qDK4HRH2PPOFyvB5jca65pAQVsnCfBHZ-wRGt0s8VhvzO_l-4Q9H_xGKQsO_efVGzJ46ElLQNaq_FEp6wPUou4aqTvEKMPlEEGOTyEtISTj0VkC5QmO38HuxWehNDTUkdvCVCCp-GrIPWJyFt4dTLp1TIbqW8hAiVEJ-vxnoKUexR6-/s1600/ctrl-ctrl.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 12:30:10 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Russian, CTRL, Toolkit, Delivered, via, Malicious, LNK, Files, Hijacks, RDP, via, FRP, Tunnels</media:keywords>
</item>

<item>
<title>SystemRescue 13 updates its kernel to Linux 6.18 LTS, adds new recovery tools</title>
<link>https://block385.com/systemrescue-13-updates-its-kernel-to-linux-618-lts-adds-new-recovery-tools</link>
<guid>https://block385.com/systemrescue-13-updates-its-kernel-to-linux-618-lts-adds-new-recovery-tools</guid>
<description><![CDATA[ Bootable Linux recovery environments occupy a specific niche in the systems administration and incident response toolkit. SystemRescue, an Arch-based live distribution built for repairing unbootable systems and recovering data from damaged drives, has shipped version 13.00 with a new long-term supported kernel, updated storage tools, and several additions to its command-line toolset. Kernel and storage updates The release moves to Linux 6.18.20, the current long-term supported kernel series. For a recovery distribution that needs to … More →
The post SystemRescue 13 updates its kernel to Linux 6.18 LTS, adds new recovery tools appeared first on Help Net Security. ]]></description>
<enclosure url="https://img.helpnetsecurity.com/wp-content/uploads/2024/03/31164614/linux-1500-1-patch.webp" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 11:00:11 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>SystemRescue, updates, its, kernel, Linux, 6.18, LTS, adds, new, recovery, tools</media:keywords>
</item>

<item>
<title>Three China&#45;Linked Clusters Target Southeast Asian Government in 2025 Cyber Campaign</title>
<link>https://block385.com/three-china-linked-clusters-target-southeast-asian-government-in-2025-cyber-campaign</link>
<guid>https://block385.com/three-china-linked-clusters-target-southeast-asian-government-in-2025-cyber-campaign</guid>
<description><![CDATA[ Three threat activity clusters aligned with China have targeted a government organization in Southeast Asia as part of what has been described as a &quot;complex and well-resourced operation.&quot;
The campaigns have led to the deployment of various malware families, including HIUPAN (aka USBFect, MISTCLOAK, or U2DiskWatch), PUBLOAD, EggStremeFuel (aka RawCookie), EggStremeLoader (aka Gorem RAT), MASOL ]]></description>
<enclosure url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMVmr08UFvUwMkDRW62724LCJu5Z774vza7r8UADDdCZcBFNJTeJ9WPFkt4BLIknMuCpLYow39D0rgDkTkftiSLBxtPsG3YW6Y7CRiPRxye2Con9Z1lP77VcDv2PA4UJ4PP6nNSCLX0cOKLKJOTCnVerXQ4w5we9s3rMTBbUMMX2hZBB5MLu5t4Ll3YFPe/s1600/chinese-hackers.jpg" length="49398" type="image/jpeg"/>
<pubDate>Mon, 30 Mar 2026 10:30:05 +0200</pubDate>
<dc:creator>jakovs</dc:creator>
<media:keywords>Three, China-Linked, Clusters, Target, Southeast, Asian, Government, 2025, Cyber, Campaign</media:keywords>
</item>

</channel>
</rss>