Critical Citrix NetScaler memory flaw actively exploited in attacks
Hackers are exploiting a critical severity vulnerability, tracked as CVE-2026-3055, in Citrix NetScaler ADC and NetScaler Gateway appliances to obtain sensitive data.
China-Linked groups target Southeast Asian government with advanced malware in 2025
China-linked groups hit a Southeast Asian government in 2025, deploying multiple malware families in a sophisticated cyber campaign.
DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials
DeepLoad exploits ClickFix and WMI persistence to steal credentials, enabling stealth reinfection after three days.
Addressing the OWASP Top 10 Risks in Agentic AI with Microsoft Copilot Studio | Microsoft Security Blog
Agentic AI introduces new security risks. Learn how the OWASP Top 10 Risks for Agentic Applications maps to real mitigations in Microsoft Copilot Studio.
Newly observed malware campaign likely combines AI and ClickFix
Using the techniques in tandem helps hackers evade detection, a security firm said.
AI SOC: Definition, Components & Architecture
Learn how to optimize your SIEM solution with key strategies and practices.
Citrix NetScaler products confirmed to be under exploitation
Security researchers at watchTowr warn that multiple flaws are involved in the early stages of a hacking spree that could rival the 2023 CitrixBleed campaign.
Mass PolyShell attack wave hits 214 stores in one hour
Sansec detected 214 stores compromised in a single hour as attackers exploit the PolyShell vulnerability at scale. The attack injects obfuscated JavaScript f...
It's a mystery ... alleged unpatched Telegram zero-day allows device takeover, but Telegram denies
A critical Telegram vulnerability could allow zero-click remote code execution on devices, but Telegram denies it.
European Commission downplays ShinyHunters cyberattack impact
Apple adds macOS Terminal warning to block ClickFix attacks
Apple has introduced a security feature in macOS Tahoe 26.4 that blocks pasting and executing potentially harmful commands in Terminal and alerts users to possible risks.
New macOS security feature will alert users about possible ClickFix attacks | Malwarebytes
Apple introduced an extra layer of protection against ClickFix attacks, only for macOS Tahoe 26.4 and later
Stryker restores most manufacturing after cyberattack
The medtech company has been working to restore manufacturing, ordering and shipping operations since it was hit by a cyberattack on March 11.
3 SOC Process Fixes That Unlock Tier 1 Productivity
Behavior-first triage with unified cross-platform analysis cuts workload 20% and MTTR by 21 minutes, accelerating SOC response.
⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
Active exploits, nation-state campaigns, fresh arrests, and critical CVEs — this week's cybersecurity recap has it all.
How to Evaluate AI SOC Agents: 7 Questions Gartner Says You Should Be Asking
AI SOC agents can reduce alert fatigue, but most teams fail to measure real outcomes. Prophet Security breaks down Gartner's questions for evaluating AI SOC agents and separating real impact from hype.
Incident responders, s'il vous plait: Invites lead to odd malware events
A phishing campaign targeting multiple organizations led to RMM installations – but not much else (yet). A threat actor experimenting, or an access-as-a-service attack underway?
Russian court sentences notorious card fraud ringleader ‘Flint’ and 25 associates
830 millions de dollars : l'immense data center de Mistral aux portes de Paris prend forme - Numerama
Mistral a annoncé ce lundi 30 mars 2026 avoir levé 830 millions de dollars sous forme de dette pour financer la construction d'un data center en Essonne, à Bruyères-le-Châtel. Le site, équipé de milliers de puces Nvidia de dernière génération, doit entrer en service d'ici à la fin du deuxième trimestre 2026. Mistral
Reprompt: Silent Copilot Data Exfiltration | CSA
Threat actors exploit Reprompt to exfiltrate data from Microsoft Copilot with a single click. Learn how it works and how to stay safe.
SC Media Names Cloud Security Alliance’s Trusted AI Safety | CSA
Code to Cloud Security: Unified Exposure Management | CSA
Learn how a code to cloud security strategy integrates development and runtime data into a unified exposure management view to prioritize critical cyber risks.
FIRESIDE CHAT: AI gives rise to a semantic attack surface, forcing a new class of network defense - The Last Watchdog
SAN FRANCISCO — Enterprises rushing to deploy AI in their operations are opening a security exposure most of their existing tools were never designed to address. That's the hard message coming out of RSAC 2026 — and it's one worth sitting with. Related: RSAC 2026 recap—no easy AI fixes Jamison Utter, A10 Networks field CISO,
The State of Secrets Sprawl 2026: 9 Takeaways for CISOs
29M secrets leaked in 2025, up 34% YoY, driven by AI growth and poor remediation, expanding enterprise attack surfaces.
Critical Fortinet FortiClient EMS flaw exploited for Remote Code Execution
Attackers are exploiting a critical Fortinet FortiClient EMS flaw (CVE-2026-21643) that allows remote code execution via SQL injection.
Hackers now exploit critical F5 BIG-IP flaw in attacks, patch now
F5 has reclassified a BIG-IP APM denial-of-service (DoS) vulnerability as a critical-severity remote code execution (RCE) flaw, warning that attackers are exploiting it to deploy webshells on unpatched devices.
Apple's Camera Indicator Lights - Schneier on Security
A thoughtful review of Apple’s system to alert users that the camera is on. It’s really well-designed, and important in a world where malware could surreptitiously start recording. The reason it’s tempting to think that a dedicated camera indicator light is more secure than an on-display indicator is the fact that hardware is generally more secure than software, because it’s harder to tamper with. With hardware, a dedicated hardware indicator light can be connected to the camera hardware such that if the camera is accessed, the light must turn on, with no way for software running on the device, no matter its privileges, to change that. With an indicator light that is rendered on the display, it’s not foolish to worry that malicious software, with sufficient privileges, could draw over the pixels on the display where the camera indicator is rendered, disguising that the camera is in use...
Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels
Russian CTRL toolkit spread via malicious LNK files in February 2026, routing C2 through FRP-tunneled RDP to evade detection.
Piratage Commission européenne : ShinyHunters vole 350 Go de données sur Europa.euLa Commission européenne piratée : ShinyHunters revendique le vol de 350 Go de données sur Europa.eu - Numerama
la Commission européenne a confirmé le 27 mars avoir été victime d'une cyberattaque visant l'infrastructure cloud de sa plateforme Europa.eu. Le groupe ShinyHunters revendique l'opération et affirme avoir exfiltré plus de 350 Go de données. Le communiqué date du 27 mars, mais l'intrusion a été détectée dès le 24.
Microsoft pulls KB5079391 Windows update over install issues
Microsoft has pulled a buggy Windows 11 non-security preview update to investigate a known issue that triggers 0x80073712 errors during installation.