How an LLM Beat Ivanti’s Own Scanners to a Critical Bug
An Ivanti LLM vulnerability discovery turned up a perfect 10 flaw in Sentry, and attackers pounced within a day.
Secure.com News
Stay updated with the latest cybersecurity news, threat intelligence, and industry updates from secure.com.
Browse by Category
Inc Ransomware Breaks Into SonicWall VPN Gateways Using Two Zero Days
Attackers used SonicWall SMA zero days to break into VPN gateways, steal logins, and prep ransomware
CISA Gives Feds Until Sunday to Patch Exploited FortiSandbox Flaws
Two FortiSandbox flaws are under active attack, and CISA gave federal agencies until Sunday to patch.
A Million Phishing Emails Are Hiding Behind Invisible Text, & AI Filters Keep Falling for It
Text salting is helping more than a million phishing emails walk past AI email filters, and the trick is older than the filters.
The Botnet That Shipped With Its Own AI Safety Warning Still Attached
TuxBot v3 is an IoT botnet built with LLM help. Researchers found the AI safety disclaimer still sitting in the shipped source code.
The Phishing Kit That Hid in Plain Sight for Six Months, Betrayed by Two Image Files
Researchers traced 1,628 sandbox sessions back to the Kratos phishing kit, and the tell was two SVG files nobody thought to look at.
The Fix Sat There for 58 Days. Then Somebody Used the Hole.
Two npm supply chain attacks hit developer machines in five days, and one of them walked through a hole that had been documented since April.
Spirals Ransomware Went From Break In to Blackout in Under 24 Hours
Spirals ransomware went from web shell to full network encryption in less than 24 hours, and researchers think the crew is just getting started.
Half an Hour After Patch Tuesday, Someone Dropped a Working Exploit Microsoft Cannot Fix Yet
The LegacyHive Windows zero-day has working exploit code, no CVE, no patch, and it runs fine on machines you updated yesterday.
Five Windows RDP Bugs Leak Memory. Microsoft Says Relax. Read the Fine Print First.
Five new Windows RDP vulnerabilities let attackers read leftover memory from remote sessions, and the scraps they find are worth more than the bugs themselves.
CISA Warns: Three SharePoint Flaws Are Under Attack Right Now, and Patching Might Not Save You
CISA warns that three SharePoint flaws are actively exploited, and patching alone will not evict attackers who already stole your machine keys.
ShinyHunters Turn Salesforce Trust Into a Loaded Gun, Microsoft Warns
Microsoft warns that ShinyHunters Salesforce OAuth abuse is stealing CRM data without tripping a single login alarm.