Threatline

Dark Reading Polls

Why a Platform Approach to SASE is Your Best Defense Against Adversarial AI

SASE architectures, though not new, were formally introduced as a market capability in 2019.

Ctrl+Alt+Oops: FortiBleed criminal's logins stitch two gangs together

Researchers scoured logs, finding opsec fail for at least one person who was working with INC and Lynx simultaneously

ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories

This week’s security news is mostly about weak spots. Browsers, bots, sandboxes, AI systems, and email flows all show the same problem in different ways. Everything looks normal until someone tests a small gap and finds a way through. This is not one big break. It is small permissions, weak checks, open systems, and normal tools doing things they were allowed to do. That same pattern runs

Google loses final appeal to overturn €4.1 billion EU fine

Court of Justice of the European Union (CJEU) has dismissed Google's final appeal against a €4.1 billion ($4.7 billion) antitrust fine over the company's use of Android to promote its Chrome browser and search service. [...]

Microsoft said exploitation was 'less likely' ... but CISA just added SharePoint RCE to KEV list

Attackers need little more than a valid SharePoint account to execute code on vulnerable on-prem servers

ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds

ConsentFix and ClickFix attacks steal Microsoft 365 tokens in seconds using fake prompts and OAuth flows. Learn how these MFA bypass tactics work and how to defend against them. [...]

ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API

The threat actor known as ToddyCat has been attributed to a new malware called Umbrij that's designed to gain surreptitious access to a victim's email correspondence via the Google API. "In this campaign, the attackers focused their attention on corporate email communications hosted on Gmail, targeting access compromise via APIs," Kaspersky said in a detailed report published this week. "

Pacemaker manufacturer Medtronic warns patients cybercrooks may have swiped health data

Company that also makes insulin pumps and other devices tells users what was exposed months after ShinyHunters attack

Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them.

IBM and Red Hat assign 20,000 engineers to the new Project Lightwell service as Anthropic's Mythos findings ignite debate over how to secure the open-source software supply chain.