Dreigingen

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

CVE-2026-61732

Doetinchemse burgemeester Mark Boumans stopt ermee

Mark Boumans stopt als burgemeester van Doetinchem. De 51-jarige bestuurder, die sinds 2017 burgemeester was van de Achterhoekse gemeente, stapt op 1 december over naar de Vereniging Hogescholen, waarvan hij voorzitter wordt.

Ransomwareclaim door Rhysida — sector onbekend

De ransomwaregroep Rhysida claimt een nieuw slachtoffer. Dit is een publieke, niet onafhankelijk bevestigde claim van een leksite; uitsluitend gebruikt als geaggregeerd sector- en landsignaal. Namen van (vermeende) slachtoffers worden niet gepubliceerd.

Ransomwareclaim door Incransom — sector onbekend (MO)

De ransomwaregroep Incransom claimt een nieuw slachtoffer in MO. Dit is een publieke, niet onafhankelijk bevestigde claim van een leksite; uitsluitend gebruikt als geaggregeerd sector- en landsignaal. Namen van (vermeende) slachtoffers worden niet gepubliceerd.

Cisco Identity Services Engine Authentication Bypass Vulnerabilities

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a remote attacker to access or manipulate data, obtain sensitive information, or cause a reload of certificate and key material on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/cente

CVE-2026-76439

Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to help defenders detect and disrupt this activity before ransomware deployment. The post Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments appeared first on Microsoft Security Blog .

3 Cyber Threats That Defined the Summer of 2026

This installment of the Reporters' Notebook video series discusses the impact of AI agents breaching Hugging Face, Fairlife's ransomware attack, and Iranian-linked threat actors compromising a dozen US water systems. It was a busy summer.

Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer

An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. "When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the

'Android-malware gebruikt vaker vpn voor blokkeren van Google Play Protect'

Android-malware gebruikt steeds vaker een vpn-service voor het blokkeren van Google Play Protect om zo detectie door de ...

Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure

Introduction The landscape of software supply chain security has undergone a significant shift. Recent campaigns demonstrate that sophisticated threat actors are systematically targeting the engineering lifecycle by compromising trusted security and programming tools. These intrusions reveal three key tactics: Attackers target trusted security scanners, utility libraries, and AI developer tools to exploit the elevated privileges granted to these systems within build pipelines. Adversaries target developer workstations and Integrated Development Environments (IDEs) via highly tailored social en

Verdachte achter ransomware-aanvallen moet 1,2 miljoen dollar betalen

Een 35-jarige Armeense man is in de Verenigde Staten wegens het uitvoeren van ransomware-aanvallen veroordeeld tot een ...

When Business Email Compromise Starts Rewriting Reality

Business Email Compromise (BEC) operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets. This dynamic is central to our analysis as we kick off a series around Rapid7's collaborative research with Zimbra; upcoming installments will explore technical details and broader findings based within the Zimbra Collaboration Suite. Our investigation disrupted the traditional BEC model in unexpected ways. We uncovered over 50 vulnerabilities, and found that several

CVE-2022-27925