Tech news

Security technology news

Headlines from leading security publications and research teams, refreshed automatically. Choose a category to narrow them.

Updated automatically every 6 hours. Last update 2 Nov 2026, 05:35 IST · 13 sources · Get these by email

Policy, regulation & law enforcement FBI Arrests Executive at Ransomware Negotiation FirmAgents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell… Krebs on Security · Global · 10 Oct 2026
Vulnerabilities & exploits Making sure the checks get printedPierre's debut newsletter explores the messy, real-world side of risk management and how to keep vital systems running when a perfect patch isn't an option. Cisco Talos · Global · 8 Oct 2026
Cloud & SaaS Evolution of Web3 in Cloud Supply Chain AttacksUnit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42. Unit 42 · Global · 7 Oct 2026
Policy, regulation & law enforcement ShinyHunters Extorted Boeing Spin-off Prior to ArrestsA teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle "Rey,"… Krebs on Security · Global · 7 Oct 2026
Applications & supply chain Blinder Tunnel Campaign Targets Iraqi InfrastructureAnalysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42. Unit 42 · Global · 6 Oct 2026
Vulnerabilities & exploits How to fix a bug in a fixProject Zero often works with software vendors to remediate the vulnerabilities we report and provide broader guidance on making software more secure. Some vendors express concern about potential scenarios in which they are unable to fix vulnerabilities that are causing immediate user harm, due to… Google Project Zero · Global · 6 Oct 2026
Network & security devices Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) appeared first on Unit 42. Unit 42 · Global · 30 Sep 2026
Cloud & SaaS OperTraitors: How Kubernetes Operators Betray Your Security PostureWe introduce OperTraitor, a tool to audit privileges of Kubernetes operators, identify excessive RBAC risks, and secure non-human identities. The post OperTraitors: How Kubernetes Operators Betray Your Security Posture appeared first on Unit 42. Unit 42 · Global · 29 Sep 2026
Policy, regulation & law enforcement Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters InvestigationAuthorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect's arrest, remaining ShinyHunters members dramatically escalated their… Krebs on Security · Global · 28 Sep 2026
Threats, ransomware & breaches 3 Consulting Myths Debunked by Unit 42 ExpertsUnit 42 security experts address critical cybersecurity misconceptions, offering practical insights to help your organization reinforce its enterprise defenses. The post 3 Consulting Myths Debunked by Unit 42 Experts appeared first on Unit 42. Unit 42 · Global · 25 Sep 2026
Threats, ransomware & breaches U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon ExtortionsA U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims. Krebs on Security · Global · 25 Sep 2026
Vulnerabilities & exploits Windows Exploitation Techniques: Dangling COM Object RegistrationsThis short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug was a dangling COM object… Google Project Zero · Global · 21 Sep 2026
Threats, ransomware & breaches Data Broker Radaris Loses Domains in Privacy FightThe consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that… Krebs on Security · Global · 16 Sep 2026
AI security Microsoft Plugs Nearly 1,000 Security HolesMicrosoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many… Krebs on Security · Global · 8 Sep 2026
Vulnerabilities & exploits Testing race conditions with memory access tracing and stack-based delay injectionMany security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: Confirming bug candidates that have been discovered manually or through static analysis. Regression tests:… Google Project Zero · Global · 8 Sep 2026
Vulnerabilities & exploits A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window OpensWe recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible to go from a zero-click context to root on Android in just two exploits. The Dolby 0-click vulnerability existed across all of Android, until it was patched in January 2026. While we had an exploit… Google Project Zero · Global · 13 May 2026
Vulnerabilities & exploits On the Effectiveness of Mutational Grammar FuzzingMutational grammar fuzzing is a fuzzing technique in which the fuzzer uses a predefined grammar that describes the structure of the samples. When a sample gets mutated, the mutations happen in such a way that any resulting samples still adhere to the grammar rules, thus the structure of the… Google Project Zero · Global · 5 Mar 2026
Applications & supply chain A Deep Dive into the GetProcessHandleFromHwnd APIIn my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t know existed until I found a publicly disclosed UAC bypass using the Quick Assist UI Access application. This API looked interesting so I thought I should take a closer look. I typically start by… Google Project Zero · Global · 26 Feb 2026
Operating systems & software Bypassing Administrator Protection by Abusing UI AccessIn my last blog post I introduced the new Windows feature, Administrator Protection and how it aimed to create a secure boundary for UAC where one didn’t exist. I described one of the ways I was able to bypass the feature before it was released. In total I found 9 bypasses during my research that… Google Project Zero · Global · 12 Feb 2026
Vulnerabilities & exploits Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529In the first part of this series, I detailed my journey into macOS security research, which led to the discovery of a type confusion vulnerability (CVE-2024-54529) and a double-free vulnerability (CVE-2025-31235) in the coreaudiod system daemon through a process I call knowledge-driven fuzzing.… Google Project Zero · Global · 30 Jan 2026

Headlines and short excerpts are collected automatically from public sources and link to the original publisher. NAPSECURE does not verify third-party content. Categories are assigned automatically and may occasionally be wrong.