Ken Underhill

Attackers are actively exploiting Fortinet flaws to bypass authentication and take over security appliances.

ConsentFix abuses trusted Azure CLI OAuth flows to hijack Microsoft accounts without passwords or MFA.

SantaStealer is a new malware-as-a-service infostealer that steals credentials and data using largely in-memory techniques.

Google warns that attackers are actively exploiting React2Shell to hijack unpatched servers.

Learn the strengths and weaknesses of MFA, how attackers bypass it, and how phishing-resistant MFA reduces identity-based attacks.

Learn how Security Service Edge (SSE) works, its benefits, key components, use cases, and why it matters for securing modern hybrid and cloud environments.

An unsecured database exposed 4.3 billion LinkedIn-derived records, enabling large-scale phishing and identity-based attacks.

Operation MoneyMount-ISO uses malicious ISO files to deliver Phantom Stealer to Windows.

Apple confirmed two WebKit zero-days exploited in targeted iPhone spyware attacks.

A fake Leonardo DiCaprio movie torrent is spreading Agent Tesla malware through trusted Windows tools.

A Windows Defender Firewall flaw lets privileged attackers read sensitive memory, showing how low-severity bugs can still enable data exposure.

Malicious VS Code extensions hid malware in PNG files, compromising developer environments and supply chains.