Microsoft has released PowerToys 0.97, with a new mouse utility for multi-monitor setups and significant improvements to the Command Palette quick launcher. [...]
Identity-based attacks are one of the primary paths attackers use to breach corporate networks. Tenfold shows how Identity Threat Detection helps spot suspicious account activity before real damage occurs. [...]
Learn how security leaders and SOC teams can work together to close the gap between platform decisions and operational needs. Join Sumo Logic and BleepingComputer on January 29 for a practical webinar on aligning security tools with real-world workflows. [...]
A set of three security vulnerabilities has been disclosed in mcp-server-git, the official Git Model Context Protocol (MCP) server maintained by Anthropic, that could be exploited to read or delete arbitrary files and execute code under certain conditions.
"These flaws can be exploited through prompt injection, meaning an attacker who can influence what an AI assistant reads (a malicious README,
Cybersecurity researchers have uncovered a new phishing campaign that exploits social media private messages to propagate malicious payloads, likely with the intent to deploy a remote access trojan (RAT).
The activity delivers "weaponized files via Dynamic Link Library (DLL) sideloading, combined with a legitimate, open-source Python pen-testing script," ReliaQuest said in a report shared with
Many security teams are forced to defend environments using tools they didn't choose. This webinar explores how SOC teams can overcome alert fatigue, platform gaps, and AI hype to get real results from the tools they already have. [...]
The Problem: The Identities Left Behind
As organizations grow and evolve, employees, contractors, services, and systems come and go - but their accounts often remain. These abandoned or “orphan” accounts sit dormant across applications, platforms, assets, and cloud consoles.
The reason they persist isn’t negligence - it’s fragmentation.
Traditional IAM and IGA systems are designed
Cybersecurity researchers have disclosed details of a malware campaign that's targeting software developers with a new information stealer called Evelyn Stealer by weaponizing the Microsoft Visual Studio Code (VS Code) extension ecosystem.
"The malware is designed to exfiltrate sensitive information, including developer credentials and cryptocurrency-related data. Compromised developer
Cloudflare has addressed a security vulnerability impacting its Automatic Certificate Management Environment (ACME) validation logic that made it possible to bypass security controls and access origin servers.
"The vulnerability was rooted in how our edge network processed requests destined for the ACME HTTP-01 challenge path (/.well-known/acme-challenge/*)," the web infrastructure
Leaked API keys are no longer unusual, nor are the breaches that follow. So why are sensitive tokens still being so easily exposed?
To find out, Intruder’s research team looked at what traditional vulnerability scanners actually cover and built a new secrets detection method to address gaps in existing approaches.
Applying this at scale by scanning 5 million applications revealed over
SentinelLABS, la division de recherche sur les menaces de SentinelOne, a publié son rapport annuel « 12 Months of Fighting Cybercrime & Defending Enterprises ». Cette analyse approfondie revient sur l’évolution des tactiques des cyberattaquants tout au long de l’année 2025. Le constat est sans appel : plus qu’une succession de ruptures technologiques, 2025 aura […]
Le 19 janvier 2026, l'Union de recouvrement des cotisations de sécurité sociale et d’allocations familiales (Urssaf) a annoncé une fuite de données d'une ampleur inédite. Au total, 12 millions de salariés pourraient être concernés par cet incident. Voici les risques concrets pour les personnes concernées et comment réduire les risques.
Dans un article publié le 16 janvier 2026, les chercheurs en cybersécurité de Huntress ont mis en lumière la face cachée d’une extension de blocage de publicités pour Chrome et Edge. Nommée NexShield, elle provoque volontairement le plantage du navigateur en préparation de l’assaut final.
A Telegram-based guarantee marketplace known for advertising a broad range of illicit services appears to be winding down its operations, according to new findings from Elliptic.
The blockchain intelligence company said Tudou Guarantee has effectively ceased transactions through its public Telegram groups following a period of significant growth. The marketplace is estimated to have processed
Cybersecurity researchers have disclosed details of a security flaw that leverages indirect prompt injection targeting Google Gemini as a way to bypass authorization guardrails and use Google Calendar as a data extraction mechanism.
The vulnerability, Miggo Security's Head of Research, Liad Eliyahu, said, made it possible to circumvent Google Calendar's privacy controls by hiding a dormant
Le 16 janvier 2026, la Royal Navy a annoncé la réussite du premier vol de Proteus, un drone autonome de la taille et de la forme d’un hélicoptère conçu pour opérer depuis des navires en soutien de diverses missions, notamment la recherche de sous-marins hostiles.
OpenAI is offering ChatGPT Plus, which costs $20 in the United States, for free, but the offer is valid for some accounts only, and it's a limited-time deal. [...]
A malvertising campaign is using a fake ad-blocking Chrome and Edge extension named NexShield that intentionally crashes the browser in preparation for ClickFix attacks. [...]
Connexion
