thehackernewsexperts.blogspot.com
Covers: Detection & ResponseIdentity & Access ManagementPhishing & Social EngineeringAI SecurityVulnerabilities & PatchingGovernance, Risk & ComplianceEndpoint & Network SecurityCloud SecurityThreat Actors & Nation-StateData Breaches
A SailPoint CISO outlines nine identity security predictions for 2026, including AI-driven identity governance replacing manual access reviews and role-based access control, liveness detection to counter deepfakes, and passkeys from Apple, Google, and...
A vendor CEO writing in The Hacker News argues that AI for GRC should replace workflows rather than improve them, and that an agent only earns the label 'agentic' if it executes an entire workflow, including the decision-making between each step, from...
Organizations faced an average of 1,968 cyber attacks per week in 2025, an 18% year-over-year increase and nearly 70% since 2023, while ClickFix-style activity rose roughly 500% and appeared in nearly half of documented malware campaigns. The report...
A Hacker News article argues that SOCs are designed, staffed, and measured around high-volume routine alerts like phishing and endpoint detections, so low-frequency signals such as a single WAF anomaly, a vendor's admin-account reset notice, or a dark web...
An MSP-focused practitioner piece argues that most Microsoft 365 breaches will begin with known configuration gaps rather than zero-days, citing policies left in report-only mode for years, legacy authentication kept on for one app, and unaudited app...
The article explains that ECDHE, the elliptic-curve key exchange underpinning TLS and securing trillions of connections daily, relies on the elliptic curve discrete logarithm problem, which Shor's algorithm would make trivial for a sufficiently powerful...
A Bitdefender-authored article on The Hacker News argues that AI in cybersecurity is not plug-and-play for lean security teams, who must weigh selecting and integrating AI-enabled tools, training staff, validating outputs, and tuning models over time. It...
Prophet Security described two investigations in which its AI engine correlated weak signals across multiple telemetry sources: in one, a dormant IAM user with a four-year-old access key began listing S3 buckets and enumerating CloudFront distributions...
A Hacker News article argues that CVSS, which was built to standardize technical severity scoring, does not capture context such as whether an asset is internet-facing, how critical it is to the business, or whether attackers are actively exploiting the...
The article argues that enterprise work has moved into HTTPS browser sessions on port 443, where firewalls see only an encrypted connection and cannot distinguish a ChatGPT prompt containing customer PII, a credential-harvesting browser extension, or a...
A January 2026 incident at the French Ministry of Finance saw a threat actor use credentials stolen from a civil servant to reach the national bank account registry (FICOBA), exposing sensitive financial and personal data for approximately 1.2 million...
Shai-Hulud 2.0, which hit in late 2025, was a self-propagating worm that weaponized the npm installation lifecycle, using a pre-install execution hook to achieve code execution before static analysis or testing suites could initialize. Once active, it...
Higher education institutions run hybrid identity environments that combine on-premises Microsoft Active Directory with cloud platforms like Microsoft Entra ID, and the two often operate in parallel with inconsistencies between them - disabling an account...
Telegram blocked more than 43 million channels and groups in 2025 as moderation volumes climbed sharply and stayed high into early 2026, with some single days reaching hundreds of thousands of removals. Check Point's analysis found carding operations,...
Semgrep's Remediation at Scale report analyzed anonymized remediation patterns across 50,000+ repositories and hundreds of organizations in 2025, splitting them into a top-15% "leaders" cohort and an 85% "field" cohort. The largest gap appeared in...
GitGuardian's research found 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34% year-over-year increase and the largest single-year jump the report has recorded, with 1,275,105 leaked secrets tied to AI services, up 81%. Claude...
This article describes how vulnerability management has moved from periodic scanning and CVSS-based patch deadlines toward continuous visibility, exploit-aware prioritization, and detection of exploitation attempts, because threat actors now exploit flaws...
Bitdefender's Martin Zugec argues that LLMs are optimized to predict the most statistically probable output, making them poor at finding the low-probability anomalies hackers exploit, and that probabilistic hallucination breaks malware that requires...
A Sygnia director recounts an engagement where an organization with mature AI-driven detection and monitoring had stalled because the security team and IT disagreed on ownership and business leadership saw cyber risk as under control. Progress came only...
The FBI's Internet Crime Complaint Center reported that business email compromise generated $3 billion in losses in 2024, and the article argues that AI-enabled attacks are accelerating the trend. It says organizations running only a secure email gateway...
Session cookie theft lets an attacker replay a stolen token from their own browser and reach an application without a username, password, or MFA prompt, because the application checks the token rather than the credentials after login. Infostealers sold on...
Filigran outlines a six-stage Threat-Informed Defense pipeline built on MITRE ATT&CK, moving from threat assessment and adaptive watchlists through exposure assessment, adversary exposure validation, remediation prioritization, and quarterly executive...
The article argues that Adversarial Exposure Validation (AEV) platforms should test human readiness alongside technical controls by injecting synthetic incidents into real environments, so analysts' escalation and incident commanders' decisions become part...
A Filigran-commissioned third-party market survey cited in this article found that 96% of security teams struggle to validate whether their risks are exploitable, and 2 in 3 lack a consolidated view of their cyber risk exposure. The article argues that...
A Hacker News piece describes a ransomware timeline in which attackers steal credentials on Day 0, move laterally by Day 3, reach domain admin by Day 7, begin targeting backups by Day 10, and trigger encryption on Day 14. The article states that many...
In August 2025, Brave's security team disclosed an indirect prompt injection against Perplexity's Comet browser, hiding instructions in a Reddit spoiler tag that led Comet to extract a user's email address and a one-time passcode. The attack chain ran in...
In November 2025, Anthropic disclosed GTG-1002, a campaign in which a Chinese state-sponsored group manipulated its Claude Code assistant to carry out roughly 80% of a multi-target intrusion autonomously, covering reconnaissance, vulnerability discovery,...
The article argues that SaaS environments run on implicit trust: OAuth tokens and API keys issued to third-party apps often never expire or get rotated, and integrations routinely receive broader permissions than they need. It cites the early-2023 Slack...
Non-human identities such as AI assistants, automation bots, integration services, and API tokens now act across SaaS applications with the same or greater privileges as employees, and about one-third of SaaS app integrations have access to sensitive data...
ShinyHunters, a cybercrime group monetizing stolen data since 2020, shifted from credential and database theft to social engineering, using vishing and fraudulent OAuth access to breach Salesforce environments at Google, Workday, Pandora, Cisco, Chanel and...