Reducing shadow IT visibility gaps with Wazuh

Shadow IT includes hardware, software, and services running outside IT and security teams’ visibility or approval.  It can include unapproved applications employees install, browser extensions with excessive permissions, and endpoints provisioned once and never enrolled in any monitoring platform. These unmanaged assets create visibility gaps because existing security controls do not monitor them. Many organizations […]

Check Point warns of Management Server zero-day exploited in attacks

Check Point Software released emergency hotfixes to address a critical Security Management Server vulnerability that could let attackers run arbitrary scripts. The Security Management Server is a central repository that stores and manages security policies, processes administrator changes, and collects system logs across enterprise networks. Tracked as CVE-2026-93616, this path traversal flaw lets unauthenticated threat […]

EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts

The EvilTokens platform that compromised more than 12,000 Microsoft accounts at over 10,000 organizations has been disrupted in an effort led by Microsoft’s Digital Crimes Unit (DCU). The phishing-as-a-service (PhaaS) operation emerged in February and was the first to support device code authentication at scale and offer cybercriminals AI-powered features for customizing lures and sifting […]

Webinar tomorrow: Inside real-world Google Workspace breaches

Google Workspace breaches don’t always begin with sophisticated exploits or stolen passwords. Sometimes attackers simply convince users to grant them the access they need. Tomorrow, September 23, BleepingComputer will host a live webinar titled “Breach autopsy: How fast-growing companies are breached through Google Workspace” with Material Security. The webinar will feature Rajan Kapoor, Vice President […]

Google fined €403 million over location data privacy violations

Ireland’s Data Protection Commission (DPC) has fined Google €403 million ($463M) for multiple GDPR violations related to processing users’ location data. The agency launched an investigation in February 2020 after receiving multiple complaints from consumer rights organizations. It examined three Google features that were active during the GDPR application period from May 25, 2018, through […]

Microsoft reminds admins to migrate Entra ID users to passkeys

Microsoft has reminded administrators to migrate Entra ID users to phishing-resistant methods, such as passkeys, to avoid sign-in disruptions after it retires SMS first-factor sign-in starting in February 2027. Admins also have alternatives, including QR code authentication, FIDO2 security keys, and other Entra ID-supported authentication methods. Before this date, organizations should ensure all users use […]