News

Web application security

May 29, 2026 29 May'26
Microsoft hits out over irresponsible vulnerability disclosure

Microsoft goes on the offensive after a disgruntled security researcher unleashed a series of zero-days without checking in first.
May 27, 2026 27 May'26
Glassworm botnet that targeted OS devs smashed to pieces

CrowdStrike, Google and the Shadowserver Foundation worked together to take down a botnet that poisoned over 300 GitHub repositories, risking widespread supply chain compromise
May 27, 2026 27 May'26
The Gentlemen emerging as key ransomware player

An emerging ransomware crew known as The Gentlemen is becoming a force to be reckoned with, according to NCC’s latest monthly threat data
May 19, 2026 19 May'26
Vulnerability exploitation now primary origin of data breaches

Verizon’s annual cyber report reveals a major change in how data breaches originate, highlighting the impact of artificial intelligence

May 13, 2026 13 May'26
AI threats push Middle East CISOs towards identity-first security

Deepfakes and shadow AI have rendered the traditional security playbook obsolete, prompting cyber leaders to shift towards resilience-first defences
May 12, 2026 12 May'26
Microsoft releases rare zero-day free Patch Tuesday update

No zero-day flaws were addressed in May’s Patch Tuesday update but as usual there is much for admins to chew over in the coming days
May 12, 2026 12 May'26
UAE launches sovereign AI-driven Cyber Factory security initiative

UAE Cyber Security Council and CPX unveil national cyber manufacturing initiative aimed at strengthening digital sovereignty, AI-powered defence and critical infrastructure resilience
May 11, 2026 11 May'26
UK government renews calls to sign Cyber Resilience Pledge

Westminster renews calls for business leaders to sign up to its yet-to-be-launched Cyber Resilience Pledge, and highlights growth, and challenges, for the UK’s cyber economy
May 11, 2026 11 May'26
The Netherlands leads in quantum technology but lags on quantum security

The Dutch government has invested €615m to build a world-class quantum technology ecosystem, but many institutions have not started any quantum-specific preparations to protect themselves against the security threat
May 08, 2026 08 May'26
ESET: Don’t fear the ‘AI Terminator’, but prepare for agent risks

While fully autonomous hacking bots remain a distant reality, an ESET expert warns that AI is quietly supercharging phishing schemes and creating new vulnerabilities inside organisations

May 06, 2026 06 May'26
ServiceNow Knowledge 2026: McDermott proclaims fully automated cyber defence

Chief executive’s conference keynote launches agentic artificial intelligence cyber security features for enterprise software player’s centralised platform
May 04, 2026 04 May'26
UK’s NCSC warns of ‘wave of patches’

Vulnerability discovery and mitigation continues to exercise the top minds at Britain’s NCSC as cyber experts continue to debate the impact of frontier AI models such as Mythos
May 01, 2026 01 May'26
IAM tools help Oracle Red Bull Racing keep pace with strict F1 regulations

Oracle Red Bull Racing massively improved the efficiency of its aerodynamics testing procedures after implementing new identity technology from 1Password. Learn more about this unlikely link
April 24, 2026 24 Apr'26
Wiz founder: Hack yourself with AI, before the bad guys do

At Google Cloud Next, Wiz co-founder Yinon Costica called on security defenders to use AI to steal a march on threat actors, and launched agentic capabilities for cyber teams
April 22, 2026 22 Apr'26
NCSC heralds end of passwords for consumers and pushes secure passkeys

UK National Cyber Security Centre is urging consumers to replace passwords and two-factor authentication with passkeys, following a technical study that shows they are more secure and easier to use
April 22, 2026 22 Apr'26
A tsunami of flaws: When frontier AI and Patch Tuesday collide

Microsoft’s April Patch Tuesday drop was the second-largest in history, falling just shy of an October 2025 record. What is behind the spike in vulnerability disclosures, and is there a connection to Anthropic’s bug-hunting Claude Mythos AI model?
April 17, 2026 17 Apr'26
Surging CVE disclosures force NIST to shake up workflows

NIST announces big changes to the way it categorises and manages CVEs, which are set to have a big impact on how organisations manage patching and remediation
April 15, 2026 15 Apr'26
UK businesses must face up to AI threat, says government

Technology secretary Liz Kendall urges Britain’s business community to sit up and pay attention to emerging AI threats, following the debut of Anthropic’s new frontier model, Mythos
April 14, 2026 14 Apr'26
April Patch Tuesday brings zero-days in Defender, SharePoint Server

Microsoft’s latest Patch Tuesday update may be one of the largest in history, with more than 160 issues in scope
April 02, 2026 02 Apr'26
How ‘Wikipedia of cyber’ helps SAP make sense of threat data

SAP runs enormous cloud environments for some of the world’s most heavily-regulated organisations, and in the hyperscale era, data security and compliance were becoming big challenges. It turned to cutting-edge agentic tools from Uptycs to cut ...
March 26, 2026 26 Mar'26
Agentic bots and synthetic identities fuel surge in fraud

LexisNexis Risk Solutions warns of a 450% rise in agentic traffic and an eight-fold increase in synthetic identity fraud as cyber criminals scale automation to bypass security controls
March 25, 2026 25 Mar'26
Emergency Microsoft, Oracle patches point to wider cyber issues

Emergency out-of-band patches from Microsoft and Oracle signal underlying security issues around update cycles and patching, and identity security and zero-trust, says the community
March 24, 2026 24 Mar'26
Cyber pros must grasp the vibe coding nettle, says NCSC chief

At RSA in San Francisco, NCSC chief exec Richard Horne says security professionals have an opportunity and a responsibility to get in front of the security issues raised by the popularity of ‘vibe coding’
March 19, 2026 19 Mar'26
Gartner: Ditch ‘big transformation’ cyber strategies for continuous improvement

As artificial intelligence reshapes the enterprise, CISOs must abandon risky big bang security transformation initiatives in favour of incremental changes to build cyber resilience
March 19, 2026 19 Mar'26
Apple issues first Background patch for WebKit browser flaw

Apple’s first ever Background Security Update fixes a WebKit browser engine bug that could enable threat actors to see and steal important data from their victims
March 16, 2026 16 Mar'26
Companies House restarts online services following cyber breach

Companies House was forced to pull its WebFiling service offline at the weekend after it emerged that a flawed update was putting data at risk of exposure
March 11, 2026 11 Mar'26
Salesforce tracks possible ShinyHunters campaign targeting its users

Salesforce warns users of an uptick in malicious activity targeting Experience Cloud customers with misconfigured user settings via an open source tool
March 10, 2026 10 Mar'26
Microsoft patches zero-days in .NET and SQL Server

Zero-days in .NET and SQL Server, and a handful of critical RCE bugs, form the nucleus of Microsoft’s March Patch Tuesday update
March 10, 2026 10 Mar'26
WA auditor general flags weak Microsoft 365 security controls across state entities

Western Australia’s Office of the Auditor General has uncovered weaknesses in M365 configurations across seven government agencies, leading to compromised accounts and data breaches
March 09, 2026 09 Mar'26
Trump looks to power up post-quantum, AI security

The US has unveiled a six-pillar national cyber security strategy, with developing technological areas such as post-quantum cryptography and artificial intelligence front and centre
March 09, 2026 09 Mar'26
APT36 unleashes AI-generated ‘vibeware’ to flood targets

The Pakistani threat group has been using AI to rewrite malicious code across multiple programming languages, prioritising scale over sophistication to evade detection, security researchers have found
March 05, 2026 05 Mar'26
Spyware suppliers exploit more zero-days than nation states

Exploitation of zero-days by commercial surveillance and spyware developers outpaced exploitation by nation-state actors last year, according to a report
February 25, 2026 25 Feb'26
Application exploitation back in vogue, says IBM cyber unit

IBM’s X-Force unit observes an uptick in the exploitation of vulnerable public-facing software applications
February 23, 2026 23 Feb'26
Innovate UK cyber startup programme gets £10m funding booster

Graduates of DSIT and Innovate UK's CyberASAP scheme to commercialise cutting-edge cyber research projects have raised nearly £50m in the past decade
February 23, 2026 23 Feb'26
Why crypto agility is key to quantum readiness

With quantum computing threatening current encryption standards, experts call for organisations to achieve crypto agility by managing the lifecycle of certificates and cryptographic keys through automation
February 19, 2026 19 Feb'26
PromptSpy Android malware may exploit Gemini AI

A newly uncovered malware targeting the Android operating system seems to exploit Google’s Gemini GenAI tool to help it maintain persistence
February 18, 2026 18 Feb'26
Flaws in Google and Microsoft products added to Cisa catalogue

Cisa has added six CVEs to its Kev catalogue this week, including newly disclosed issues in Google Chromium and Dell RecoverPoint for Virtual Machines, and some older flaws as well
February 11, 2026 11 Feb'26
CVE volumes may plausibly reach 100,000 this year

The number of vulnerabilities to be disclosed in 2026 is almost certain to exceed last year's total, and may be heading towards 100,000, according to analysis
February 10, 2026 10 Feb'26
Arctic Wolf targets mid-market security gap in APAC

Following the launch of its full portfolio in Malaysia, the SOC provider discusses the security challenges facing lean IT teams, the value of supplier neutrality, and its roadmap for AI and ransomware protection
February 10, 2026 10 Feb'26
February Patch Tuesday: Microsoft drops six zero-days

Microsoft releases patches for six zero-day flaws in its latest monthly update, many of them related to security feature bypass issues
February 10, 2026 10 Feb'26
Researchers delve inside new SolarWinds RCE attack chain

Researchers at Huntress and Microsoft have shared findings from their analysis of a new SolarWinds Web Help Desk vulnerability
February 04, 2026 04 Feb'26
SolarWinds RCE bug makes Cisa list as exploitation spreads

Exploitation of CVE-2025-40551, an RCE flaw affecting SolarWinds Web Help Desk, appears to be spreading, with defenders on high alert
February 02, 2026 02 Feb'26
Canva uses 1Password to secure ID during growth phase

As it underwent a growth spurt in the early 2020s, graphic design platform Canva turned to 1Password to manage identity across its expanding organisation
February 02, 2026 02 Feb'26
Interview: Why identity is the nucleus for cyber security

Amid a wave of market consolidation, Computer Weekly speaks to Keeper Security’s leadership on how identity and access management systems are becoming unified identity platforms capable of securing both human and machine identities
January 15, 2026 15 Jan'26
Cyber body ISC2 signs on as UK software security ambassador

Professional cyber association ISC2 pledges support to UK government’s Software Security Ambassador scheme, part of the recently unveiled Cyber Action Plan
January 14, 2026 14 Jan'26
Texas judge throws out second lawsuit over CrowdStrike outage

A US judge has dismissed a lawsuit filed by CrowdStrike shareholders over the July 2024 outage that caused widespread disruption around the world
January 13, 2026 13 Jan'26
Microsoft patches 112 CVEs on first Patch Tuesday of 2026

January brings a larger-than-of-late Patch Tuesday update out of Redmond, but an uptick in disclosures is often expected at this time of year
January 13, 2026 13 Jan'26
‘Dual-channel’ attacks are the new face of BEC in 2026

Business email compromise remains a significant threat as cyber fraudsters deploy a more diverse range of tactics against their potential victims, according to a report
January 12, 2026 12 Jan'26
Business leaders see AI risks and fraud outpacing ransomware, says WEF

C-suite executives are more concerned with risks arising from AI vulnerabilities and cyber fraud than ransomware, according to the World Economic Forum
January 12, 2026 12 Jan'26
Intersec Dubai highlights why AI has become critical in the race against cyber attackers

Cigna Healthcare’s Jean Wiles warns that healthcare security teams must act faster without sacrificing accuracy or compliance as threats driven by artificial intelligence scale