Popular
Nothing found for . Try a course, an exam code (SC-200), a tool or a topic.
↑↓ moveEnter openEsc close
Cyber security news, as it breaks.
Updated 121 stories in 24 hours
SOC & SIEM
Microsoft, identity, cloud and the security operations centre.
15stories this week
0today
the last seven days
Most fromHuntress, Microsoft Sentinel Blog, SecurityWeek, Help Net Security
In the news hereMicrosoft4Google1ConnectWise1OpenAI1Lumma Stealer1NetSupport RAT1
MyCyberWay trainingEvery story here started as an alert. Learn to triage them.See Blue Team Analyst
-
Learn the CMMC Level 2 requirements you can’t skip, the new 88-point minimum score, and how the 180 day POA&M clock affects contract eligibility.
Huntress
-
REF8801 exposes how Apex Accelerator combines convincing Web3 services with malicious npm packages, attacker-controlled AI infrastructure, and cross-platform malware delivery.
Elastic Security Labs
-
Threat actors are exploiting AhsayCBS flaws, including CVE-2026-105133 and CVE-2026-105134, to deploy webshells and XMRig cryptominers. Update to 10.3.4 and restrict access now.
Huntress
-
We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new material we dicsuss 8&#;x26;#;xc2;&#;x26;#;xa0;of the most popular AI coding assistants and&#;x26;#;xc2;&#;x26;#;xa0;agents including Claude Code, Codex, Gemini CLI, Cursor, Copilot, Warp, Windsurf, and Qwen Code. I&#;x26;#;39;ve been using…
SANS Internet Storm Center
-
Critical and high-severity vulnerabilities could allow attackers to bypass authentication, execute arbitrary code, and elevate their privileges.
SecurityWeek
-
AlertZero brings AI SOC automation to Elastic Security with four agents, one job each, so the queue stops setting your priorities. Nothing changes in your environment without your approval.
Elastic Security Labs
-
Recently, somebody from a fairly mature security team told me something I did not want to hear: if software vendors run “Mythos-class” models on their own code and fix what they find, they must publish a CVE for every fixed vulnerability. My first reaction (vendor hat firmly on, since I now work at Cisco) was:…
Anton Chuvakin
-
Email remains one of the most common entry points for security threats. Yet email products often describe the same activity with different table names, fields, and values. This makes it harder to build detections and investigations that work consistently across data sources. The Microsoft Sentinel Advanced Security Information Model, or ASIM, EmailEvent schema is now…
Microsoft Sentinel Blog
-
How to prevent budget overruns in the information security department, and what cyber risks the cost of AI tokens poses to the SOC.
Kaspersky
-
A recent phishing campaign abused Microsoft Power BI links to deliver multiple rogue ScreenConnect clients.
Huntress
-
Active Directory defenses must combine identity fundamentals, telemetry, and rapid response as attackers reach the environment’s first breach attempt within a median of 11 hours.
Sophos
-
SMB1001 gives small businesses a cybersecurity standard with a finish line. See how its five tiers work and where Huntress maps to each control.
Huntress
