Russian CTRL Toolkit Uses Fake Private-Key LNK Files to Stealthily Hijack RDP Through FRP Tunne
Censys has disclosed a previously undocumented Russian-origin .NET toolkit called CTRL that is delivered through fake private-key LNK files and…
Chrome Under Attack: Google Patches Two Actively Exploited Zero-Day Vulnerabilities (CVE-2026-3909, CVE-2026-3910)
The two Chrome zero-day vulnerabilities highlight how browsers remain a prime attack surface. Memory corruption in Skia and flaws in…
Phishing Fraud: What the EU Directive Really Says About Bank Liability
The EU’s PSD2 directive transformed digital payments with stronger security, open banking and clear liability rules. But does it force…
Google Patches Actively Exploited Chrome Zero-Day
Google patched an actively exploited Chrome zero-day (CVE-2026-2441) enabling remote code execution via a CSS use-after-free flaw. CISOs must act…
Critical Vulnerabilities in Cloud Password Managers Undermine “Zero-Knowledge” Claims
ETH Zurich researchers found 25 vulnerabilities in Bitwarden, LastPass, and Dashlane that can undermine “zero-knowledge” protections under a malicious server…
Exposed: Zero-Click RCE Vulnerability in Claude Desktop Extensions Puts Over 10,000 Users at Risk
A critical zero-click RCE vulnerability in Claude Desktop Extensions exposes over 10,000 users to remote attacks via a malicious Google…
The Chrysalis Backdoor: When Espionage Tooling Evolves in Plain Sight
Rapid7 uncovered a Lotus Blossom espionage campaign delivering the new “Chrysalis” backdoor via a compromised Notepad++ distribution chain. The tool…
149 Million Credentials Exposed: Why This Leak Matters More Than the Numbers
A leaked database with 149 million credentials proves that credential compromise is now a constant risk. For CISOs and CIOs,…
Microsoft, BitLocker and Law Enforcement: Why CISOs Should Re-Evaluate Endpoint Encryption Assumptions
Microsoft’s disclosure of providing BitLocker recovery keys to law enforcement exposes a critical misconception in enterprise security: encryption without exclusive…
Microsoft Teams adds “External Domains Anomalies” reporting to catch attackers early (Rollout: Feb–Mar 2026)
Microsoft is rolling out a new Microsoft Teams security feature—the External domains anomalies report—to help organizations detect suspicious external communications…