Security · Top stories
Improving SPIRE Security and Resiliency with AWS Managed Services
This article details how to integrate SPIRE, an open-source implementation of SPIFFE, with AWS managed services to enhance security and resiliency. It addresses operational challenges in production SPIRE deployments by offloading core functionalities to AWS services.
How to Check Android Phone Security Update Status and End-of-Life Date
Android phones do not notify users when security updates cease, creating a false sense of security. Users can check their phone's last security patch date and Google Play system update status via device settings and the Play Store. Determining the device's end-of-life date requires consulting manufacturer information.
Rental Car Bluetooth Syncing Can Expose Personal Data
Connecting a phone to a rental car's infotainment system via Bluetooth can expose personal data like contacts, navigation history, and streaming account logins to subsequent drivers. Rental car companies typically state that customers are responsible for removing their data, as systems may store information indefinitely by default.
Using a Router Without Firmware Updates Poses Security Risks
Routers continue to function without firmware updates, but they become vulnerable to newly discovered security flaws. While not immediately compromised, these routers can be targeted by attackers to relay malicious traffic or join botnets.
How to Improve Router Security by Changing Default Settings
This guide explains how to enhance home router security by modifying default settings. It covers changing login credentials and Wi-Fi network names to prevent unauthorized access and protect the network.
Wazuh Helps Identify Shadow IT and Visibility Gaps
Wazuh, an open-source security platform, helps organizations identify shadow IT by collecting system inventory data directly from monitored endpoints. This method allows for comparison with network scan data to uncover unmanaged assets, unapproved software, and monitoring blind spots. The approach addresses limitations of traditional network discovery, which often misses powered-off devices or software not exposing network ports.
Software Sandboxing Basics and Best Practices for 2025
This article defines software sandboxing and discusses its implementation, focusing on restricting process privileges without administrative authority. It highlights the challenges of sandboxing and offers updated best practices for 2025, differing from earlier definitions regarding the use of superuser APIs.
Homoglyph Attacks Use Similar-Looking Characters to Create Fake URLs and Emails
Homoglyph attacks are an increasing phishing tactic where fraudsters use characters from different alphabets that look similar to legitimate ones to create deceptive URLs and email addresses. This method bypasses traditional security scans for attachments and exploits human psychology to trick users into clicking malicious links, leading to credential harvesting.
How to check a Windows PC for malware using Microsoft Defender
This guide details how to use Microsoft Defender, the built-in antivirus tool in Windows 11, to scan a PC for malware. It explains the different scan options available, including quick, full, and offline scans, and how to check protection history and firewall settings. This information helps users identify and address potential security threats on their systems.
Implementing Defense-in-Depth Authorization for MCP Tools on Amazon Quick
A multi-gate authorization pattern for Model Context Protocol (MCP) tools on Amazon Quick has been implemented to provide defense-in-depth authorization. This pattern evaluates OpenID Connect (OIDC) JSON Web Token (JWT) claims sequentially to enforce role-based and attribute-based access control, addressing compliance needs beyond basic SSO authentication.
When to Keep a VPN Active for Enhanced Online Privacy and Security
This article explains the benefits of using a Virtual Private Network (VPN) for online privacy and security, particularly on public Wi-Fi or when accessing sensitive information. It details how VPNs mask IP addresses and encrypt internet connections, protecting user data from hackers, advertisers, and Internet Service Providers (ISPs). The article also clarifies that VPNs are not a complete cybersecurity solution and outlines specific scenarios where their continuous use is most beneficial.
Bishop Fox CEO Vinnie Liu's Early Hacking Experiences and NSA Recruitment at 17
Vinnie Liu, CEO of Bishop Fox, was recruited by the NSA at age 17 after being recommended by an Air Force contact. His early interest in computers stemmed from curiosity and learning how systems worked, rather than malicious intent.
Bluetooth Security Risks and Best Practices for Mobile Devices
Leaving Bluetooth enabled on mobile devices can expose users to security vulnerabilities, including data siphoning and eavesdropping, due to flaws in hardware and software implementations. Users can mitigate these risks by disabling Bluetooth when not in use, setting devices to hidden mode, and clearing data from connected vehicle systems.
Guide to Configuring a Tor Exit Node on Linux
This tutorial provides instructions for setting up a Tor exit node on a Linux machine, detailing the necessary software installation and configuration steps. Running an exit node helps bridge the Tor network with the clear net, enabling anonymous internet access for users, but it carries risks for the operator due to potential legal scrutiny and website blocking.
Understanding Cold Wallets for Cryptocurrency Security
Cold wallets are offline storage solutions for cryptocurrency private keys, offering enhanced security by isolating them from internet-connected devices. This method helps users maintain self-custody of their digital assets, reducing third-party risks associated with online platforms.
AWS provides solution for automated IAM Identity Center governance and reporting
AWS has released a sample solution to automate discovery and reporting for IAM Identity Center, addressing challenges in tracking access assignments and enforcing governance policies as AWS organizations scale. This solution helps answer questions about user and group access to AWS applications and generates reports for compliance audits or security reviews.
Six-point checklist for MSPs to improve ransomware recovery
A six-point checklist outlines essential outcomes for Managed Service Providers (MSPs) to enhance ransomware protection and accelerate recovery processes. The checklist addresses reducing exposure, early detection, 24/7 response, isolated recovery points, clean recovery, and consistent operation across tenants. This guidance aims to help MSPs improve their resilience against ransomware attacks, which affected 143 MSPs and IT service providers in 2025 according to the Acronis Cyberthreats Report.
How to Remotely Disable Digital Wallets on Lost Android Phones
Users can remotely disable their digital wallets on lost Android phones to prevent unauthorized access to payment cards, loyalty accounts, and other digital passes. This process involves using Google's Find Hub or Remote Lock, or Samsung's SmartThings Find for Galaxy devices, to secure personal information.
Secure File Server Management: Best Practices for Access Governance
Organizations continue to use on-premises file servers due to factors like cloud costs and data sovereignty. Effective access governance is crucial for securing these file servers, which remain an IT mainstay. One key best practice involves assigning permissions to security groups rather than directly to individual users.
AWS guide details detecting multi-stage attacks using cross-service signal correlation
AWS published a guide for security engineers on detecting multi-stage attacks by correlating signals from various AWS security services with business context. This approach helps identify attack sequences rather than triaging individual findings, improving overall security posture. The guide provides examples using Amazon CloudWatch Logs Insights and outlines how to build automated pipelines for correlation.
ClamUI offers a modern graphical interface for ClamAV on Linux
ClamUI is a new graphical user interface for the open-source antivirus engine ClamAV on Linux, providing an updated look and simplified scanning and database updates. This tool offers an easier way for Linux users to manage antivirus scans, particularly when sharing files with Windows users, by improving the usability of ClamAV.
Using Tailscale for secure, free remote access to home PCs
This article details how Tailscale can be used to create a secure private network for remote access to home PCs without cost. It explains that Tailscale allows devices to connect securely over the internet as if they were on the same local network, bypassing router and firewall configurations.
Researcher logs phone calls to military bases via e164.arpa DNS hijacking
A researcher demonstrated how DNS hijacking of e164.arpa domains, intended for phone network infrastructure, allowed them to log hundreds of thousands of phone calls to military bases. This highlights a vulnerability in an outdated but still active part of the internet's phone routing system.
Passkeys offer security improvements over passwords but have adoption and sharing limitations
Passkeys provide a more secure login method than traditional passwords by using public and private key pairs tied to devices, eliminating the need for users to remember text strings. While they enhance security and user experience by leveraging device biometrics, passkeys are not universally supported and present challenges for sharing and device-independent access.
Nico Waisman's Journey from Self-Taught Hacker to Offensive Security Professional
Nico Waisman, born in Argentina in 1982, developed his hacking skills through self-teaching and experimentation, eventually leading to a career in offensive security. He joined Immunity in 2003 as a senior security researcher, marking the start of his professional journey in the field.
Understanding App Activity Tracking and Device-Level Identifiers
This article explains how apps track user activity beyond audio recording, focusing on nonverbal signals like scrolling speed, network connection, and referral sources. It details how device-level identifiers are used by companies like Google and Meta to build advertising profiles across multiple applications.
Guide to IAM Compliance Requirements and Best Practices
This guide explains Identity and Access Management (IAM) compliance, focusing on the distinction between policy intent and actual enforcement of access controls. It details why organizations need to move beyond periodic access reviews to continuous, evidence-backed verification for auditors. The guide highlights common evidence gaps and the importance of verifying implementation over just design.
How to Enable Android's Built-in Theft Protection Features
Google has integrated new AI-powered theft detection features into Android, available on devices running Android 10 or newer through Google Play Services. These features, including motion-sensing theft detection and Offline Device Lock, automatically secure a phone if it is snatched or disconnected from the internet. This provides users with enhanced proactive security measures against phone theft.
Android devices generally do not require third-party antivirus applications
Modern Android smartphones typically do not need third-party antivirus applications due to built-in security features like Google Play Protect, app sandboxing, and regular security updates. While Android is susceptible to malware, its integrated protections are often sufficient for the average user, though specific use cases might warrant additional security.
Guide to checking for unauthorized access on ChatGPT and Claude AI accounts
A guide details how users can check for suspicious device logins on their ChatGPT and Claude AI platform accounts. It outlines the specific steps within each platform's settings to view active sessions and log out unrecognized devices, emphasizing the importance of security measures like unique passwords and multi-factor authentication.
ZDNET Ranks 1Password as Top Password Manager for 2026
ZDNET has identified 1Password as the best overall password manager for 2026, citing its user-friendly interface and comprehensive features. This ranking provides guidance for individuals seeking to improve their digital security through password management solutions.
Adversary Emulation for GenAI Red Teaming: A Foundational Overview
A presentation introduces the concept of using adversary emulation for red teaming in Generative AI applications. It covers the importance of securing GenAI, compliance motivations, and basic red teaming principles for AI security.
AWS provides guidance for identifying and remediating over-permissioned S3 buckets
AWS published a guide detailing a five-phase workflow to detect, remediate, and continuously monitor over-permissioned Amazon S3 buckets. This workflow helps security teams prevent unauthorized data access due to misconfigured S3 policies or ACLs.
How to Enable SIM Protection Settings on Verizon to Prevent SIM Swapping Attacks
Verizon Wireless offers specific settings, SIM Protection and Number Lock, to prevent unauthorized SIM swaps and device changes. Enabling these features helps protect mobile accounts and other linked services from fraudulent access by blocking attackers from intercepting two-factor authentication codes.
How to Limit Roku's Data Collection and Tracking Features
Roku devices collect user viewing data, including what, when, how, and where content is watched, similar to other connected devices and services. Users can adjust privacy settings to limit this data collection, such as disabling Automatic Content Recognition and personal advertising. This allows individuals to manage their data sharing preferences on Roku devices.
Russ Kirby Discusses Career Path and Role as CISO at Ping Identity
Russ Kirby, CISO at Ping Identity, shared insights into his career progression in cybersecurity, attributing his success to a natural inclination for order and protection. He discussed his journey from general technology roles to CISO positions at Creditsafe, ForgeRock, and now Ping Identity, emphasizing how opportunities aligned with his personality and interests.
Understanding SPF Record Syntax: Mechanisms, Qualifiers, Modifiers, and Macros
This article details the syntax of SPF records, explaining the components like version tags, mechanisms, and modifiers. It clarifies how these elements function within an SPF record to authenticate email senders and prevent spoofing.
Honeypot Network Reveals SSH Credential Harvesting Trends from July 2026
A personal honeypot network collected data on SSH login attempts during July 2026, recording over 1.5 million attempts from nearly 6,800 unique IP addresses. The data provides insights into the geographic origins of these credential harvesting activities and the volume of unique credentials targeted.
Firmware analysis of TP-Link TL-841N reveals persistent credentials
A researcher documented the process of extracting and analyzing the firmware from a TP-Link TL-841N router, discovering plaintext, hardcoded credentials that persist even after a factory reset. This demonstration highlights a common vulnerability in IoT devices where sensitive information is not properly erased.
User encounters malicious captcha attempting to execute PowerShell script
A user encountered a deceptive captcha on the Crooked Timber website that instructed them to run a PowerShell script from their clipboard. The script, if executed, would download and run content from a suspicious URL, indicating a social engineering attempt to compromise the user's system.