Know what changed. Know what matters.

A breach at France’s National Agency for Secure Credentials revealed millions of sensitive ID entries, sparking fresh scrutiny on national identity security.

A new study shows that GitHub’s “Verified” badge can be spoofed because signed commits’ hashes are mutable, threatening software supply‑chain integrity.

A critical flaw in Google’s Dialogflow CX lets attackers hijack chatbots and exfiltrate user conversations within the same cloud project.

Threat actors weaponize OAuth 2.0 Device Authorization Grants to breach industrial automation systems.

Researchers show a new attack that leaks data from isolated PCs by exploiting faint radio signals emitted through HDMI cables.

RunZero revealed seven serious vulnerabilities in the FatFs filesystem library used across millions of embedded devices, raising major security concerns.

New threat actor Armored Likho has attacked government agencies and electric power sectors in Russia, Brazil, Kazakhstan using the BusySnake stealer.

The National Telecommunications and Information Administration issued its July 22, 2024 report on online health and safety for children, detailing risks such as harassment, cyberbullying, sexual exploitation, abuse, and mental‑health–exacerbating content.

Google cuts the NetNut botnet, shutting down two million home‑device proxies used for traffic routing.

Microsoft now requires meeting organizers to approve any external AI bot before joining Teams meetings, tightening control over potential malicious code injection.

Attackers hijack Office 365 credentials by tricking users into approving token exchanges through counterfeit prompts, bypassing MFA.

The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives has ended its agreement with the phone‑tracking tool Webloc because of legal concerns over how it was used in investigations.