Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion

Last month, Microsoft disclosed a vulnerability in Microsoft Paint, but messaging regarding a patch was unclear.

Black Hat India 2026 Makes a Landmark Debut in Bengaluru, Bringing the Global Cybersecurity Community to India

Inaugural edition by Informa Markets in India brings together leading researchers, security practitioners and industry decision makers for four days of cutting-edge research, technical exchange and strategic dialogue.

Attackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on Linux

Attackers can exploit a flaw in Claude's document-processing tool by creating a temporary file that Anthropic's AI assistant can access and run on a user's machine.

PwC's CISO on AI, Robots & What's Next for Security

As AI accelerates change across the enterprise, PwC's James Shira explains why security teams must rethink their approach to risk and adapt their strategies.

NIST: Solo Shouldn't Mean Less Secure

New guidance provides a basic framework for less-technical solo business owners, but it may miss the mark on how to secure technology that requires no human oversight.

Operação de influência russa tem como alvo generalizado a América Latina

A operação, que contou com o uso de inteligência artificial, utilizou e-mails falsos, documentos governamentais falsificados e a criação de uma organização local para atacar escolas no Peru e no Equador, entre outras ações.

AI Gave Your Incident Archive a Second Job

Security records are increasingly being used by vendors to train their models, creating new risks for enterprises.

US Government Email Systems Open to Abuse Thanks to Typos

Erroneous or outdated DNS records can give attackers surprising powers over organizations' email systems.

What We Missed: Knicks Phishing Test Goes Out of Bounds

In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from an ill-conceived phishing simulation to a hacktivist attack on a US government agency.

APT29's Watering Holes Target Thousands of Mobile Users

After compromising websites, the Russian state-sponsored threat group is fingerprinting victims, then harvesting information from the interesting ones.

SecurityDataPipeline.com Launches as a New Educational Resource for the AI Era

The ungated resource explains how security data pipelines reduce SIEM ingestion costs, preserve detection coverage, and prepare the data layer for AI-driven security operations.

Critical Rails Bug Threatens to Derail Vulnerable Servers

An attacker could write arbitrary files and read sensitive files via images uploaded to the Rails Active Storage ImageMagick integration, possibly positioning a threat actor for lateral movement.

Phishing-Resistant Isn't Enough; Yubico Takes Aim at Identity-Verification Gap

The new YubiID service bridges identity verification with credential enrollment and recovery across existing identity platforms, closing a phishing-resistant authentication gap. Plus: post-quantum YubiKey beta.

Philippine Migrant Worker Data Likely Leaked in 69GB Government Breach

An unknown operator appears to have exfiltrated SQL Server backups from the Philippine Overseas Employment Administration in under a half hour.

Germany Busts 'Crime-as-a-Service' Investment Fraud Outfit

German police led a multinational probe that exposed an alleged crime-as-a-service provider supplying fraudulent trading platforms to investment scammers.

9 Cyber Awareness Tips That Actually Match Today’s Maze of Threats

Practical guidance on safer search, stronger login security, better executive protection, and other habits that help reduce enterprise risk.

LLMJacking Emerges as Thriving Cybercriminal Enterprise

Cybercriminals have turned reselling cloud access to LLMs into a lucrative business model, with some victims paying as much as $1 million in resource consumption before access was revoked.

3AM Affiliate Embraces AI-Like Loops in European School Attack

Evidence suggests a model may have generated and revised commands during the ransom gang's breach, though researchers stopped short of claiming full automation.

One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning

The record theft shows how weak system separation, inadequate controls, and untested attack possibilities can turn one breach into systemic loss.

Microsoft's AI Risk Report Misses This Key Detail

The latest "Digital Defense Report" identifies government agencies as prime targets for AI attacks but doesn't mention that they are broadly being targeted through Microsoft bugs.