FIDO's October Passkey Index puts the estimated number of passkeys in use at seven billion, with sign-ins far more likely to succeed than password-plus-MFA.
Three arrests, five servers and at least 110 TB of data were seized after investigators linked KillSec to roughly 1,000 suspected attacks.
CIRCIA's final rule missed October 2025, then May 2026, then a September target, as the agency that must enforce it shrinks and its info-sharing law runs on short extensions.
Federal agencies had three days to secure appliances, and CISA's advice is unusual: look for compromise before you patch.
Since September 11, makers of connected products sold in Europe must report actively exploited vulnerabilities and severe incidents on a strict clock.
From a Trivy scanner compromise in March to an August arrest, the TeamPCP campaign showed how stolen CI credentials cascade across five software ecosystems.
Leak-site data for the second quarter of 2026 shows record monthly volume and a market that keeps reshuffling its leaders.
Google fixed 74 vulnerabilities in one release, including CVE-2026-11645, as the browser keeps pace with a steady drumbeat of in-the-wild exploits.
Two more Americans were sentenced to 18 months in May 2026, the seventh and eighth such convictions in five months.
A voice-phishing crew stole data on more than 30 million students and staff, defaced login pages, and got paid despite FBI advice.
Falling estimates of the quantum hardware needed to break RSA are pushing big tech to finish cryptographic migration years ahead of government schedules.
After a year of regulatory review, Google Cloud now owns the fastest-growing cloud security vendor and says it will keep Wiz multi-cloud.
The Handala group reportedly abused Microsoft Intune's remote-wipe feature, erasing tens of thousands of devices at the medtech giant without classic malware.
Salesforce warned that a known extortion crew was scanning public Experience Cloud sites, harvesting CRM data that fuels the next round of voice phishing.
A maximum-severity authentication bypass triggered a CISA emergency directive and a Five Eyes hunt guide, weeks after CISA ordered agencies to rip out unsupported edge gear.
After hardening ChatGPT Atlas with an AI attacker trained to hunt for exploits, OpenAI says defending agents is a continuous fight, not a fix.
Chainalysis says Pyongyang-linked hackers took at least $2.02 billion in 2025, led by the Bybit heist, and washed it through Chinese-language money networks.
From patch to CISA KEV listing took two days, and vulnerable internet-facing hosts fell by more than half in 48 hours.
A faster second wave of the self-spreading npm worm hit Zapier, PostHog and Postman packages, and pushed GitHub and npm to rework authentication.
Police took down or disrupted more than 1,025 servers behind the Rhadamanthys infostealer, the VenomRAT trojan and the Elysium proxy botnet.
