Latest security news

Microsoft has issued another massive batch of security updates with 400 fixed in the August Patch Tuesday

Apple has imposed strict new submission limits on its bug bounty portal after finding itself overwhelmed by low-quality, AI generated vulnerability reports - many of which were found to be describing security flaws that simply didn't exist. Read more in my article on the Hot for Security blog.

3 Paperclip flaws exposed data & allowed unauthenticated command execution in two deployment modes

AWS has linked North Korea to the axios campaign to other attacks on npm libraries

The new version of Chrome, 151, comes with 370 vulnerability patches, including for seven critical flaws

The White House announced Gold Eagle to help accelerate the discovery, prioritization and patching of flaws found by AI

Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA credentials -- including AWS Govcloud keys -- in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say the gaps identified in the agency's initial response provide important lessons that all security teams should absorb.

CISA reveals how it responded after sensitive AWS GovCloud credentials and internal data were exposed in a public GitHub repository