SCOUTBUDDY
search

Sections

Cyber Security

2432 articles

Where Severity Scores Go Wrong: “Just Add Prototype Pollution”
cybersecurity

Where Severity Scores Go Wrong: “Just Add Prototype Pollution”

JFrog’s Security Research team consistently tracks and evaluates newly disclosed CVEs in the open-source ecosystem. Their findings reveal that often, the severity scores assigned to vulnerabilities do not accurately reflect their actual impact or risk of exploitation. In 2025, JFrog researchers reviewed critical-severity vulnerabilities from the National Vulnerability Database (NVD) and determined that 96% of these scores were misaligned with the vulnerabilities’ true severity.

From the Frog's mouth - JFrog Blog ·
22nd June – Threat Intelligence Report
cybersecurity

22nd June – Threat Intelligence Report

The Threat Intelligence Bulletin for the week of June 22nd highlights significant findings in cyber research. A notable incident involves the Texas Parks and Wildlife Department, which suffered a data breach linked to a third-party vendor for its license system. This breach compromised sensitive information, including driver’s license details, passport numbers, email addresses, phone numbers, and residential addresses. For more details, the full bulletin is available for download.

Check Point Research ·
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique
cybersecurity

Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique

Research by Alexey Bukhteyev highlights the evolution of large language models (LLMs) in both software and malware development. Check Point Research details how cybercriminals have increasingly utilized LLMs, including tools like ChatGPT, to generate offensive components and create malicious tools. This trend has led to new attack techniques such as browser-only ransomware, showcasing the sophisticated ways AI is being leveraged in cybercrime.

Check Point Research ·
ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365
cybersecurity

ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365

Talos has identified “ARToken,” a phishing-as-a-service platform that targets Microsoft 365. The ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token persistence, email access, BEC operations, and SharePoint exfiltration.

Cisco Talos Blog ·
When Security Scans Break the Brain: Solving Trivy’s etcd Exhaustion Problem
cybersecurity

When Security Scans Break the Brain: Solving Trivy’s etcd Exhaustion Problem

This post comes from Pushkar Joglekar, Principal Security Engineer at Broadcom, where he focuses on VMware Kubernetes distributions. Pushkar is a Kubernetes security maintainer and co-author of the security chapters in Nigel Poulton’s “The Kubernetes Book.” He writes from experience securing infrastructure at scale. It starts with a failing deployment. You attempt a quick fix—maybe

Aqua ·
Accelerating the quantum-safe timeline
cybersecurity

Accelerating the quantum-safe timeline

We’re accelerating quantum-safe readiness—and sharing what organizations can do now to transition earlier and with confidence. The post Accelerating the quantum-safe timeline appeared first on Microsoft Security Blog.

Cloud security Insights | Microsoft Security Blog ·
​​What’s new in Microsoft Security: June 2026
cybersecurity

​​What’s new in Microsoft Security: June 2026

This month’s updates help security and IT teams strengthen identity and multicloud foundations, protect data wherever it lives, and secure the developer workflows powering AI innovation. The post ​​What’s new in Microsoft Security: June 2026 appeared first on Microsoft Security Blog.

Cloud security Insights | Microsoft Security Blog ·
The Hidden National Security Threat Inside AI-Driven Software
cybersecurity

The Hidden National Security Threat Inside AI-Driven Software

AI is significantly impacting federal mission stacks, necessitating security processes that can adapt to the increasing attack surface. It has transformed the way teams develop software, identify threats, analyze intelligence, automate workflows, and make mission-related decisions. This shift is particularly critical for defense organizations involved in intelligence, electronic warfare, cyber operations, and software-driven systems, making AI a fundamental part of their operations.

2024 Sonatype Blog ·
How Do You Protect a Workload You Cannot Afford to Patch Right Now?
cybersecurity

How Do You Protect a Workload You Cannot Afford to Patch Right Now?

TL;DR Vulnerability management is collapsing under scale and the remediation timeline for production workloads is not going to shorten fast enough to keep pace with attacks that adapt at machine speed. Aqua vShield is a patented runtime capability that closes the gap between discovery and remediation by enforcing compensating controls directly inside running containers, blocking

Aqua ·