A compromised employee laptop became the starting point for a reported $6.3 billion theft from Binance. Disclosures say the attackers reached an internal service container that could initiate withdrawals, then gained approval authority over a hot wallet through additional compromise points and an Ethereum…
Internet-exposed industrial gateways running affected Node-RED deployments are being used to deliver Linux malware. The affected Siemens devices do not enforce authentication on the Node-RED HTTP interface, allowing remote attackers to create flows that execute system commands. One source sent a complete…
AI-assisted cyberespionage has expanded to simultaneous attacks against more than 200 organizations across 14 countries. The operation began October 17 and compromised at least nine organizations, while at least 12 other high-value targets faced password spraying and credential scans. Human operators…
A hidden, zero-click Android message can crash the process responsible for phone service and interrupt active calls. The specially crafted WAP Push message is processed automatically and does not appear like a normal text. Repeated processing can extend the disruption and may affect calls to emergency…
AudioExposed LXD and Incus management interfaces can let remote attackers impersonate trusted clients and control clusters or managed virtual machines. The certificate-checking process proved ownership of one certificate but trusted other attacker-supplied certificates in the same chain. An attacker could…
Lyft agreed to a $1.8 million California settlement over allegations that its app created unlawful barriers to privacy choices. The company had sold or shared personal information for targeted advertising without offering an in-app opt-out. Users instead had to follow links to a webpage and re-enter…
Withdrawals on multiple networks were temporarily suspended after Binance confirmed a security incident and reports of funds leaving its wallets. The exchange said customer funds were safe and that it was investigating. External estimates placed the potential loss between at least $2 billion and as much…
AudioInternet-exposed PHP systems face active exploitation of two critical weaknesses collectively called PHP2Shell. Telemetry identified over 22.6 million exposed instances potentially vulnerable, while separate monitoring recorded successful exploitation. Attackers have chained PHP2Shell with a Linux…
AudioAttackers exploited Cisco SD-WAN controllers to gain privileged access and deploy malware built for persistence and key theft. The KeyDrift framework operated inside legitimate control-plane processes, intercepted decrypted traffic and collected material believed to protect data-plane communications. The…
AudioPatient care was disrupted after a cyberattack affected the University of New Mexico Health Sciences Center and its hospitals and clinics. Ambulances were diverted for a time, outpatient surgeries and appointments were suspended, and medical classes were cancelled. A ransomware group claimed…
AudioOracle E-Business Suite systems are facing exploitation attempts shortly after an October security fix became available. The affected component can let an unauthenticated attacker run database queries and execute commands on the application host. Depending on the deployment, exposed records may include…
AudioPolymarket temporarily halted trading after a compromised third-party service distributed cryptocurrency-draining JavaScript through its website. The malicious script used authenticated sessions to liquidate positions or transfer user assets. Approximately $2.5 million was traced through a suspected…
Security telemetry has become a major recurring cost. The feature asks leaders to decide which signals actually reduce meaningful risk instead of collecting everything by default.
Read on Bare Metal Cyber →
Purple teaming matters most when exercises change real decisions, ownership, architecture, and spending instead of ending as another technical report.
Read on Bare Metal Cyber →
Detection engineering shifts security operations from impressive dashboards and alert counts toward deliberate, testable coverage of attacker behavior.
Read on Bare Metal Cyber →
Sensitive information accumulates in logs, analytics platforms, collaboration suites, and AI stores, creating concentrated risk outside traditional systems of record.
Read on Bare Metal Cyber →
Rapid API growth turns interfaces into a strategic attack surface, requiring explicit ownership, secure defaults, partner controls, and risk-based measurement.
Read on Bare Metal Cyber →
Control checklists can look complete while missing how modern systems actually work. The feature argues for evidence and controls grounded in architecture and risk.
Read on Bare Metal Cyber →
Decision Point CISO executive sceneStep into the role of a cybersecurity executive and navigate evolving company crises through hundreds of branching decisions, with voice, audio, imagery, consequences, and achievements.
BMC ChallengesChallenge paths, certification testing, games, and educator tools for hands-on cybersecurity practice.
Deep dive: Endpoint Detection and Response. Endpoint detection and response collects endpoint activity, identifies suspicious behavior, supports investigation, and provides response actions such as isolation or process t
BMC MagazineLong-form analysis and commentary for deeper context.
