Security Bulletin

Armored Likho utilizes a modular and evolving toolkit that includes obfuscated remote access trojans (RATs), the Python-based BusySnake Stealer, and Go2Tunnel for network tunneling.

The lawsuit, initially filed by three women, now includes two additional anonymous plaintiffs, Jane Does 4 and 5.

The vulnerabilities, tracked as CVE-2026-40138 and CVE-2026-40139, affect specific versions of BeyondTrust's RS and PRA software.

A cryptomining incident highlights how AI gateways can provide access to AI models, cloud infrastructure, and identity and access management (IAM) data.

The technique abuses symlinks to escape the intended workspace and weaken human-in-the-loop protections.

Microsoft co-signed a malicious kernel driver, and now it's being used to kill security software in ransomware attacks.

A new survey shows security leaders have an inflated sense of safety regarding their collaboration tools and platforms.

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

[This is a Guest Diary by Jason Callahan, an ISC intern as part of the SANS.edu BACS program]

The Latin American nation's cybersecurity plan — still in the expansion phase — has to survive its own knockout round during the FIFA World Cup.

Here's how ISPM provides the necessary visibility, governance and risk assessment to manage AI agents.

The attacker exploited AI workflows, chained cloud weaknesses, and stolen credentials to extort a large Amazon customer.