Recon

RECON

Updated 4m ago
High-Signal Security Intelligence

2026-04-15

Red Canary62 · 2026-04-15 13:42

Identity, browsers, and node.js: Everything you missed in the Threat Detection Report miniseries

Get cliff notes from our three-part deep dive into the 2026 Threat Detection Report and watch every episode, on demand now.
Microsoft Security Blog47 · 13d ago

Incident response for AI: Same fire, different fuel

AI changes how incidents unfold and how we respond. Learn which IR practices still apply and where new telemetry, tools, and skills are needed. The post Incident response for AI: Same fire, different fuel appeared first on Microsoft Security Blog .
Qualys Threat Research45 · 13d ago

Qualys VMDR and TotalCloud™ Now Available on Oracle Cloud Marketplace

Key Takeaways As organizations accelerate cloud adoption, security teams are under increasing pressure to gain unified visibility, prioritize risk effectively, and respond faster without adding complexity. We are excited to announce that Qualys VMDR (Vulnerability Management, Detection and Response) and Qualys TotalCloud™ CNAPP are now both available on the Oracle Cloud Marketplace. These Qualys listings enable joint customers to […]
Simon Willison45 · 2026-04-15 15:36

Quoting Kyle Kingsbury

I think we will see some people employed (though perhaps not explicitly) as meat shields : people who are accountable for ML systems under their supervision. The accountability may be purely internal, as when Meta hires human beings to review the decisions of automated moderation systems. It may be external, as when lawyers are penalized for submitting LLM lies to the court. It may involve formalized responsibility, like a Data Protection Officer. It may be convenient for a company to have th...
Simon Willison45 · 2026-04-15 02:50

datasette-ports 0.3

Release: datasette-ports 0.3 A small update for my tool for helping me figure out what all of the Datasette instances on my laptop are up to. Show working directory derived from each PID Show the full path to each database file Output now looks like this: http://127.0.0.1:8007/ - v1.0a26 Directory: /Users/simon/dev/blog Databases: simonwillisonblog: /Users/simon/dev/blog/simonwillisonblog.db Plugins: datasette-llm datasette-secrets http://127.0.0.1:8001/ - v1.0a26 Directory: /Users/simon/dev/...
Rapid7 Blog40 · 2026-04-15 12:37

A Clearer Path from Prioritized Exposures to Remediation Progress

Security leaders know that reducing risk is not just about finding the right exposures, but helping the organization act on them before known issues turn into real incidents.  That is often where remediation gets harder. Security teams may know which actions matter most, but progress can slow when infrastructure, cloud, endpoint, and IT teams do not have the context needed to execute. Teams need clear asset detail to scope the work, trusted status signals to validate remediation, and usable r...
Cyber Kendra29 · 13d ago

Anthropic's MCP Design Flaw Enables Remote Code Execution Across 200,000+ AI Servers

A single architectural decision baked into Anthropic's Model Context Protocol has quietly turned the backbone of the AI agent ecosystem into a remote code execution (RCE) machine — one that ran undetected across more than 200,000 servers, 150 million downloads, and dozens of tools that millions of developers trust every day. OX Security researchers disclosed the findings today in a report they're calling " The Mother of All AI Supply Chains " — the result of a months-long investigation that b...
The Hacker News28 · 2026-04-15 12:56

Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover

A recently disclosed critical security flaw impacting nginx-ui, an open-source, web-based Nginx management tool, has come under active exploitation in the wild. The vulnerability in question is CVE-2026-33032 (CVSS score: 9.8), an authentication bypass vulnerability that enables threat actors to seize control of the Nginx service. It has been codenamed MCPwn by Pluto Security. "
The Register (Security)17 · 13d ago

Nobody knows how many CVEs Anthropic's Project Glasswing has actually found

Like the majority of the companies participating, it remains a mystery Last week, Anthropic surprised the world by declaring that its latest model, Mythos, is so good at finding vulns that it would create chaos if released. Now, under the title of Project Glasswing, over 50 selected companies and orgs are allowed to test the hyped up LLM to find security holes in their own products. But just how many problems have they really discovered?…
The Register (Security)17 · 13d ago

Patch these critical Fortinet sandbox bugs that let attackers bypass login, run commands over HTTP

No reports of active exploitation (yet) Watch out for more Fortinet vulns! Two critical bugs in Fortinet's sandbox could allow unauthenticated attackers to bypass authentication or execute unauthorized code on vulnerable systems.…
Security on TechRepublic17 · 13d ago

Massive Chrome Extension Scam Exposes 20,000 Users to Data Theft

Researchers linked 108 malicious Chrome extensions to a coordinated campaign that exposed about 20,000 users to data theft, backdoors, and ad injection. The post Massive Chrome Extension Scam Exposes 20,000 Users to Data Theft appeared first on TechRepublic .
The Register (Security)17 · 13d ago

Automotive data biz Autovista blames ransomware for service disruption

Some customer orgs tell staff to block inbound email from the provider Autovista confirms that it called in outside support to help clean up a ransomware infection currently affecting systems in Europe and Australia.…
Graham Cluley17 · 2026-04-15 11:05

108 malicious Chrome extensions caught stealing Google and Telegram data from 20,000 users

Cybersecurity researchers have revealed that 108 malicious Google Chrome extensions have been quietly stealing user credentials, hijacking Telegram sessions, and injecting unwanted ads and scripts into browsers - all reporting back to the same central point. Read more in my article on the Hot for Security blog.
Infosecurity17 · 2026-04-15 09:45

Researchers Spot Surge in Brute-Force Attacks from Middle East

Barracuda says 88% of brute-force attempts in Q1 were from the region
The Register – Security17 · 2026-04-15 08:01

Agents hooked into GitHub can steal creds – but Anthropic, Google, and Microsoft haven't warned users

Researchers who found the flaws scored beer money bounties and warn the problem is probably pervasive Exclusive   Security researchers hijacked three popular AI agents that integrate with GitHub Actions by using a new type of prompt injection attack to steal API keys and access tokens, and the vendors who run agents didn’t disclose the problem.…
先知安全技术社区15 · 2026-04-15 03:27

基于ptrace与/proc/mem的Linux无文件进程注入:攻击实现与内存取证检测

如何在不向磁盘写入任何文件的前提下,将payload注入到一个已有的合法进程中长期驻留? 这不是一个新问题。Windows平台上的进程注入技术(CreateRemoteThread、APC Injection、Process Hollowing)已经被研究得相当充分,MITRE ATT&CK的T1055条目下列出了十余种子技术。但Linux侧的讨论往往停留在LD_PRELOAD这类启动时劫持手段,
MapTiler14 · 2026-04-15 00:00

OpenMapTiles 3.16: Transportation Layer Improvements and Style Enhancements

Version 3.16 offers improved road connections and dark-mode maps. Thanks to all the Open-source contributors who helped update it.
The Hacker News13 · 13d ago

n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails

Threat actors have been observed weaponizing n8n, a popular artificial intelligence (AI) workflow automation platform, to facilitate sophisticated phishing campaigns and deliver malicious payloads or fingerprint devices by sending automated emails. "By leveraging trusted infrastructure, these attackers bypass traditional security filters, turning productivity tools into delivery
The Hacker News13 · 2026-04-15 11:30

Deterministic + Agentic AI: The Architecture Exposure Validation Requires

Few technologies have moved from experimentation to boardroom mandate as quickly as AI. Across industries, leadership teams have embraced its broader potential, and boards, investors, and executives are already pushing organizations to adopt it across operational and security functions. Pentera’s AI Security and Exposure Report 2026 reflects that momentum: every CISO surveyed
The Hacker News13 · 2026-04-15 04:30

OpenAI Launches GPT-5.4-Cyber with Expanded Access for Security Teams

OpenAI on Tuesday unveiled GPT-5.4-Cyber, a variant of its latest flagship model, GPT‑5.4, that's specifically optimized for defensive cybersecurity use cases, days after rival Anthropic unveiled its own frontier model, Mythos. "The progressive use of AI accelerates defenders – those responsible for keeping systems, data, and users safe – enabling them to find and fix problems
Dark Reading12 · 2026-04-15 12:00

Microsoft, Salesforce Patch AI Agent Data Leak Flaws

Two recently fixed prompt injections in Salesforce Agentforce and Microsoft Copilot would have enabled an external attacker to leak sensitive data.
The Register (Security)12 · 2026-04-15 10:15

UK told its Big Tech habit is now a national security risk

Open Rights Group says years of reliance on US giants have left Britain exposed Britain has spent years wiring its public sector into US Big Tech, and a new report says that dependence could quickly become a national security headache.…
gilesthomas.com11 · 13d ago

Writing an LLM from scratch, part 32k -- Interventions: training a better model locally with gradient accumulation

I've been working on a GPT-2-small-style LLM based on Sebastian Raschka 's book " Build a Large Language Model (from Scratch) ". I've trained various versions of it in the cloud to work out which interventions to the model and training code had the best effects on the loss it gets on a specific test dataset, and now I wanted to do a training run locally to match the best of those. For that, I wanted to match the batch size I was using for the cloud training runs. When I first started learning...
Dark Reading11 · 2026-04-15 14:38

Audit: Big Tech Often Ignores CA Privacy Law Opt-Out Requests

Google, Meta, and Microsoft about half the time don't comply with requests to opt out of online tracking per a California law mandate, privacy watchdog finds.
Daring Fireball8 · 13d ago

Lisa Melton: ‘Memories of Steve’ (and Memories of Safari’s Unique Page-Loading Indicator in Particular)

Lisa Melton: ‘Memories of Steve’ (and Memories of Safari’s Unique Page-Loading Indicator in Particular)
Dark Reading8 · 13d ago

Navigating the Unique Security Risks of Asia's Digital Supply Chain

Regulatory differences, interconnected digital ecosystems, and the rise of AI have created a complex supply chain Asian organizations must wrangle.
Cyber Kendra8 · 13d ago

How to Choose an ERP Consultant Without Creating Security Blind Spots

ERP projects are often described as technology initiatives. In reality, they are business-wide trust exercises. The moment a company starts replacing finance, operations, inventory, procurement, or customer data systems, it is not just buying software. It is handing a third party access to sensitive workflows, internal processes, and sometimes the most valuable data in the organization. That is why choosing the right ERP consultant is not just a delivery decision. It is also a security decisi...
Infosecurity8 · 13d ago

OpenAI Unveils GPT-5.4-Cyber for Improving Cyber Defense With AI

OpenAI’s new frontier model focused on cybersecurity comes following Anthropic’s launch of Claude Mythos Preview and Project Glasswing
Infosecurity8 · 2026-04-15 15:31

European Cybersecurity Agency ENISA Seeks Top-Tier Status in CVE Program

The EU cybersecurity agency looks to become the third Top-Level Root CVE Numbering Authority, alongside CISA and MITRE
Dark Reading8 · 2026-04-15 15:12

Prepping for 'Q-Day': Why Quantum Risk Management Should Start Now

Quantum computers are coming and may impact systems in unexpected ways, and it will "take years to be fully quantum-safe, if ever," cryptography expert warns.
8th Light8 · 2026-04-15 13:44

LLMs Are Proving That It Is Impossible to Automate Away the Human Experience

The Gap is Real If your accessibility process ends with a passing scan, your users with disabilities are likely encountering barriers you do not know about. Automated tools are useful. LLM-assisted auditing has raised the ceiling. Neither closes the gap between what a tool can verify and what a person actually experiences when navigating with a screen reader. The gap is real, it is measurable, and it has organizational consequences. I have spent years running every category of automated acces...
Tenable Blog8 · 2026-04-15 12:50

Unlocking foundational visibility for cyber-physical systems with OT vulnerability management

Stop managing risk in silos. VM-Native OT Discovery, now available in Tenable Vulnerability Management and Tenable Security Center provides unified visibility across IT and OT domains. See every asset and manage your total cyber exposure in a unified view. Key takeaways The air gap is dead. IT security teams are inheriting responsibility for operational technology (OT), but often lack visibility into these systems.   Security teams face significant barriers with OT security. Fear of disruptin...
IEEE Spectrum6 · 2026-04-15 13:00

Crypto Faces Increased Threat From Quantum Attacks

The race to transition online security protocols to ones that can’t be cracked by a quantum computer is already on. The algorithms that are commonly used today to protect data online— RSA and elliptic curve cryptography —are uncrackable by supercomputers, but a large enough quantum computer would make quick work of them. There are algorithms secure enough to be out of reach for both classical and future quantum machines, called post-quantum cryptography, but transitioning to these is a work i...
Infosecurity6 · 2026-04-15 13:00

Critical Nginx-ui MCP Flaw Actively Exploited in the Wild

Critical nginx-ui MCP authentication bypass CVE-2026-33032 actively exploited with CVSS 9.8
Infosecurity6 · 2026-04-15 10:30

AI Companies to Play Bigger Role in CVE Program, Says CISA

At VulnCon, Lindsey Cerkovnik, head of vulnerability management at CISA, said AI companies should play a bigger role in vulnerability disclosures in the future
[DRAGNET]5 · 2026-04-15 11:21

Crypto Scam Alert: Hackers Exploit Obsidian Plugins to Deploy Stealth Malware

Crypto Scam Alert: Hackers Exploit Obsidian Plugins to Deploy Stealth Malware    CoinCentral
[DRAGNET]5 · 2026-04-15 07:00

Brockton Hospital Ransomware Attack: Downtime Procedures to Continue for Two Weeks

Brockton Hospital Ransomware Attack: Downtime Procedures to Continue for Two Weeks    The HIPAA Journal
[DRAGNET]5 · 2026-04-15 07:00

WordPress plugin suite hacked to push malware to thousands of sites

WordPress plugin suite hacked to push malware to thousands of sites    BleepingComputer