Normal view

Received yesterday — 12 December 2025
Received before yesterday

Rethinking Security as Access Control Moves to the Edge

11 December 2025 at 13:35
attacks, cyberattacks, cybersecurity, lobin, CISOs, encryption, organizations, recovery, Fenix24, Edgeless digital immunity, digital security, confidential Oracle recovery gateway, security

The convergence of physical and digital security is driving a shift toward software-driven, open-architecture edge computing. Access control has typically been treated as a physical domain problem — managing who can open which doors, using specialized systems largely isolated from broader enterprise IT. However, the boundary between physical and digital security is increasingly blurring. With..

The post Rethinking Security as Access Control Moves to the Edge appeared first on Security Boulevard.

Hacks Up, Budgets Down: OT Oversight Must Be An IT Priority

11 December 2025 at 13:32

OT oversight is an expensive industrial paradox. It’s hard to believe that an area can be simultaneously underappreciated, underfunded, and under increasing attack. And yet, with ransomware hackers knowing that downtime equals disaster and companies not monitoring in kind, this is an open and glaring hole across many ecosystems. Even a glance at the numbers..

The post Hacks Up, Budgets Down: OT Oversight Must Be An IT Priority appeared first on Security Boulevard.

Identity Management in the Fragmented Digital Ecosystem: Challenges and Frameworks

11 December 2025 at 13:27

Modern internet users navigate an increasingly fragmented digital ecosystem dominated by countless applications, services, brands and platforms. Engaging with online offerings often requires selecting and remembering passwords or taking other steps to verify and protect one’s identity. However, following best practices has become incredibly challenging due to various factors. Identifying Digital Identity Management Problems in..

The post Identity Management in the Fragmented Digital Ecosystem: Challenges and Frameworks appeared first on Security Boulevard.

An Inside Look at the Israeli Cyber Scene

11 December 2025 at 11:30
investment, cybersecurity, calculator and money figures

Alan breaks down why Israeli cybersecurity isn’t just booming—it’s entering a full-blown renaissance, with record funding, world-class talent, and breakout companies redefining the global cyber landscape.

The post An Inside Look at the Israeli Cyber Scene appeared first on Security Boulevard.

NIST Plans to Build Threat and Mitigation Taxonomy for AI Agents

10 December 2025 at 14:08

The U.S. National Institute of Standards and Technology (NIST) is building a taxonomy of attack and mitigations for securing artificial intelligence (AI) agents. Speaking at the AI Summit New York conference, Apostol Vassilev, a research team supervisor for NIST, told attendees that the arm of the U.S. Department of Commerce is working with industry partners..

The post NIST Plans to Build Threat and Mitigation Taxonomy for AI Agents appeared first on Security Boulevard.

Gartner’s AI Browser Ban: Rearranging Deck Chairs on the Titanic

10 December 2025 at 10:31

The cybersecurity world loves a simple solution to a complex problem, and Gartner delivered exactly that with its recent advisory: “Block all AI browsers for the foreseeable future.” The esteemed analyst firm warns that agentic browsers—tools like Perplexity’s Comet and OpenAI’s ChatGPT Atlas—pose too much risk for corporate use. While their caution makes sense given..

The post Gartner’s AI Browser Ban: Rearranging Deck Chairs on the Titanic appeared first on Security Boulevard.

Securing MCP: How to Build Trustworthy Agent Integrations

10 December 2025 at 08:25
LLMs, prompt, MCP, Cato, AI, jailbreak, cybersecurity, DeepSeek, LLM, LLMs, attacks, multi-agent, Cybersecurity, AI, security, risk, Google AI LLM vulnerability

Model Context Protocol (MCP) is quickly becoming the backbone of how AI agents interact with the outside world. It gives agents a standardized way to discover tools, trigger actions, and pull data. MCP dramatically simplifies integration work. In short, MCP servers act as the adapter that grants access to services, manages credentials and permissions, and..

The post Securing MCP: How to Build Trustworthy Agent Integrations appeared first on Security Boulevard.

Indirect Malicious Prompt Technique Targets Google Gemini Enterprise

9 December 2025 at 14:06
MCP, vulnerabilities, F5, vulvisibility, vulnerabilities, CAST AI, KSPM, Google Kubernetes vulnerabilities

Noma Security today revealed it has discovered a vulnerability in the enterprise edition of Google Gemini that can be used to inject a malicious prompt that instructs an artificial intelligence (AI) application or agent to exfiltrate data. Dubbed GeminiJack, cybercriminals can use this vulnerability to embed a malicious prompt in, for example, a Google Doc..

The post Indirect Malicious Prompt Technique Targets Google Gemini Enterprise appeared first on Security Boulevard.

Australian Social Media Ban Takes Effect as Kids Scramble for Alternatives

9 December 2025 at 16:10

Australian Social Media Ban Takes Effect as Kids Scramble for Alternatives

Australia’s world-first social media ban for children under age 16 takes effect on December 10, leaving kids scrambling for alternatives and the Australian government with the daunting task of enforcing the ambitious ban. What is the Australian social media ban, who and what services does it cover, and what steps can affected children take? We’ll cover all that, plus the compliance and enforcement challenges facing both social media companies and the Australian government – and the move toward similar bans in other parts of the world.

Australian Social Media Ban Supported by Most – But Not All

In September 2024, Prime Minister Anthony Albanese announced that his government would introduce legislation to set a minimum age requirement for social media because of concerns about the effect of social media on the mental health of children. The amendment to the Online Safety Act 2021 passed in November 2024 with the overwhelming support of the Australian Parliament. The measure has met with overwhelming support – even as most parents say they don’t plan to fully enforce the ban with their children. The law already faces a legal challenge from The Digital Freedom Project, and the Australian Financial Review reported that Reddit may file a challenge too. Services affected by the ban – which proponents call a social media “delay” – include the following 10 services:
  • Facebook
  • Instagram
  • Kick
  • Reddit
  • Snapchat
  • Threads
  • TikTok
  • Twitch
  • X
  • YouTube
Those services must take steps by Wednesday to remove accounts held by users under 16 in Australia and prevent children from registering new accounts. Many services began to comply before the Dec. 10 implementation date, although X had not yet communicated its policy to the government as of Dec. 9, according to The Guardian. Companies that fail to comply with the ban face fines of up to AUD $49.5 million, while there are no penalties for parents or children who fail to comply.

Opposition From a Wide Range of Groups - And Efforts Elsewhere

Opposition to the law has come from a range of groups, including those concerned about the privacy issues resulting from age verification processes such as facial recognition and assessment technology or use of government IDs. Others have said the ban could force children toward darker, less regulated platforms, and one group noted that children often reach out for mental health help on social media. Amnesty International also opposed the ban. The international human rights group called the ban “an ineffective quick fix that’s out of step with the realities of a generation that lives both on and offline.” Amnesty said strong regulation and safeguards would be a better solution. “The most effective way to protect children and young people online is by protecting all social media users through better regulation, stronger data protection laws and better platform design,” Amnesty said. “Robust safeguards are needed to ensure social media platforms stop exposing users to harms through their relentless pursuit of user engagement and exploitation of people’s personal data. “Many young people will no doubt find ways to avoid the restrictions,” the group added. “A ban simply means they will continue to be exposed to the same harms but in secret, leaving them at even greater risk.” Even the prestigious medical journal The Lancet suggested that a ban may be too blunt an instrument and that 16-year-olds will still face the same harmful content and risks. Jasmine Fardouly of the University of Sydney School of Psychology noted in a Lancet commentary that “Further government regulations and support for parents and children are needed to help make social media safe for all users while preserving its benefits.” Still, despite the chorus of concerns, the idea of a social media ban for children is catching on in other places, including the EU and Malaysia.

Australian Children Seek Alternatives as Compliance Challenges Loom

The Australian social media ban leaves open a range of options for under-16 users, among them Yope, Lemon8, Pinterest, Discord, WhatsApp, Messenger, iMessage, Signal, and communities that have been sources of controversy such as Telegram and 4chan. Users have exchanged phone numbers with friends and other users, and many have downloaded their personal data from apps where they’ll be losing access, including photos, videos, posts, comments, interactions and platform profile data. Many have investigated VPNs as a possible way around the ban, but a VPN is unlikely to work with an existing account that has already been identified as an underage Australian account. In the meantime, social media services face the daunting task of trying to confirm the age of account holders, a process that even Albanese has acknowledged “won’t be 100 per cent perfect.” There have already been reports of visual age checks failing, and a government-funded report released in August admitted the process will be imperfect. The government has published substantial guidance for helping social media companies comply with the law, but it will no doubt take time to determine what “reasonable steps” to comply look like. In the meantime, social media companies will have to navigate compliance guidance like the following passage: “Providers may choose to offer the option to end-users to provide government-issued identification or use the services of an accredited provider. However, if a provider wants to employ an age assurance method that requires the collection of government-issued identification, then the provider must always offer a reasonable alternative that doesn’t require the collection of government-issued identification. A provider can never require an end-user to give government-issued identification as the sole method of age assurance and must always give end-users an alternative choice if one of the age assurance options is to use government-issued identification. A provider also cannot implement an age assurance system which requires end-users to use the services of an accredited provider without providing the end-user with other choices.”  

Rebrand Cybersecurity from “Dr. No” to “Let’s Go”

9 December 2025 at 11:52
CISOs, challenge, security strategy

When it comes to cybersecurity, it often seems the best prevention is to follow a litany of security “do’s” and “don’ts.”  A former colleague once recalled that at one organization where he worked, this approach led to such a long list of guidance that the cybersecurity function was playfully referred to as a famous James..

The post Rebrand Cybersecurity from “Dr. No” to “Let’s Go” appeared first on Security Boulevard.

AI-Powered Security Operations: Governance Considerations for Microsoft Sentinel Enterprise Deployments

9 December 2025 at 11:31
agentic aiDeepseek, CrowdStrike, agentic,

The Tech Field Day Exclusive with Microsoft Security (#TFDxMSSec25) spotlighted one of the most aggressive demonstrations of AI-powered security operations to date. Microsoft showcased how Sentinel’s evolving data lake and graph architecture now drive real-time, machine-assisted threat response. The demo of “Attack Disruption” captured the promise—and the unease—of a security operations center where AI acts..

The post AI-Powered Security Operations: Governance Considerations for Microsoft Sentinel Enterprise Deployments appeared first on Security Boulevard.

Microsoft Takes Aim at “Swivel-Chair Security” with Defender Portal Overhaul

9 December 2025 at 10:20

At a recent Tech Field Day Exclusive event, Microsoft unveiled a significant evolution of its security operations strategy—one that attempts to solve a problem plaguing security teams everywhere: the exhausting practice of jumping between multiple consoles just to understand a single attack. The Problem: Too Many Windows, Not Enough Clarity Security analysts have a name..

The post Microsoft Takes Aim at “Swivel-Chair Security” with Defender Portal Overhaul appeared first on Security Boulevard.

TransUnion Extends Ability to Detect Fraudulent Usage of Devices

9 December 2025 at 08:38
authorization , systems,

TransUnion today added an ability to create digital fingerprints without relying on cookies that identify, in real time, risky devices and other hidden anomalies to its Device Risk service for combatting fraud. Clint Lowry, vice president of global fraud solutions at TransUnion, said these capabilities extend a service that makes use of machine learning models..

The post TransUnion Extends Ability to Detect Fraudulent Usage of Devices appeared first on Security Boulevard.

Nudge Security Extends Ability to Secure Data in the AI Era

9 December 2025 at 08:25
AI

Nudge Security today extended the scope of its namesake security and governance platform to monitor sensitive data shared via uploads and integrations with an artificial intelligence (AI) service, in addition to now being able to identify individuals sharing that data by department or the specific tools used. In addition, Nudge Security is now making it..

The post Nudge Security Extends Ability to Secure Data in the AI Era appeared first on Security Boulevard.

Meta offers EU users ad-light option in push to end investigation

8 December 2025 at 09:57

Meta has agreed to make changes to its “pay or consent” business model in the EU, seeking to agree to a deal that avoids further regulatory fines at a time when the bloc’s digital rule book is drawing anger from US authorities.

On Tuesday, the European Commission announced that the social media giant had offered users an alternative choice of Facebook and Instagram services that would show them fewer personalized advertisements.

The offer follows an EU investigation into Meta’s policy of requiring users either to consent to data tracking or pay for an ad-free service. The Financial Times reported on optimism that an agreement could be reached between the parties in October.

Read full article

Comments

© Derick Hudson

Scammers harvesting Facebook photos to stage fake kidnappings, warns FBI

8 December 2025 at 08:17

The FBI has warned about a new type of scam where your Facebook pictures are harvested to act as “proof-of-life” pictures in a virtual kidnapping.

The scammers pretend they have kidnapped somebody and contact friends and next of kin to demand a ransom for their release. While the alleged victim is really just going about their normal day, criminals show the family real Facebook photos to “prove” that person is still alive but in their custody.

This attack resembles Facebook cloning but with a darker twist. Instead of just impersonating you to scam your friends, attackers weaponize your pictures to stage fake proof‑of‑life evidence.

Both scams feed on oversharing. Public posts give criminals more than enough information to impersonate you, copy your life, and convince your loved ones something is wrong.

This alert focuses on criminals scraping photos from social media (usually Facebook, but also LinkedIn, X, or any public profile) then manipulating those images with AI or simple editing to use during extortion attempts. If you know what to look for, you might spot inconsistencies like missing tattoos, unusual lighting, or proportions that don’t quite match.

Scammers rely on panic. They push tight deadlines, threaten violence, and try to force split-second decisions. That emotional pressure is part of their playbook.

In recent years, the FBI has also warned about synthetic media and deepfakes, like explicit images generated from benign photos and then used for sextortion, which is a closely related pattern of abuse of user‑posted pictures. Together, these warnings point to a trend: ordinary profile photos, holiday snaps, and professional headshots are increasingly weaponized for extortion rather than classic account hacking.

What you can do

To make it harder for criminals to use these tactics, be mindful of what information you share on social media. Share pictures of yourself, or your children, only with actual friends and not for the whole world to find. And when you’re travelling, post the beautiful pictures you have taken when you’re back, not while you’re away from home.

Facebook’s built-in privacy tool lets you quickly adjust:

  • Who can see your posts.
  • Who can see your profile information.
  • App and website permissions.

If you’re on the receiving end of a virtual kidnapping attempt:

  • Establish a code word only you and your loved ones know that you can use to prove it’s really you.
  • Always attempt to contact the alleged victim before considering paying any ransom demand.
  • Keep records of every communication with the scammers. They can be helpful in a police investigation.
  • Report the incident to the FBI’s Internet Crime Complaint Center at www.ic3.gov.

We don’t just report on threats – we help protect your social media

Cybersecurity risks should never spread beyond a headline. Protect your social media accounts by using Malwarebytes Identity Theft Protection.

Ex-Employee Sues Washington Post Over Oracle EBS-Related Data Breach

8 December 2025 at 00:16
food stamp fraud, Geofence, warrant, enforcement, DOJ AI crime

The Washington Post last month reported it was among a list of data breach victims of the Oracle EBS-related vulnerabilities, with a threat actor compromising the data of more than 9,700 former and current employees and contractors. Now, a former worker is launching a class-action lawsuit against the Post, claiming inadequate security.

The post Ex-Employee Sues Washington Post Over Oracle EBS-Related Data Breach appeared first on Security Boulevard.

Meta Acquires AI Wearable Company Limitless

5 December 2025 at 17:22
Meta is acquiring AI wearable startup Limitless, maker of a pendant that records conversations and generates summaries. "We're excited that Limitless will be joining Meta to help accelerate our work to build AI-enabled wearables," a Meta spokesperson said in a statement. CNBC reports: Limitless CEO Dan Siroker revealed the deal on Friday via a corporate blog post but did not disclose the financial terms. "Meta recently announced a new vision to bring personal superintelligence to everyone and a key part of that vision is building incredible AI-enabled wearables," Siroker said in the post and an accompanying video. "We share this vision and we'll be joining Meta to help bring our shared vision to life."

Read more of this story at Slashdot.

China Hackers Using Brickstorm Backdoor to Target Government, IT Entities

5 December 2025 at 17:36
china, flax typhoon,

Chinese-sponsored groups are using the popular Brickstorm backdoor to access and gain persistence in government and tech firm networks, part of the ongoing effort by the PRC to establish long-term footholds in agency and critical infrastructure IT environments, according to a report by U.S. and Canadian security offices.

The post China Hackers Using Brickstorm Backdoor to Target Government, IT Entities appeared first on Security Boulevard.

Cultural Lag Leaves Security as the Weakest Link

5 December 2025 at 11:19
cybersecurity

For too long, security has been cast as a bottleneck – swooping in after developers build and engineers test to slow things down. The reality is blunt; if it’s bolted on, you’ve already lost. The ones that win make security part of every decision, from the first line of code to the last boardroom conversation...

The post Cultural Lag Leaves Security as the Weakest Link appeared first on Security Boulevard.

Meta Poaches Apple Design Exec Alan Dye

4 December 2025 at 10:15
Apple's longtime human-interface chief Alan Dye is leaving to lead a new creative studio at Meta's Reality Labs, where he'll shape AI-driven design for devices like smart glasses and VR headsets. Dye will be replaced by Steve Lemay, who has had "a key role in the design of every major Apple interface since 1999," according to a statement Apple CEO Tim Cook gave Bloomberg's Mark Gurman. TechCrunch reports: Shortly after the news broke of Dye's departure, Zuckerberg announced a new creative studio within Reality Labs that would be led by Dye. There, he'll be joined by Billy Sorrentino, another former Apple designer who led interface design across Reality Labs; Joshua To, who led interface design across Reality Labs; Meta's industrial design team, led by Pete Bristol; and its metaverse design and art teams led by Jason Rubin. Zuckerberg said the studio would "bring together design, fashion, and technology to define the next generation of our products and experiences." "Our idea is to treat intelligence as a new design material and imagine what becomes possible when it is abundant, capable, and human-centered," the Meta CEO wrote on Threads. "We plan to elevate design within Meta, and pull together a talented group with a combination of craft, creative vision, systems thinking, and deep experience building iconic products that bridge hardware and software."

Read more of this story at Slashdot.

Dangerous RCE Flaw in React, Next.js Threatens Cloud Environments, Apps

4 December 2025 at 10:54
Google, Wiz, Cnapp, Exabeam, CNAPP, cloud threat, detections, threats, CNAP, severless architecture, itte Broadcom report cloud security threat

Security and developer teams are scrambling to address a highly critical security flaw in frameworks tied to the popular React JavaScript library. Not only is the vulnerability, which also is in the Next.js framework, easy to exploit, but React is widely used, including in 39% of cloud environments.

The post Dangerous RCE Flaw in React, Next.js Threatens Cloud Environments, Apps appeared first on Security Boulevard.

AWS Adds Bevy of Tools and Capilities to Improve Cloud Security

4 December 2025 at 09:07
maginot, defense,

Amazon Web Services (AWS) this week made an AWS Security Hub for analyzing cybersecurity data in near real time generally available, while at the same time extending the GuardDuty threat detection capabilities it provides to the Amazon Elastic Compute Cloud (Amazon EC2) and Amazon Elastic Container Service (Amazon ECS). Announced at the AWS re:Invent 2025..

The post AWS Adds Bevy of Tools and Capilities to Improve Cloud Security appeared first on Security Boulevard.

Undetected Firefox WebAssembly Flaw Put 180 Million Users at Risk

2 December 2025 at 13:30
AI, risk, IT/OT, security, catastrophic, cyber risk, catastrophe, AI risk managed detection and response

Cybersecurity startup Aisle discovered a subtle but dangerous coding error in a Firefox WebAssembly implementation sat undetected for six months despite being shipped with a regression testing capability created by Mozilla to find such a problem.

The post Undetected Firefox WebAssembly Flaw Put 180 Million Users at Risk appeared first on Security Boulevard.

OAuth Isn’t Enough For Agents

2 December 2025 at 12:59
attacks, cyberattacks, cybersecurity, lobin, CISOs, encryption, organizations, recovery, Fenix24, Edgeless digital immunity, digital security, confidential Oracle recovery gateway, security

OAuth is a broadly accepted standard. It’s used all over the internet. But as the usage of LLM agents continues to expand, OAuth isn’t going to be enough. In fact, relying on OAuth will be dangerous. We won’t be able to set permissions at an appropriate granularity, giving LLMs access to far too much. More..

The post OAuth Isn’t Enough For Agents appeared first on Security Boulevard.

Security’s Next Control Plane: The Rise of Pipeline-First Architecture

2 December 2025 at 12:51
cost, visibility, SIEM model, data, SIEM, teams, Elastic SIEM LogPoint security employees

For years, security operations have relied on monolithic architectures built around centralized collectors, rigid forwarding chains, and a single “system of record” where all data must land before action can be taken. On paper, that design promised simplicity and control. In practice, it delivered brittle systems, runaway ingest costs, and teams stuck maintaining plumbing instead..

The post Security’s Next Control Plane: The Rise of Pipeline-First Architecture appeared first on Security Boulevard.

ServiceNow to Acquire Identity Security Firm Veza

2 December 2025 at 12:44
consolidation, security, cyberthreats, Darktrace cybersecurity acquisition

ServiceNow Inc. announced on Tuesday plans to acquire Veza in a move aimed at fortifying security for identity and access management. The acquisition will integrate Veza’s technology into ServiceNow’s Security and Risk portfolios, helping organizations monitor and control access to critical data, applications, systems, and artificial intelligence (AI) tools. The deal comes as businesses increasingly..

The post ServiceNow to Acquire Identity Security Firm Veza appeared first on Security Boulevard.

Closing the Document Security Gap: Why Document Workflows Must Be Part of Cybersecurity

2 December 2025 at 12:35
security, risk, vector

Organizations are spending more than ever on cybersecurity, layering defenses around networks, endpoints, and applications. Yet a company’s documents, one of the most fundamental business assets, remains an overlooked weak spot. Documents flow across every department, cross company boundaries, and often contain the very data that compliance officers and security teams work hardest to protect...

The post Closing the Document Security Gap: Why Document Workflows Must Be Part of Cybersecurity appeared first on Security Boulevard.

How Financial Institutions Can Future-Proof Their Security Against a New Breed of Cyber Attackers

2 December 2025 at 12:34

As we look at the remainder of 2025 and beyond, the pace and sophistication of cyber attacks targeting the financial sector show no signs of slowing. In fact, based on research from Check Point’s Q2 Ransomware Report, the financial cybersecurity threat landscape is only intensifying. Gone are the days when the average hacker was a..

The post How Financial Institutions Can Future-Proof Their Security Against a New Breed of Cyber Attackers appeared first on Security Boulevard.

❌