NGAV (next-gen antivirus) focuses on stopping malware and exploits with AI and behavior analysis. EDR adds continuous visibility, investigation, and one-click response when prevention misses. For most SMEs, start with a strong NGAV baseline and move to EDR as soon as you can support alerts and response especially if ransomware or hands-on-keyboard attacks worry you. …
The Trump administration is reportedly considering licenses that would let Nvidia sell its H200 AI chips to China, reversing earlier restrictions that treated the GPU as too advanced for export. The debate pits Nvidia’s lost China revenue and a fragile tech truce against fresh smuggling indictments, the proposed CHIP Security Act and mounting fears that high-end AI hardware will accelerate China’s weapons and surveillance programmes.
Envoy Air confirmed it was targeted in a Clop-linked campaign exploiting vulnerabilities in Oracle E-Business Suite. While the airline asserts no passenger data was affected, business records may have been stolen. This write-up breaks down the tactics, likely exploited CVEs, impacts, and what organizations must do next.
The latest version of the ransomware family known as LockBit has resurfaced with a potent new variant, LockBit 5.0, capable of striking Windows endpoints, Linux servers and VMware ESXi hypervisor platforms in one campaign. Organisations must reassess their ransomware defences and detection posture now.
A critical flaw (CVE-2025-9242) in WatchGuard Fireware OS allows unauthenticated attackers to execute code remotely via the IKEv2 VPN process. This vulnerability impacts Firebox devices running outdated firmware and exposes enterprise networks to full compromise if left unpatched.
CVE-2025-61757 is a critical pre-authentication remote code execution vulnerability in Oracle Identity Manager’s REST APIs that CISA now lists as actively exploited. By abusing a security filter bypass and a Groovy compilation endpoint, attackers can run arbitrary code on identity-tier servers over HTTP. This article explains the exploit chain, CISA’s KEV deadline and how Oracle shops should patch, monitor and lock down their Identity Manager deployments.
The UN is set to convene a landmark global cybercrime treaty signing in Hanoi, aiming to enhance cross-border cooperation and streamline investigations into ransomware, phishing and online trafficking. While supporters hail the pact as overdue, human-rights advocates and tech firms warn the broad language and choice of host country raise serious concerns about surveillance and enforcement.
This Windows 11 (24H2) hardening guide delivers 20 Group Policy settings you can deploy today. You’ll protect credentials, block ransomware, enforce SMB signing, harden RDP, and tighten audit logging with version-specific notes and quick tests. Roll out in phases, validate with gpresult, and keep exceptions minimal and time-boxed.
Aardvark is OpenAI’s GPT-5–powered security agent that reads repositories like a human, validates exploitability in a sandbox, and proposes precise patches. Consequently, teams can cut detection and remediation time without slowing delivery.
Cybercriminals have found a way to turn Velociraptor an open-source DFIR and endpoint monitoring tool into a stealthy persistence mechanism, deploying hidden backdoors on compromised systems. Security researchers warn that trusted forensic tools are increasingly being repurposed for post-exploitation control.