GoKawiil
Tech News
A high-severity authentication bypass and remote code execution vulnerability in Ivanti ICS, tracked as CVE-2026-104935, was only partially fixed when Ivanti issued a patch in July. Threat actors have since exploited the remaining gap, according to reports, allowing attacks to continue despite the earlier remediation attempt.
Apple quietly included a feature called Impersonation Risk Detection in iOS 27, alongside the headline Siri AI update. The tool analyzes interaction patterns, timing and context on-device to flag social-engineering scams as Unknown, Medium or High risk, sharing only that risk level with supporting apps rather than personal data. Users can enable it via Settings > Privacy & Security, though activation can take up to 24 hours.
Security researchers describe a growing cybercriminal tactic of targeting executives' family members and friends, who often lack the security training given to leadership, to gain backdoor access into corporate systems. Google Cloud's Office of the CISO warned in March that personal attacks against executives are rising, and BlackCloak's Brian Hill notes attackers can map a household's routines and relationships through reconnaissance before pivoting to impersonation, device compromise, or phishing.
Citrix has released emergency firmware updates for NetScaler ADC and Gateway appliances to fix CVE-2026-88779, a memory buffer vulnerability in SAML authentication with a CVSS score of 8.7. The company confirmed the bug has already been exploited in targeted attacks against unpatched devices, causing denial-of-service outages, and said it has found no evidence of customer data being compromised. Fixed versions include 14.1-73.41 and 13.1-64.28, with separate builds for FIPS and NDcPP customers.
Google is experimenting with a Chrome Canary flag called 'Biometric reauth for password filling' that requires a fingerprint or face scan before autofilling saved passwords on Android. The feature appeared in version 157.0.8083.0 and was spotted by browser researcher Leopeva64, who demonstrated it triggering an authentication prompt. Google previously tested a similar feature in 2024 before pulling it ahead of a stable release.
A new study by Consumer Reports, Aspen Digital and the Global Cyber Alliance found that roughly 90% of US adults have experienced at least one digital scam or cyberattack. Confidence in the safety of personal data has dropped sharply, with those saying they have no confidence at all in protections for data like Social Security numbers nearly doubling from 16% in 2025 to 29% now, while those expressing confidence fell from 48% to 32%.
A new how-to guide walks through configuring SPF, DKIM and DMARC records for a sending domain, using Mailfully's setup process as the working example. It explains that SPF authorizes sending IPs, DKIM cryptographically signs messages, and DMARC checks alignment between the two and enforces a policy, with receiving servers using all three to decide whether mail is legitimate.
A new analysis of FBI data by Incogni found that 72% of elder fraud cases in 2024 were enabled by victims' personal information being exposed online, resulting in $4.2 billion in losses. The report details how scammers use publicly available data, family chat groups, and SIM-swapping techniques to impersonate relatives and bypass two-factor authentication.
Reddit announced it will soon limit logged-in access to Old.Reddit.com to accounts that have used the interface within the previous six months. Moderators are exempt from this rule and can continue accessing Old Reddit regardless of recent activity, as long as they're logged in. The move builds on a July change requiring login to access Old Reddit at all.
Security guidance is comparing two ways of handling two-factor authentication codes: storing them inside a password manager alongside saved passwords, or keeping them in a separate dedicated authenticator app. Password managers combine both login factors in one vault for convenience, while authenticator apps keep the second factor physically separate from the password itself, generating or sending one-time codes through methods like text messages, push notifications, email, or in-app codes.
Varonis Threat Labs disclosed a technique called TrustSink in which an attacker with a highly privileged Entra account registers a rogue external MFA provider that inserts a fake password prompt into legitimate login flows, capturing users' plaintext passwords. The rogue provider still returns a valid signed token to Entra, so the sign-in completes normally with no visible error, and resetting a stolen password does not remove the malicious provider from the authentication flow. Varonis says the method could work with any authentication system using this external MFA model but demonstrated it specifically against Microsoft Entra.
Passkeys replace a secret you know with a key your device holds. That single change removes most of what makes phishing work, and it changes how account recovery should be set up.