Code Defender

The deal extends Okta’s reach beyond identity management and into the realm of security operations, positioning the company to compete more directly on identity threat detection and response.

The post Okta to Acquire Identity Threat Detection Firm Permiso appeared first on SecurityWeek.

The acquisition will add approximately 65 cybersecurity professionals to Bank of America’s operations in the United Kingdom.

The post Bank of America to Acquire Cybersecurity Firm MDSec appeared first on SecurityWeek.

CISA is urging water and wastewater utilities to lock down internet-exposed controllers, days after intrusions hit dozens of Minnesota systems.

The post CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs appeared first on SecurityWeek.

In this edition of Reporters’ Notebook, our journalists discuss the ins and outs of Anthropic’s Claude Mythos rollout. How seriously should we take its risks? How big of a deal is it?

Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft.

In his proof of concept, the internally generated file triggered the same behavior when it was used in a second Copilot drafting session.

Måløy’s

A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service’s Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz.

Wiz, which codenamed the chain CosmosEscape, said the exploit chain began with a crafted query against a Gremlin database controlled by the attacker. From there, code execution on a

A lot of security still comes down to trusting the wrong screen.

This week, that screen might be a login page, an install guide, a recruiter call, or a familiar service behaving slightly wrong. Behind it: reused credentials, exposed systems, quiet loaders, abused trust, and exploit paths that should have been harder.

Some defenses improved. The loose parts still got found first. Anyway,

Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview campaign.

The defining aspect of the attack is that bogus macOS software update screen stealthily

A premium-grade malware-as-a-service offering takes flight with multiple threat groups, building infostealers that drain victims’ bank accounts.

The groups move from goods to services and continue to traffic people from at least 80 countries, costing nations in the region at least $88 billion in 2025 alone.