March 2026 – Page 43

New “LeakyLooker” Flaws in Google Looker Studio Could Enable Cross-Tenant SQL Queries

Cybersecurity researchers have disclosed nine cross-tenant vulnerabilities in Google Looker Studio that could have permitted attackers to run arbitrary SQL queries on victims’ databases and exfiltrate sensitive data within organizations’ Google Cloud environments.
The shortcomings have been collectively named LeakyLooker by Tenable. There is no evidence that the vulnerabilities were exploited in

Hundreds of Salesforce Customers Allegedly Targeted in New Data Theft Campaign

Salesforce has confirmed that customers are being targeted via poorly secured instances.

The post Hundreds of Salesforce Customers Allegedly Targeted in New Data Theft Campaign appeared first on SecurityWeek.

Escape Raises $18 Million to Automate Pentesting

The company will deepen its platform’s AI agent capabilities and scale engineering and go-to-market teams.

The post Escape Raises $18 Million to Automate Pentesting appeared first on SecurityWeek.

Recent Ivanti Endpoint Manager Flaw Exploited in Attacks

CISA has added the high-severity authentication bypass vulnerability to its KEV list, along with SolarWinds and Workspace One bugs.

The post Recent Ivanti Endpoint Manager Flaw Exploited in Attacks appeared first on SecurityWeek.

How to Stop AI Data Leaks: A Webinar Guide to Auditing Modern Agentic Workflows

Artificial Intelligence (AI) is no longer just a tool we talk to; it is a tool that does things for us. These are called AI Agents. They can send emails, move data, and even manage software on their own.
But there is a problem. While these agents make work faster, they also open a new “back door” for hackers.
The Problem: “The Invisible Employee”
Think of an AI Agent like a new employee who has

CISA: Recently patched Ivanti EPM flaw now actively exploited

CISA flagged a high-severity Ivanti Endpoint Manager (EPM) vulnerability as actively exploited in attacks and ordered U.S. federal agencies to patch systems within three weeks. […]

The Zero-Day Scramble is Avoidable: A Guide to Attack Surface Reduction

You can’t control when the next critical vulnerability drops. You can control how much of your environment is exposed when it does. The problem is that most teams have more internet-facing exposure than they realise. Intruder’s Head of Security digs into why this happens and how teams can manage it deliberately.
Time-to-exploit is shrinking
The larger and less controlled your attack surface is,

SIM Swaps Expose a Critical Flaw in Identity Security

SIM swap attacks exploit misplaced trust in phone numbers and human processes to bypass authentication controls and seize high-value accounts.

The post SIM Swaps Expose a Critical Flaw in Identity Security appeared first on SecurityWeek.

APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military

The Russian state-sponsored hacking group tracked as APT28 has been observed using a pair of implants dubbed BEARDSHELL and COVENANT to facilitate long‑term surveillance of Ukrainian military personnel.
The two malware families have been put to use since April 2024, ESET said in a new report shared with The Hacker News.
APT28, also tracked as Blue Athena, BlueDelta, Fancy Bear, Fighting Ursa,

Microsoft to enable Windows hotpatch security updates by default

Microsoft will turn on hotpatch security updates by default for all eligible Windows devices managed through Microsoft Intune and the Microsoft Graph API, beginning with the May 2026 Windows security update. […]

Month: March 2026