Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

ClickFix Investigation Exposes API-Driven Malware Across 3,000 Live Payloads

  A growing number of ClickFix campaigns are advancing from simple social engineering operations into highly orchestrated malware delivery o...

All the recent news you need to know
UAE
Children Privacy Cyber Security Online Safety Social Media Ban UAE

UAE Becomes First Arab Nation to Ban Social Media for Children Under 15

 

The United Arab Emirates has become the first Arab nation to impose a comprehensive ban on social media use for children under the age of 15, marking a significant milestone in digital child protection. Announced in mid-June 2026 through a cabinet resolution, the policy prohibits minors below 15 from creating, using, or managing personal accounts on platforms like Instagram, TikTok, Snapchat, and Facebook. 

This decision aligns the UAE with countries such as Australia, Britain, and Canada that have recently tightened online safety rules amid growing concerns about social media's impact on young people's mental health. Under the new regulations, children under 15 are completely barred from accessing interactive social media features, including posting content, commenting on posts, sharing material, or joining public groups and open channels. 

The ban is absolute and cannot be circumvented through parental or caregiver consent, representing a stricter approach than previous guidelines. For teenagers aged 15 and 16, limited access is permitted but comes with enhanced safeguards, including age-appropriate content controls, restrictions on interactions with strangers, screen-time management tools, and mandatory parental supervision features. 

Social media platforms operating in the UAE must now implement robust age-verification systems, including digital identity checks and AI-supported technologies, with self-declared ages explicitly rejected as valid proof. Companies have been given a 12-month transition period ending December 31, 2026, to identify, monitor, and disable accounts belonging to underage users. Failure to comply with these requirements could result in significant penalties, including partial or full blocking of non-compliant services within the country, with enforcement overseen by the Telecommunications and Digital Government Regulatory Authority.

The resolution builds upon Federal Decree-Law No. 26 of 2025 on Child Digital Safety, which came into force on January 1, 2026, and applies to all digital platforms that operate in or have users within the UAE, regardless of where the company is headquartered. These regulations also restrict the collection of personal data from children under 13 without verifiable parental consent and prohibit platforms from using minors' information for targeted advertising or behavioural profiling. The measures are designed to protect children from inappropriate content, online risks, excessive social media use, and misuse of personal data while fostering healthier digital habits. 

The policy has immediate relevance for the UAE's large expatriate population, including over 3.5 million Indians residing in the country, many of whom have school-aged children using social media platforms. In response, Dubai has launched a nationwide initiative aimed at promoting healthy technology use among young people and supporting parents in adapting to rapid technological changes. Authorities emphasise that digital balance does not mean rejecting technology but rather helping children and families use it in ways that support their wellbeing and growth. 

Read more »
Microsoft Defender vulnerability
BlueHammer Vulnerability CISA Cyber Attacks Cyber Campaigns Cyber Security Ransomware Attacks Malware attacks Microsoft Microsoft Defender vulnerability

BlueHammer Microsoft Defender Vulnerability Linked to Ransomware Attacks After CISA Confirms Active Exploitation

 

Microsoft Defender users are advised to update their software after discovering a security flaw known as BlueHammer was used in ransomware attacks. The weakness with identifier CVE-2026-33825 has been added to the list of flaws actively used by malicious actors. It is part of the growing trend of ransomware attackers using zero-day issues. 

The issue was uncovered after the cybersecurity researcher, otherwise known as Chaotic Eclipse or Nightmare Eclipse, shared the information regarding another vulnerability before the update was released. The same individual has criticized Microsoft several times over their approach to disclosure of security weaknesses. The researcher has published multiple posts about actively used problems prior to the official date of their resolution. 

Microsoft published the details regarding BlueHammer on April 2nd, whereas the security update was released on April 14th. The flaw was categorized as a privilege escalation vulnerability with the ability to escalate the privileges of an authenticated attacker. However, Microsoft updated the description, specifying the risk as more likely than not, while refraining from officially acknowledging active exploitation. 

According to the independent security researchers, the vulnerability was actively used by ransomware operators before the release of the mentioned security update. The evidence came from the report by the Huntress team, which discovered multiple attacks that incorporated CVE-2026-33825 as a zero-day exploit. This information has prompted the addition of the weakness to the CISA’s Known Exploited Vulnerabilities (KEV) list on April 22nd, with the updated listing providing the additional context of ransomware attacks. 

Despite the confirmation of ransomware attacks, the one issued by CISA does not indicate what group may be responsible for them. There is no public evidence linking BlueHammer to any known ransomware group or family. In spite of that, the weakness has been actively used in ransomware operations. At the same time, it is unclear whether other ransomware groups have used it or may be using it currently. The issue has also prompted the debate over the response to such incidents, with the critics suggesting that the defenders and security researchers are not notified when the weaknesses are added to the ransomware operations. 

In practice, the CISA only updates the KEV list periodically. It does not provide threat intelligence and response support for individual organizations every time when the weakness is added to the list. Some security experts have stated that the better alternative would be to notify the defenders directly. In the meantime, a threat intelligence company GreyNoise has announced the availability of a free service that monitors the KEV list for changes, indicating when the weakness is updated to include the details of a ransomware attack. 

The discovery of BlueHammer presents an illustrative example of how fast the ransomware attackers can adopt and incorporate the newly discovered vulnerabilities into their operations. Experts advise the defenders to always remain alert, apply the Microsoft security updates in a timely manner and monitor the threats intelligence channels for the relevant weaknesses. The ransomware operators continue to pursue the opportunities, which render the prompt response to the updates crucial.
Read more »
Vulnerabilities and Exploits
CISA advisory Daktronics Vulnerabilities Digital Billboard Security Highway Sign Hacking Industrial Control Systems Infrastructure Cybersecurity OT Security Remote Code Execution Vulnerabilities and Exploits

Remote Exploits Target Controller Flaws in Highway Signs and Digital Billboards


 

With the increasing integration of digital display infrastructure within transportation networks and public information systems, vulnerabilities within controllers that operate these assets present an increasing threat to cybersecurity. 

A number of Daktronics display controllers have been reported to contain critical and high-severity vulnerabilities that could allow unauthorized remote access to the content appearing on the highway message boards, roadside signs, and digital billboards. 

According to an independent cybersecurity researcher who identified the security flaws and subsequently published an advisory, widespread deployment of controller models for the management of large-scale LED display systems within highways, airports, sports stadiums, and urban advertising networks are affected by the flaws. 

A variety of vulnerabilities within operating display technologies are identified in this study, which illustrate how they can affect more than just the security of the system, resulting in tangible risk to public communications, infrastructure integrity, and reliability of information delivered via connected electronic signage. 

According to the latest advisory issued by CISA under ICSA-26-176-04, the Daktronics VFC-DMP-5000, DMP-5000, and DMP-8000 display controllers are affected. A total of nine vulnerabilities have been disclosed which expose weaknesses across directory access, file management, and administrative authentication. One of the vulnerabilities, CVE-2026-28701, allows both authenticated and unauthenticated remote users to enumerate arbitrary paths on the file system irrespective of their identity. Secondly, CVE-2026-33560 pertains to the DMP-5000 file service, where authenticated users can upload files of any type without being validated, enabling the deployment of unauthorized content. CVE-2026-31928 relates to a default administrative web account that is configured with weak authentication controls and does not require password modification during deployment, which allows attackers to gain full control of the system if left unchanged. 

Security researcher Thomas Jou, an undergraduate at Princeton University, discovered the vulnerabilities after discovering a number of internet-facing controllers with the potential to be remotely targeted. It has been reported that Jou submitted his findings via CISA's VINCE vulnerability reporting platform in early January 2026, which enabled Daktronics to prepare patched firmware by early March, prior to the release of a public advisory.

Despite the availability of updated firmware, the researcher stressed that organizations must ensure affected controllers are not exposed directly to the public internet, as patching alone does not eliminate unnecessary attack surfaces. In addition to the mitigation guidance provided by Daktronics, customers are encouraged to change default administrative credentials. 

In June, a security incident involving a FIFA World Cup API authorization flaw exposed live television broadcasts to an account takeover, following several instances of security incidents involving publicly accessible infrastructure and digital platforms. A cPanel vulnerability affecting over 550,000 servers was exploited last month, as was the compromise of airport public address systems across Canada and the United States last year, during which unauthorized political and anti-Israel messages were broadcast. 

These incidents provide an example of how overlooked vulnerabilities in internet-connected communication and operational systems can rapidly develop into high-impact disruptions with public consequences if not addressed. The underlying controllers of connected display technologies require the same level of security oversight as any other internet-accessible operational system as they become an integral component of public infrastructure. 

The timely management of patches, removal of unnecessary external exposures, and strong authentication practices are all necessary to prevent vulnerabilities from becoming potential avenues for real-world disruption. As operators are reminded by these findings, the resilience of public-facing digital infrastructure depends on both its deployment and its design in equal measure.
Read more »
Technology
AI Anthropic AI Claude AI KYC Technology

Anthropic to Restore Access to Claude Fable 5 After U.S. Lifts Export Controls



Anthropic is preparing to restore access to its Claude Fable 5 artificial intelligence model after the U.S. Department of Commerce lifted export controls that had temporarily restricted deployment of the company's most advanced AI systems.

The company announced on X that access to Claude Fable 5 will begin returning on Wednesday following the government's decision. Anthropic also confirmed that the export restrictions affecting both Claude Fable 5 and Claude Mythos 5 have been removed.

"We've received notice that the Department of Commerce has lifted export controls on Claude Fable 5 and Mythos 5," the company said in its statement, adding that it will begin restoring access on Wednesday and provide additional updates as the rollout progresses.

Anthropic also thanked its community for its patience during the temporary suspension and acknowledged the teams involved in preparing the models for redeployment.

Although the rollout is set to begin immediately, the company has not clarified whether Claude Fable 5 will become available to all users at the same time. It remains uncertain whether users outside the United States will regain access during the initial phase of the deployment or whether availability will expand gradually across different regions.

The export restrictions were introduced earlier after U.S. authorities raised national security concerns surrounding the deployment of highly capable frontier AI models. During that period, Anthropic temporarily suspended access while it worked to comply with government requirements and strengthen safeguards governing the release of its latest systems.

While restoring access to its models, Anthropic also appears to be expanding identity verification measures for certain Claude services.

Recent references to Know Your Customer (KYC) procedures discovered on the company's website suggest that some users may soon be required to verify their identities before accessing specific Claude capabilities. The references have prompted speculation that advanced models such as Claude Fable 5 could initially be limited to verified users or become available only in certain regions as Anthropic gradually expands access.

According to Anthropic's support documentation, identity verification is being introduced for a limited number of use cases. Users may encounter verification requests when using particular Claude features, during routine platform integrity reviews, or as part of broader safety, security and regulatory compliance checks.

The company says the verification process is intended to reduce abuse of its AI systems, enforce platform usage policies and meet legal obligations associated with operating increasingly powerful AI technologies.

"Being responsible with powerful technology starts with knowing who is using it," Anthropic said while explaining the purpose of the new verification measures.

Anthropic has selected Persona as its identity verification provider. Users who are asked to complete verification may be required to submit a valid government-issued photo identification document, including a passport, driver's license, state or provincial identification card, or a national identity card.

The company notes that several forms of identification will not be accepted during the verification process. These include photocopies, screenshots, scanned documents, mobile IDs, student identification cards, employee badges, bank cards and temporary paper identification documents.

Some users may also be asked to complete a live selfie verification using the camera on a computer or mobile device. According to Anthropic, the entire verification process typically takes less than five minutes to complete.

Addressing privacy concerns, the company says identity documents and selfie data are collected and stored by Persona rather than directly within Anthropic's own systems. However, Anthropic may access verification records through Persona when necessary, including during account review or appeal processes.

Anthropic also emphasized that identity verification information is not used to train Claude's AI models. Instead, the data is used solely to confirm a user's identity and to satisfy the company's legal, safety and compliance responsibilities.

The restoration of Claude Fable 5, together with the introduction of targeted identity verification measures, reflects the growing intersection of frontier AI development, government oversight and platform security. As developers release increasingly capable AI systems, compliance requirements, export regulations and stronger user verification are becoming a more prominent part of deploying advanced models responsibly.

Read more »
WhatsApp
Privacy Security Social Media Username WhatsApp

Chatting Without Username: WhatsApp Rolls Out Username Feature


When a new person walks into our lives, sharing our phone numbers can be a big step as it’s personal and connected to many spheres of our lives. At times, we wish to chat without revealing our contacts. 

WhatsApp users will soon have a new option to talk without exposing their contact numbers. Prior to the wider update set for this year, WhatsApp has started launching username reservations in advance, permitting people to pre-claim a unique username before the feature becomes publicly available. 

“For most people, choosing a WhatsApp username should be something unique that only people you want to contact you will know. If you need help picking one, we have a username generator to make one work just for you. We also know that some people like creators, small businesses, and organizations may want to maintain a consistent presence online. For them, we reserved an option to claim their existing Instagram or Facebook username on WhatsApp.” WhatsApp wrote in its blog. 

This move is said to be WhatsApp’s one of the biggest privacy-focused modifications, allowing users to start chats through a username instead of showing their contact number. WhatsApp released the feature in an official blog post recently, and said the feature launch will take place gradually in the next few months. 

Users can book usernames

The company has started allowing users to book a username in advance so that they can choose the handle they want and have a better chance. The early reservation process is important because WhatsApp now has over three billion users across the world. This feature will be optional and gradually allow users to replace their contact number with a user handle when texting someone for the first time (but the username has to be turned on). 

How to set a user handle

Users can see the feature by updating to the latest version and going to Settings > Account > Username.

The users will get an in-app notification when the feature is available in their country. 

If someone has already taken your user name, WhatsApp will offer a built-in userhandle generator that provides alternative unique handles.

Focusing on privacy and security

Contrary to many social media platforms, WhatsApp will not launch a searchable username directory. Users can only contact someone if they know the specific username.

Read more »
IBM quantum computer
Cryptographically Relevant Quantum Computer Cryptography Cyber Security cybersecurity policies Enterprise security IBM quantum computer

Post-Quantum Cryptography Readiness Becomes a Strategic Cybersecurity Priority for Enterprises

 

Though practical quantum computers may still be years away, organizations are already preparing for the security risks they could create. Post-quantum cryptography has shifted from research into real-world planning as experts warn current encryption could eventually become vulnerable. Rather than waiting for that moment, many businesses are reviewing existing systems now. 

Early preparation is increasingly viewed as essential because delaying changes could make future transitions far more difficult. Fresh policies are adding urgency by setting clear expectations for organizations responsible for protecting critical infrastructure and sensitive data. Quantum readiness is no longer seen as only an IT issue but a business-wide priority involving leadership, governance, funding, and long-term planning. 

Instead of simply replacing outdated encryption, organizations are expected to build flexible strategies that can adapt to future cryptographic standards. A major concern is the “harvest now, decrypt later” threat. Attackers may steal encrypted information today and store it until quantum computers become powerful enough to decrypt it. 

Intellectual property, healthcare records, financial information, source code, and government communications with long-term value could all become exposed in the future, even if current encryption remains secure against today’s computers. The challenge is no longer just preparing for future technology but protecting data that must remain confidential for years. Organizations handling highly sensitive or regulated information may need to begin migration sooner because the consequences of delayed action could be far greater.  

Cybersecurity leaders recommend assigning clear ownership of post-quantum initiatives instead of leaving responsibility with individual application teams. Cross-functional groups involving security, IT, engineering, legal, compliance, procurement, and business leadership are better positioned to manage the transition since encryption supports nearly every part of modern digital operations. 

A critical first step is identifying where cryptography exists throughout the organization. Many companies lack a complete view of which systems rely on specific algorithms, certificates, keys, authentication methods, APIs, cloud environments, and third-party services. Without that visibility, assessing risks or deciding migration priorities becomes extremely difficult. Security experts also stress that this inventory should remain continuously updated rather than existing as a static spreadsheet. 

Ongoing visibility helps organizations identify systems requiring stronger protection, understand dependencies, provide accurate regulatory reporting, and give executives a realistic view of progress. Once cryptographic assets are fully mapped, organizations can prioritize migration based on business impact. Systems protecting customer information, healthcare data, financial services, critical infrastructure, digital identities, and software integrity generally require attention before less critical environments, allowing organizations to spread the transition over several years. 

Preparing for post-quantum security also requires dedicated investment. Funding must support discovery tools, testing environments, migration programs, automation, and governance. Organizations will also need specialists with expertise in cryptography, enterprise architecture, public key infrastructure, compliance, and cybersecurity to guide the transition effectively. Long-term success depends on achieving crypto-agility—the ability to update cryptographic algorithms without rebuilding entire systems. 

Rather than treating post-quantum cryptography as a one-time project, many organizations are designing adaptable security architectures capable of evolving alongside future standards. As artificial intelligence, autonomous technologies, and increasingly complex digital ecosystems continue to expand, flexible cryptographic infrastructure will become even more important.  

Although no one knows exactly when quantum computers capable of breaking today’s encryption will become reality, many cybersecurity experts believe organizations should begin preparing now. Companies that establish governance, maintain visibility into cryptographic assets, and gradually modernize their infrastructure will be better positioned to adapt as quantum computing—and the security landscape—continues to evolve.
Read more »
Subscribe to: Posts (Atom)

Featured