CySecurity News - Latest Information Security and Hacking Incidents

Botnet Disruption Botnet Takedown Cyber Attacks CyberCrime Cybersecurity malware P2P Botnet Sality Botnet

Sality Botnet Disrupted as Authorities Seize Key Infrastructure

An international public-private operation has disrupted Sality, a peer-to-peer botnet that remained active for more than two decades, by seizing domains and redirecting infected computers away from infrastructure controlled by its operator.

The coordinated action took place on August 31, 2026, and involved authorities in the United States, Bulgaria, Hungary and Romania. CrowdStrike and the Shadowserver Foundation provided technical assistance, while Europol and Eurojust supported the international coordination.

According to the US Department of Justice, the DOJ, FBI and the Defense Criminal Investigative Service seized Sality-linked domains in the United States. European authorities took action against additional domains hosted in Bulgaria, Hungary and Romania.

CrowdStrike’s Counter Adversary Operations team simultaneously carried out a peer-to-peer sinkholing operation designed to separate infected computers from the botnet’s operator.

The action disabled Sality’s current command channel, but it did not automatically remove malware from compromised computers.

Sality Remained Active for More Than Two Decades

First observed in 2003, Sality began as a polymorphic file-infecting malware family. It attached malicious code to executable files and could spread through network shares, removable drives and file-sharing systems.

Sality eventually developed into a decentralized botnet in which infected computers communicated directly with one another. Unlike a conventional botnet with one central command-and-control server, Sality’s peer-to-peer architecture did not present investigators with a single server that could be seized to disable the entire operation.

CrowdStrike said two incompatible Sality networks, known as versions 3 and 4, remained active until the disruption. Although they used the same underlying codebase and were operated by the same threat actor, the networks used different protocol versions and cryptographic keys.

The botnet’s main function was to deliver additional malicious software. During its long history, Sality distributed malware associated with credential theft, spam, proxy services, network exploitation and distributed denial-of-service attacks.

For approximately the past eight years, CrowdStrike said its primary payload was EggJagger, a clipboard-hijacking tool that monitored devices for copied cryptocurrency wallet addresses. When it detected a Bitcoin or Ethereum address, the malware replaced it with an address controlled by the attacker.

CrowdStrike estimates that at least $150,000 in cryptocurrency was stolen through EggJagger, although other malware distributed through Sality may have produced additional criminal revenue.

How Large Was the Sality Botnet?

CrowdStrike’s technical account of the disruption states that Sality enabled its operator to distribute malicious payloads to more than 33,000 infected computers worldwide at the time of the operation.

Historical figures are considerably larger. Europol reported that Sality provided access to as many as one million infected machines at its peak. More than 11 million unique IP addresses have been connected to its infrastructure over its lifetime.

The 11 million figure should not be interpreted as the number of simultaneously infected devices. Individual machines can use different IP addresses over time, and the total covers years of recorded activity.

Europol has supported Sality-related investigations since 2017. The agency said international partners held weekly operational calls in the weeks before the latest action to coordinate infrastructure seizures and the technical disruption.

How the Sinkhole Operation Worked

The operation targeted the peer lists that Sality-infected computers used to locate other machines in the botnet.

Each infected computer maintained a limited list of publicly reachable “super peers,” which formed the backbone of the P2P network. Approximately every 40 minutes, the malware checked whether those peers remained available. Responsive peers gained reputation, while unresponsive entries were gradually removed.

CrowdStrike found that the Sality protocol did not authenticate computers joining the network. Any publicly reachable system that completed the required handshake could be accepted as a legitimate peer.

Defenders used this weakness to manipulate the botnet’s peer lists. Legitimate Sality peers were invalidated and replaced with sinkhole nodes operated by CrowdStrike. As the process continued, infected computers lost contact with the criminal network and began communicating with defender-controlled infrastructure instead.

Computers located behind firewalls or network address translation could not always be contacted directly. However, when those devices initiated their routine communications with a sinkhole, their peer lists could also be purged, isolating them from the operator.

Authorities and industry partners also acted against websites hosting Sality’s payloads. Taking those locations offline prevented infected computers with older download instructions from retrieving additional malware during the transition.

Who Operated Sality?

CrowdStrike tracks the criminal actor associated with Sality as SALTY SPIDER. The company assesses that the group likely operates from Russia’s Republic of Bashkortostan, near the border with Kazakhstan.

This remains a company attribution rather than a publicly established legal finding. The DOJ and Europol announcements did not identify an individual operator, announce an arrest or disclose criminal charges connected to the disruption.

Infected Computers Still Require Remediation

Although the operator has lost the ability to issue new instructions through the disrupted network, Sality remains installed on affected computers. Additional malware previously delivered by the botnet may also remain active.

CrowdStrike said Sality-infected systems now communicate with its sinkhole infrastructure. The company published a defanged lighthouse IP address, the botnet’s final payload URLs and YARA rules that security teams can use to identify active infections.

Shadowserver is working with internet service providers and national Computer Security Incident Response Teams to identify affected organizations, notify victims and support remediation.

Organizations that detect a Sality infection should isolate the affected device, inspect it for secondary malware and remove or rebuild compromised systems. Security teams should also examine network shares and removable media that may contain infected executable files.

Passwords and other credentials used on an infected device should be considered exposed. However, credential changes should be performed from a clean system after the malware has been removed.

The operation has disabled Sality’s existing command channel and prevented it from distributing new payloads through the disrupted infrastructure. Its long-term impact will now depend on whether remaining infections are found and remediated before the operator can attempt to rebuild part of the network.

Four Cybersecurity Habits That Can Do More Harm Than Good When Misused



 

WiFi

2FA Cyber Security passwords stolen credentials vpn WiFi

Four Cybersecurity Habits That Can Do More Harm Than Good When Misused

Cybersecurity advice is often reduced to simple rules: change passwords regularly, avoid public Wi-Fi, install antivirus software and enable two-factor authentication. These recommendations were created for good reasons, but the threat landscape and the technology protecting users has changed.

The problem is not that these safeguards have become useless. Instead, rigidly following outdated versions of the advice can create false confidence, encourage risky behaviour or distract users from more effective protections.

Here are four familiar cybersecurity habits that need to be reconsidered.

1. Changing Every Password on a Fixed Schedule

For years, organizations required employees to change their passwords every 30, 60 or 90 days. The intention was to limit the amount of time a stolen password could remain useful.

In practice, frequent forced changes can encourage people to select predictable passwords or make minor alterations, such as replacing “Password1” with “Password2.” This provides much less protection than organizations may assume.

The current NIST Digital Identity Guidelines advise service providers not to demand periodic password changes unless there is evidence that a password has been compromised. NIST instead emphasizes longer passwords, blocking commonly used or compromised credentials and permitting the use of password managers.

A better approach is to give every account a long, unique password generated and stored by a reputable password manager. A password should be changed immediately if it appears in a breach, is entered on a suspicious website or may have been exposed through malware.

Where available, users should also consider passkeys, which remove the need to remember a password and provide stronger resistance to phishing. Organizations reviewing password policies should combine these protections with measures designed to secure single sign-on systems against credential attacks.

2. Treating Every Public Wi-Fi Network as Equally Dangerous

“Never use public Wi-Fi” was once common security advice. However, widespread adoption of HTTPS means that most websites now encrypt information travelling between a device and the website.

The US Federal Trade Commission says that connecting through public Wi-Fi is usually safe because most websites use encryption. Users should still check for HTTPS and remember that an encrypted connection does not prove that the website itself is legitimate. A phishing website can also use HTTPS.

Public networks continue to present risks. Attackers may create convincing lookalike networks, manipulate captive-portal login pages or target devices with outdated software and exposed sharing settings.

Instead of avoiding every public network, users should:

Confirm the network name with the venue before connecting.
Disable automatic Wi-Fi connections and unnecessary file sharing.
Keep the operating system, browser and security software updated.
Avoid proceeding past browser certificate warnings.
Use cellular data or a personal hotspot for especially sensitive work.
Follow an employer’s approved VPN requirements when accessing company systems.

A trusted VPN can provide another encrypted layer, particularly for work traffic or applications that do not protect their own connections. However, a VPN transfers trust from the local network to the VPN provider and does not prevent phishing, malware or account compromise.

3. Assuming Antivirus Software Is a Complete Security System

Antivirus software remains an important protection and should not be disabled. The outdated habit is assuming that installing it is the only step needed to secure a device.

Traditional antivirus products relied heavily on signatures that identified previously discovered malicious files. Modern security tools also use reputation checks, behavioural analysis, cloud intelligence and other methods to identify suspicious activity.

Attackers nevertheless use techniques intended to evade detection, including frequently changing malware, malicious scripts, abuse of legitimate system tools and attacks that leave few conventional files behind. Artificial intelligence may help criminals modify malicious code more quickly, but malware evasion existed long before generative AI.

CISA’s ransomware guidance recommends keeping antivirus and antimalware tools updated while also using protections such as application allowlisting and endpoint detection and response. This reinforces an important point: antivirus should be one part of a layered defence.

For individual users, that means enabling the device’s built-in or another reputable security product, installing software updates promptly, downloading applications from trusted sources and maintaining backups. Businesses should add centralized monitoring, restricted administrative privileges, application controls and tested recovery procedures.

Running multiple antivirus products at the same time is not necessarily safer. They may conflict, reduce performance or interfere with each other’s detection capabilities.

4. Believing Any Form of Two-Factor Authentication Is Unbreakable

Two-factor authentication remains one of the most effective ways to prevent account takeover, and users should enable it wherever possible. The mistake is believing that every form of two-factor authentication provides the same protection—or that it makes an account impossible to compromise.

Text-message codes and one-time passwords can be captured through phishing. Attackers may also send repeated login approval requests in the hope that a user eventually accepts one.

Another threat is session theft. After a successful login, a website generally creates a session token or cookie that allows the user to remain signed in. Malware or adversary-in-the-middle phishing infrastructure can steal this token and reuse it without repeating the original authentication process.

Microsoft explains that stolen browser cookies can bypass authentication controls. This is why infostealers that collect browser data and authentication tokens remain dangerous, as demonstrated by the growing capabilities of threats such as the REMUS infostealer.

Passkeys and physical security keys provide stronger protection against phishing because authentication is tied to the legitimate website. CISA recommends moving toward phishing-resistant MFA, especially for important or privileged accounts.

However, even passkeys cannot make an infected device completely safe. Users and organizations must also protect endpoints, monitor active sessions, revoke suspicious sessions and require fresh authentication before particularly sensitive actions.

Security Controls Must Evolve With the Threats

The lesson is not to abandon passwords, public Wi-Fi precautions, antivirus software or two-factor authentication. Each remains useful when applied correctly.

The safer approach is to replace scheduled password resets with unique credentials or passkeys, assess public networks based on the connection and activity, treat antivirus as one security layer and choose phishing-resistant authentication whenever possible.

Cybersecurity habits should evolve as attacks and defensive technologies change. A safeguard becomes dangerous when users stop examining what it protects against—and assume that it can protect them from everything.

Received an Apple Threat Notification? How to Verify and Respond Safely



 

User Security

Apple Digital Privacy Mobile Security Spyware User Security

Received an Apple Threat Notification? How to Verify and Respond Safely

An Apple threat notification is not a routine security warning. Apple issues these high-confidence alerts when its threat intelligence indicates that someone may have been individually targeted by sophisticated mercenary spyware.

Receiving an alert does not necessarily mean that the spyware successfully infected the device. It also does not identify the spyware operator or explain why the person was targeted. However, Apple says recipients should take the warning seriously and obtain expert assistance.

Verify That the Notification Is Genuine

Attackers may impersonate Apple and use spyware concerns to steal passwords or verification codes. Recipients should therefore confirm the notification before following any instructions.

Apple threat notifications may appear:

On an iPhone’s Lock Screen.
Inside the iPhone’s Settings application.
In an email sent to an address associated with the Apple Account.
As a banner at the top of the Apple Account website.

Instead of following a link inside an email or message, manually enter account.apple.com into a browser and sign in. A genuine notification will be displayed prominently at the top of the account page.

Apple says its threat notifications will never ask recipients to click a link, open a file, install an application or configuration profile, or disclose their Apple Account password or verification code.

Any communication making these requests should be treated as a possible phishing attempt.

What the Alert Actually Means

Apple describes its threat notifications as high-confidence warnings that a user may have been individually targeted by mercenary spyware.

These attacks are significantly more sophisticated than ordinary cybercrime. They frequently involve commercial surveillance tools developed for highly targeted operations against a small number of individuals.

Journalists, activists, politicians, diplomats and human-rights defenders have historically been among those targeted. Nevertheless, the notification alone does not prove that a device was successfully compromised.

A forensic investigation may be required to determine whether an attempted infection succeeded and what information may have been exposed.

Preserve Potential Evidence

Recipients should not immediately erase or factory-reset the affected device. Resetting it may remove forensic evidence that investigators could use to identify an attempted or successful compromise.

Access Now recommends preserving the device and creating a backup when an immediate forensic examination is unavailable. Because information stored in system logs can be overwritten over time, expert assistance should be requested as quickly as possible.

Apple directs notified users to Access Now’s Digital Security Helpline, which provides emergency assistance to eligible civil-society groups, including independent journalists, activists and human-rights defenders.

People outside the organization’s support mandate should contact a trusted cybersecurity professional with experience in mobile-device forensics.

Update and Harden Apple Devices

The appropriate order of forensic preservation and security changes may depend on the individual case. When possible, recipients should coordinate these actions with a qualified investigator.

Apple and Access Now recommend the following protective measures:

Update the iPhone and other Apple devices to the latest available software.
Enable Lockdown Mode on supported devices.
Use a strong, unique Apple Account password.
Confirm that two-factor authentication is enabled.
Review the devices connected to the Apple Account and remove anything unfamiliar.
Enable Stolen Device Protection.
Install applications only from the App Store.
Avoid links and attachments from unknown senders.

Apple recommends updating devices before enabling Lockdown Mode to obtain the complete set of available protections.

On an iPhone, Lockdown Mode can be activated under Settings > Privacy & Security > Lockdown Mode. It restricts certain applications, websites, invitations, attachments and device connections to reduce the attack surface available to highly targeted spyware.

Lockdown Mode must be enabled separately on an iPhone, iPad and Mac. Enabling it on an iPhone automatically activates it on a paired Apple Watch.

Do Not Rely on a Basic Spyware Scanner

A consumer security application reporting that a device is clean does not prove that no compromise occurred. Mobile security applications have limited access to protected areas of the operating system, while sophisticated spyware is specifically designed to avoid detection.

The absence of unusual battery consumption, unexpected applications or suspicious messages also cannot establish that a device is safe. Some advanced spyware attacks require little or no interaction from the target and may leave few visible symptoms.

Remain Alert for Follow-Up Phishing

A person who receives a legitimate threat notification may subsequently encounter fraudulent messages from criminals claiming to offer Apple support or spyware-removal services.

Recipients should never provide passwords, device passcodes or two-factor authentication codes to an unsolicited caller. CySecurity.news has separately reported how fake Apple Support agents target device owners using phishing messages and AI-generated voice calls.

Apple has sent threat notifications to users in more than 150 countries since 2021. Although most people will never receive one, anyone who does should verify it directly, preserve potential evidence, obtain expert assistance and take immediate steps to strengthen the security of every connected device.

Attackers Exploit CVE-2026-82329 to Forge JFrog Artifactory Admin Tokens



 

RCE

Critical Vulnerability Cyber Security JFrog Artifactory Organization Security RCE

Attackers Exploit CVE-2026-82329 to Forge JFrog Artifactory Admin Tokens

Cybersecurity researchers have observed attackers exploiting a critical JFrog Artifactory vulnerability shortly after its public disclosure. The flaw allows unauthenticated attackers to obtain administrative privileges on vulnerable self-hosted installations.

Tracked as CVE-2026-82329, the authentication-bypass vulnerability carries a CVSS severity score of 9.8. JFrog published its advisory and released security updates on August 28, 2026. Threat-intelligence researchers subsequently detected exploitation attempts beginning on September 1.

What Is JFrog Artifactory?

JFrog Artifactory is an artifact repository manager used by development teams to store, manage and distribute software packages and binary files.

Because Artifactory often connects directly to software-development and deployment pipelines, administrator-level access could allow attackers to manipulate repositories, steal credentials or introduce malicious components into software builds.

How CVE-2026-82329 Works

The vulnerability affects JFrog Access, the component responsible for authentication and credential management.

According to research shared by watchTowr, Artifactory installations without an additional join key configured may receive a fallback or “phantom” join key. Attackers can potentially abuse this condition to forge access and generate administrator-level authentication tokens.

Successful exploitation does not require an existing account or user interaction. An attacker only needs network access to a vulnerable Artifactory installation operating under the affected configuration.

The vulnerability does not directly provide remote-code execution. However, administrative control over an artifact repository could allow attackers to modify packages, create unauthorized accounts, access sensitive credentials and interfere with connected build systems.

Exploitation Detected in the Wild

WatchTowr researchers reported observing attackers use the vulnerability to generate administrator tokens and enumerate information about users, groups, credentials and federated-access configurations.

Some activity appeared limited to confirming whether a system was vulnerable. In a smaller number of cases, attackers reportedly created backdoor accounts and examined the compromised environment for opportunities to maintain access or expand the intrusion.

Researchers had not observed widespread scanning or mass exploitation when the activity was initially reported. Nevertheless, the rapid transition from public disclosure to exploitation demonstrates the limited time organizations have to secure internet-facing systems.

The Canadian Centre for Cyber Security has also warned that open-source reporting indicates active exploitation of CVE-2026-82329.

Patched JFrog Artifactory Versions

JFrog has released fixes across multiple supported Artifactory branches. Self-hosted customers should upgrade to the applicable fixed release:

7.111.21
7.117.28
7.125.20
7.133.29
7.146.38
7.161.20

JFrog says affected cloud environments have already been fortified and do not require customer action. Administrators of self-hosted deployments should consult the official JFrog security advisory to identify the correct update for their installation.

Recommended Security Measures

Organizations operating self-hosted JFrog Artifactory installations should:

Install the appropriate security update immediately.
Restrict internet access to Artifactory management interfaces.
Review audit logs for unexpected token or administrator-account creation.
Revoke unauthorized tokens and remove unfamiliar user accounts.
Rotate credentials and secrets accessible through the affected environment.
Inspect repositories for unauthorized package or configuration changes.
Examine connected CI/CD systems for evidence of lateral movement or artifact tampering.

CVE-2026-82329 is particularly dangerous because compromising a central artifact repository can affect more than the initially targeted server. Attackers with administrative access may be able to interfere with the software-development process and distribute modified components through trusted internal channels.

No public evidence currently confirms that CVE-2026-82329 is connected to the previously reported OpenAI and Hugging Face AI-agent activity involving an internal Artifactory environment. The two stories should be treated as separate security incidents.

FBI Investigates Dark Web Service Offering 153 Million Driver’s Licenses



 

KrebsonSecurity

Credential Theft Cyber Security Data Breach driver’s license FBI Identity Theft KrebsonSecurity

FBI Investigates Dark Web Service Offering 153 Million Driver’s Licenses

The FBI has opened an investigation into an apparent breach involving identity verification provider IDScan.net after a newly launched dark web service began advertising access to more than 153 million U.S. and Canadian driver’s license records.

The service, named Nexus, appeared on the Russian cybercrime forum Exploit on August 31, claiming access to identity documents belonging to more than 170 million people across North America. Its advertised database includes more than 153 million driver’s licenses, over 10 million identification cards, more than three million travel or international identity documents, and at least 579,000 medical cards.

An examination of the service indicates that the claimed volume may be credible. A search without filters reportedly produced about 11.5 million pages of records, with approximately 15 results per page. Canadian licenses accounted for roughly 1.1 million results, including 473,673 records from Ontario, while most listings originated from the United States.

The dataset also contains marijuana dispensary cards, commercial driver’s licenses and records marked “CAC,” potentially referring to U.S. government Common Access Cards. Nexus operators claim the information is being obtained through an ongoing compromise of a major identity verification company serving Fortune 500 customers. They claim to have continuously extracted new records for more than a year.

Evidence examined by KrebsOnSecurity also indicates that the database may still be receiving stolen information. The number of available driver’s license records reportedly increased by nearly 400,000 within 24 hours.

The exposed records are unusually detailed. One license examined by Krebs contained six image files showing the front and back of the document, including standard, infrared and ultraviolet captures. Each file carried a timestamp. In several cases, those timestamps corresponded closely with victims’ real-world activities.

Krebs tested the apparent pattern by obtaining permission to search for licenses belonging to more than a dozen acquaintances. Nine licenses were located, and each individual confirmed travelling on or around the dates associated with the image timestamps. Further comparison with rental records indicated the timestamps appeared consistent with Greenwich Mean Time.

The evidence initially pointed toward airports, but that theory weakened because the database contained no passports and several individuals had not presented their licenses at airport security. Two federal employees who appeared in the dataset said they used other government identification at airport checkpoints, but later handed their state licenses to Hertz when renting vehicles.

A particularly revealing comparison involved Krebs’ own license and his mother’s. Their records carried timestamps only seconds apart, corresponding to the time both licenses were handed to a Hertz representative. Another exposed license belonged to security researcher Zach Edwards, whose timestamp matched a trip to Las Vegas for DEF CON. Edwards said he showed his license to TSA, his hotel and Planet 13, but identified the dispensary as the only location that definitely scanned it.

That connection is notable because Planet 13 announced in 2022 that it had deployed IDScan.net’s VeriScan technology across 16 check-in stations at its Las Vegas SuperStore. The system captures government-issued identification, performs document authentication and can use white-light, infrared and ultraviolet imagery. IDScan.net says its technology performs more than 21 million identity verifications each month across more than 20,000 locations.

IDScan.net also publicly lists major organizations using its technology, including Hertz, Target, FedEx and Caesars Entertainment. Its current platform supports ID scanning, document authentication, data parsing and integrations through APIs and software development kits.

IDScan.net told KrebsOnSecurity that it was investigating but had not provided a substantive public explanation of the suspected incident. Its documentation shows that its systems can retain raw files generated during scans, while its security documentation describes encryption for data at rest and in transit.

The FBI’s New Orleans field office subsequently opened an official investigation into the suspected breach. The development adds a law-enforcement dimension to an incident that could expose highly sensitive identity information at unprecedented scale.

The potential consequences extend beyond conventional credential theft. Driver’s license information is legally recognized as identifying information, and stolen identity data can be used to open accounts, obtain services, commit financial fraud or impersonate victims.

The incident also exposes a difficult security trade-off in modern identity verification. Organizations increasingly depend on third-party systems to scan government credentials for travel, rentals, retail, financial services and age verification. TSA began enforcing REAL ID requirements for domestic air travel in May 2025, further embedding government-issued identification into everyday verification processes.

For now, the precise intrusion path, affected customers and total number of compromised individuals remain unconfirmed. However, the combination of detailed document images, matching timestamps, apparent fresh data collection and the FBI investigation makes Nexus a serious warning about the risks created when sensitive identity documents are concentrated within third-party verification infrastructure.

Hackers Hijack BGP Routes to Deliver Malicious Virtualizor Update



 

Hacker attack

BGP Hijacking cloud hosting Cyber Attacks Cybersecurity Breach Exposed Servers file server attacks Hacker attack

Hackers Hijack BGP Routes to Deliver Malicious Virtualizor Update

Hijackers compromised network routes used by Softaculous and redirected traffic to servers where they distributed a rogue Virtualizor update to a limited number of installations. Virtualizor is a web-based control panel made by Softaculous that hosting providers use to set up, manage and sell their virtual private servers (VPS).

According to an urgent security advisory from Softaculous, the attack occurred between 20:57 UTC on 28th August and 06:10 UTC on 30th August. The hijackers rerouted a block of IP addresses hosted by Hetzner through a Border Gateway Protocol (BGP) hijacking before redirecting traffic to the company’s software update infrastructure and client/billing portal. BGP hijacking works by having an attacker or misconfigured network publish a false route for a targeted IP address range.

Inadvertently, some networks start routing traffic based on the falsified information, giving bad actors access to data. Softaculous confirmed that the attack resulted in a rogue Virtualizor update being distributed to a limited number of installations that fetched their updates during the attack. The company noted that the incident affected only a handful of servers and not the wider Virtualizor user-base. (BleepingComputer) Since the hijacking rerouted requests to the company’s update infrastructure, Softaculous stated that it does not have records of the affected requests.

The company is recommending that Virtualizor administrators check for the suspicious service /etc/systemd/system/java-jre-update.service. If found, administrators should rotate and lock their API credentials and check their systems for unauthorized SSH keys, users, cronjobs, and outbound connections. Users who accessed the Softaculous client area or provided payment details in the attack window should also change their passwords, check their account activity, and monitor their credit card statements.

Softaculous’ investigation into the incident is ongoing, although the company stated that there is no indication that its other products were affected. The hijacked routing has been restored, and the fraudulent certificate used during the attack has been reported for revocation. Softaculous released Virtualizor version 3.2.9.9 on 1st September. The update includes a Security Analyzer tool in the administration panel and will roll out cryptographic signing for all software packages. The company will also migrate its infrastructure to a more secure environment. (BleepingComputer)

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Footer About