Author: HackWatchit

Microsoft has announced that it will start disabling external workbook links to blocked file types by default between October 2025 and July 2026. After the rollout, Excel workbooks referencing blocked file types will display a #BLOCKED error or fail to refresh, eliminating security risks associated with accessing unsupported or high-risk file types, including, but not limited to, phishing attacks that utilize workbooks to redirect targets to malicious payloads. This change is being introduced as a new FileBlockExternalLinks group policy, which expands File Block Settings to include external workbook links. As the company explained in a Microsoft 365 admin center message…

A cyberattack on a water facility can put entire communities and businesses at risk. Even a short disruption in clean water supply can have serious public health and safety consequences, and threat actors know the damage they can cause. Water utilities have been moving away from isolated OT and toward more digitally connected systems that integrate with IT. This shift helps them get more accurate, real-time data. While these technologies improve efficiency and performance, they also open the door to new cyber risks. Water systems are often more vulnerable than other types of critical infrastructure, largely because they’re more likely…

An NFT Explorer is a Decentralized Application (dApp) that allows users to get information about an NFT collection from the blockchain, such as the name, owner address, and tokenId.In this tutorial, we will build an explorer on the Ethereum blockchain using Alchemy and NextJS. Firstly, what is Alchemy?With the Alchemy API and its support for NFTs on the Ethereum blockchain, querying blockchain data is now easier than ever.DemoThe video below shows the demo of the finished NFT Explorer we are going to build:PrerequisitesThis tutorial uses the following technologies:NextJSTailwind CSSAlchemy APIIt is also worth noting that for this tutorial, you will…

In this Help Net Security interview, Rohan Sen, Principal, Cyber, Data, and Tech Risk, PwC US, discusses how organizations can design autonomous AI agents with strong governance from day one. As AI becomes more embedded in business ecosystems, overlooking agent-level security can open the door to reputational, operational, and compliance risks. When designing autonomous AI agents, what are the most critical governance and risk control mechanisms that must be built in from the outset? Can you give examples of what good vs. weak implementation looks like in practice? The most critical step is treating autonomous agents as digital identities with…

Attackers actively exploit critical zero-day in Alone WordPress Theme Pierluigi Paganini July 31, 2025 Hackers exploit a critical vulnerability, tracked as CVE-2025-5394 (CVSS score of 9.8), in the Alone WordPress theme to hijack sites. Threat actors are actively exploiting a critical flaw, tracked as CVE-2025-5394 (CVSS score of 9.8), in the “Alone – Charity Multipurpose Non-profit WordPress Theme” to compromise websites. On May 30th, 2025, security researcher Thái An reported the bug via WordPress security firm Wordfence. “This vulnerability makes it possible for an unauthenticated attacker to upload arbitrary files to a vulnerable site and achieve remote code execution, which…

A new report from Booz Allen and the McCrary Institute for Cyber and Critical Infrastructure Security warns that foreign adversaries are expanding cyber operations to target U.S. ports, escalating the threat to the nation’s critical infrastructure and underscoring the urgent need for stronger maritime cybersecurity. The Booz Allen–McCrary report follows U.S. Coast Guard investigations that revealed systemic OT (operational technology) vulnerabilities in Chinese-manufactured cranes, including weak passwords, poor cyber hygiene, unpatched software, and flat, unsegmented networks. As ports continue to procure PRC-linked equipment, exposure across the maritime sector is growing. Titled ‘Anchored in Zero Trust: Taking Action to Build Resilient…

the last few weeks, we have seen the release of powerful LLMs such as Qwen 3 MoE, Kimi K2, and Grok 4. We will continue seeing such rapid improvements in the foreseeable future, and to compare the LLMs against each other, we require benchmarks. In this article, I discuss the newly released ARC AGI 3 benchmark and why frontier LLMs struggle to complete any tasks on the benchmark. Motivation Today, we’re announcing a preview of ARC-AGI-3, the Interactive Reasoning Benchmark with the widest gap between easy for humans and hard for AIWe’re releasing:* 3 games (environments)* $10K agent contest* AI…

The Russian state hacker group known as Turla has carried out some of the most innovative hacking feats in the history of cyberespionage, hiding their malware’s communications in satellite connections or hijacking other hackers’ operations to cloak their own data extraction. When they’re operating on their home turf, however, it turns out they’ve tried an equally remarkable, if more straightforward, approach: They appear to have used their control of Russia’s internet service providers to directly plant spyware on the computers of their targets in Moscow.A Microsoft security research team focused on hacking threats today published a report detailing an insidious…

The Everest ransomware group is claiming responsibility for breaching Mailchimp, the popular marketing platform used to create, send and manage email campaigns and newsletters. The group made the announcement earlier today on its dark web leak site, claiming to have stolen a 767 MB database containing 943,536 lines of data. According to Everest, the leak includes “internal company documents” and “a huge variety of personal documents and information of clients.” A look at the sample data published by Everest shows that the leaked dataset includes structured business information rather than sensitive internal Mailchimp data. The records appear to contain domain…