Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

At UpGuard, we believe your Trust Center should be the single place your prospects and customers go to get their trust questions answered. Today, we're excited to announce subprocessor listing in the Trust Center. This capability lets you publish your subprocessors directly where buyers already look for trust signals. You can also keep that list up to date and enable customers to subscribe to updates.

Learn how the OWASP Top 10 CI/CD Security Risks map the modern software delivery attack surface, and why credential hygiene sits at the center of so many real-world failures.

Internxt Mail is now available! With this new release, the Internxt product suite is finally complete and offers you everything you need to protect your privacy online. Internxt Mail is part of Internxt’s encrypted cloud storage, VPN, Meet, Antivirus, and Photos. With Mail, you can send end-to-end encrypted emails to ensure nobody but you and your recipients can view the contents. To get Mail, get 85% off all Internxt plans, including Ultimate plans using the link below.

You can reduce your cloud attack surface by auditing every persistent permission across your cloud and identity platforms, stripping away unnecessary access and replacing always-on admin rights with Just-In-Time (JIT) access that’s granted on approval, time-limited and automatically revoked. Getting there starts with understanding why standing privilege makes up such a significant portion of the cloud attack surface.

MSPs are expected to understand their clients’ technology environments. They know which endpoints are managed, which applications are business-critical, which systems require patching or maintenance, where sensitive data resides and who has access to it. Increasingly, however, critical technology decisions are now being made without IT or MSP involvement. Across client environments, this can take many forms: And each instance can occur without the MSP ever knowing.

CYJAX intelligence is now built directly into Google SecOps SIEM and Microsoft Sentinel, giving analysts structured, normalised threat data inside the platforms they already use. Four feeds are live in Google SecOps and eight endpoints are available in Microsoft Sentinel's Content Hub.

CVE-2026-81891 is an unrestricted file upload vulnerability in Studio 42 elFinder, an open source web file manager embedded in a wide range of PHP applications and content management systems. The flaw sits in the checkExtractItems() function in php/elFinderVolumeDriver.class.php, which calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize().

Researchers at Zimperium are tracking widespread phishing campaigns that use Browser-in-the-Browser (BitB) attacks to trick users into handing over their enterprise credentials. The attackers impersonate real HR employees at major companies and target job seekers with extremely realistic interview processes.

A new phishing kit is using generative AI to fully automate voice phishing (vishing) attacks, according to researchers at Group-IB. The phishing platform, called “Balonx,” includes a module dubbed “CallFlow” that the researchers say “represents a fundamental evolution” in the phishing-as-a-service market.

On 26/05/2026, a security researcher at Astra Security found a critical Remote Code Execution (RCE) vulnerability in UpSnap, a web-based wake-on-LAN(WoL). The root cause is an OS Command Injection vulnerability(CWE-78) that exists in UpSnap’s device management functionality due to unsafe template interpolation of the IP and MAC fields.