Kaspersky

Almost 60% of online learners faced a digital incident in the past 12 months.* 🚩 Watch for: a web address that’s slightly off, a price far below everyone else’s, an offer from a random message. *Kaspersky research, Aug 2026 kas.pr/3f36

86% of SMBs faced at least one cyberincident last year, according to our Global B2B Market Pulse survey. As a business grows, so do its entry points. Here's how to scale protection with Kaspersky Next Optimum and Security Modules, step by step 👇 kas.pr/4n4r

Pixel owners, this one's for you 👋 Google has fixed 110 vulnerabilities in Pixel phones, and one of them is already being used in targeted attacks. Here's how to update: Settings → Security & privacy → System & updates → Security update → Install. Full story: kas.pr/j2f6

.@Frost_Sullivan has named Kaspersky 2026 Company of the Year in Global APT Intelligence & Attribution, recognizing our threat research, patented attribution technologies and expert-validated, AI-assisted analytics. Learn more: kas.pr/f5ip

Kaspersky Threat Research supported @INTERPOL_HQ's Operation Serengeti III with threat intelligence on botnet, DDoS and phishing infrastructure targeting Africa. The result: 1,462 arrests and US$105M recovered. The latest in our growing record of joint operations.

A cyberattack doesn’t end with the breach. 💸 22% reported financial loss 👤 21% faced clients’ personal data theft ⚙️ 20% experienced disruption to business processes See the real impact of cyber incidents on SMBs. 🔗 kas.pr/1hfm #CyberSecurity #SMB #KasperskyNext

The new PHP vulnerabilities aren’t just an admin headache. Home network storage, smart-home hubs and the sites you sign in to every day can be affected too. Here’s how to protect your accounts and files 🏠 kas.pr/8eue

New BlackX bootkit used in espionage attacks Threat actors, likely part of the APT41 cluster, have revamped the previously known BlackLotus bootkit code and deployed it in attacks targeting diplomatic organizations in Central Asia. The BlackX bootkit is used to maintain persistence on previously compromised systems and conduct long-term espionage. Data exfiltration occurs via common cloud services such as Google Drive, OneDrive and Yandex Disk. Notably, the attackers attempt to disable endpoint security products on hosts, including Kaspersky solutions, but our protection remains effective against these attempts. The Secure Boot bypass vulnerability (CVE‑2023‑24932) exploited in this bootkit was patched in 2023. However, the update requires system administrators to manually complete certain configuration steps to fully activate the protection. Many organizations have not performed these manual steps and remained vulnerable. Kaspersky GReAT expert Georgy Kucherin shared detailed research on BlackX in his talk at the Security Analyst Summit 2026. Watch our video and find IoCs and technical details on Securelist: securelist.com/uefi-bootkit-… More on Microsoft's mitigations: support.microsoft.com/en-us/… #TheSAS2026 #APT #Windows #bootkit

𝗜𝗳 𝘆𝗼𝘂𝗿 𝗶𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 𝗿𝗲𝗹𝗶𝗲𝘀 𝗼𝗻 𝗣𝗛𝗣, 𝘆𝗼𝘂 𝘀𝗵𝗼𝘂𝗹𝗱 𝗿𝗲𝘃𝗶𝗲𝘄 𝘁𝗵𝗶𝘀 𝗮𝗱𝘃𝗶𝘀𝗼𝗿𝘆 𝗽𝗿𝗼𝗺𝗽𝘁𝗹𝘆. Newly disclosed critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, may allow unauthenticated RCE. Until patched, affected internet-facing servers may remain exposed. More on Securelist ⇒ kas.pr/rdt3 #securelist #php

Could this be the vulnerability of the year? @61ack1ynx, Head of Kaspersky GReAT Research Center, APAC & META, on the critical #PHP flaws that can lead to remote code execution with no authentication. His advice: “You cannot wait 10 minutes.” Patch immediately. php.net/archive/2026.php#202… #TheSAS2026 @TheSAScon

Critical PHP kernel vulnerabilities - patch today Two critical flaws in PHP will be patched urgently today at 14:00 UTC due to premature disclosure before scheduled fixes. Both bugs (CVE-2026-109618 and CVE-2026-109619) carry a CVSSv4 Base Score of 9.2 and can lead to remote code execution on servers running PHP. Affected versions are not yet fully confirmed but likely span PHP 5 through 8. A demo video of the PHP2Shell exploit is circulating on social media, showing successful attacks on servers running many PHP-based projects, from WordPress to Magento. Preliminary analysis links the flaws to memory corruption and use-after-free vulnerabilities in the PHP core. The attack requires no authentication. Most experts expect exploitation to begin within 15 minutes of vulnerability details becoming public. Administrators responsible for publicly accessible PHP web servers should clear their schedules tonight for urgent patch deployment. php.net/archive/2026.php#202…

.@e_kaspersky live from Bali, at #TheSAS2026 👇🏼 @TheSAScon

New Lazarus tradecraft: updated malware, abuse of legitimate software and a dash of post-quantum encryption Kaspersky GReAT researchers today shared details about Lazarus's Operation FlashHole, targeting organizations in South Korea. This time, attackers abused CrossWeb EX, a financial security solution that is required to access some online banking websites. Nearly all malware components, except the loader, operate only in memory. Newly identified malware includes TouchHub and ClientHub, which complement already known components such as TouchShift, LPEClient, and Cubridge. In this attack, Lazarus is first observed to employ the SNOW algorithm for encryption and orchestrate C2 traffic for LPEClient through ClientHub, using ML-KEM (CRYSTALS-Kyber), a recently standardized post-quantum algorithm for key encapsulation. The attack details were shared today during Security Analyst Summit 2026. Watch our video where Sojun Ryu recaps key details about their new findings, or read the full details at securelist.com/lazarus-opera… #APT #Lazarus #TheSAS2026