backblaze

A hard drive reliability check on 341,263 drives, from 4TB to past 20TB Large cloud storage operators track their hard drives every day, recording which units keep running and which ones drop off the racks. Backblaze does this at scale, and its Q1 2026 report covers a fleet built for continuous use. The analysis covered 341,263 hard drives, after boot drives and a small group of units that missed the reporting thresholds were set aside. The pool spans capacities from 4TB to past 20TB. The quarterly annualized failure rate came to 1.24%. That figure rose from the prior quarter and settled under the level of a year earlier. Across the whole fleet, the lifetime failure rate stands at 1.39%, a steadier long-run gauge of how the hardware holds up. Newer, higher-capacity hardware carried much of the load. The company added more than ten thousand drives during the period, most of them holding more than 20TB each. This young pool posted an annualized failure rate of 0.85%, strong for freshly deployed equipment. No new drive models joined the fleet this quarter, an outcome the company calls rare given that new models arrived in six of the past eight quarters. Several existing models ran clean, with the HGST HUH728080ALE600 and two others recording zero failures over the period. Failure counts and failure rates tell separate stories. The Seagate ST16000NM000J logged a single failure and still posted a 3.61% annualized rate, a result driven by a pool that has dwindled to about 130 units. One drop from a small group moves the percentage a long way. Several other models logged just one failure each across the quarter, among them the Toshiba MG09ACA16TE and a pair of Seagate drives in the 12TB to 14TB range. Their raw failure counts look calm, and their rates stay low because their populations remain large. Backblaze counts failures with a C++ program that gathers SMART statistics at the end of each day. A drive present one day and absent the next gets logged as a failure, with a lookback window that reverses the call if the serial number returns within the quarter. The reported rates, author Stephanie Doyle wrote, come down to people “actively managing failure and risk.” The method depends on a drive appearing in the pool the day before, which leaves day-one failures outside its reach. Some drives give out on their first day in a data center, and the counter can miss them. Day-one failures have probably gone under-recorded across the program’s history. Drive qualification before deployment keeps such cases rare, so the effect on the published figures stays small. The complete dataset remains available for download.

AI traffic is getting bigger, louder, and less predictable AI workflows need storage that supports repeated movement across the model lifecycle. Large datasets are ingested, transformed, exported for training, pulled back for evaluation, and refreshed as models evolve. Backblaze’s Q1 2026 Network Stats report says this creates a shift from diffuse internet-style traffic to large, high-bandwidth flows between fewer endpoints. Monthly view of all bits transferred to each network type (2025-05 to current) (Source: Backblaze) “From a network perspective, this represents a meaningful shift from diffuse, internet-style traffic patterns to large, high-bandwidth flows between a smaller set of endpoints typical of AI-centric infrastructure,” Brent Nowak, Manager of Network Engineering at Backblaze, explained. The report shows that this traffic pattern is becoming an operational factor for cloud infrastructure teams. Neocloud, or AI-focused compute networks, and hyperscaler traffic behave differently from content delivery networks (CDN), hosting, and ISP regional traffic. Traffic slowed, then rebounded Q1 2026 showed a winter slowdown in neocloud and hyperscaler traffic, followed by an upward trend in March. Backblaze also recorded an increase in CDN traffic during the winter months. Hosting and ISP traffic stayed largely within historical norms, reflecting steady usage patterns. The report suggests two possible explanations. The slowdown may reflect a seasonal business cycle, with more downtime during the winter months. Another possibility is tied to dataset movement. If a large dataset is already stored, network traffic may remain low until a later update or training cycle sends a new volume of data across the network. Traffic distribution by region Quarter-over-quarter heatmaps show how traffic distribution changes by region and provider type. The analysis combines total traffic with the number of active endpoints to measure flow magnitude. Q1 2026 showed lower neocloud and hyperscaler traffic during the winter months, followed by renewed activity in March. Neocloud traffic maintained high magnitude through the quarter, indicating large transfers across a small number of endpoints. Northern Virginia, including the Ashburn and Reston corridor, remains a primary location for neocloud activity. Activity also expanded into US-West and EU-Central in March after lower levels earlier in the quarter. Hyperscaler traffic followed a similar pattern, with a winter decrease and continued visibility in US-East. CDN, hosting, and ISP regional traffic remained more predictable and spread out over time. These traffic types involve more sources and destinations, which makes them easier to model and load balance. Network flow characteristics Neocloud traffic is concentrated in regions tied to dense data center and compute infrastructure. The United States shows the highest concentration of neocloud, hyperscaler, and CDN traffic. Backblaze notes that the U.S. contains about 40% to 45% of global data centers, which aligns with the traffic patterns observed in its network data. Within the U.S., neocloud traffic is concentrated in California. Hyperscaler activity aligns with California and Virginia, including the Ashburn and Reston corridor. Outside the United States, neocloud activity appears in Finland, Brazil, France, and Canada. CDN traffic shows concentration in the Netherlands, while hosting activity appears in Germany. Neocloud and hyperscaler traffic are more dynamic than CDN, hosting, and ISP regional traffic. They move large volumes of data across fewer endpoints, appear in bursts, and require network planning around high-magnitude flows.

AWS, Wasabi, Cloudflare, and Backblaze go head-to-head in new cloud storage test Cloud storage buyers rarely get vendor-provided performance data that includes the vendor’s own weak spots. Backblaze’s Q1 2026 Performance Stats report, attempts to do exactly that, sharing benchmark results for Backblaze B2, AWS S3, Cloudflare R2, and Wasabi Object Storage across US-East and EU-Central regions, and including results where Backblaze’s own rate limits affected the numbers. The report is the second in a quarterly series. Backblaze publishes its full methodology and states that tests run from a neutral Vultr-hosted Ubuntu virtual machine, routed through Catchpoint’s network, to avoid identifying the test account as Backblaze-owned to competing providers. “What you’re seeing in this quarter’s data are early signals about provider strengths and weaknesses, which start to make sense once you understand the architectural decisions behind them,” said Dan Spraggins, SVP of Engineering, Backblaze. “As this dataset grows quarter over quarter, those signals will become patterns, and those patterns will fundamentally change how the industry thinks about cloud storage strategy.” What was tested Tests covered average upload and download times for 256KiB, 2MiB, and 5MiB files, time-to-first-byte (TTFB) for downloads, and five-minute sustained throughput tests in both single-threaded and multi-threaded configurations. Throughput tests used file sizes of 256KiB, 5MiB, 50MiB, and 100MiB. Multi-threaded tests ran 20 concurrent threads. EU-Central data originates from an Amsterdam data center. US-East upload and download averages Across US-East upload averages, every provider recorded lower times compared to Q4 2025. Backblaze led for 256KiB and 5MiB uploads; Wasabi led for 2MiB uploads. In US-East download averages, AWS S3 led in TTFB, 256KiB, and 5MiB categories. Backblaze took the 2MiB download category, a position AWS held last quarter. Rate limits in the throughput data Backblaze hit its own bandwidth caps during multi-threaded throughput tests at larger file sizes in US-East. The bandwidth cap did not affect the 256KiB or 5MiB file sizes in the multi-threaded upload test, only the larger ones. To address the rate-limit behavior, Backblaze ran an auto-retry script and raised the bandwidth cap for affected test sizes only, keeping all other account parameters at standard tier defaults. Backblaze had an advantage in detecting its own rate limits, and that other providers may apply similar or different constraints without those being visible in the test data. In US-East multi-threaded upload throughput, Wasabi led across file sizes. In US-East multi-threaded download throughput, Backblaze led for 256KiB, AWS led for 5MiB and 50MiB, and Cloudflare led for 100MiB. EU-Central findings The EU-Central region, added this quarter, produced different provider rankings than US-East. In EU upload averages, Cloudflare R2 led the 256KiB category and Backblaze led for 2MiB and 5MiB. In EU download averages and TTFB, Cloudflare led in TTFB, 256KiB, and 2MiB categories; AWS led for 5MiB. In EU multi-threaded upload throughput, Wasabi led for 256KiB and 100MiB; AWS led for 5MiB and 50MiB. Backblaze’s EU download average times drew internal attention. Backblaze identified an issue it believes contributed to those numbers and plans to report on the impact of fixes in a future quarter. Variance and dataset maturity A recurring observation across both regions is the wide spread between highest and lowest throughput values within each file size category. This pattern appeared last quarter as well, and flags it as something worth tracking over time. It also cautions that the dataset is still young and that significance cannot yet be attributed to quarter-over-quarter changes in throughput results, given that the methodology changed between Q4 2025 and Q1 2026. Upload and download averages were unaffected by the methodology change and are considered comparable. A separate pattern visible in both regions is that multi-threaded download throughput rises sharply from 256KiB to 5MiB file sizes and then flattens out for larger files. Methodology limitations The report lists several constraints, including a 10MiB file size ceiling on average upload and download tests due to timeout thresholds, a static origination point in NY/NJ for US-East tests, and the possibility of intermediate caching in repeated download tests. It also notes that Wasabi’s inbound connection rules affected test behavior in a prior quarter. The full methodology, raw data tables, and per-file-size clustering charts are included in the report.

Several US companies have been targeted by Iranian hacking group MuddyWater in a new campaign that started in early February and has continued after the US and Israeli military strikes on Iran. The campaign was detected by the Threat Hunter Team at Broadcom’s Symantec and Carbon Black. The potential victims include a US bank, a US airport, non-governmental organizations in both the US and Canada and the Israeli operation of a US software company that supplies the defense and aerospace sectors. Each of these organizations has experienced suspicious activity on their networks in recent days and weeks, said the Threat Hunter Team in a March 5 report. The campaign involves a previously unknown backdoor, dubbed ‘Dindoor’ by the cyber threat researchers. Reused Certificates Tie New Backdoors to Iran-Linked MuddyWater The Dindoor backdoor was found by the threat researchers on the networks of the Israeli outpost of the software company, the US bank and the Canadian non-profit organization. Signed with a certificate issued to “Amy Cherne,” this backdoor leverages Deno, the secure runtime for JavaScript and TypeScript, to execute. The researchers also observed an attempt to exfiltrate data from the software company using Rclone, a command-line program to manage files on cloud storage, to a Wasabi cloud storage bucket. It is not clear if this attempt was successful. A different, Python backdoor called Fakeset was found on the networks of the US airport. It was signed by certificates issued to “Amy Cherne” and “Donald Gay”. The Donald Gay certificate has been used previously to sign malware linked to MuddyWater, a hacking group active since 2017 and associated with the Iranian Ministry of Intelligence and Security (MOIS), also known as Seedworm, Temp Zagros and Static Kitten. The backdoor was downloaded from two servers belonging to the Backblaze cloud storage company. The Donald Gay certificate was also used to sign a sample from the malware family the researchers track as ‘Stagecomp,’ which downloads the Darkcomp backdoor. The Stagecomp and the Darkcomp malware have been linked to MuddyWater by security vendors, including Google, Microsoft and Kaspersky. This malware wasn’t seen on the targeted networks, but the use of the same certificates suggests MuddyWater was involved, said the Threat Hunter Team. “While we have disrupted these breaches, other organizations could still be vulnerable to attack,” the researchers added.

New research from Broadcom's Symantec and Carbon Black Threat Hunter Team has discovered evidence of an Iranian hacking group embedding itself in several U.S. companies' networks, including banks, airports, non-profit, and the Israeli arm of a software company. The activity has been attributed to a state-sponsored hacking group called MuddyWater (aka Seedworm). It's affiliated with the Iranian Ministry of Intelligence and Security (MOIS). The campaign is assessed to have begun in early February, with recent activity detected following U.S. and Israeli military strikes on Iran. "The software company is a supplier to the defense and aerospace industries, among others, and has a presence in Israel, with the company's Israel operation seeming to be the target in this activity," the security vendor said in a report shared with The Hacker News. The attacks targeting the software company, as well as a U.S. bank and a Canadian non-profit, have been found to pave the way for a previously unknown backdoor dubbed Dindoor, which leverages the Deno JavaScript runtime for execution. Broadcom said it also identified an attempt to exfiltrate data from the software company using the Rclone utility to a Wasabi cloud storage bucket. However, it's currently not known if the effort paid off. Also found in the networks of a U.S. airport and a non-profit was a separate Python backdoor called Fakeset, which was downloaded from servers belonging to Backblaze, an American cloud storage and data backup company. The digital certificate used to sign Fakeset has also been used to sign Stagecomp and Darkcomp malware, both previously linked to MuddyWater. Brigid O Gorman, senior intelligence analyst, Symantec and Carbon Black Threat Hunter Team, said Microsoft and Kaspersky have detected samples associated with the Stagecomp and the Darkcomp malware with Muddywater-linked signatures – "Trojan:Python/MuddyWater.DB!MTB" for Microsoft and "Backdoor.Python.MuddyWater.a" for Kaspersky. "While this malware wasn't seen on the targeted networks, the use of the same certificates suggests the same actor -- namely Seedworm -- was behind the activity on the networks of the U.S. companies," Symantec and Carbon Black said. "Iranian threat actors have become increasingly proficient in recent years. Not only has their tooling and malware improved, but they've also demonstrated strong social engineering capabilities, including spear-phishing campaigns and 'honeytrap' operations used to build relationships with targets of interest to gain access to accounts or sensitive information." The findings come against the backdrop of an escalating military conflict in Iran, triggering a barrage of cyber attacks in the digital sphere. Recent research from Check Point has uncovered the pro-Palestinian hacktivist group known as Handala Hack (aka Void Manticore) routing its operations through Starlink IP ranges to probe externally facing applications for misconfigurations and weak credentials. In recent months, multiple Iran-nexus adversaries, such as Agrius (aka Agonizing Serpens, Marshtreader, and Pink Sandstorm), have also observed scanning for vulnerable Hikvision cameras and video intercom solutions using known security flaws such as CVE-2017-7921 and CVE-2023-6895. The targeting, per Check Point, has intensified in the wake of the current Middle East conflict. The exploitation attempts against IP cameras have witnessed a surge in Israel and Gulf countries, including the U.A.E., Qatar, Bahrain, and Kuwait, along with Lebanon and Cyprus. The activity has singled out cameras from Dahua and Hikvision, weaponizing the two aforementioned vulnerabilities, as well as CVE-2021-36260, CVE-2025-34067, and CVE-2021-33044. "Taken together, these findings are consistent with the assessment that Iran, as part of its doctrine, leverages camera compromise for operational support and ongoing battle damage assessment (BDA) for missile operations, potentially in some cases prior to missile launches," the company said. "As a result, tracking camera-targeting activity from specific, attributed infrastructures may serve as an early indicator of potential follow-on kinetic activity." The U.S. and Israel's war with Iran has also prompted an advisory from the Canadian Centre for Cyber Security (CCCS), which cautioned that Iran will likely use its cyber apparatus to stage retaliatory attacks against critical infrastructure and information operations to further the regime's interests. Some other key developments that have unfolded in recent days are listed below - Israeli intelligence agencies hacked into Tehran's extensive traffic camera network for years to monitor the movements of bodyguards of Ayatollah Ali Khamenei and other top Iranian officials in the lead up to the assassination of the supreme leader last week, the Financial Times reported. Iran's Islamic Revolutionary Guard Corps (IRGC) targeted Amazon's data center in Bahrain for the company's support of the "enemy's military and intelligence activities," state media Fars News Agency said on Telegram. Active wiper campaigns are said to be underway against Israeli energy, financial, government, and utilities sectors. "Iran's wiper arsenal includes 15+ families (ZeroCleare, Meteor, Dustman, DEADWOOD, Apostle, BFG Agonizer, MultiLayer, PartialWasher, and others)," Anomali said. Iranian state-sponsored APT groups like MuddyWater, Charming Kitten, OilRig, Elfin, and Fox Kitten "demonstrated clear signs of activation and rapid retooling, positioning themselves for retaliatory operations amid the escalating conflict," LevelBlue said, adding "cyber represents one of Iran's most accessible asymmetric tools for retaliation against Gulf states that condemned its attacks and support U.S. operations." According to Flashpoint, a massive #OpIsrael cyber campaign involving pro-Russian and pro-Iranian actors has targeted Israeli industrial control systems (ICS) and government portals across Kuwait, Jordan, and Bahrain. The campaign is driven by NoName057(16), Handala Hack, Fatemiyoun Electronic Team, and Cyber Islamic Resistance (aka 313 Team). Between 28 February 2026 and 2 March 2026, pro-Russia hacktivist group Z-Pentest claimed responsibility for compromising several U.S.-based entities, including ICS and SCADA systems and multiple CCTV networks. "The timing of these unverified claims, coinciding with Operation Epic Fury, suggests Z-Pentest likely began prioritizing U.S. entities as targets," Adam Meyers, head of Counter Adversary Operations at CrowdStrike, told The Hacker News. "Iran's offensive cyber capability has matured into a durable instrument of state power used to support intelligence collection, regional influence, and strategic signaling during periods of geopolitical tension," UltraViolet Cyber said. "A defining feature of Iran's current cyber doctrine is its emphasis on identity and cloud control planes as the primary attack surface." "Rather than prioritizing zero-day exploitation or highly novel malware at scale, Iranian operators tend to focus on repeatable access techniques such as credential theft, password spraying, and social engineering, followed by persistence through widely deployed enterprise services." Organizations are advised to bolster their cybersecurity posture, strengthen monitoring capabilities, limit exposure to the internet, disable remote access to operational technology (OT) systems, enforce phishing-resistant multi-factor authentication (MFA), implement network segmentation, take offline backups, and ensure that all internet-facing applications, VPN gateways, and edge devices are up-to-date "Western organizations should continue to remain on high-alert for potential cyber response as the conflict continues and activity may move beyond hacktivism and into destructive operations," Meyers said.

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Week in review: Windows kernel flaw patched, suspected Fortinet FortiWeb zero-day exploited Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Adopting a counterintelligence mindset in luxury logistics In this Help Net Security interview, Andrea Succi, Group CISO at Ferrari Group, discusses how cybersecurity is integrated into every aspect of the logistics industry. He explains why protecting data can be as critical as securing physical assets and how a layered defense approach helps safeguard both. Succi adds that awareness, collaboration, and resilience keep client trust and operations consistent. Wi-Fi signals may hold the key to touchless access control Imagine walking into a secure building where the door unlocks the moment your hand hovers near it. No keycards, no PINs, no fingerprints. Instead, the system identifies you by the way your palm distorts the surrounding Wi-Fi signal. That is the idea behind a new study from researchers at the Aeronautics Institute of Technology (ITA) in Brazil. To get funding, CISOs are mastering the language of money In this Help Net Security interview, Chris Wheeler, CISO at Resilience, talks about how CISOs are managing changing cybersecurity budgets. While overall spending is up, many say the increases don’t match their most pressing needs. Wheeler explains how organizations are reallocating funds, measuring ROI, and linking cybersecurity plans to business goals. When every day is threat assessment day In this Help Net Security interview, Paul J. Mocarski, VP & CISO at Sammons Financial Group, discusses how insurance carriers are adapting their cybersecurity strategies. He explains how ongoing threat assessments, AI-driven automation, and third-party risk management help maintain readiness. Healthcare security is broken because its systems can’t talk to each other In this Help Net Security interview, Cameron Kracke, CISO at Prime Therapeutics, discusses how the healthcare ecosystem can achieve cohesive security visibility. With hospitals, clinics, telehealth, and cloud partners all in the mix, maintaining visibility remains a complex task. Kracke shares how interoperability, collaboration, and strategic investment can strengthen resilience across the healthcare security landscape. Why your security strategy is failing before it even starts In this Help Net Security interview, Adnan Ahmed, CISO at Ornua, discusses how organizations can build a cybersecurity strategy that aligns with business goals. He explains why many companies stumble by focusing on technology before understanding risk and shares how embedding cybersecurity across the business helps build resilience. Attackers exploited another Gladinet Triofox vulnerability (CVE-2025-12480) Attackers have exploited yet another vulnerability (CVE-2025-12480) in the Gladinet Triofox secure file sharing and remote access platform, Mandiant revealed on Monday. CISA: Patch Samsung flaw exploited to deliver spyware (CVE-2025-21042) CISA has added CVE-2025-21042, a vulnerability affecting Samsung mobile devices, to its Known Exploited Vulnerabilities (KEV) catalog, and has ordered US federal civilian agencies to address it by the start of December. Patch Tuesday: Microsoft fixes actively exploited Windows kernel vulnerability (CVE-2025-62215) Microsoft has delivered a rather light load of patches for November 2025 Patch Tuesday: some 60+ vulnerabilities have received a fix, among them an actively exploited Windows Kernel flaw (CVE-2025-62215). UK’s new Cyber Security and Resilience Bill targets weak links in critical services The UK government has introduced the Cyber Security and Resilience Bill, a major piece of legislation designed to boost the country’s protection against cyber threats. The new law aims to strengthen the digital defenses of essential public services and update the ageing Network and Information Systems (NIS) Regulations 2018, the UK’s only cross-sector cyber security law. Rhadamanthys infostealer operation disrupted by law enforcement The rumors were true: Operation Endgame, a joint effort between law enforcement and judicial authorities of several European countries, Australia, Canada, the UK and the US, has disrupted the infrastructure supporting the operation of the Rhadamanthys infostealer. “Patched” but still exposed: US federal agencies must remediate Cisco flaws (again) CISA has ordered US federal agencies to fully address two actively exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362) in Cisco Adaptive Security Appliances (ASA) and Firepower firewalls. Fake spam filter alerts are hitting inboxes A new phishing campaign is attempting to trick users into believing they’ve missed important emails, security researchers are warning. The bogus email alerts look like they are coming from the recipient’s email domain, and falsely claim that due to a “Secure Message system” upgrade, important messages have been blocked. A suspected Fortinet FortiWeb zero-day is actively exploited, researchers warn A suspected (but currently unidentified) zero-day vulnerability in Fortinet FortiWeb is being exploited by unauthenticated attackers to create new admin accounts on vulnerable, internet-facing devices. Chinese cyber spies used Claude AI to automate 90% of their attack campaign, Anthropic claims “Analysis of operational tempo, request volumes, and activity patterns confirms the AI executed approximately 80 to 90 percent of all tactical work independently, with humans serving in strategic supervisory roles,” Anthropic said. Shadow AI risk: Navigating the growing threat of ungoverned AI adoption AI is transforming how businesses operate, but it’s also creating new, often hidden risks. As employees and business units eagerly embrace and experiment with AI solutions, many organizations are losing control over where and how AI is being used. A new threat is emerging: shadow AI. This unsanctioned use of AI tools without oversight from IT or security teams has quickly become a top concern for CISOs. How to adopt AI security tools without losing control In this Help Net Security video, Josh Harguess, CTO of Fire Mountain Labs, explains how to evaluate, deploy, and govern AI-driven security tools. He talks about the growing role of AI in security operations and the new kinds of risks it brings. sqlmap: Open-source SQL injection and database takeover tool Finding and exploiting SQL injection vulnerabilities is one of the oldest and most common steps in web application testing. sqlmap streamlines this process. It is an open-source penetration testing tool that automates the detection and exploitation of SQL injection flaws and can take over database servers when configured to do so. CISOs are cracking under pressure Cybersecurity leaders are hitting their limit. A new report from Nagomi Security shows that most CISOs are stretched thin, dealing with nonstop incidents, too many tools, and growing pressure from their boards. The pressures are so intense that many say they are burned out and thinking about walking away. How far can police push privacy before it breaks Police use drones, body cameras, and license plate readers as part of their daily work. Supporters say these tools make communities safer. Critics see something different, a system that collects too much data and opens the door to abuse. When surveillance expands without public oversight, civil liberties start to slip away, especially for people who already face bias and discrimination. ProxyBridge: Open-source proxy routing for Windows applications ProxyBridge is a lightweight, open-source tool that lets Windows users route network traffic from specific applications through SOCKS5 or HTTP proxies. It can redirect both TCP and UDP traffic and gives users the option to route, block, or allow connections on a per-application basis. Autonomous AI could challenge how we define criminal behavior Whether we ever build AI that thinks like a person is still uncertain. What seems more realistic is a future with more independent machines. These systems already work across many industries and digital environments. Alongside human-to-human and human-to-machine contact, communication between machines is growing fast. Criminology should start to look at what this shift means for crime and social control. Google adds Emerging Threats Center to speed detection and response When a new vulnerability hits the news, security teams often scramble to find out if they are at risk. The process of answering that question can take days or weeks, involving manual research, rule-writing, and testing. Google Security Operations wants to close that window with its new Emerging Threats Center, designed to help teams understand their exposure and detection coverage in near real time. Sprout: Open-source bootloader built for speed and security Sprout is an open-source bootloader that delivers sub-second boot times and uses a clean, data-driven configuration format that works across operating systems. Wanna bet? Scammers are playing the odds better than you are Placing a bet has never been this easy, and that’s the problem. The convenience of online gambling is the same thing scammers are cashing in on. Whether it’s a fake app, a “can’t-miss” tipster, or a rigged casino, the game is stacked against you. Los Alamos researchers warn AI may upend national security For decades, the United States has built its defense posture around predictable timelines for technological progress. That assumption no longer holds, according to researchers at Los Alamos National Laboratory. Their paper argues that AI is advancing so quickly that the current defense system cannot adapt in time. Protecting mobile privacy in real time with predictive adversarial defense Mobile sensors are everywhere, quietly recording how users move, tilt, or hold their phones. The same data that powers step counters and activity trackers can also expose personal details such as gender, age, or even identity. A new study introduces a method designed to stop that information from being inferred in the first place, without interrupting the phone’s normal functions. AI is rewriting how software is built and secured AI has become part of everyday software development, shaping how code is written and how fast products reach users. A new report from Cycode, The 2026 State of Product Security for the AI Era, explores how deeply AI now runs through development pipelines and how security teams are trying to manage the risks that come with it. Hidden risks in the financial sector’s supply chain When a cyber attack hits a major bank or trading platform, attention usually turns to the institution. But new research suggests the real danger may lie elsewhere. BitSight researchers found that many of the technology providers serving the financial sector have weaker cybersecurity performance than the institutions they support. GNU Coreutils 9.9 brings fixes and updates across essential tools GNU Coreutils is the backbone of many enterprise Linux environments. It provides the basic file, shell, and text utilities that every GNU-based system depends on. The latest release, version 9.9, refines these tools with fixes and performance improvements. What the latest data reveals about hard drive reliability What really counts as a hard drive failure? That’s the question at the center of Backblaze’s Q3 2025 Drive Stats report, which tracks the performance of 328,348 hard drives across its global data centers. The latest findings build on more than a decade of data that has made Backblaze one of the most transparent sources on drive reliability for IT teams, researchers, and data professionals. AI is forcing boards to rethink how they govern security Boards are spending more time on cybersecurity but still struggle to show how investments improve business performance. The focus has shifted from whether to fund protection to how to measure its return and ensure it supports growth. The browser is eating your security stack Employees log into SaaS platforms, upload files, use AI tools, and manage customer data from a single tab. While the browser has become the enterprise’s main workspace, it remains largely outside the reach of security controls. According to the 2025 Browser Security Report by LayerX, that blind spot has turned into a major risk surface for data loss, identity theft, and AI misuse. Automation can’t fix broken security basics Most enterprises continue to fall short on basic practices such as patching, access control, and vendor oversight, according to Swimlane’s Cracks in the Foundation: Why Basic Security Still Fails report. Leadership often focuses on broad resilience goals while the day-to-day work that supports them remains inconsistent and underfunded. What happens when employees take control of AI Executives may debate AI strategy, but many of the advances are happening at the employee level. A recent Moveworks study shows that AI adoption is being led from the ground up, with employees, not senior leaders, driving the change. Download: Strengthening Identity Security whitepaper Identity threats are escalating. Attackers increasingly exploit compromised credentials, often undetected by organizations, and use social engineering to gain access. Most companies lack visibility into service account activity and don’t have the tools to detect identity-led threats. Cybersecurity jobs available right now: November 11, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: November 14, 2025 Here’s a look at the most interesting products from the past week, featuring releases from Action1, Avast, Cyware, Firewalla, and Nokod Security.

What the latest data reveals about hard drive reliability What really counts as a hard drive failure? That’s the question at the center of Backblaze’s Q3 2025 Drive Stats report, which tracks the performance of 328,348 hard drives across its global data centers. The latest findings build on more than a decade of data that has made Backblaze one of the most transparent sources on drive reliability for IT teams, researchers, and data professionals. Backblaze hard drive failure rates for Q3 2025 “After more than ten years and billions of drive days, we’ve built one of the largest collections of drive reliability data in the world,” said Gleb Budman, CEO of Backblaze. “This quarter, we’re going deeper, and showing exactly how we spot drive failures and turning that insight into something anyone can use.” The quarterly failure rate ticked up slightly, from 1.36% in Q2 to 1.55% in Q3, closely matching the 2024 annualized failure rate (AFR) of 1.57%. Four models had zero recorded failures this quarter: the Seagate HMS5C4040BLE640 (4TB), Seagate ST8000NM000A (8TB), Toshiba MG09ACA16TE (16TB), and the newly added Toshiba MG11ACA24TE (24TB). High-capacity drives (20TB and up) continued to grow in use, adding nearly 8,000 units and now making up 21% of Backblaze’s active drive pool. The lifetime AFR held steady at 1.31%, consistent with the past two quarters. This quarter’s report takes a closer look at how Backblaze determines when a drive has actually failed. The company uses SMART data, internal monitoring tools, and automated tracking systems to tell true mechanical failures apart from temporary removals. A drive is marked as failed if it is flagged in work tracking systems or does not return to service by the end of the quarter. One outlier stood out: the Toshiba MG08ACA16TEY (16TB), which posted a 16.95% AFR. The spike, Backblaze explained, came from an infrastructure upgrade that temporarily pulled several drives from operation, not from actual hardware failures. The company expects those figures to level out in future reports.