YouTube hides some of its best mobile features, like background playback and picture-in-picture, behind its expensive $14/month YouTube Premium subscription. And it’s notorious for stopping free apps and workarounds. If you’re on Android, you can use the third-party app NewPipe to get around these limitations. But on the walled garden that is the iPhone? There's very little you can do. Even if you try to play videos using Safari, they’ll stop playing as soon as you lock your screen.

Which is why it’s a big deal that Vivaldi, the privacy-focused browser, now supports background playback for YouTube, and many other video sites that expressly block it. If you’re okay using YouTube on the web instead of an app (your feed will still be the same), you can now enjoy a paid YouTube Premium feature for free. Even if you only use this feature for long podcast episodes or long videos, it might be worth it.

How to enable and use background playback in Vivaldi for iPhone

For this feature to work, you’ll first need to update your Vivaldi app to the latest version. As long as you’re running version 7.4 or higher, you’re good.

Next, it’s time to enable a specific setting, without which, this feature won’t work. First, click the Vivaldi icon from the toolbar, then choose the Settings icon.

Go to General and enable the Allow media playback in background option.

Credit: Khamosh Pathak

With that, background playback is now enabled.

To try it out, go to the YouTube website in Vivaldi and open a video. Once it starts playing, go back to the Home Screen or lock your iPhone or iPad completely. The playback will still continue, as intended, in the background.

Credit: Khamosh Pathak

When you lock the screen, you’ll also see media controls, like when you use a music app (or when you use YouTube Premium). So you'll be free to pause the video, or move forwards or backwards freely, without opening Vivaldi again. Unfortunately, Vivaldi still won’t stop ads, so for that, take a look at our best ad-free YouTube apps.

from Lifehacker https://ift.tt/3lCLyFM

Barracuda Networks unveiled the BarracudaONE AI-powered cybersecurity platform.

BarracudaONE maximizes threat protection and cyber resilience by unifying layered security defenses and providing deep, intelligent threat detection and response for managed service providers (MSPs), other channel partners and end users.

BarracudaONE simplifies and strengthens security operations by unifying Barracuda’s comprehensive portfolio of solutions into a single, integrated platform. It delivers layered threat protection, managed through a centralized dashboard, reducing operational complexity and improving visibility. By consolidating key security functions, BarracudaONE minimizes the administrative burden and enhances overall cyber resilience.

Advanced, battle-tested AI – integrated across Barracuda’s solutions and fine-tuned over years of real-world application – enables precise threat detection, rapid response and intelligence automation. At the core of this AI-driven platform are robust reporting capabilities that deliver clear, actionable insights.

These reports help security teams and channel partners demonstrate the effectiveness of the AI threat layer in identifying and neutralizing attacks, while also highlighting ROI and operational impact. By making threat data easy to interpret and communicate, the platform empowers organizations to validate their cybersecurity posture and make informed decisions with confidence.

“BarracudaONE is a shields-up force multiplier that helps us safeguard critical municipal services – including our police dispatcher center, police and fire departments, as well as wastewater, finance and other essential operations,” said William Mann, CISO at the Borough of West Chester, Pennsylvania. “The ability to manage multiple security modules through a single, centralized dashboard is transformational. Barracuda Email Protection’s incident response capabilities are mission-critical, and with BarracudaONE, they’re more accessible, faster and easier to manage. The streamlined experience of having fewer clicks and faster insights enables us to prioritize threats and respond with the speed and precision our first responders, government teams and community depend on.”

“As an MSP, BarracudaONE isn’t just another tool – it’s a strategic differentiator for our business,” said Tyler Bracken, director of network operations at OpX Networks. “We’re already using BarracudaONE as a powerful sales asset to clearly demonstrate the value we deliver and make ROI tangible for our customers. Cybersecurity can sometimes be a challenging sell, clouded by misconceptions around complexity and cost. BarracudaONE helps shift that narrative. Its rich telemetry and real-time insights enable us to show exactly what threats we’re neutralizing and the protection we’re providing. That level of transparency builds trust with our customers and gives us a strong advantage in a crowded market.”

“BarracudaONE brings all our Barracuda solutions into a unified, powerful platform – delivering centralized visibility, real-time alerts and actionable reporting,” said Adam Butler, principal cyber solutions architect at ARO. “It represents a major step forward for our customers, and an even greater advantage for us as an MSP overseeing thousands of customer environments. With BarracudaONE, we can pinpoint security gaps faster, prioritize alerts with greater accuracy and generate high-value reports in seconds.”

Availability

BarracudaONE is now available at no additional cost to MSPs, other channel partners and customers already using Barracuda Email Protection, Barracuda Cloud-to-Cloud Backup and Barracuda Data Inspector. The platform provides a centralized interface for MSPs and partners to easily manage solutions and licenses.

MSPs, partners and end users can further strengthen their security posture with Barracuda Managed XDR, a 24/7 service that delivers expert threat detection and response backed by Barracuda’s security operations center (SOC).

from Help Net Security https://ift.tt/zFg3ec1

In this Help Net Security interview, Aaron McCray, Field CISO at CDW, discusses how AI is transforming the CISO role from a tactical cybersecurity guardian into a strategic enterprise risk advisor. With AI now embedded across business functions, CISOs are leading enterprise-wide governance and risk management efforts. He also shares insights on practical challenges, new skillsets, and building AI-fluent security cultures.

With AI now embedded across business functions, how does a CISO’s role evolve to oversee enterprise-wide AI governance and risk management?

The role of the CISO is no longer just the guardian of firewalls and endpoints. The role is increasingly shifting from operating as a tactical cybersecurity leader to a strategic enterprise risk advisor – now at the table advising on AI risk at the board level. New CDW research shows that 85% of IT leaders believe AI can improve cybersecurity, and nearly three-quarters are already implementing it to do just that.

As AI becomes more embedded, the modern CISO is helping shape governance frameworks that ensure AI is used responsibly and in alignment with compliance and business goals. This is a fundamental shift that my colleague, Walt Powell, refers to as “CISO 2.0 to CISO 3.0” – where the role of the CISO has shifted from being a cybersecurity steward to that of strategic leader aimed at achieving business outcomes, performing quantitative financial risk management, and advising the C-Suite and board level in the decision-making process.

What are the practical challenges CISOs face when deploying AI-driven security tools, especially around visibility, explainability, or false positives?

As advanced as AI has become, obstacles remain that require human oversight. Ensuring visibility into the AI function, which allows for outputs to be audited and broken down into easily digestible language, will be a central challenge, especially as building trust with the technology is top of mind. AI tools are incredibly powerful, but it’s important to be able to explain how they make decisions – especially in regulated industries. CISOs must balance both efficiency and accuracy as AI deployment picks up momentum, and part of this requires transparency into how outputs are created.

Additionally, false positives are a real issue. AI-driven security tools can inundate teams with alerts that turn out to be irrelevant or low-priority. When teams are constantly chasing down false alarms, it creates alert fatigue and diverts attention from genuine threats. This not only slows down response times but can also erode trust in the system itself.

Integration is another hurdle. These tools need to work with existing infrastructure, and that’s not always straightforward. Many organizations have a complex patchwork of legacy systems, cloud environments, and third-party platforms. Introducing AI into that mix requires careful planning – ensuring compatibility, managing data flows, and maintaining security across all touchpoints. If an AI tool doesn’t align with existing workflows, its effectiveness drops significantly. It’s not just about plugging in a new tool; it’s about orchestrating a seamless, secure ecosystem where AI can deliver value.

How is AI changing the skillset CISOs need, both for themselves and for their teams?

AI is expanding the CISO’s required skillset beyond cybersecurity to include fluency in data science, machine learning fundamentals, and understanding how to evaluate AI models – not just technically, but from a governance and risk perspective. Understanding how AI works and how to use it responsibly is essential.

Fortunately, AI has also evolved how we train our teams. For example, adaptive learning platforms that personalize content and simulate real-world scenarios are assisting in closing the skills gap more effectively.

Ultimately, to become successful in the AI space, both CISOs and their teams will need to grasp how AI models are trained, the data they rely on, and the risks they may introduce.

How should CISOs evaluate and vet third-party AI tools for security operations? What are the “red flags”?

CISOs should always prioritize accountability and transparency. Red flags to look out for include a lack of explainability or insufficient auditing capabilities, both of which leave companies vulnerable. It’s important to understand how it handles sensitive data, and whether it has proven success in similar environments.

Beyond that, it’s also vital to evaluate how well the tool aligns with your governance model, that it can be audited, and that it integrates well into your existing systems.

Lastly, overpromising capabilities or providing an unclear roadmap for support are signs to proceed with caution. If a vendor isn’t articulating how they’ll maintain, update, or evolve a tool over time – or if there is no transparency around how issues will be handled post-deployment, it puts your organization at risk. You need partners who are realistic about what their tools can do today, and who are committed to evolving with you as your needs and the threat landscape change.

What advice would you give CISOs who are trying to build an AI-fluent security culture within their organization?

Start with education. AI is creating personalized course content directed down to the individual, which addresses learning more effectively. Training modules can use adaptive learning and monitor someone’s ability to grasp and understand the content. You could even try gamifying the process by bringing in simulation strategies to target different learning styles. The resources are there, and they’re evolving fast. The key is to invest the time now to ensure your team has the foundational knowledge and hands-on experience they need to be successful in an AI-driven security landscape.

from Help Net Security https://ift.tt/Eyf5RSA

If you’ve spent any time in penetration testing, chances are you’ve crossed paths with Metasploit. The second edition of Metasploit tries to bring the book in line with how pentesters are using the tool. It mostly succeeds, with some caveats depending on your experience level and what you’re hoping to get out of it.

About the authors

David Kennedy, founder of Binary Defense and TrustedSec, is a cybersecurity leader who advised on the series Mr. Robot. Mati Aharoni, OffSec founder, is a veteran penetration tester who has uncovered major security flaws. Devon Kearns co-founded the Exploit Database and Kali Linux. Jim O’Gorman heads the Kali Linux project at OffSec. Daniel G. Graham is a professor of computer science at the University of Virginia and a former program manager at Microsoft.

Inside the book

At its core, the book still functions as both a walkthrough and a reference. It starts by laying out the penetration testing methodology: preengagement, recon, scanning, exploitation, post-exploitation, and reporting. Then it maps each of those phases to how you might use Metasploit along the way. It gives the reader a way to think systematically, which is useful if you’re building or refining your own approach.

The early chapters walk through setting up a lab with Kali and Metasploitable, exploring the framework’s structure, and understanding how Metasploit’s components like modules, payloads, and listeners fit together.

One of the strongest sections is the middle of the book, where it digs into exploitation, post-exploitation with Meterpreter, and evasion techniques. The authors take time to show not just how to pop a shell but how to make it stick. Topics like privilege escalation, persistence, and lateral movement, give the reader plenty of room to dig deeper.

The writing is straightforward and practical. The examples are command-line heavy, which is what you’d expect. The book assumes you’re comfortable in a terminal and that you’re not afraid of a little scripting.

Another plus is that the book goes beyond just using Metasploit like a script kiddie. It walks through building your own modules and porting exploits into the framework. These chapters won’t turn you into an exploit developer overnight, but they’ll give you a foundation and appreciation of how Metasploit works under the hood.

The simulated pentest in Chapter 15 is also a nice touch. It pulls together pieces from earlier chapters and gives a realistic look at how everything might come together in the field.

Who is it for?

This book is best suited for penetration testers or IT professionals who want to sharpen their offensive skills using Metasploit specifically. If you’ve used Metasploit a bit but feel like you’re only scratching the surface, this book will help you go deeper.

If you’re already doing full-scope red team engagements and writing custom tooling regularly, you probably won’t learn a lot of new tricks here. But it might still be worth skimming for its structure and as a refresher.

Metasploit, 2nd Edition is a solid update to a book that’s been a staple in the infosec community. You won’t finish the book and become an expert. But you will have a strong foundation, and you’ll know what to practice next. For IT pros working in or around security, this book remains a worthwhile tool in the learning arsenal.

from Help Net Security https://ift.tt/U1A7Nod

In this Help Net Security video, Mick Leach, Field CISO at Abnormal AI, explores why security awareness training (SAT) is failing to reduce human error, the top cause of cybersecurity incidents. He discusses how AI can transform SAT into a smarter, more dynamic, and personalized defense layer. From just-in-time training and role-based content to automation and adaptive phishing coaches, Leach outlines a vision for next-gen security education that changes behavior and reduces risk.

The post Security awareness training isn’t stopping breaches. Can AI help? appeared first on Help Net Security.

from Help Net Security https://ift.tt/VIqdGEh

32% of security professionals think they can deliver zero-vulnerability software despite rising threats and compliance regulations, according to Lineaje. Meanwhile, 68% are more realistic, noting they feel uncertain about achieving this near impossible outcome.

Software compliance adoption varies across organizations

While Software Bill of Material (SBOM) regulations and guidelines continue to increase, organizations vary in their level of adoption. Notably, some organizations do not have enough visibility, while others struggle with insufficient tools and processes.

The urgency of this cannot be overstated, especially given that over 90% of modern codebases are built upon open-source dependencies, and 95% of software weaknesses are directly attributable to this code.

A substantial 34% reported difficulty in accurately identifying and tracking open-source components, revealing a critical blind spot where developers and security professionals remain unaware of the elements they are integrating into their software supply chains.

The recent easyjson open-source vulnerability, which has been traced back to Russian developers, is the latest incident emphasizing the significant risks inherent in its reliance on open-source components.

Despite the lack of visibility, the survey found that 48% of security professionals are falling behind global SBOM compliance regulations, including the U.S. Office of Management and Budget (OMB) Memo M-22-18, Executive Order 14028, and the EU Cyber Resilience Act.

Lack of compliance opens organizations up to significant fines, potential data breaches, and hurts security-minded customer prospects. 47% have not started SBOM integration or are presently evaluating tools and practices, despite legislation potentially opening their organizations up to legal and financial penalties.

Security teams lack tools to analyze SBOM vulnerabilities

In addition, 38% of respondents noted they prioritize the most vulnerable areas within their applications. While this may sound positive at first, this means they are leaving the supposedly less vulnerable areas within the software supply chain open to attack.

With advancements in AI, all vulnerabilities are now exploitable. For example, GPT4 can write exploits for 87% of known vulnerabilities. Without full visibility into all of the software supply chains’ dependencies, many organizations are likely underestimating risks.

Unfortunately, 29% of teams still lack the tools and processes needed to analyze SBOMs for vulnerabilities. Without the ability to correlate SBOM data with known weaknesses or automate risk prioritization, organizations face delayed threat times, widening the window of opportunity for attackers to exploit security weaknesses.

AI enhances software supply chain security visibility

88% of respondents reported that AI has the potential to critically or significantly enhance software supply chain security visibility. For example, we’ve seen a big uptick in organizations’ desire to use AI for auto-remediation. This readiness to adopt AI to secure code is driven by the adoption of AI by developers to create code.

When asked what the most pressing or high-stakes issues that AI is creating for organizations today are, the top two responses were data security and privacy risks (35%), and AI code generation and vibe coding risks (26%). This makes a lot of sense given practices like AI code generation and vibe coding significantly increase the software supply chain attack surface.

AI-powered auto-remediation is a great tool in combating this increased risk, however, it is limited to vulnerabilities for which fixes are available. 70% of respondents admitted that when a fix is not available for a vulnerability, they either don’t have or are not sure if they have a remediation plan in place.

“It is heartening to note that security professionals are more aware of security drivers around AI innovations, open-source risks, and increasing regulations,” said Javed Hasan, CEO at Lineaje. “However, driving safer digital infrastructure requires more action tied to this awareness. Organizations must leverage holistic solutions that can provide visibility into all code, and fix them at the velocity of digital transformations – so teams can innovate instead of playing catch-up.”

from Help Net Security https://ift.tt/nZMsEGA

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

Vulnerabilities found in NASA’s open source software
Vulnerabilities in open source software developed and used in-house by NASA could be exploited to breach their systems, claims Leon Juranić, security researcher and founder of cybersecurity startup ThreatLeap.

NIST proposes new metric to gauge exploited vulnerabilities
NIST has introduced a new way to estimate which software vulnerabilities have likely been exploited, and it’s calling on the cybersecurity community to help improve and validate the method.

What CISOs can learn from the frontlines of fintech cybersecurity
At Span Cyber Security Arena, Mirko Zorz, Director of Content at Help Net Security, sat down with Ria Shetty, Director, Cyber Security & Resilience for Europe at Mastercard. The conversation cut through the hype and focused on what CISOs deal with every day: how to embed security into innovation, manage supply chain risk, and prepare both systems and people for the threats ahead.

Attackers hit MSP, use its RMM software to deliver ransomware to clients
A threat actor wielding the DragonForce ransomware has compromised an unnamed managed service provider (MSP) and pushed the malware onto its client organizations via SimpleHelp, a legitimate remote monitoring and management (RMM) tool.

How AI agents reshape industrial automation and risk management
In this Help Net Security interview, Michael Metzler, Vice President Horizontal Management Cybersecurity for Digital Industries at Siemens, discusses the cybersecurity implications of deploying AI agents in industrial environments.

Microsoft, Dutch security agencies lift veil on Laundry Bear cyber espionage group
The Dutch intelligence and security services have identified a new Russia-affiliated threat group that has been breaching government organizations and commercial entities in Europe and North America, and they dubbed it Laundry Bear.

Why data provenance must anchor every CISO’s AI governance strategy
Provenance is more than a log. It’s the connective tissue of data governance. It answers fundamental questions: Where did this data originate? How was it transformed? Who touched it, and under what policy?

Microsoft unveils “centralized” software update tool for Windows
Microsoft is looking to streamline the software updating process for IT admins and users by providing a Windows-native update orchestration platform, and to help organizations upgrade their computer fleet to Windows 11 with the help of Windows Backup for Organizations.

How to threat hunt Living Off The Land binaries
In this Help Net Security video, Lee Archinal, Senior Threat Hunter at Intel 471, walks through practical strategies for detecting malicious activity involving Living Off The Land binaries (LOLBins).

Why app modernization can leave you less secure
Most modernization projects stop at the authentication layer, believing that identity transformation is complete once SAML or OIDC is wired up. What’s often overlooked is one of the most critical components of application security: session management.

Cyber threats are changing and here’s what you should watch for
In this Help Net Security video, Stefan Tanase, Cyber Intelligence Expert at CSIS, gives an overview of how cybercriminals are changing their tactics, including using legitimate tools to avoid detection and developing more advanced info-stealing malware.

Why privacy in blockchain must start with open source
With blockchains and decentralized applications (dApps), a new model of trust has emerged: one that doesn’t require trusting institutions but instead trusts the code itself. And this is only possible because of a founding principle: open source.

Review: Cybersecurity For Dummies, 3rd Edition
If you’re new to cybersecurity and looking for a book that doesn’t overwhelm you with jargon or dive too deep into technical territory, Cybersecurity For Dummies might be a solid starting point.

Why layoffs increase cybersecurity risks
A wave of layoffs has swept through the tech industry, leaving IT teams in a rush to revoke all access those employees may have had.

Woodpecker: Open-source red teaming for AI, Kubernetes, APIs
Woodpecker is an open-source tool that automates red teaming, making advanced security testing easier and more accessible.

4.5% of breaches now extend to fourth parties
Security teams can no longer afford to treat third-party security as a compliance checkbox, according to SecurityScorecard.

LlamaFirewall: Open-source framework to detect and mitigate AI centric security risks
LlamaFirewall is a system-level security framework for LLM-powered applications, built with a modular design to support layered, adaptive defense.

GitHub becomes go-to platform for malware delivery across Europe
Phishing has become the go-to method for attackers looking to get past security controls and access sensitive environments in Europe, according to Netskope.

AI forces security leaders to rethink hybrid cloud strategies
Hybrid cloud infrastructure is under mounting strain from the growing influence of AI, according to Gigamon.

How well do you know your remote IT worker?
Is the remote IT worker you recently hired really who he says he is? Fake IT workers are slipping into companies around the world, gaining access to sensitive data.

Cybersecurity jobs available right now: May 27, 2025
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

Hottest cybersecurity open-source tools of the month: May 2025
This month’s roundup features exceptional open-source cybersecurity tools that are gaining attention for strengthening security across various environments.

Infosec products of the month: May 2025
Here’s a look at the most interesting products from the past month, featuring releases from: Anchore, BalkanID, Cyble, groundcover, Hunted Labs, LogicGate, McAfee, Obsidian Security, Outpost24, PentestPad, ProcessUnity, Resecurity, Searchlight Cyber, SecuX, ServiceNow, ThreatMark, and Verosint.

from Help Net Security https://ift.tt/HpMucgW