News

The UK’s National Cyber Security Centre (NCSC) has fully backed passkeys, stating that it should now be consumers’ first choice of login. According to NCSC, this follows a year‑long shift as the agency observed progress across the passkey ecosystem and saw…

Vercel revealed on 23 April 2026 that it has identified an additional set of customer accounts compromised as part of its security incident, expanding its investigation to include extra compromise indicators and reviews of network requests and environment…

SecurityWeek reports that a recently disclosed privilege escalation vulnerability in Microsoft Defender has been exploited in the wild as a zero-day using publicly available PoC code, tracked as CVE-2026-33825 with a CVSS of 7.8. Patched on 14 April, the…

The National Cyber Security Centre (NCSC) in the UK advocates for the use of passkeys over traditional passwords for online authentication. Passkeys offer a more secure and user-friendly method for logging into online accounts, significantly enhancing…

DataBreaches[.]net reports that the hacktivist known as “Internet Yiff Machine” (IYM) said the P3 database from the BlueLeaks 2.0 incident has not been sold and will not be sold, having been taken off the market. The dataset comprises 8.3 million tips that…

On 22 April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑33825 to its Known Exploited Vulnerabilities (KEV) catalogue. The vulnerability affects Microsoft Defender and is officially named Microsoft Defender Insufficient…

Crypto scammers are targeting thousands of ships stranded near the Strait of Hormuz, with at least one vessel coming under gunfire after it reportedly paid for safe passage. The first warning of the scam was raised by the Greek maritime risk management…

According to StepSecurity Threat Intelligence, xinference versions 2.6.0, 2.6.1 and 2.6.2 on PyPI carried a two-stage credential-stealing payload injected directly into xinference/__init__.py, harvesting SSH keys, cloud credentials and environment variables…

The Gentlemen has rapidly risen to ransomware prominence as a ransomware-as-a-service outfit that first surfaced in mid-2025, proving itself with a high pace of operations and notable sophistication. According to Check Point Research, the gang has claimed…

Cybersecurity researchers warn of malicious images pushed to the official checkmarx/kics Docker Hub repository after an alert by Socket. According to Socket, unknown threat actors overwritten existing tags such as v2.1.20 and alpine and introduced a new…

Cybersecurity researchers have flagged a new self-propagating supply chain worm that compromises npm packages to harvest developer tokens and credentials, spreading via a postinstall hook that activates during installation. The campaign, tracked by Socket…

Outside FDA, Inside the Crosshairs: Cybersecurity Risks for General Wellness and Fitness Products notes that low‑risk general wellness devices fall outside active FDA device regulation, but still face regulatory scrutiny. The piece emphasises that the…

A new study from Cisco Talos, published on 21 April, reveals that a growing range of native macOS features are being repurposed by attackers to execute code, move laterally and evade detection on Apple systems. The research highlights how built‑in tools such…

The Harvester threat actor has been attributed a new Linux version of its GoGra backdoor deployed in attacks likely targeting entities in South Asia. According to The Symantec and Carbon Black Threat Hunter Team, the malware uses the legitimate Microsoft…

The UK National Cyber Security Centre (NCSC) has unveiled SilentGlass, a plug‑and‑play device designed to actively block anything unexpected or malicious between HDMI or display port connections and monitor screens, approved for use in high‑threat…

DPRK Fake Job Scams Self-Propagate in 'Contagious Interview' describes a worm-like infection vector that uses compromised developer projects to spread remote access Trojans and other malware through the software supply chain, with a compromised developer’s…

Following a disruption to Bluesky, Mastodon was targeted in a major DDoS attack on its flagship Mastodon[.]social server, causing a “major outage” before mitigations were rolled out and the site came back online. According to the Mastodon status page, the…

BlueLeaks 2.0 has reportedly exposed more than 93 GB of data comprising millions of anonymous crime tips, with DataBreaches[.]Net noting that the dataset includes tips from students and about people, including full names in some cases.

The UK government has announced a £90m injection into cybersecurity to strengthen the nation’s cyber resilience. According to the National Cyber Security Centre, CYBERUK conference on 22 April 2026 revealed the funding will help provide support to small and…

A surge in silent subject phishing campaigns targeting high-value users has been identified, with emails arriving without subject lines to lure recipients. According to Cyberproof’s findings on 21 April, the activity—also known as silent subject or null…

According to Associated Press, the head of the U.K.’s National Cyber Security Centre, Richard Horne, said the most serious cyberattacks in the U.K. are now carried out by hostile nations including Russia, Iran and China. He warned that the U.K. could be…

Published on 22 April 2026, How AI Changed Vishing: Case of PlugValley explains how AI-enabled vishing platforms have lowered the skill barrier by combining voice synthesis, caller ID spoofing, scripted call modes, voicemail detection, and real‑time…

A threat actor has used a new wiper malware in recent attacks against the energy and utilities sector, according to Kaspersky. The attack targeted an organisation in Venezuela and relied on two batch scripts to weaken defenses and disrupt operations before…

The NCSC has launched SilentGlass, a plug-and-play device designed to prevent malicious HDMI and Display Port connections, enhancing cybersecurity for video links on monitors. It is aimed at protecting sensitive data and is already deployed within government…

SBOMs were meant to strengthen software supply chain security, but the data have not translated into fewer attacks, with the article noting that five years after their introduction supply chain compromises are more frequent than ever. In March 2026 alone,…