News

SecurityWeek reports that Google’s analysis of indirect prompt injection attempts on public-web sites shows an upward trend in malicious activity, even though overall sophistication remains relatively low. The researchers identified two malicious classes:…

Itron, a US-based energy and water management solutions provider serving utilities and cities, said it detected unauthorized access to some of its systems on 13 April 2026, with operations continuing in all material respects. The firm noted in an SEC filing…

According to Google Threat Intelligence Group (GTIG), the threat actor UNC6692 has been observed bombarding victims with emails and impersonating IT support to persuade them to run malicious code, a technique that aimed to deliver the Snow malware family. In…

A race condition in the PackageKit cross-distro package management abstraction layer has been described as easily exploitable, allowing unprivileged users to install packages with root privileges. The flaw, tracked as CVE-2026-41651 with a CVSS of 8.1, is a…

According to Associated Press, US officials have announced a sweeping crackdown on Southeast Asian cyberscam operations, led by a Scam Center Strike Force and described as a “new theatre of war” by US officials. The action includes sanctions by the Treasury…

Fast16 is described by SentinelOne as a sabotage malware uncovered in 2005 that tampered with precision software and spread itself, predating Stuxnet by at least five years. The malware is written in Lua and targeted high-precision calculation software,…

Italy plans to extradite Xu Zewei to the United States over cyber-espionage charges, according to Bloomberg. The Chinese national—arrested in 2025 at Milan’s Malpensa Airport on a U.S. warrant—has been linked by Italian authorities to a China state-backed…

According to Malwarebytes Labs, the week of 20–26 April 2026 featured a slate of notable cybersecurity stories, including an entry about medical data from 500,000 UK Biobank volunteers being listed for sale on Alibaba (April 24, 2026). The roundup also…

Itron, a U.S.-based utility technology provider, disclosed a cyber incident involving unauthorised access to part of its internal IT systems detected on 13 April 2026, with the company activating its incident response plan and notifying law enforcement.…

The article discusses a widespread SMS and cryptocurrency fraud linked to a fake CAPTCHA IRSF scam, alongside 120 campaigns involving the Keitaro platform. It emphasizes the rise in social engineering tactics used to deceive individuals and collect sensitive…

CrowdStrike has fixed CVE-2026-40050 in its LogScale self-hosted product, a critical unauthenticated path traversal flaw that could let a remote attacker read arbitrary files from the server filesystem. According to CrowdStrike's advisory, the vulnerability…

GopherWhisper is a newly identified China-aligned APT group uncovered by ESET researchers, targeting Mongolian government institutions with a Go-based malware toolkit. The operations include loaders and backdoors written mainly in Go, used to deploy multiple…

The Security Affairs Malware Newsletter Round 94, written by Pierluigi Paganini and published on 26 April 2026, collects the best articles and research on malware from the international landscape. It presents a curated set of linked stories, including…

Trigona ransomware now uses a custom command-line tool to exfiltrate data faster and evade detection, replacing tools like Rclone and MegaSync, according to Symantec. The shift, observed in March 2026 incidents, gives attackers more control and helps them…

Security Affairs newsletter Round 574 by Pierluigi Paganini – INTERNATIONAL EDITION arrives with a slate of notable security stories for the week, dated 26 April 2026. The edition gathers items from across cyber security, including the report that U.S. CISA…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four flaws from Samsung, SimpleHelp and D-Link to its Known Exploited Vulnerabilities (KEV) catalog. The newly listed CVEs are CVE-2024-7399 for Samsung MagicINFO 9 Server (CVSS 8.8),…

Over 400,000 websites running the Breeze Cache WordPress plugin are at risk after hackers exploited a critical flaw tracked as CVE-2026-3844, which Wordfence researchers say has a CVSS score of 9.8. Attacks exploiting the vulnerability have already been…

SecurityWeek reports that the China-linked APT group GopherWhisper has been abusing legitimate services for command-and-control and data exfiltration, with ESET warning that the operation has been active since at least November 2023. The group is said to…

CISA said a U.S. federal civilian agency’s Cisco Firepower ASA device running ASA software was compromised in September 2025 by the FIRESTARTER backdoor, and that the malware persisted even after security patches were applied. The agency, together with the…

The npm threat landscape reached a critical inflection point in September 2025 with the Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious packages. Since then, Unit 42 has tracked an acceleration in…

TGR-STA-1030 remains an active threat, with ongoing activity tracked by Unit 42. Since February, widespread activity from this group has been observed across multiple countries. Most recently, their efforts appear to be heavily focused on regions within…

Monitoring Claude Code and Cowork at scale through OpenTelemetry and Elastic’s ingestion stack shows Elastic Security Labs’ hands-on approach to real-time observability for AI agents.

The Pack2TheRoot flaw, tracked as CVE-2026-41651, lets unprivileged local Linux users install or remove system packages without authorisation, potentially gaining full root access. It affects multiple Linux distributions in their default installations and…