News

Operation DragonReturn is a cyber espionage campaign targeting Indian taxpayers and finance professionals, discovered in May 2026 by Seqrite Lab. Attackers use phishing emails impersonating the Income Tax Department to deliver malware via a fake tax…

Huntress has identified a significant password spray attack targeting Microsoft 365 environments, specifically the Azure CLI, which occurred between June 12 and June 21. The campaign involved over 81 million login attempts, leading to the compromise of 78…

The article discusses the emerging threat of "Phantom Squatting," which involves the use of AI-generated, hallucinated domain names for phishing and malware attacks. Cybercriminals exploit the capabilities of AI to create misleading domains that appear…

Palo Alto Networks' Unit 42 reported finding five malicious skills on the ClawHub marketplace for OpenClaw, an AI agent. These skills evaded detection to deliver macOS infostealers and facilitate financial fraud between February and May 2026. The skills were…

On July 1, 2026, Anthropic announced the restoration of its AI model, Claude Fable 5, following the lifting of U.S. export controls related to jailbreak vulnerabilities. This move is significant in enhancing the capabilities of AI in critical infrastructure…

Google released Chrome 151, addressing 382 vulnerabilities, primarily discovered in-house, with 15 deemed critical and 67 high severity. The vulnerabilities include user-after-free and out-of-bounds issues, potentially allowing remote code execution. Most…

The article discusses a significant cybersecurity incident involving a password spray attack targeting Microsoft accounts via Azure CLI. In total, there were over 81 million attempts made on at least 78 accounts. The piece emphasizes the need for enhancing…

The article discusses the analysis of 3,000 live ClickFix payloads by a researcher, revealing the vulnerabilities of API-driven malware delivery. It highlights the increasing threat of such malware, providing essential insights into how it operates and…

Xavier Mertens has reported a phishing email targeting Metamask, a popular cryptocurrency wallet. The campaign utilizes pressure tactics to persuade users to disclose their secret security phrase by falsely claiming that their wallets are at risk. The…

Citrix has released patches for six vulnerabilities in its NetScaler products, addressing issues that could lead to unauthorized file reading and denial-of-service attacks. These vulnerabilities have been classified as significant risks, and users are urged…

The article discusses the introduction of a new feature called "Gmail Live," which utilizes AI to allow users to search their emails by voice. This feature debuted at the Google I/O 2026 developer conference and is currently in beta testing for select…

A recent discovery by a Reddit user revealed that Anthropic's Claude Code has a hidden surveillance system targeting Chinese users. This functionality, introduced in version 2.1.91, monitors user locations and proxies, with obfuscated code to avoid…

On June 29, 2026, the Apache Tomcat project disclosed seven vulnerabilities, with the most critical being CVE-2026-55957, which allows attackers to bypass authentication. This affects Tomcat versions 7 to 11. The flaws pose significant risks as Tomcat is…

Google released a significant security update for Chrome on June 30, 2026, patching 382 vulnerabilities, including 15 critical issues. The update affects all major operating systems: Windows, Mac, and Linux. Key vulnerabilities are primarily use-after-free…

The Incus team has released version 7.2.0 to patch six critical vulnerabilities (scoring 9.9 on the CVSS scale) that allow for file writes at the root level, potentially leading to command execution. These flaws, affecting all versions prior to v7.2.0,…

The ISC Stormcast for July 1st, 2026, is hosted by handler Xavier Mertens, with a threat level categorized as green. The page features links to previous diaries and classes taught by Dr. Johannes Ullrich at SANS. Additionally, resources related to cyber…

GeoVision disclosed 10 vulnerabilities affecting its GV-LPC2011 and GV-LPC2211 license plate cameras, all of which impact firmware V1.12 and earlier. These flaws are unauthenticated and can be exploited remotely, with four rated at 9.8 on the CVSS scale,…

The Fluentd project has patched four significant security vulnerabilities in version 1.19.3, with the most critical being CVE-2026-44024, which allows for remote code execution (RCE) with a severity score of 9.8. The other vulnerabilities include server-side…

The article discusses a threat identified by Unit 42 researchers called "phantom squatting," where large language models (LLMs) generate nonexistent web domains that adversaries then register to exploit. Key findings include: 1. **Phantom Squatting**: LLMs…

A China-linked cyber threat group, named CL-STA-1062, has shifted its focus from Taiwanese web-hosting attacks to targeting critical infrastructure in Southeast Asia, compromising at least ten organizations, including state-owned entities. They are using a…

The article discusses an active security exploit identified as CVE-2026-35025, which is a vulnerability in ProFTPD (version ≤ 1.3.9b and ≤ 1.3.10rc2). This flaw allows logged-in users to bypass access controls, specifically through the RNFR command, enabling…

Plone has patched three critical vulnerabilities across two add-on packages, with the most severe being a Remote Code Execution (RCE) flaw (CVE-2026-57149), scoring 9.9 on the CVSS scale. This vulnerability allows attackers to execute code within the Plone…

The article discusses the takedown of XSS.is, a prominent Russian-language cybercrime forum that facilitated ransomware activities. On July 22, 2025, French and Ukrainian police arrested an alleged administrator linked to the forum, which had over 50,000…

The article discusses a new cybersecurity threat called "agentjacking," where attackers exploit the inability of AI coding agents to distinguish between content and instructions. Researchers from Tenet Security demonstrated that by submitting a fake-error…

The article discusses a recent trend where attackers are hijacking exposed AI endpoints without needing special authentication, simply by knowing their location. Between March and May, multiple campaigns were recorded exploiting infrastructure related to…

The article warns readers about a prevalent scam involving fraudulent job offers from supposed Amazon recruiters. These texts promise high pay for minimal work, typically claiming $250-$500 per day for just 60-90 minutes of effort. A common tactic is to use…

This article discusses the vulnerabilities of AI browsers that can be exploited through a technique called "BioShocking." Researchers have demonstrated that these browsers can be tricked into disregarding safety guardrails by presenting them with false…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical authentication bypass vulnerability, tracked as CVE-2026-48558, to its Known Exploited Vulnerabilities catalog. This flaw affects SimpleHelp versions 5.5.15 and earlier, as…

The article discusses the perspective of John Paul Cunningham, CISO at Silverfort, on the evolving landscape of cybersecurity and career opportunities in the field. He emphasizes that while AI automates certain tasks, human oversight remains crucial,…

Microsoft is accelerating its quantum-safe security efforts due to advances in quantum technology, which suggest that quantum computers capable of breaking current cryptographic systems could arrive sooner than previously thought. Recognizing this urgency,…

The article discusses recent phishing campaigns targeting hospitality organizations in Europe and Asia, as observed by researchers from Microsoft and Trend Micro. Attackers use malicious zip files disguised as guest photos to install malware and gain…

Microsoft has issued a warning regarding potential security risks associated with polluted descriptions in its Managed Cloud Platform (MCP) tools. These contaminated descriptions have the potential to cause artificial intelligence agents to unintentionally…

The article discusses the RustDuck Botnet, which has been rebuilt using the Rust programming language. This new iteration targets routers and servers for launching Distributed Denial of Service (DDoS) attacks. The focus on Rust enhances the botnet's…

Adobe has addressed 11 vulnerabilities in ColdFusion, including six critical flaws with a CVSS score of 10.0, allowing for arbitrary code execution. The most urgent updates were released on June 30, 2026, following no known exploits in the wild. Key issues…

A critical alert regarding six vulnerabilities found in NetScaler ADC and Gateway has been issued. The highest CVSS rating of 8.8 is related to insufficient input validation leading to memory overread. No confirmed exploitation is reported; however, patches…

The June 2026 update from Microsoft Security introduces several advancements aimed at enhancing security across various environments. Key highlights include: 1) **Codename MDASH** - a new multi-model scanning system that identifies and helps remediate…

Nissan has reported a data breach affecting current and former employees, linked to a zero-day vulnerability in Oracle's PeopleSoft software. Sensitive information, including Social Security numbers and banking details, may have been exposed. The breach was…

The Microsoft blog post discusses the evolution of AI agents in enterprise environments, transitioning from content readers to action takers. It highlights an emerging attack pattern targeting Model Context Protocol (MCP) tools, particularly tool poisoning…