News

The article discusses the essential capabilities to evaluate when assessing AI Security Operations Center (SOC) platforms in 2026. It emphasizes the importance of distinguishing leaders in the field from basic, bolt-on AI solutions. Key capabilities…

Threat actors are exploiting prompt injection attacks through malicious websites to trick AI agents into making payments to fraudulent cryptocurrency platforms. Zscaler identified two campaigns using indirect prompt injection: one promoting a payment scam…

The article discusses a cyber espionage incident involving suspected hackers linked to China who utilized a fake Indian tax filing utility to deploy a malware called DcRAT. The attack highlights the increasing use of deceptive tactics to infiltrate systems,…

runZero has identified seven significant vulnerabilities in FatFs, a filesystem library widely used in IoT and embedded devices. These flaws, affecting platforms like Espressif ESP-IDF and STMicroelectronics STM32Cube, can lead to memory corruption, crashes,…

The article discusses the rise of Device Code Phishing attacks that exploit the Microsoft Device Authorization Grant protocol. Key points include: 1. **Device Authorization Grant Steps**: It simplifies authentication for input-constrained devices, where…

The National Crime Agency (NCA) has launched a campaign to warn parents about the risks of oversharing images and videos of their children online. This warning follows a staggering 26,000% increase in AI-generated child sexual abuse imagery reported by the…

The Ousaban banking trojan targets banking customers in Spain and Portugal through a phishing campaign utilizing fake tax documents. It leverages geo-restriction techniques to ensure only users within the Iberian Peninsula are attacked. The malware delivery…

The article discusses the TrojPix attack, which targets air-gapped systems by exploiting video cable emissions to leak sensitive data. This cybersecurity threat is significant as it can bypass conventional network defenses meant to protect isolated systems.…

The SOCRadar Dark Web Team has reported several significant security threats identified on underground forums. Key points include: 1. An alleged zero-day privilege escalation exploit for a WordPress plugin is up for sale, potentially impacting over 10,000…

Cloud security firm Sysdig reports the emergence of JadePuffer, the first fully agentic ransomware campaign, driven entirely by a large language model (LLM). This campaign exploited a vulnerability in a Langflow instance to automate various attack stages,…

The article discusses a newly discovered Linux kernel vulnerability known as Bad Epoll (CVE-2026-46242). This flaw allows local attackers to gain full root access on Linux systems and Android devices by exploiting a use-after-free condition in the epoll…

The page discusses the launch of QuimaRAT, a new Malware-as-a-Service (MaaS) that is Java-based and compatible with Windows, Linux, and macOS. It's categorized under malware and endpoint security, highlighting its usability across multiple platforms, which…

### Summary of TAG-182 Threat Cluster **Threat Actor:** TAG-182, suspected to be linked to Iran. **Activity Type:** Cyber surveillance and distribution of MarkiRAT malware. **Targets:** Iranian citizens and dissidents globally. **Methodology:** Utilizes fake…

A recent security vulnerability in the Opera GX browser allows malicious websites to automatically install mods, potentially leading to data theft from users' visited pages. This issue highlights significant risks in web security, emphasizing the importance…

In March 2026, HiAnime, a major pirated anime streaming site, announced its closure amid speculations of copyright disputes and law enforcement pressure. Vietnamese police arrested seven individuals linked to HiAnime following a coordinated raid supported by…

The article "A Week in Security (June 29 – July 5)" from Malwarebytes Labs highlights key cybersecurity threats and news from that week. Key points include: 1. Multiple incidents of malware proliferation, including a verified ad spreading Mac malware and…

The article discusses the emergence of SkillCloak, a new technique that allows malicious AI agents to bypass static security scanners through self-extracting packing methods. It highlights the challenges posed by advanced AI capabilities in cybersecurity,…

The article discusses two significant vulnerabilities in PHP: CVE-2026-12184 and CVE-2026-14355. CVE-2026-12184, with a CVSS score of 8.2, is a remote DoS flaw that can crash PHP-FPM on TLS handshake failures. CVE-2026-14355, a lower severity issue (CVSS…

This article discusses three critical security vulnerabilities affecting IBM WebSphere Application Server (versions 9.0 and 8.5) identified as CVE-2026-11712, CVE-2026-11708, and CVE-2026-11595. Both CVE-2026-11712 and CVE-2026-11708 are cross-site scripting…

The weekly threat intelligence report highlights significant cyber vulnerabilities, detailing 1,939 new threats detected from June 29 to July 5, 2026. Critical vulnerabilities were identified by CISA, including a severe authentication bypass in SimpleHelp…

The FreeBSD Project has issued multiple security advisories detailing critical vulnerabilities in OpenZFS, libalias, TCP RACK, and POSIX shared memory. These flaws allow remote code execution and local privilege escalation, putting servers at serious risk.…

CVE-2026-26128 is a significant security vulnerability affecting multiple versions of Microsoft Windows 10, allowing domain users to escalate privileges to SYSTEM via Kerberos reflection attacks. Despite the high risk, no confirmed exploitations have been…

The OWASP ModSecurity team has patched two vulnerabilities in ModSecurity version 3.0.16, identified as CVE-2026-52747 and CVE-2026-52761, which allow attackers to bypass Web Application Firewall (WAF) rules. CVE-2026-52747 relates to a multipart parser…

Medtronic has notified 3.8 million individuals about a data breach linked to the ShinyHunters hacker group, which exposed personal and medical data. The breach, confirmed in April 2026, affects data such as names, contact details, birth dates, Social…

The Security Affairs Malware Newsletter Round 104, authored by Pierluigi Paganini, presents a collection of significant articles and research on malware threats globally. Key points include: 1. Advances in malware techniques including hijacked npm packages…

The latest Security Affairs newsletter (Round 584) by Pierluigi Paganini covers recent key cybersecurity events and reports. Notable highlights include a U.S. government agency paying $1M to the data extortion group Kairos, the FBI's warning about TeamPCP…

North Korean hackers have released 108 malicious software packages and extensions as part of the PolinRider campaign, targeting various cryptocurrency platforms. This highlights an increasing trend in cyber attacks utilizing advanced malware to exploit…

IBM security researchers identified six critical vulnerabilities in Langflow OSS, allowing unauthorized code execution, data theft, and service disruption. These vulnerabilities include CVE-2026-10134, which permits unauthenticated remote code execution,…

CISA issued an advisory on June 30, 2026, regarding five vulnerabilities in the DCMTK toolkit, which is vital for managing DICOM images in medical facilities. The most severe issue (CVE-2026-50003) allows attackers to exploit path traversal to write files,…

The article discusses unpatched vulnerabilities discovered in a widely used filesystem found in millions of embedded devices, highlighting critical risks to IoT security. The vulnerabilities were disclosed by researchers and can potentially allow…

The Citizen Lab reported that Stelios Kouloglou, a former Member of the European Parliament (MEP) involved in an investigation into the Pegasus spyware, was targeted by the spyware itself. His devices were infected multiple times while the PEGA Committee was…

A new vulnerability in the Linux kernel, dubbed 'Bad Epoll', allows unprivileged users to escalate privileges to root on both Linux and Android systems. This flaw presents a significant security risk and has drawn attention for its potential exploitation.…

The article discusses the emergence of a new malware framework called New Avalon, which integrates CrownX ransomware capabilities. As ransomware threats evolve, the framework represents a significant shift in the landscape of cybersecurity. The integration…

The article discusses the emergence of npm packages linked to North Korea that disguise themselves as Rollup polyfills to siphon off sensitive developer information. This highlights a significant threat within the software supply chain, emphasizing the…