News

Security analysts have detected a widespread banking fraud campaign by the threat group REF6045, targeting Mexican retail banks and fintechs. The operation involves deceptive web pages that utilize fake CAPTCHA challenges to trick victims into installing the…

A critical alert has been issued regarding vulnerabilities in WinFSP, specifically CVE-2026-3006 and CVE-2026-7162, which could allow local privilege escalation on Windows systems. CVE-2026-7162 has a CVSS score of 7.8, and CVE-2026-3006 has a score of 7.0.…

Microsoft has introduced a refined search experience for Windows 11 Insider Preview users aimed at enhancing speed, relevance, and usability. Key features include: 1. **Streamlined Dashboard**: Reduces visual clutter by removing trending queries and…

Telegram's t.me domain is currently in a serverHold status, rendering all contact and content links that utilize this domain unresolvable. This issue impacts user interactions and link-sharing on the platform. In response, Telegram has activated the fallback…

The article discusses a critical privacy issue with SpaceXAI's Grok Build, revealing that the tool has been uploading entire Git repositories, including sensitive code and credentials, to a Google Cloud storage without user consent. Following public…

The content provides information related to the Internet Storm Center (ISC) where Manuel Humberto Santander Pelaez is the handler on duty. The current threat level is indicated as 'green,' suggesting a low level of threat.

Netwrix has addressed two critical vulnerabilities in their Password Secure software through update version 26.6.100. The most severe vulnerability allows authenticated attackers to execute remote code, rated 9.9 on the CVSS scale. Both flaws arise from…

A critical vulnerability (CVE-2026-6875) has been identified in the ServiceNow AI Platform, with a CVSS score of 9.5. This flaw allows unauthenticated remote attackers to execute code if certain conditions are met, creating risks for sensitive workflow data…

A critical security vulnerability in the @better-auth/sso plugin, tracked as CVE-2026-53513, has been identified, scoring 9.6 on the CVSS scale. The flaw allows authenticated users to exploit server-side request forgery (SSRF) by accessing internal services…

The AI Security Report 2026 highlights a significant shift in the cyber security landscape where AI has transitioned from being an assistive technology to becoming an active operator in cyber attacks. Key findings include: 1) AI's role in executing live…

Microsoft's recent blog details ongoing threats from ShinyHunters targeting SaaS organizations, particularly through OAuth abuse aimed at applications like Salesforce. Key intrusion paths include: 1. **Voice Phishing**: Attackers impersonate IT personnel to…

The UK and EU have jointly imposed sanctions on 24 Russian individuals and entities linked to cyberattacks and disinformation campaigns. This marks a significant collaboration to tackle Russia's cyber operations, especially those orchestrated by the Federal…

The U.S. government warns that Russian state hackers are targeting home and small office routers to compromise them for malicious activities against sensitive sectors. Cybersecurity and Infrastructure Security Agency (CISA) indicates that these actors…

Lidl informed online shop customers in Germany, Belgium, and the Netherlands about a data breach involving personal data stolen from a third-party IT service provider. The compromised data includes names, phone numbers, emails, dates of birth, and customer…

The article discusses the emergence of 'Yellow Teams' in cybersecurity, which are engineering teams focused on developing both defensive strategies and offensive tools for artificial intelligence (AI) within security contexts. These teams are crucial in…

The article discusses the emergence of CrashStealer, a new macOS malware that utilizes a notarized dropper to bypass Gatekeeper checks, indicating that cybercriminals are increasingly developing sophisticated methods to evade security measures on Apple's…

Google and Microsoft removed the ModHeader browser extension, which had 1.6 million installations due to a dormant data collector found in the code. Concerns about web security are increasing as malicious entities may exploit vulnerabilities in popular…

Microsoft Entra ID is transitioning to make passkeys the default authentication method, effective September 1, 2026, as a measure against phishing and credential theft, common in today's AI-driven threat environment. This change aims to phase out SMS and…

The article discusses GigaWiper, a new modular malware that allows attackers to select different methods of destruction for targeted systems. It merges functionalities from various malware types, combining backdoor capabilities with destructive payloads like…

An open directory left misconfigured on a virtual server in Budapest has exposed sensitive tools and data of a phishing ecosystem involving three operators. The report by Lexfo details that an actor known as codemado is using Evilginx for attacks on…

Prompt injections are malicious commands embedded by attackers into content, exploiting AI platforms to turn them against users. Researchers from Tracebit have found that using a technique called 'context bombing' can effectively disrupt AI hacking efforts.…

The article provides a weekly recap of significant cybersecurity events, including threats from ShareFile, Citrix Bleed 2 ransomware, and the rise of AI-driven coding attacks. It emphasizes the evolving landscape of cyber threats and the urgent need for…

Two nation-state espionage campaigns linked to China and India have targeted a Pakistani police force, particularly the Balochistan Police, from February 2024 to April 2026. The attacks compromised sensitive assets like biometric records and criminal case…

A massive Vidar stealer campaign was uncovered in April 2026, distributing data theft and cryptocurrency mining tools primarily targeting consumers and small-to-medium businesses (SMBs) in the U.S. and EU. Attackers deploy oversized files and fake…

In the latest episode of the Lock and Code podcast, host David Ruiz discusses online safety for children with Anna Brading, an expert in cybersecurity and mother of three. The episode highlights the increasing legislative measures across various countries to…

Jesse McGraw, once a blackhat hacker known as GhostExodus, shares his journey from hacking for thrill-seeking to advocating for cybersecurity using open-source intelligence (OSINT). Growing up in a troubled environment, he found solace in hacking, believing…

The UNK_MassTraction, a suspected China-aligned espionage group, has been exploiting vulnerabilities in Roundcube webmail to infiltrate physics and engineering departments at select US and Canadian universities since May 2026. The attacks, which have…

Criminal IP has partnered with Torq to enhance threat intelligence for security operations. This integration allows Torq's AI SOC Platform to automatically enrich threat data, enabling faster and more efficient responses to security threats. Key features…

The article discusses a new cybersecurity threat called the MemGhost attack, which can implant persistent false memories in artificial intelligence (AI) agents through a single email. This technique poses significant risks for data integrity and presents…

Cisco Talos is monitoring UAT-7810, a suspected Chinese hacking group that has been expanding its LapDogs ORB network through malware targeting unpatched edge devices, particularly Ruckus and ASUS routers. The group employs a growing toolkit including new…

The Ghostcommit attack demonstrates how AI coding assistants can be exploited by embedding malicious instructions in image files. Researchers from the ASSET Research Group revealed that attackers can hide commands within a PNG file referenced in a software…

Hydro-Québec disclosed three critical vulnerabilities in its Le Circuit Electrique charging station backend, with the most severe, CVE-2026-20744, rated at a CVSS score of 9.8. This flaw allows for privilege escalation and poses risks of denial-of-service…

The article discusses the Forg365 PhaaS (Phishing as a Service) which targets Microsoft 365 users through device code theft and Account in the Middle (AitM) session attacks. It emphasizes the importance of cybersecurity as attackers increasingly leverage AI…

A novel OAuth Client ID spoofing technique is on the rise, targeting cloud environments, as revealed by Proofpoint's research. Attackers exploit Microsoft's Entra ID to spoof OAuth Client IDs to gain unauthorized access to accounts without registered IDs.…

The article introduces Precursor, a new client-side verification system by Cloudflare designed to enhance bot detection by continuously collecting behavioral signals as users interact with web applications. Precursor complements existing tools like…