News

Clover Health Investments has reported a data breach affecting customers' personal and health information due to a social engineering attack on July 4, which compromised the accounts of three non-managerial employees. The company responded promptly by…

Researchers at SOCRadar have uncovered a sophisticated social engineering campaign attributed to the North Korean hacking group Famous Chollima, targeting Web3 and cryptocurrency professionals. The campaign involves fraudulent job interviews and interactive…

The article discusses critical vulnerabilities in SonicWall SMA 1000 appliances exploited in a zero-day attack campaign leading to the deployment of KNUCKLEBALL malware. The two primary vulnerabilities, CVE-2026-15409 and CVE-2026-15410, allow attackers…

The article discusses the increasing exploitation of the WordPress vulnerability known as wp2shell, which has led to widespread scanning and attacks on WordPress sites. It emphasizes the urgency for website administrators to secure their platforms against…

Microsoft held a technical community exchange regarding the UEFI CA 2023 certificate update, attended by major hardware manufacturers. The transition from the expired UEFI CA 2011 certificate to the new one has raised concerns among enterprise IT…

OVH, a European cloud provider, executed an emergency patch to resolve a critical security flaw (CVE-2026-53359) in KVM virtualization, affecting tens of thousands of servers and around a million virtual machines within ten days. This flaw, a use-after-free…

Zimbra has announced critical patches for several vulnerabilities, including a command injection bug affecting its collaboration suite if specific services are enabled. The security update, Zimbra Collaboration Suite (ZCS) version 10.1.20, addresses…

The TuxBot v3 Evolution is a newly discovered IoT botnet framework, identified by Palo Alto Networks' Unit 42. It primarily targets IoT devices through methods such as Telnet brute-force attacks, leveraging over 1,400 credential pairs. The botnet is part of…

Nextcloud, an open-source cloud software, experienced a cyberattack on July 20th, resulting in a phishing redirect to a fraudulent site named Cloudbox. Initial investigations linked the breach to a potential WordPress vulnerability known as wp2shell, raising…

Anthropic has updated its Claude Team plan, reducing the minimum seat count from five to two, making it more accessible for small teams like startups and agencies. The pricing remains unchanged, but the new requirement allows for smaller groups to utilize…

The article discusses a new ransomware variant called ENCFORGE, which specifically targets AI model files during Langflow Remote Code Execution (RCE) attacks. It highlights the increasing threat posed by ransomware to AI software and emphasizes the need for…

The article discusses the activities of a Russian-speaking threat actor, known as "bandcampro", who utilized AI to manage a botnet. Researchers obtained 200 logs documenting the operation of an AI-powered command and control (C&C) botnet that targeted a…

The article discusses a critical vulnerability in the ServiceNow AI platform that allows for unauthenticated code execution. This flaw poses significant security risks, enabling attackers to exploit the system without proper authentication. The author…

The ClickLock Stealer is a new macOS malware identified by Group-IB, specifically targeting macOS users, especially those holding cryptocurrencies. This malware exploits social engineering rather than needing exploits or elevated privileges. It operates via…

The White House has launched the GOLD EAGLE initiative to streamline cybersecurity vulnerability coordination, involving key federal agencies such as the Treasury, DHS, and the Department of War. This program aims to expedite the identification and…

In June 2026, Arctic Wolf Labs identified multiple ransomware incidents linked to the Qilin ransomware, attributed to an exploitation of the CVE-2026-0257 vulnerability in Palo Alto Networks' GlobalProtect firewall. This authentication bypass allowed…

Artificial intelligence has accelerated the identification of vulnerabilities, leading to 440 new CVE advisories for the Linux kernel within 24 hours. This influx of advisories includes 431 on July 19 and 9 additional on July 20, with most vulnerabilities…

Recent complaints have emerged from owners of LG monitors about unwanted pop-up ads for McAfee installed via companion software that downloads automatically on Windows devices without user consent. This practice began in July 2025 and is a product of…

The content features a handler on duty, Johannes Ullrich, with the current threat level being reported as green. There is a mention of the ISC Stormcast for July 21, 2026. Additional resources and links are provided for further information on classes taught…

This article addresses critical vulnerabilities in WordPress identified as CVE-2026-60137 and CVE-2026-63030, responsible for unauthenticated remote code execution (RCE). The CVSS score for CVE-2026-63030 is notably high at 9.8, indicating a severe security…

The article discusses the recent exploitation of two critical vulnerabilities in WordPress, identified as CVE-2026-60137 and CVE-2026-63030, which allow unauthenticated remote code execution on millions of sites. Discovered using AI technology, these flaws…

Cloudflare Internal DNS, now generally available, provides authoritative and recursive DNS services for private networks. This solution aims to simplify DNS management by consolidating public and private DNS on a single platform, reducing operational…

Ivanti is leveraging large language models (LLMs) to improve the identification and remediation of software vulnerabilities, a move prompted by the effectiveness of these models in the cybersecurity domain. Daniel Spicer, Ivanti's Chief Security Officer,…

CISOs are experiencing increased job stress due to rapid AI adoption, with 26% considering leaving their positions. The complexity of managing AI governance and the heightened risk of personal liability related to cyber incidents are significant concerns.…

The article discusses a critical SQL injection vulnerability in WordPress, designated CVE-2026-63030, named 'wp2shell', which allows unauthenticated remote code execution. Detected initially by Searchlight Cyber, this vulnerability is unique as it is found…

The article discusses a phishing campaign known as "The TFF Trap," which employs advanced evasion tactics to deliver remote access Trojans (RATs) such as Agent Tesla and Remcos. Attackers impersonate reputable companies, using fileless techniques and…

A cybersecurity threat known as the FakeGit campaign has infected approximately 7,600 GitHub repositories, distributing SmartLoader malware. This malicious software utilizes sophisticated techniques to target software development environments, posing risks…

The article discusses the exposure of a server revealing an AI-driven phishing toolkit involved in a WebDAV malware campaign. The toolkit utilizes AI to enhance the effectiveness of phishing attacks, indicating a growing trend in cyber threats leveraging…

The U.S. Department of Justice has seized over 1,000 internet domains involved in illegal streaming of the World Cup 2026, as part of Operation Offsides. Collaborating with law enforcement in Latin America and Europe, numerous additional sites have been…

The article discusses the emergence of piracy scams for Christopher Nolan's movie **The Odyssey** within hours of its release. Scammers employed tactics like fake browser warnings and disguised malware as movie downloads. The two main scams involved…

A critical vulnerability in Gitea, CVE-2026-58443 (CVSS 9.6), allows public-only tokens to push commits to private repositories, breaching intended access restrictions. The flaw is present in all versions up to v1.26.4 and has been addressed in v1.27.0. No…

The article discusses the Cruciferra crypter, a service used by various cyber-criminal groups to cloak malware and evade detection. It details the advanced techniques utilized by Cruciferra, including process ghosting and kernel driver abuse, which help…

Neo, an American-Israeli cybersecurity startup, has secured $100 million in funding to launch a platform designed to control and secure AI software for enterprises. The funding comes from notable investors including Andreessen Horowitz and Bessemer Venture…

The article discusses the HollowGraph malware, which has the ability to conceal command and control (C2) infrastructure as well as stolen files within Microsoft 365 events dated for the year 2050. This method of obfuscation enhances its stealth capabilities,…

Abbott Laboratories is investigating two separate cyber incidents involving its Cancer Diagnostics business and the externally hosted LabCentral portal, denying any operational disruptions or data exposure. The hacker groups ShinyHunters and ShadowByt3$…

Recent vulnerabilities in SonicWall appliances, identified as CVE-2026-15409 and CVE-2026-15410, were exploited by threat actor UTA0533 prior to patch releases. These vulnerabilities allowed remote, unauthenticated attacks, compromising SMA1000 secure remote…