News

Cybersecurity companies reported on new banking trojans targeting users globally. Three key malware types discussed include: 1. **Manic** - An Android trojan with banking and spyware capabilities, primarily targeting Ukrainian institutions but also affecting…

A critical vulnerability has been discovered in the NASA/JPL AIT-GUI, allowing unauthenticated command execution on spacecraft instruments. The flaw, with a CVSS score of 9.4, enables anyone to send arbitrary commands, run server-side scripts, and execute…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in the Zimbra Collaboration Suite (ZCS), identified as CVE-2026-73570, to its Known Exploited Vulnerabilities catalog. This flaw allows unauthenticated remote…

Cloudflare has introduced a new feature called **Bot Preference Sync** to help website owners manage their bot traffic preferences more efficiently. This feature automatically updates a site's robots.txt file to reflect the configured preferences for AI bot…

The article from Palo Alto Networks' Unit 42 discusses the increasing threats to the software development lifecycle (SDLC) supply chain, highlighting how attackers have shifted their focus from exploiting finished software to targeting the tools and code…

This article discusses the security risks associated with Time-Sensitive Networking (TSN) protocols in Operational Technology (OT) environments, highlighting vulnerabilities that could allow attackers to manipulate industrial processes. Key insights include:…

The article discusses the emergence of 14 Trojanized npm packages that install the RedC2 4.0 Linux backdoor, highlighting concerns about malware's increasing sophistication and the role of AI in command-and-control (C2) systems. It underscores the importance…

Researchers from UMass Amherst have demonstrated that expired Visa contactless credit cards can still make valid purchases by exploiting a vulnerability in Visa's EMV payment protocol. The study, presented at USENIX Security 2026, reveals that a…

The Open Worldwide Application Security Project (OWASP) has launched a new top 10 security list for AI skills, highlighting the risks associated with 'Malicious Skills' and 'Supply Chain Compromise' at the forefront. A recent incident demonstrated…

The page discusses a critical security vulnerability identified as CVE-2026-77806, which affects the SPIP content management system (CMS). This unauthenticated remote code execution (RCE) vulnerability has a CVSS score of 9.8, indicating its severity. It…

VMware disclosed four high severity vulnerabilities in Spring frameworks affecting Spring Data REST and Spring AI on August 20, 2026. These vulnerabilities include a JSON Patch Property Mutation allowing privilege escalation, a session exhaustion flaw…

A critical vulnerability (CVE-2026-75501) has been identified in the Calix GS7 XGS GS5239XG router, related to missing authentication in its UPnP service. This flaw allows remote attackers to access the router's critical functions without authentication,…

Troutman Pepper Locke (TPL), a prominent law firm with over 1,600 attorneys, has faced multiple data breaches attributed to the Silent Ransom Group (SRG). In April 2025, SRG conducted a physical intrusion leading to the compromise of TPL's data, though TPL…

Retired U.S. Army General Paul M. Nakasone has launched the Nakasone Group, a national security advisory firm focused on cybersecurity, geopolitical, and personal security risks. The firm aims to provide high-caliber security counsel to government leaders,…

The content discusses a critical security vulnerability (CVE-2026-19598) in the Pods WordPress plugin, which allows unauthenticated attackers to escalate privileges and gain complete control over affected sites. This flaw has a high CVSS score of 9.8 and…

The page discusses critical vulnerabilities detected in Apache CloudStack, particularly highlighting CVE-2026-50112, which allows for cross-tenant remote code execution on KVM hypervisor hosts. The recent releases, 4.20.3.1 and 4.22.1.1, address a total of…

The article discusses the vulnerabilities in Microsoft Defender's driver that can be exploited by attackers to remove security software during system boot. This raises significant concerns about endpoint security and threat detection protocols. It highlights…

The article discusses the rise of a new Android car malware that exploits built-in software updaters to engage in ad fraud and build proxy botnets. The malware spreads through legitimate update processes, compromising vehicle systems and potentially leading…

The SecurityWeek news roundup covers significant developments in cybersecurity, focusing on various vulnerabilities and incidents: 1. **CISA and Ray Vulnerability**: CISA alerts federal agencies about a critical code injection vulnerability in Ray-Project…

Researchers at Adversa AI revealed a new attack method called "Cryptographic Context Injection," which poses a significant threat to AI systems like xAI's Grok and Google’s Gemini. The technique involves delivering an encrypted payload to manipulate the AI…

The article discusses iAuthFlow V2, a sophisticated phishing toolkit offering persistent access to victims' accounts, even after password resets. Sold for $10,000, it operates by tricking victims into entering credentials on attacker-controlled pages, while…

The article discusses the potential security risk of using expired Visa credit cards, termed "Zombie Cards," which can still be used for purchases due to a flaw in contactless payment systems. Researchers from the University of Massachusetts Amherst…

IBM has released security patches for a series of vulnerabilities in IBM AIX and PowerVM VIOS, published on August 15, 2026. The patch addresses seven critical CVEs, including three command injection flaws and multiple memory-related bugs, all with CVSS…

The article by Darshan Tiwari emphasizes the urgent need for cybersecurity professionals to support local government agencies, particularly those with limited budgets. It recounts an instance where a local housing authority lost nearly a million dollars to…

A critical vulnerability has been identified in the uutils coreutils stdbuf tool, allowing local users on shared systems to execute arbitrary code due to its handling of the LD_PRELOAD environment variable. The stdbuf tool creates a world-writable library,…

OpenAI has introduced new security controls following a breach involving its AI models at Hugging Face. These changes are designed to enhance safeguards against potential cybersecurity risks associated with advanced AI capabilities. The measures include a…

The content outlines critical security vulnerabilities in the RDK-B WebUI, with five flaws disclosed by CERT/CC on August 19, 2026. The most severe vulnerability, CVE-2026-19505, allows unauthenticated remote attackers to bypass login and gain admin control…

Eddie received a call from a scammer posing as an American Express employee, claiming his identity was involved in a fraudulent firearm purchase. After being transferred through what seemed like legitimate NYPD officers, Eddie was convinced of their…

A recent supply chain attack linked to North Korean hackers impacted the Rust programming ecosystem, specifically targeting the official Rust package registry, crates.io. The attack exploited a compromised maintainer's account to embed backdoors in popular…

Cisco has released security patches addressing nine critical vulnerabilities discovered during internal testing, including six rated with a maximum CVSS score of 10.0. These vulnerabilities impact various products within Cisco's Crosswork and Secure Workload…

A critical vulnerability has been found in the isolated-vm library of Node.js, which allows for a type confusion that can lead to remote code execution (RCE) on host systems. This vulnerability stems from the ExternalCopy function that transfers data across…

A new variant of the Agent Tesla malware, identified as version 4, features enhanced evasion capabilities specifically designed to steal credentials without detection. This malware utilizes innovative obfuscation techniques, including embedding Unicode emoji…

The CareCloud data breach, one of the largest in healthcare this year, impacted over 3.75 million individuals. Unauthorized access occurred between March 10 and March 16, 2026, revealing sensitive data, including names, Social Security numbers, medical…

The article discusses the integration of Wazuh and artificial intelligence (AI) to enhance Security Operations Center (SOC) workflows. It highlights the benefits of using AI to automate and improve threat detection, incident response, and overall efficiency…

Google's Threat Intelligence Group has identified three Russian-linked cyber espionage clusters—UNC6293, UNC7005, and UNC5976—that target researchers, diplomats, and defense personnel. They exploit legitimate authentication tools through phishing and social…

Cisco has released patches for nine vulnerabilities affecting its Crosswork and Secure Workload platforms, with five of these vulnerabilities rated CVSS 10.0, indicating critical severity. The updates aim to enhance security against potential exploits that…