Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3580 articles
CrowdStrike says China-backed Vapor Panda targeted more than 200 organizations in at least 14 countries, with about 70% confirmed compromised or showing moderate-confidence intrusion evidence. ARTEX and DeepSeek enabled faster, concurrent activity.
Operation Blackout coordinated law enforcement and industry partners against West African scam networks. The DOJ announced dozens of arrests, trafficking-victim rescues and the removal of more than 3.7 million fake social media accounts.
A malicious Claude Code extension was available on Cursor’s marketplace for about 11 hours, exposing up to 5,000 developers to malware that attempted to install persistent SSH access and collect system data. Cursor removed it and took the attacker’s server offline.
Ahmad Umar Agha was sentenced to 42 months in prison. Prosecutors said he took part in an Assad-regime-linked hacking operation targeting about 47 organizations, including the Associated Press, U.S. government bodies and businesses.
A cleared defense contractor pleaded guilty to aiding a scheme authorities say benefited North Korea, letting co-conspirators use his identity to seek remote jobs. Court records cite 88 applications and nine offers; one military-project placement was stopped before work
Apple says it notified users in 99 countries of mercenary spyware threats. It did not identify attackers or regions; researchers recommend Lockdown Mode and contacting Access Now. Industry standards talks are nearing their final rounds.
Eye Security found a legacy Time4Popcorn updater still running on over 2.5 million Windows machines and an estimated 300,000 Macs. Abandoned domains it queried could let a controller deliver executable code with high privileges.
ESET says FrostyNeighbor (UNC1151) used Chisel, UltraVNC, Cobalt Strike and a VBScript wiper via Group Policy against a Ukrainian manufacturing company tied to transportation, marking its first documented destructive attack by a Belarus-aligned actor in Europe.
Microsoft says the October 2026 KB5127936 preview update fixes Always On VPN failures triggered by September Windows 11 security updates. Admins can temporarily switch from automatic protocol selection to SSTP or IKEv2.
CERT-AGID found 382 of 22,371 IPA-listed URLs (1.7%) reporting potentially vulnerable PHP versions, down from 650. The decline does not confirm remediation; AgID also released scripts to check and update systems.
Microsoft says IDC named it a Leader in its 2026 enterprise endpoint-security assessment. The post highlights Defender’s automated attack containment, local-agent discovery, and preview runtime protection against malicious instructions.
Microsoft Threat Intelligence reports that North Korean actors use AI to scale targeting, social engineering, tool development, and operations. Microsoft assesses the activity remains human-directed and provides mitigation guidance and Defender detections.
Google says its unreleased Gemini 4 Carbon topped rival models on vulnerability-discovery, exploitation and patching benchmarks. The company is opening staged access to selected cyber defenders and reports additional coding and safety gains.
Cisco has open-sourced Project Quarry, a rule-based and ML-assisted system designed to detect suspicious sequences across AI-agent actions, including tool use and multi-turn conversations. It includes a runtime, scanner, SDK and rule-development plugin.
Socket researchers identified three malicious Firefox extensions impersonating Phantom, Jupiter and Bitget. The add-ons stole recovery phrases and private keys; all three listings were removed after the analysis.
Adobe, Veeam and Juniper patched more than three dozen vulnerabilities, including critical flaws that could enable code or command execution. The companies reported no known exploitation of the covered flaws.
Google says Gemini 4 Carbon scored 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench. Its limited rollout is for cyber defenders, while Google reports resistance to evaluated indirect prompt-injection attempts.
SOC Prime says LogTotal now automatically detects formats and maps fields for exports from Google SecOps, CrowdStrike, MDE, and Sentinel. The tool also sanitizes parsed events locally in the browser before upload.
Cisco Talos says UAT-11473 used CVE-2026-20127 to plant KeyDrift on SD-WAN controllers and steal keying material. Talos found infrastructure overlap with Volt Typhoon’s Silent Train network, but does not say the actors are the same.
GitHub previewed an npm package firewall for Enterprise Cloud that checks metadata and downloads against malware advisories and package-age policies, blocking packages that fail configured rules. Administrators can approve exceptions.
Hornetsecurity describes 365 Total Protection’s real-time Microsoft 365 threat alerts, configurable thresholds and integrations. It says Q4 2026 updates will add email-assessment explanations and a Control Panel AI assistant.
The episode covers a Brotli decoder flaw affecting vendored copies beyond Node, LiteLLM’s October malicious release tied to an unrevoked leaked admin key, MALFEX npm payloads, and DPRK fake-font extensions.
A SANS diary described a newly observed ClickFix campaign using a fake Cloudflare verification page on macOS and Windows. The malware could not be retrieved: one server returned 403, and another domain did not resolve.
At Fortune’s Cyber 60 event, cybersecurity founders said AI is widening attackers’ speed and scale advantage. Armadin’s Evan Peña claimed it can scan a Fortune 500 company’s 10,000+ external systems in hours; the event unveiled Fortune’s 2027 Cyber 60 list.
