Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3800 articles
A weekly security roundup covers GitHub's confirmed theft of internal repositories via a poisoned VS Code extension, TeamPCP's malicious durabletask releases, DBIR findings, Mythos exploit research, and security product and industry developments.
Microsoft introduced Rampart, which continuously tests code for vulnerabilities including cross-prompt injection, and Clarity, which provides design-time security guidance. Microsoft says Rampart has also helped speed vulnerability investigation and retesting.
Quantum Bridge raised $8 million in Series A funding for its quantum-safe key distribution solution. Its platform combines the company’s DSKE protocol with post-quantum cryptography and quantum key distribution, and is designed to integrate with existing networks.
Researchers report that a fresh Mini Shai-Hulud campaign affected more than 320 npm packages and related GitHub Actions and a VS Code extension, using payloads to steal CI/CD secrets and credentials, establish persistence, and enable remote execution.
Ofcom plans to strengthen UK platform rules for detecting and removing non-consensual intimate images, including wider hash matching. Related legislation would ban nudification tools and require takedowns within two days.
Discord completed its rollout of default end-to-end encryption for voice and video calls using the DAVE protocol. Stage channels remain excluded, and the company says it has no plans to encrypt text chats.
Microsoft says it disrupted Fox Tempest’s malware-signing service, seized signspace[.]cloud, took related infrastructure offline, and revoked over 1,000 certificates used to make malware appear legitimate.
The company says its headquarters’ internal networks faced attempted logins and cyberattacks on May 20, 2026. It activated defenses, reported no information leaks or significant operational impact, and said it is reviewing and strengthening its systems.
StepSecurity summarizes a May 18–19, 2026 supply-chain attack wave involving a poisoned VS Code extension, hijacked GitHub Actions, a self-replicating npm worm and trojanized PyPI releases; it says GitHub confirmed exfiltration of about 3,800 internal repositories.
HUMAN researchers describe Trapdoor, an Android malvertising and ad-fraud operation involving 455 apps and 183 C2 domains. It reportedly generated 659 million daily bid requests; Google removed identified apps after disclosure.
The FBI says it received more than 13,400 complaints about cryptocurrency kiosk scams in 2025, with reported losses exceeding $388 million. It warned that scammers direct victims to deposit cash into attacker-controlled wallets.
A new Shai-Hulud wave published 639 malicious versions across 323 npm packages, mostly targeting @antv. The malware steals developer and CI/CD secrets, exfiltrates them via Session and GitHub, and can generate valid-looking Sigstore attestations.
Microsoft says a recent macOS security update is causing repeated, non-dismissible location prompts for some Teams users. It is working with Apple on a fix and advises affected users to reset Teams location permissions in macOS settings.
Microsoft’s Driver Quality Initiative aims to improve Windows 11 drivers by moving more third-party drivers out of kernel mode, strengthening partner checks, and cleaning up Windows Update’s driver catalog. Rollout timing remains unclear.
AI bills of materials (AI BOMs) are gaining support from regulators and security groups to document models, datasets, provenance and runtime dependencies. Adoption remains immature as AI supply-chain risks grow.
Microsoft says it seized Fox Tempest infrastructure and removed more than 1,000 accounts and subscriptions. The service sold code-signing certificates that helped malware appear trusted and supported ransomware and other cybercrime operations.
Microsoft says it disrupted Fox Tempest’s malware-signing service, revoked over 1,000 attributed certificates, seized core infrastructure, and removed fraudulent accounts. The service reportedly supported ransomware and other malware distribution.
Microsoft says January 2026 optional preview updates can cause Windows Update downloads to fail in restricted networks with error 0x80010002. Administrators can apply Known Issue Rollback policies while Microsoft works on a fix.
Wiz says its runtime sensor for Google Cloud Run is generally available, monitoring container activity for threats and enabling investigation, alert correlation, and automated responses.
Bitdefender reports increased threat-actor use of MSHTA to deliver malware, including Lumma, Amatera, ClipBanker and PurpleFox. The article describes social-engineering tactics and recommends user training and restricting legacy binaries.
B1ack’s Stash announced a free release of 4.6 million card records. SOCRadar says it validated some records; its analysis found expired and duplicate entries, while about 4.3 million appear new and likely usable.
Researchers report that VS Code extension rwl.angular-console 18.95.0 ran a credential-stealing payload; Nx says a few users were compromised. The maintainers urge upgrading to 18.100.0 or later and rotating exposed credentials.
OpenAI is rolling out ChatGPT financial-account connections via Plaid, with Intuit integration planned. Experts warn that account takeover could expose sensitive financial details and recommend stronger account and data controls.
GitHub is tightening bug-report requirements amid a rise in AI-assisted submissions. Cloudflare says Mythos reduces false positives, while curl maintainer Daniel Stenberg found its results only modestly better than earlier models.
