Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3800 articles
Microsoft's Windows 10 KB5087544 update addresses May 2026 security vulnerabilities, fixes a Remote Desktop warning display issue, and improves Secure Boot reporting. Microsoft also warns of a BitLocker recovery-key prompt issue and offers a temporary workaround.
Signal added warnings, confirmations, and safety tips to help users spot phishing and fake support messages. The update follows attacks reportedly using QR codes or one-time codes to link devices to targeted accounts.
The ICO fined South Staffordshire Water Plc and South Staffordshire Plc £963,900 after confirming leaked data was authentic. Its investigation found a phishing-led breach and serious security failures.
Google is rolling out Intrusion Logging in Android Advanced Protection Mode to preserve records that may help investigate spyware and other suspected intrusions. Amnesty International praised the feature; it is currently limited to Android 16 Pixel devices.
Microsoft patched 137 vulnerabilities, none flagged as exploited in the wild; roughly a dozen were rated more likely to be exploited. Adobe also patched 52 vulnerabilities across 10 products, including critical code-execution flaws.
Google says Android 17 will add bank-app-assisted spoofed-call blocking, expanded Play Protect threat detection, biometric device-loss controls, and privacy features. Some protections will also reach older Android versions or select markets.
Exaforce raised $125 million in a Series B, bringing its total funding to $200 million. The company says it will use the funding to enhance its agentic SOC platform and expand in Japan and Europe.
More than 50 npm packages across several namespaces were compromised with malware that steals GitHub credentials and AWS secrets, then uses stolen credentials to publish malicious package versions.
Adobe patched 52 vulnerabilities across 10 products, including critical code-execution and privilege-escalation flaws in Adobe Connect. The company says it is unaware of any of the flaws being exploited in the wild.
French startup White Circle announced $11 million in seed funding for its AI control platform, which it says monitors model inputs and outputs for risks including prompt injection, data leakage, harmful content and model drift.
CIS, Astrix Security, and Cequence Security developed three AI security companion guides. The AI Agent guide addresses risks from tool use, memory and retrieval, multi-agent workflows, and runtime ownership.
Wiz Audit History tracks cloud resource changes, security findings, and vulnerabilities over time to support incident investigations, outage troubleshooting, and compliance reporting. Its Mika AI integration can summarize changes in natural language.
Apple issued security updates across its operating systems, addressing dozens of vulnerabilities. The article says the FBI reportedly exploited a flaw to recover deleted Signal chats; Apple has not flagged other flaws as exploited in the wild.
The FCC will allow vendors to provide software and firmware updates for foreign-made consumer routers already deployed in the US through at least January 2029. The ban on new models remains in place.
Darkowl reviews Handala’s attacks and tactics, including disruption at Stryker and a breach claim involving FBI Director Kash Patel. The Justice Department confirmed the group’s link to Iran’s MOIS and seized four associated domains.
A leak reportedly containing 8,200 lines of The Gentlemen’s internal chats reveals alleged use of compromised Fortinet credentials, ZeroPulse, defense evasion and backup targeting; researchers say the group patched its malware after a decryptor appeared.
OpenAI says Daybreak combines its models with Codex Security to model attack paths, test vulnerabilities in isolated environments, and suggest fixes. Major security companies are integrating the capabilities, amid concerns that AI is accelerating vulnerability discovery
California reached a $12.75 million settlement with GM over alleged collection and sale of drivers’ location and driving data without adequate notice or consent. Requirements include sales restrictions, data deletion, and stronger privacy controls.
StepSecurity introduced Secure Registry, an authenticated upstream registry that evaluates npm metadata and package downloads against install-time controls. Its available cooldown feature filters recent versions; compromised-package and typosquatting controls are in the
Huntress and Acrisure announced a cyber insurance and Tech E&O program for eligible customers using Huntress Managed EDR and ITDR, offering streamlined applications, preferential pricing and $0 deductibles on covered losses.
Researcher Kim Dvash released GhostLock, a proof of concept that uses Windows CreateFileW and SMB sharing behavior to block file access without encrypting or deleting data. The article also describes detection telemetry and recovery conditions.
The FCC extended to January 1, 2029, deadlines for proposed bans on updates to foreign-made routers and drones. The delay addresses concerns that blocking updates could prevent security patches; the proposal applies only to future imports.
Google says an unknown actor likely used an AI model to discover and weaponize a zero-day 2FA bypass in an unnamed admin tool. Its report also details PromptSpy’s Android surveillance and persistence capabilities and other threat actors’ AI abuse.
Frame Security emerged from stealth with $50 million in funding for its AI-powered cybersecurity awareness platform, which offers tailored phishing and deepfake simulations, employee risk scoring, training, and real-time suspicious-message triage.
