Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3800 articles
Google’s Threat Intelligence Group says an exploit for an unnamed open-source web administration tool’s 2FA was likely developed with AI. Google says it disrupted the attack before mass exploitation and cites code traits supporting its assessment.
The article argues CI/CD scanners can miss malicious dependencies and unknown vulnerabilities, and presents InvisiRisk’s build application firewall as a way to enforce build-time policies, inspect package behavior, and improve SBOM provenance.
Google says it found signs that AI was used to develop a zero-day affecting an unnamed open-source administration tool. The vendor patched it before a cybercrime group could begin mass exploitation.
Google says a cybercrime group likely used AI to develop a zero-day exploit targeting an unnamed open-source system administration tool’s 2FA. Google worked with the vendor to prevent mass exploitation.
German police announced the shutdown of the resurrected Crimenetwork marketplace and said a suspected administrator was arrested in Mallorca. Authorities seized assets and user and transaction data for analysis.
SOCRadar reports that the four-year Operation HookedWing campaign stole more than 2,000 credentials across over 500 organizations, using evolving infrastructure and personalized phishing pages that impersonated Microsoft Outlook.
Huntress says the EvilTokens phishing campaign affected 344 organizations across five countries, using AI-generated lures and Microsoft device-code authentication to capture valid session tokens. It recommends tighter access controls and phishing-resistant MFA.
A malvertising campaign uses Google Ads and malicious instructions in genuine Claude[.]ai shared chats to trick macOS users into running shell payloads. Reported variants include polymorphic delivery and a MacSync infostealer targeting browser and Keychain data.
A roundup of recent AI and privacy rules, investigations, and enforcement across Europe and North America, plus a WEF-KPMG report on AI adoption in cybersecurity.
German authorities shut down Crimenetwork’s relaunched marketplace and arrested its suspected operator in Mallorca. Investigators say the platform generated at least €3.6 million and seized assets and user and transaction data.
Rapid7 says its Terraform provider for Detection as Code is available across Incident Command and InsightIDR tiers, bringing version control, peer review, testing, rollback, and rule import to detection management.
Tom Parker is reportedly a contender to lead CISA, but says he has had no direct engagement with the administration. The article outlines his cybersecurity background, possible agency priorities and likely Senate confirmation hurdles.
Alan Bill was sentenced to more than 16 years for his role in operating Kingdom Market, a dark web marketplace selling drugs and cybercrime-related goods. German authorities seized its servers in a coordinated international takedown.
GM agreed to a $12.75 million California settlement over allegations it sold OnStar users’ driving data without consent. The deal requires a five-year sales pause, data deletion rules and stronger privacy controls; court approval is pending.
ESET says 28 CallPhantom Android apps on Google Play drew over 7.3 million downloads by promising call, SMS and WhatsApp histories, then charging users for fabricated data. The apps were removed; Group-IB separately reported fraud targeting Indonesians.
Chuck Schumer asked DHS for a plan by July 1 to coordinate with state, local, tribal and territorial governments on defending against AI-enabled cyber threats, citing concerns about CISA capacity and federal funding cuts.
The roundup covers a student detained over alleged rail-network interference, campaigns targeting drone-sector attendees and gaming-platform users, the marketed PamDOORa Linux backdoor, and guidance for removing Firestarter from Cisco firewalls.
Wiz’s public-preview Akamai integration ingests Edge DNS zones and account metadata into its Security Graph to identify and prioritize exposed services and edge misconfigurations alongside cloud, identity, and runtime risks.
Poland’s ABW reported 2025 ICS breaches at five water treatment stations. In some cases, attackers could alter equipment parameters; weak passwords and internet exposure were identified as primary attack vectors.
Computer scientist Alexander Hanff says Chrome downloads a hidden 4GB Gemini Nano model file and may redownload it after deletion. He raises privacy and environmental concerns; Google has not officially responded.
Two U.S. nationals received 18-month prison sentences for hosting laptop farms that let North Korean IT workers pose as U.S.-based employees, affecting nearly 70 companies and generating over $1.2 million for the regime, according to authorities.
OPM and NSF are steering the CyberCorps Scholarship for Service program toward AI skills for future cohorts. Current scholars raised concerns about communication and placements; the agencies said competencies are to be developed during study, not required at entry.
The ACSC warns that attackers are using compromised WordPress sites and fake verification prompts to trick Australian organizations into running PowerShell commands that deliver Vidar Stealer. It recommends restricting PowerShell, allow-listing applications, and patchin
Wiz and Lovable introduced an integration that runs Wiz CLI scans in Lovable’s workflow, surfacing vulnerabilities, secrets, and misconfigurations in Lovable’s security view and Wiz Code and Build scans.
