Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3800 articles
The episode discusses Lazarus Group’s use of Git hooks, the contested Antrea project compromise, Dirty Frag Linux privilege escalation, active cPanel exploitation, and why interpreted-language malware can evade sandboxes.
Wiz is challenging customers to eliminate critical code issues with available fixes, promoting AI coding guardrails, code visibility, agentic remediation, and workflows to help teams reach zero.
XBOW announced a $35 million extension to its Series C, bringing total funding above $270 million. The company says its AI platform autonomously tests applications for vulnerabilities and provides reproducible proof of findings.
A weekly roundup covers an AI agent deleting PocketOS production data, TRM Labs’ report of $577M in DPRK-linked crypto theft, critical cPanel and GitHub flaws, and new defensive logging and account-security offerings.
Rapid7 says an intrusion it investigated used Chaos ransomware as cover for suspected MuddyWater espionage, with Microsoft Teams social engineering, credential theft, MFA manipulation and remote-access tools. Attribution is moderate-confidence.
Gavril Sandu was extradited from Romania to the US to face bank fraud charges over an alleged 2009–2010 scheme involving hacked business VoIP systems, vishing, cloned payment cards and cash withdrawals.
CISA launched CI Fortify, urging U.S. critical infrastructure operators to prepare for prolonged isolation from external networks and strengthen recovery through system documentation, backups, restoration rehearsals and manual-operation plans.
Oracle will add monthly Critical Security Patch Updates alongside its quarterly releases, starting May 28. Oracle-managed cloud services will receive updates automatically; self-managed customers must apply them.
Elastic says Security v9.4 will add named, weighted watchlists for users, hosts, and services, feeding organizational context into entity risk scores. Lists can be managed manually or populated through integrations and APIs.
ESET attributed an Android BirdCall campaign to APT37, which hid the backdoor in Sqgame card-game updates distributed outside Google Play. The malware stole device data and recorded audio; researchers found seven versions and said the update package is no longer harmful
CISA’s CI Fortify initiative will assess critical infrastructure and help operators plan to maintain essential services for weeks to months while disconnected from IT and third-party connections, with isolation and recovery planning as key measures.
Kaspersky says trojanized, digitally signed DAEMON Tools installers infected thousands across 100+ countries since April 8; about a dozen high-value systems received second-stage payloads, including QUIC RAT. The campaign is ongoing.
Deniss Zolotarjovs was sentenced to 102 months after pleading guilty to money laundering and wire fraud. Prosecutors say he helped ransomware groups extort more than 53 companies, causing $56 million in losses.
A proposed FTC settlement would bar Kochava and its subsidiary from selling or sharing sensitive location data without explicit consent. It also requires consent and supplier programs, retention limits, and consumer access and withdrawal options; court approval is still
Cisco Talos attributes attacks on South American and southeastern European government entities to China-nexus APT UAT-8302, which deploys NetDraft, CloudSorcerer and VShell; initial access is suspected to involve web-application exploits.
Deniss Zolotarjovs was sentenced to 102 months for helping a ransomware organization pressure victims. Authorities say the crew extorted nearly $16 million in confirmed ransom payments and targeted more than 54 companies.
CISA officials say AI automation is helping security analysts triage threats faster and supporting customer response and data migration. They cite legacy workflows, data-platform gaps and the need for transparent AI governance as adoption challenges.
Kaspersky reports that DAEMON Tools installers were trojanized from April 8, 2026. The signed installers delivered malware, with a backdoor and QUIC RAT reaching a limited number of targets.
Google is increasing top rewards for difficult Android and Chrome exploits while reducing payouts for some flaws it says AI makes easier to find. It also narrowed submission priorities and reported $17.1 million in 2025 payouts.
A proposed FTC order would bar Kochava and subsidiary Collective Data Solutions from selling precise location data without affirmative consent. It also requires consent checks, sensitive-location safeguards, consumer controls, incident reporting, and data-deletion rules
Microsoft observed more than 35,000 phishing attempts targeting users at roughly 13,000 organizations. The campaign uses compliance-themed PDFs and CAPTCHA pages before AiTM phishing to capture authentication tokens and access accounts.
Wiz’s public-preview feature centralizes findings from bug bounty programs, external audits, internal tests, and AI assessments, then maps them to cloud resources to support prioritization, ownership, reporting, and remediation tracking.
Deniss Zolotarjovs was sentenced to 102 months for helping a Russia-based ransomware organization extort victims. DOJ documents describe his use of stolen sensitive data and estimate the group’s losses likely reached hundreds of millions of dollars.
ESET says APT37 delivered at least seven versions of its Android BirdCall backdoor through trojanized APKs on sqgame[.]net, targeting users in China’s Yanbian region and collecting messages, contacts, location, screenshots, audio, and files.
