Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3800 articles
OpenSourceMalware’s episode discusses Lovable and Vercel incident response, a GitHub RCE, EDR false positives with AI coding agents, and Team PCP’s Mini Shai-Hulud campaign targeting developer tools and packages.
A joint U.S.-China operation raided at least nine Dubai scam centers, resulting in 276 arrests. U.S. prosecutors charged four alleged operators with fraud and money laundering after investigators traced pig-butchering schemes using Meta data and financial and crypto.
The House voted 235-191 to renew FISA Section 702 for three years, adding oversight provisions and a Federal Reserve digital-currency ban. The bill now goes to a Senate where its passage is uncertain; privacy advocates say reforms are inadequate.
A researcher found that Quick Page/Post Redirect versions 5.2.1 and 5.2.2 used a hidden updater linked to anadnet[.]com; a tampered 5.2.3 build added a backdoor. WordPress.org pulled the plugin pending review.
At a House hearing, lawmakers and industry witnesses debated whether data centers need a standalone critical-infrastructure designation, citing their growing importance, recent Iranian drone strikes and unclear federal coordination.
Ukrainian authorities arrested three suspects accused of stealing and selling over 610,000 Roblox accounts using infostealer malware disguised as a game enhancer. Police say the scheme earned about $225,000; the investigation continues.
Researchers attribute the PromptMink npm campaign to North Korean actor Famous Chollima; its layered dependencies are designed to steal credentials and crypto-wallet data. Related campaigns use fake job interviews, malicious packages and RATs to target developers.
Threat actor 0056113 is reportedly selling law-enforcement and government email accounts, forged legal documents, and a service for submitting fraudulent Emergency Data Requests that could expose user data.
Austrian and Albanian authorities arrested 10 suspects in a suspected crypto investment fraud operation that allegedly caused more than €50 million in losses. Investigators say the network used fake platforms, remote-access tools and call centers in Tirana.
Wiz recapped new capabilities for securing AI-driven development, including AI and IaC inventories, IDE guardrails for code and agent risks, remediation through coding agents, and CI/CD pipeline risk monitoring.
Forescout found 670 unauthenticated VNC servers offering direct access to ICS/OT panels, alongside widespread exposed RDP and VNC servers. The firm recommends secure remote-access solutions for sensitive systems.
Handala reportedly sent US troops in Bahrain WhatsApp messages threatening drone and missile attacks. The group also claimed it published personal information on 2,379 US Marines stationed in the Persian Gulf.
Kaseya announced an AI-powered IT management platform unifying operations, security and backup data, with automated ticket triage, threat containment and backup verification. Kaseya SIEM is generally available and correlates telemetry from 60+ sources.
Microchip announced the TS1800 root-of-trust controller and TS50x secure boot controllers, with hardware-accelerated post-quantum cryptography for functions including secure boot, firmware updates, attestation and signature verification.
Halcyon researchers say a feud between 0APT and KryBit exposed operational data and showed that 0APT’s initial list of 190+ victims was fabricated. They recommend monitoring for data staging, validating backups, and deploying anti-ransomware defenses.
Arctic Wolf reports that BlueNoroff is using fake Zoom meetings, stolen webcam footage and a fake SDK update prompt to target crypto executives, stealing credentials and from crypto wallets; one investigated victim was compromised in under five minutes.
NGA plans a three-to-five-year AI and workforce transformation, with agentic systems operating within secure boundaries. Officials cite validation, bias monitoring and accountability needs, while addressing employee concerns that automation could displace expertise or.
ZenoX attributes a new campaign targeting Minecraft players to LofyGang. A fake “Slinky” hack delivers LofyStealer, which reportedly steals browser data; the group is also offering a Slinky Cracked builder through a malware-as-a-service model.
Google’s Chrome 147 update fixes 30 security flaws, while Mozilla’s Firefox 150.0.1 fixes four. The updates address memory-safety bugs, including critical flaws; Firefox ESR releases also receive fixes.
Step Security says Dev Machine Guard now runs natively on Linux, extending its developer-machine inventory and scanning to Linux fleets. The release supports local reporting and enterprise visibility, policy enforcement, and alerting.
Federal CIO Greg Barbaccia says agencies have not deployed Anthropic’s Mythos; OMB is preparing a controlled rollout. He sees potential for faster vulnerability discovery but says lab results have not established its effectiveness on defended networks.
Delia Ramirez replaces Eric Swalwell as the top Democrat on the House cybersecurity subcommittee. She has criticized CISA cuts and DOGE data-security decisions; the panel is scheduled to hold a hearing on CISA’s role.
Microsoft will block TLS 1.0 and 1.1 for POP3 and IMAP4 connections to Exchange Online starting in July 2026. Legacy devices and applications must support TLS 1.2 or later to avoid connection failures.
A 19-year-old known as “Bouquet” was arrested in Finland and faces U.S. charges. Prosecutors allege he took part in four Scattered Spider breaches, including a 2025 retailer incident involving an $8 million demand and over $2 million in costs.
