Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
Socket reports that attackers altered Checkmarx KICS Docker image tags and that some VS Code extensions ran malicious code. The KICS binary could exfiltrate scan reports; the Docker repository was archived.
Google says Workspace Intelligence will use content across Workspace apps for AI suggestions and automation, with user permissions, admin controls, DLP, regional data residency, and optional client-side encryption. A disabled source may still be used if a user adds it.
French authorities arrested 20-year-old HexDex, whom prosecutors link to roughly 100 website breach reports. They also link the suspect to a Compas database breach that exposed personal information of about 243,000 education employees.
Kaspersky researchers report that Lotus Wiper, a destructive malware targeting Venezuela’s energy and utilities sector, erases data across physical drives. The affected organizations and actor are unknown; researchers found no confirmed link to the PDVSA incident.
The Supreme Court will hear Chatrie v. United States, a case challenging geofence warrants that collect location data across a time and area. The ruling could shape Fourth Amendment protections and courts’ use of the good-faith exception.
Socket and StepSecurity report CanisterSprawl, a worm that steals developer secrets and npm tokens to spread poisoned packages. The article also covers compromised xinference releases and the prt-scan campaign targeting GitHub Actions.
The Defense Department is drafting a cyber strategy expected this summer. Katie Sutton says it will align with the National Cyber Strategy and prioritize integrating cyber across warfare domains, gaining advantage below armed conflict, and reorganizing cyber forces.
The NCSC says the UK handles about four nationally significant cyber incidents weekly, most linked to nation-states. The government announced £90 million for cyber resilience and a pledge for major organizations as officials warned of AI-enabled cyber risks.
The MIVD assesses that China probably matches the U.S. in offensive cyber capabilities and says only a limited share of operations against Dutch interests is detected and mitigated. It links the threat to PLA restructuring and reports access to Dutch providers’ routers.
Researchers reported compromised Namastex Labs packages whose malware steals developer secrets and attempts to spread through npm and PyPI. Similarities to TeamPCP’s CanisterWorm were noted, but attribution remains unconfirmed.
NCSC chief Richard Horne said state-linked operations from Russia, Iran and China pose the UK’s most serious cyber threat. He cited about four nationally significant incidents weekly, amid European officials’ reports of Russian-linked infrastructure attacks.
Wiz announced expanded AI and cloud security coverage, a public-preview AI agent for finding and validating vulnerabilities, new AI-code visibility and guardrails, agentic remediation skills, and integrations for cloud-edge security.
Microsoft’s 2026 OneDrive and SharePoint updates add Copilot and search features alongside governance changes, including expiring internal sharing links, file-level archiving preview, and ownership-transfer tools that preserve permissions.
Tencent opened a 20,000-user international beta of QClaw for Windows and macOS. The company says its Claw Gateway processes data on-device and detects malicious instructions and skill-poisoning risks in real time.
LayerX researchers report that at least 12 TikTok downloader extensions affected over 130,000 Chrome and Edge users, collecting telemetry and using remote configuration to change behavior after installation.
Researchers found a Google Antigravity flaw that could enable sandbox escape and remote code execution; Google patched it in late February. Separately, a fake installer was found delivering scripts for stealer malware.
Oracle released 481 security patches across 28 product families in its April 2026 CPU. More than 300 address remotely exploitable flaws without authentication, and roughly three dozen fix critical-severity defects.
Angelo Martino pleaded guilty to helping BlackCat/ALPHV extort US companies by sharing confidential client negotiation and insurance information. Authorities seized about $10 million in assets; experts urged separating negotiation, payment, and response roles.
Angelo Martino pleaded guilty to conspiring with BlackCat/ALPHV affiliates while working as a DigitalMint ransomware negotiator, sharing clients’ confidential negotiating and insurance information. Prosecutors said the scheme helped extort $75.3 million.
CIS, Astrix Security, and Cequence Security developed three Companion Guides that apply CIS Controls to securing LLMs, AI agents, and Model Context Protocol environments.
Mozilla says Anthropic’s Mythos Preview helped identify 271 vulnerabilities in unreleased Firefox 150 source code, compared with 22 security-sensitive bugs found by Opus 4.6 in Firefox 148. Mozilla says AI could make vulnerability discovery more efficient.
Check Point says a SystemBC C2 server was linked to a botnet of more than 1,570 victims and reports a The Gentlemen affiliate deployed the proxy malware; the relationship between SystemBC and the ransomware operation remains unclear.
Thunderbird 150.0 adds search within OpenPGP and S/MIME encrypted messages, OpenPGP Unobtrusive Signatures, and PDF viewer improvements. The release also includes web-engine security patches and fixes a PDF viewer clickjacking and information disclosure issue.
Ofcom is investigating Telegram over alleged CSAM sharing and Chat Avenue and Teen Chat over grooming risks. Telegram denies the allegations; the chat sites say they have safety measures. Ofcom could order changes or impose fines if violations are found.
