Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
At a House hearing, former FBI cyber official Cynthia Kaiser proposed terrorism designations and clearer DOJ guidance on homicide charges for hospital ransomware attacks. FBI figures cited show healthcare incidents rose from 238 in 2024 to 460 in 2025.
Tyler Robert Buchanan, described as a key Scattered Spider figure, pleaded guilty to wire-fraud conspiracy and aggravated identity theft. U.S. authorities say phishing and SIM-swapping by him and co-conspirators stole over $8 million in cryptocurrency.
Angelo Martino pleaded guilty to helping BlackCat operators obtain confidential victim negotiation details and to collaborating on attacks against U.S. victims. Authorities seized about $10 million in assets; Martino faces up to 20 years in prison.
Ukraine’s SBU and police say they detained a suspected Zhytomyr bot-farm organizer and blocked nearly 20,000 fake profiles allegedly sold to Russian intelligence for propaganda, false mining claims and phishing. Investigators seized about 2,000 SIM cards.
The EU sanctioned Euromore and Pravfond over alleged Russian disinformation and hybrid influence operations targeting Europe and Ukraine, freezing their EU assets and barring EU citizens and companies from providing them funds or resources.
Acronis researchers attribute a campaign targeting Indian financial organizations and US and Korean policy circles to Mustang Panda. It uses spear-phishing and DLL sideloading to deliver a LotusLite variant, with intelligence collection believed to be the goal.
Ofcom is investigating Telegram over alleged CSAM sharing and probing Teen Chat, Chat Avenue, and X over child-safety concerns. Telegram denies the allegations; Ofcom can impose fines or seek court orders for serious non-compliance.
Former ransomware negotiator Angelo Martino pleaded guilty to helping BlackCat/ALPHV by sharing confidential information from five victim companies to aid ransom negotiations; DOJ says the group paid him. Authorities seized $10 million in assets.
CISA added eight actively exploited vulnerabilities to its KEV catalog on April 21, 2026, affecting products including PaperCut, TeamCity, Cisco Catalyst SD-WAN Manager and Zimbra. Federal remediation deadlines run from April to May.
Kaspersky says 26 FakeWallet phishing apps on Apple's App Store targeted crypto wallet recovery phrases and private keys. Apple has begun removing them; Kaspersky links the campaign to SparkKitty based on shared indicators.
Wiz announced Code plugins and skills that bring security scanning and Green Agent remediation guidance into AI-native IDEs and coding agents, including automated checks at file-save, pre-commit, and pre-push stages.
An analysis found 6,122 internet-exposed Perforce servers in 2025. Of 2,826 still active at their original IP addresses, 1,525 allowed unauthenticated source-code access. The exposed servers included sensitive data and credentials.
CISA added eight vulnerabilities to its KEV catalog. Cisco confirmed exploitation of two Catalyst SD-WAN Manager flaws; exploitation of a third is unconfirmed. US federal civilian agencies must remediate all eight by April 20, 2026.
OpenAI’s opt-in Chronicle preview for Codex captures screen activity to build contextual memories. The article describes its processing and deletion practices, pause controls, unencrypted local memory files, and potential prompt-injection exposure.
Former DigitalMint negotiator Angelo Martino pleaded guilty to helping BlackCat target U.S. companies, sharing victims’ negotiation positions and insurance limits. Prosecutors say the scheme contributed to multimillion-dollar ransom payments.
Wiz says its Security Graph now maps Apigee X and Hybrid gateways, proxies, endpoints, and authentication policies, connecting API exposure to cloud workloads, data stores, and network paths.
Atlassian plans to use Jira, Confluence and related cloud metadata and in-app content to train AI models from Aug. 17, 2026, affecting about 300,000 customers. Contribution defaults vary by tier; data may be retained for up to seven years.
DarkOwl highlights Q1 platform updates for darknet intelligence analysts, including vendor context, translations, and workflow improvements, alongside research on conflict-related cyber activity and summaries of notable data leaks.
University of Central Florida researchers say SecureRouter routes encrypted queries to models of different sizes, cutting inference time versus fixed-model approaches while keeping accuracy close to the large-model baseline on most tasks.
Tal Be’ery says WhatsApp Web silent pings can reveal users’ online habits, while per-device encryption fingerprints can expose their registered device types. Meta confirmed the findings and has made partial fixes.
Forescout identified 20 vulnerabilities in Lantronix and Silex serial-to-IP converters and found averages of 212 known open-source flaws and 2,255 kernel bugs per firmware image. Researchers also cited difficult patching and limited binary hardening.
Italy’s data protection authority fined Poste Italiane €6.6M and Postepay €5.8M over disproportionate app data collection, ordering the practices stopped and retention corrected. The article also covers a €31.8M Intesa Sanpaolo fine over repeated insider access.
Alexander Hanff reports that Claude Desktop installs a persistent native-messaging bridge that preauthorizes browser extensions. He warns it could expose authenticated sessions; the article says no official response has been issued.
The weekly roundup covers Vercel’s disclosed breach linked to Context.ai, malware and browser-extension campaigns, a DDoS-for-hire takedown, QEMU abuse, new Android RATs and security product news.
