Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
Authorities in 21 countries seized 53 DDoS-for-hire domains, arrested four people and dismantled supporting infrastructure in Operation PowerOFF. Seized databases held records for more than 3 million alleged user accounts.
Two U.S. men were sentenced for helping place North Korean operatives in more than 100 U.S. companies. Officials said the scheme used stolen identities and shell companies, and operatives stole ITAR-controlled defense files.
The House and Senate voted for a 10-day Section 702 extension as lawmakers debate RISAA’s impact. Disputes include untracked FBI queries, possible expansion of covered providers and a FISC ruling on filtering systems.
Fortinet reports a Mirai variant, Nexcorium, exploiting CVE-2024-3721 in TBK DVRs. Unit 42 observed flawed scans for CVE-2023-33538 against end-of-life TP-Link routers; users are advised to replace unsupported devices and avoid default credentials.
Authorities in more than 20 countries coordinated a takedown of DDoS-for-hire platforms, reporting four arrests, over 50 domain seizures and about 75,000 identified users. U.S. officials also seized eight sites, including Vac Stresser and Mythical Stress.
NAKIVO says v11.2 adds automated real-time VM replication, vSphere 9 and Proxmox support, immutable and air-gapped backups, pre-recovery malware scanning, and OAuth 2.0 for email notifications.
White House chief of staff Susie Wiles plans to meet Anthropic CEO Dario Amodei about Mythos. The UK AI Security Institute called it a step up and said it can exploit weakly secured systems; Anthropic is limiting access and launched Project Glasswing.
CoChat says its platform gives organizations visibility into AI use and pauses agent actions it considers dangerous, such as exposing sensitive data or deleting files, until a user approves or rejects them.
The roundup covers Grinex’s reported loss of over $15 million in USDT, sentences in a North Korea-linked IT worker scheme, a TierOne exploit-writing contest, and Rockstar’s confirmation of unauthorized access alongside ShinyHunters’ extortion claim.
Wiz introduced IaC Inventory to connect infrastructure modules, deployments, and live cloud resources, and added Pulumi scanning across AWS, GCP, and Azure to identify misconfigurations before deployment.
The roundup covers a satellite cybersecurity bill, a W3LL phishing-kit takedown, GlassWorm, AWS and ShowDoc flaws, ShinyHunters claims and leaks, a school-network breach, EPA cyber funding, and Chrome 147 fixes.
Kamerin Stokes was sentenced to 30 months in prison for his role in a 2022 credential-stuffing scheme that accessed about 60,000 DraftKings accounts; he also faces forfeiture and restitution.
Kuwait’s banking sector has deployed a virtual war room to coordinate real-time fraud detection and response. Officials say it links banks with government bodies to halt suspicious transactions, trace funds and monitor scam patterns.
Operation PowerOFF seized 53 domains, made four arrests and sent warnings to more than 75,000 suspected DDoS-for-hire users. U.S. investigators also seized infrastructure linked to Vac Stresser and Mythical Stress.
Kamerin Stokes was sentenced to 30 months for reselling access to hijacked DraftKings accounts. Prosecutors linked the accounts to a November 2022 credential-stuffing campaign that compromised nearly 68,000 accounts.
Microsoft says April 2026 update KB5082063 can cause LSASS crashes and reboot loops on some Windows domain controllers using Privileged Access Management. Administrators should contact Microsoft Support for mitigation.
A joint advisory attributes an ongoing campaign targeting logistics and technology firms supporting Ukraine to GRU Unit 26165 (APT28). It reports spearphishing, exploitation, malware and IP-camera targeting, and recommends MFA, patching and monitoring.
Google says Gemini ad-safety systems blocked over 8.3 billion ads and suspended nearly 25 million advertiser accounts in 2025. It reports using behavioral signals and submission-time review; its claim of blocking over 99% of policy-violating ads before serving is not
Europol says authorities in 21 countries took down 53 DDoS-for-hire domains, arrested four people, executed 25 search warrants, and sent 75,000 warnings to users. The operation also exposed over 3 million criminal user accounts.
Two New Jersey men received prison sentences for helping North Korean IT workers obtain jobs at over 100 U.S. companies using stolen identities and laptop farms. The DOJ said workers stole ITAR-controlled source code from a defense contractor.
StepSecurity says Dev Machine Guard now inventories extensions and plugins across multiple IDE families on macOS, Windows and Linux, with per-item metadata, supply-chain risk scoring, and detection of known compromised and typosquat extensions.
Huntress says its Managed EDR Attack Disruption Engine repeatedly killed an Akira encryptor targeting a fire department’s network shares, preventing file encryption. The company says the engine runs locally and sends accelerated alerts to its SOC.
Operation PowerOFF, supported by Europol and authorities in 21 countries, warned more than 75,000 DDoS-for-hire users, arrested four people, took 53 domains offline, and launched prevention measures.
Two U.S. nationals were sentenced to 108 and 92 months for helping overseas IT workers obtain jobs at more than 100 U.S. companies using stolen identities and laptop farms. Authorities say the scheme generated over $5 million; some workers accessed sensitive, ITAR-rele
