Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
Sysdig reports attackers exploiting Marimo CVE-2026-39987 to deploy an NKAbuse variant from Hugging Face Spaces. It recommends upgrading to Marimo 0.23.0 or blocking external access to /terminal/ws.
OpenAI is expanding its Trusted Access for Cyber program to thousands of verified defenders and hundreds of teams, offering GPT-5.4-Cyber with relaxed guardrails and binary reverse-engineering capabilities. Model performance data was not disclosed.
Abnormal researchers say ATHR automates telephone-oriented attack delivery with spoofed lures, AI or human voice operators, and credential harvesting. Advertised on underground forums, it targets services including Google, Microsoft and Coinbase.
BreachForums says a security audit led to WAF, CSP, anti-XSS and anomaly-detection upgrades. The forum also announced a VECT partnership and planned affiliate keys, Monero multisignature escrow, and dataset imports.
Wiz says its platform will detect AI-specific risks in code, validate whether they are exploitable at runtime, trace findings to their code roots, and route fixes through developers’ workflows.
Two U.S. nationals were sentenced for helping DPRK IT workers use stolen identities to get jobs at over 100 U.S. companies. Court documents cite more than $5 million in DPRK revenue and an estimated $3 million in company damages.
Microsoft is investigating KB5082063 installation failures on some Windows Server 2025 systems, including 0x800F0983 errors. Some affected servers may also enter BitLocker recovery; Microsoft says the configurations are typically enterprise-managed.
The European Commission says its open-source age-verification app is technically ready and will let users prove their age without revealing their identity. Several EU countries plan wallet integration as officials signal stricter platform enforcement.
The newsletter covers Anthropic’s and OpenAI’s gated security models, OX Security’s reported MCP STDIO command-execution flaws, and HackerOne’s pause on new Internet Bug Bounty submissions as AI-assisted findings outpace remediation.
A roundup reports active exploitation of nginx-ui CVE-2026-33032, the FBI–Indonesian police W3LL takedown, Storm infostealer and Android banking trojans targeting Indonesian users, Google’s developer-verification rollout, and an unverified Nova ransomware claim againstB
April’s patch releases cover many vendors. Adobe Acrobat Reader CVE-2026-34621 and Microsoft SharePoint CVE-2026-32201 are reported as actively exploited; other highlighted fixes address critical SAP and FortiSandbox flaws.
Cisco Talos says attackers have abused n8n cloud webhooks since October 2025 to host phishing pages, deliver modified Datto and ITarian RMM installers, and fingerprint email recipients. Webhook-linked email volume rose 686% in March 2026 versus January 2025.
NIST will prioritize NVD enrichment for CISA-listed exploited flaws and vulnerabilities in federal or critical products, move older backlog records to “Not Scheduled,” and rely on submitter severity scores as submissions outpace staff capacity.
South Korean police say a Kazakh man accused of leading a ransomware group was arrested in Almaty. The group reportedly encrypted servers at six Korean organizations, including hospitals, using weak or default credentials; outages occurred, but victims paid no ransom.
CERT-UA reported a March–April 2026 surge in UAC-0247 activity targeting Ukrainian hospitals, emergency services, municipalities and defense-linked users, using humanitarian-aid phishing, malware and credential theft.
Microsoft says it awarded $2.3 million after nearly 700 submissions to Zero Day Quest, where researchers identified more than 80 high-impact cloud and AI flaws. Testing was limited to authorized environments; findings will be shared through the CVE program.
Sweden’s civil defense minister said a pro-Russian group linked to Russian security and intelligence services targeted a western Swedish heating plant last year, but the attack failed. Sweden gave no further details.
webXray says 194 ad services ignored Global Privacy Control signals in a March audit of California web traffic, including Google, Microsoft and Meta. The companies dispute or qualify the findings; failures may violate the CCPA.
Israeli startup Capsule Security emerged from stealth with $7 million in seed funding. It says its platform monitors AI agents at runtime and can intervene to block anomalous activity, risky commands and data exposure.
Socket identified 108 malicious Chrome extensions with more than 20,000 installs, linked by shared command-and-control infrastructure. They reportedly steal Google and Telegram data, inject ads, or open attacker-selected URLs; Google had not immediately removed them.
OpenAI says it is expanding Trusted Access for Cyber and rolling out GPT 5.4 Cyber to vetted defenders. The program uses identity verification and phased access to provide defensive capabilities while managing dual-use risks.
Microsoft says April 2026 update KB5082063 can trigger a one-time BitLocker recovery prompt on some Windows Server 2025 devices with a specific PCR7 policy configuration. Administrators can remove the policy or apply a Known Issue Rollback.
April 2026 Windows updates add warnings before .rdp files connect, identify the publisher and remote address, and disable local resource redirection by default to reduce phishing-related credential and data theft.
StepSecurity added group and cooldown controls to centralized Dependabot configuration, allowing teams to batch updates and set PR cadence across supported ecosystems. The company says they complement its npm Package Cooldown check.
