Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3580 articles
Iru says its EDR Remote Shell lets administrators investigate detections, stop processes and retrieve forensic files from managed Macs, including devices under partial isolation. Complete isolation blocks shell access; Windows support is planned.
Healthcare AI adoption is expanding faster than security controls, raising concerns about sensitive data, vendor risk and clinical decisions. The article cites a reported breach affecting 238,083 people and offers five governance safeguards.
Symantec says High Speed Discovery uses a shared per-target index so worker nodes can identify changed files and avoid rescanning unchanged content across large repositories, while providing inspection and exclusion telemetry.
StepSecurity compares GitHub’s preview egress firewall for hosted Linux Actions runners with Harden-Runner, highlighting cross-platform coverage, behavioral and file monitoring, threat-intelligence blocking, and centralized visibility, with supply-chain incident cases.
Fortinet CEO Ken Xie said demand for AI security remains strong, driven by infrastructure expansion and threat concerns. The company also reported a seven-figure firewall deal with an AI developer expanding across five data centers.
U.S. authorities seized Virtualine’s primary domain over its alleged role in criminal activity. TRM Labs says the service drew substantial illicit-attributed crypto payments; the seizure disrupted access but did not establish a full shutdown.
Morphisec says it observed PHP2Shell post-exploitation activity on a customer’s Windows IIS/PHP-CGI server and blocked the payload with AMTD. The company says AMTD disrupted in-memory shellcode but does not patch the vulnerable PHP runtime.
U.S. and European authorities seized Virtualine’s primary domain and dozens of servers, taking hundreds of virtual servers offline. Authorities allege it enabled cybercrime; blockchain firms linked payments to ransomware and other illicit activity.
Project Lifeline 250 is a six-month initiative offering rural South Carolina hospitals free cybersecurity resources, including help with network defenses, operational backups and identifying high-risk medical devices.
GitGuardian reported 72,000 GhostAction commits across 23,000 public repositories. GitHub prevented workflow execution, but 1,792 accounts remained compromised; the researchers found no evidence the PolinRider-style local stealer ran.
Microsoft will retire its SMS and voice authentication for Entra ID workforce tenants starting February 1, 2027, and urges admins to migrate users to phishing-resistant methods such as passkeys to avoid sign-in disruptions.
Discord plans to make eligible messages from public Discoverable Servers accessible on Server Web Pages and searchable online from mid-December 2026. Admins and users can limit future sharing, but previously exposed messages cannot be retracted.
Aikido announced an external network pentesting service that uses AI agents to map and test public-facing assets from a domain. The company says findings are evidence-validated and the service includes remediation guidance, retests and production safeguards.
U.S. prosecutors charged six people over an alleged Madagascar-based scheme that used fake dating profiles and fraudulent NFT investment sites to drain cryptocurrency wallets. The FBI linked about 74 wallets to 800 victims and estimated losses of at least $516,695.
Black Lotus Labs says Volt Typhoon’s Silent Train operation rapidly rotates compromised routers, IoT devices and enterprise infrastructure. Researchers report notifying hundreds of victims and observing zero-day campaigns, but say the activity cannot be fully measured.
CQ Prime Research says a scanner impersonating 32 AI bots probed organizations for credential and configuration files from late September into late October. Nearly all requests were blocked or failed, and the researchers reported no successful credential theft.
Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to ransomware-related charges tied to Nefilim and Hive attacks. Authorities said the attacks targeted businesses and healthcare organizations in multiple countries.
Interpol says its two-month Operation Serengeti III led to nearly 1,500 arrests across 20 African countries and the US, recovered $105 million in stolen funds, and shut down nearly 11,000 malicious networks.
AWS launched Route 53 Resolved IP Validation for Network Firewall, which checks outbound destinations against Route 53 Resolver answers to enable domain-based controls for non-web traffic and block SNI spoofing without TLS inspection.
The FBI and international partners seized virtualine[.]net, Virtualine’s primary domain. DOJ says the host supported criminal operations and laundered direct Bitcoin payments; Chainalysis says its wallets connected to cybercrime infrastructure.
The FBI seized virtualine[.]net under Operation Omegaline, while Virtualine disputed allegations. Silent Push says bulletproof hosts can quickly shift to new ASNs and recommends monitoring hosting infrastructure, ASN changes and sanctions lists.
TrendAI analyzed three exposed environments linked to attacks using AI in different ways, including CyberStrikeAI’s 44-agent workflow. One separate intrusion reportedly stole records and credentials from a GIS server.
Censys says its Investigator API lets scripts, SOAR playbooks and AI agents expand submitted indicators into related infrastructure clusters and queries for blocklists, log hunts and monitoring, with CTI, triage and DFIR examples.
AWS announced completion of a Canadian Cloud High (PBHH) security assessment, effective September 18, 2026. The Canadian Centre for Cyber Security assessed 172 services and features available in AWS’s Canada Central and Canada West (Calgary) Regions.
