Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
A weekly security roundup details Phorpiex’s hybrid P2P botnet, an ActiveMQ RCE chain, phishing and stealer campaigns, and AI-related prompt-injection risks, alongside vulnerabilities and exposed industrial systems.
Russia’s FSB says it detained an unnamed former Radio Free Europe freelancer on treason charges, alleging he shared information through an SBU-linked Telegram channel used to aid cyberattacks. The allegations are not independently confirmed.
The FCC is seeking comment on proposed stricter customer identity checks, longer record retention and per-call penalties for voice providers, aiming to curb illegal robocalls and help law enforcement.
A malicious Smart Slider 3 Pro v3.5.1.35 update distributed April 7 may have affected WordPress and Joomla sites, installing backdoors and stealing credentials. The vendor recommends restoring a pre-April 7 backup or updating to v3.5.1.36 and cleaning affected sites.
Treasury will provide eligible U.S. digital-asset firms and industry groups the same actionable cyber threat intelligence shared with traditional financial institutions, at no cost; eligibility criteria remain unspecified.
Forest Blizzard reportedly compromised SOHO routers to redirect DNS queries, affecting more than 200 organizations and 5,000 consumer devices. The campaign enabled monitoring and targeted AiTM attacks; Microsoft said its own systems were not compromised.
RSAC researchers report combining Neural Execs prompt injection with Unicode manipulation bypassed Apple Intelligence filters in 76% of 100 tests. RSAC says protections rolled out in iOS 26.4 and macOS 26.4; researchers have seen no malicious exploitation.
Google reports that UNC6783 targets BPO providers using phishing, live-chat impersonation and fake updates, with tools that can capture clipboard data and install remote access malware. Mandiant recommends FIDO2 keys and MFA-registration audits.
CloudSEK says 32 API keys embedded in 22 Android apps can access Gemini resources. Attackers who extract them could access files and cached data or exhaust API quotas; actual misuse or data exposure is not reported.
Wiz introduced an integration that maps Vercel projects, domains, teams, members, and firewall configurations into its Security Graph to surface exposure, misconfigurations, and potential attack paths.
GTIG warns that UNC6783 targets BPOs and corporate helpdesk staff with phishing, spoofed Okta and Zendesk pages, and a clipboard-stealing kit to bypass MFA. A possible link to Mr. Raccoon and his Adobe data-theft claim remains unconfirmed.
Microsoft suspended accounts used by WireGuard, VeraCrypt, MemTest86, and Windscribe, blocking Windows releases and security patches. Microsoft said the suspensions followed incomplete mandatory verification; media coverage prompted outreach to help reinstate accounts.
TikTok said it removed six covert influence networks, hundreds of impersonating accounts and thousands of videos ahead of Hungary’s election. Reports described fabricated political narratives and a separate alleged operation targeting the Tisza Party’s IT systems.
Handala said it would continue targeting Israel and may resume attacks on the U.S. U.S. agencies warned that Iran-supporting hackers had accessed internet-connected industrial controllers and urged organizations to update security precautions.
Google says UNC6783 targets BPO providers with social engineering and phishing to access high-value companies, steal data and extort victims. Its findings include spoofed Okta pages, clipboard theft to bypass MFA and fake updates delivering remote access malware.
Sansec reports a campaign targeting nearly 100 Magento stores with skimmers hidden in 1×1-pixel SVGs. The attackers reportedly use fake checkout forms to steal payment data; Adobe has not released a production fix for PolyShell.
Jamf researchers observed fake Apple-themed sites using applescript:// links to launch Script Editor with malicious code that downloads Atomic Stealer, which targets Keychain data, passwords, cookies, browser wallets and other system information.
A U.S. agency advisory reports Iranian-affiliated actors compromising internet-exposed Rockwell PLCs, manipulating HMI/SCADA displays and disrupting operations. It urges operators to remove PLCs from public internet exposure and secure remote access.
The FBI says Operation Masquerade disrupted the U.S. portion of an APT28-linked network of compromised routers by collecting evidence, resetting DNS settings and blocking renewed access. Authorities recommend updating or replacing vulnerable routers and checking DNS and
AttackIQ released an Adversarial Exposure Validation attack graph emulating Sinobi ransomware behaviors, including discovery, privilege escalation and AES-128/Curve25519 file encryption, to test security controls and response workflows.
Proofpoint reports that TA416 resumed targeting European government and diplomatic entities in mid-2025 and expanded into Middle Eastern government and diplomatic targets after the March 2026 Iran conflict, using evolving methods to deliver PlugX.
U.S. agencies warn that Iran-linked actors are targeting internet-exposed PLCs across critical infrastructure, with reported disruptions involving PLC project files and manipulated HMI/SCADA displays. They urge organizations to assess OT networks and apply advisory m
U.S. agencies report Iranian-affiliated actors have targeted internet-facing PLCs since at least March 2026, extracting project files and manipulating HMI/SCADA displays. Some organizations experienced operational disruption and financial loss.
Lumen and Microsoft linked APT28/Storm-2754 to FrostArmada, which compromised SOHO routers to redirect DNS traffic and steal credentials via attacker-in-the-middle attacks. Infrastructure was disrupted after activity peaked at 18,000 IPs across 120 countries.
