Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
About 50 former national security officials urged Congress to renew FISA Section 702 for 18 months before its April 20 expiration, warning that delays or unrelated policy disputes could jeopardize the surveillance authority.
U.S. agencies report Iran-affiliated actors targeting internet-facing PLCs, with disruptions and financial losses across critical infrastructure. The advisory highlights CVE-2021-22681 and urges organizations to remove OT from direct internet exposure and check logs.
U.S. agencies warn that Iranian-affiliated actors have targeted internet-exposed Rockwell/Allen-Bradley PLCs since March 2026, extracting project files and manipulating HMI/SCADA displays; reported impacts include financial losses and operational disruption.
Anthropic introduced Claude Mythos Preview for Project Glasswing, an effort to scan and secure critical and open-source software. Anthropic says the model found thousands of zero-days but will not be generally released.
UK startup Trent AI emerged from stealth with $13 million in seed funding to develop a platform that scans AI agents and autonomous systems, assesses risks, patches vulnerabilities, validates fixes, and evaluates security posture.
Authorities, Microsoft, and Lumen disrupted infrastructure for FrostArmada, an APT28-linked campaign that hijacked SOHO routers to redirect DNS traffic and steal Microsoft credentials and OAuth tokens.
Microsoft reports that Medusa operators, tracked as Storm-1175, rapidly exploit newly disclosed and zero-day vulnerabilities, then move to credential theft, data exfiltration and encryption. The group has reportedly hit more than 300 critical-infrastructure targets.
German authorities identified Daniil Maksimovich Shchukin as a suspected leader of GandCrab and REvil, attributing at least 130 attacks in Germany to the group between 2019 and 2021.
Germany’s BKA identified Russian national Daniil Maksimovich Shchukin as the alleged leader of GandCrab and REvil, linking him to 130 extortion attempts and more than $40 million in estimated damages.
The White House proposes cutting CISA’s FY2027 budget by $707 million to about $2 billion, eliminating some programs and offices. CISA reportedly lost about 1,000 staff members, but now plans to recruit more than 300 for critical roles.
The EU's temporary ePrivacy derogation for voluntary CSAM scanning expired April 3, 2026. Authorities warn reports to Europol and NCMEC may fall, while Google, Meta, Microsoft and Snap say they will continue detection.
Microsoft removed the SaRA command-line utility from supported Windows updates as of March 10 and advises IT admins to migrate to GetHelpCmd.exe. Microsoft says Get Help offers similar scripted diagnostics with enhanced security.
Sysdig's March 2026 briefing reviews rapid exploitation of Pac4j, Ingress-NGINX and Langflow flaws, a TeamPCP-attributed CI/CD supply-chain campaign, botnet takedowns and AI-related leaks, with guidance on runtime monitoring and AI asset inventory.
Cofense PDC reported a campaign impersonating government emergency alerts to drive QR-code scans. A fake human-verification page redirected users to a Microsoft-themed credential-harvesting page.
Fortinet reports that likely DPRK-linked actors use phishing-delivered LNK files and PowerShell to target South Korean organizations, exfiltrating host profiles to a GitHub repository and retrieving further modules for C2.
Check Point says a suspected Iran-linked actor conducted three password-spraying waves against Microsoft 365 tenants, affecting 300+ organizations in Israel and 25+ in the UAE. The article also reports a Pay2Key attack on a U.S. healthcare organization.
After the EU law permitting proactive CSAM scanning expired, Microsoft, Google, Meta and Snapchat said they would continue voluntarily. EU officials warn scanning may lack a legal basis, while supporters cite child-protection and law-enforcement concerns.
Microsoft says Medusa exploits vulnerabilities before public disclosure and can move from initial access to data exfiltration and ransomware deployment within 24 hours. The article cites attacks involving SmarterMail and GoAnywhere vulnerabilities.
Germany’s BKA identified Daniil Shchukin and Anatoly Kravchuk as alleged GandCrab and REvil leaders, linking them to at least 130 extortion cases. Authorities estimate over $40 million in damage and seek information on their whereabouts.
University of Toronto researchers say GPUBreach uses GDDR6 Rowhammer bit flips to corrupt GPU page tables, giving an unprivileged CUDA kernel GPU memory access that may be chained through NVIDIA driver bugs to CPU-side escalation, even with IOMMU enabled.
Bryan Fleming, founder of stalkerware maker pcTattletale, pleaded guilty to offenses involving devices that intercept communications and received a $5,000 fine, with no prison time beyond one day served.
Check Point Research reports a three-wave password-spraying campaign against Microsoft 365 tenants, primarily targeting municipalities in Israel and the UAE. It assesses the activity as moderately linked to Iranian interests and Gray Sandstorm.
Google DeepMind researchers identify six classes of web-based traps that can manipulate AI agents, including hidden instructions, memory poisoning and attacks on human overseers. Proposed defenses include model hardening, runtime protections and evaluation benchmarks.
SafeDep says 36 malicious npm packages across four accounts delivered payloads for credential theft, reverse shells and other attacks. The firm assesses the campaign targeted Strapi users and Guardarian; it advises affected users to rotate credentials.
