Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
Google has enabled Drive’s ransomware detection by default for paid Workspace customers. It pauses desktop syncing when it detects ransomware-encrypted files, alerts users and admins, and offers file recovery; local files may still be encrypted.
Palo Alto Networks researchers described ways excessive Vertex AI service-agent permissions could expose project resources and enable backdoors. Google revised its documentation and recommends BYOSA for least-privilege execution.
Anthropic says a packaging error in Claude Code v2.1.88 exposed nearly 2,000 TypeScript files, but no customer data or credentials. The article also reports typosquats and warns some npm users may have received trojanized Axios; downgrade and rotate secrets.
Researchers attributed malicious axios npm releases to North Korean-linked UNC1069. The releases used a hijacked maintainer account to install a multi-stage RAT, but the full scope and downstream impact remain unclear.
Microsoft released KB5086672 for Windows 11 24H2 and 25H2 after installation errors led it to stop the KB5079391 preview rollout. Microsoft says the update includes March security protections and the installation fix.
A Russian-language forum listing attributed to bobby_killa offers alleged WordPress admin access to an unnamed Spanish REDSYS merchant handling about 1,150–1,200 card orders monthly. The listing is not confirmation that access was obtained.
TrendAI reviews the White House’s new National Cyber Strategy, which sets priorities including deterring adversaries, regulatory reform, federal network modernization, critical infrastructure protection, emerging technology leadership, and cyber workforce development.
Zscaler says attackers are using trojanized Claude Code repositories on GitHub to distribute Vidar and GhostSocks. The article also describes source code exposed in the public npm package and provides related malware indicators.
Proton launched Meet, a video conferencing service with client-side encryption for calls and chat using MLS. It supports up to 50 participants on the free plan and uses WebRTC, SFU relays, and SRP authentication.
Google is rolling out developer identity checks for apps distributed outside Play, with a September start in Brazil, Indonesia, Singapore and Thailand. Apple also revised rules for third-party wearables handling Forwarding Information.
U.S. prosecutors indicted Jonathan Spalletta over the alleged 2021 theft of more than $54 million from Uranium Finance. Authorities say he exploited smart-contract errors, laundered proceeds and that about $31 million in cryptocurrency was seized.
Compromised Axios npm releases added a malicious dependency whose postinstall script downloaded platform-specific RATs. Developers whose install workflows ran the affected versions are advised to treat build machines as compromised and rotate secrets.
CERT-UA says UAC-0255 impersonated the agency in phishing emails that delivered AgeWheeze, a remote administration tool. It reported few infections; CyberSerp’s claims of roughly 1 million targets and 200,000 compromised devices remain unconfirmed.
Leak Bazaar advertises a service to turn data stolen in ransomware attacks into searchable intelligence for sale or extortion. Experts warn of possible follow-on crimes, but say costs, trust barriers and uncertain returns may limit its use.
Censys raised $70 million, including $40 million in Series D equity and $30 million in debt financing, to support innovation and global expansion of its internet intelligence platform for security teams.
Jonathan Spalletta faces U.S. charges over alleged 2021 attacks that stole about $53.3 million from Uranium Finance. Authorities seized about $31 million in cryptocurrency and collectibles in 2025.
Wiz reports that TeamPCP used credentials stolen in its open-source supply-chain campaign to enumerate compromised AWS environments and exfiltrate source code, secrets and data from S3, Secrets Manager and databases.
Google researchers estimate that breaking the 256-bit elliptic-curve cryptography used by cryptocurrencies could require far fewer quantum resources than previously thought. The attack remains beyond current hardware.
Validin’s beta webhooks notify Enterprise users of YARA matches and new threat-profile indicators or references. Users can select payload fields, verify HMAC SHA256 signatures, test delivery, and integrate notifications with Slack.
At RSAC 2026, TrendAI researchers discussed proof-of-concept agentic AI cybercrime and security risks at interfaces in EV charging infrastructure, recommending NIST IR 8473 as a unifying framework for vendors.
A Russian military court sentenced 26 Flint24 members, including alleged leader Alexei “Flint” Stroganov, for organized-crime and stolen payment-card trafficking offenses. Investigators said the operation ran from 2014 to 2020 and sold dumps through about 90 stores.
macOS Tahoe 26.4 delays some pasted Terminal commands and warns users about potential risks, aiming to counter ClickFix attacks. Apple has not documented the feature, and user reports leave its detection behavior unclear.
Israeli startup Huskeys emerged from stealth with $8 million in seed funding for its edge security management platform, which coordinates policies and configurations across multi-cloud and multi-WAF environments.
Wiz says its Blue Agent is generally available to Wiz Defend customers, with cloud-context investigations, forensic and code analysis, and workflow automation for incident response.
