Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
At the RSA Conference, UK NCSC leaders warned that AI-generated code could replicate existing vulnerabilities and urged organizations to embed security principles, improve legacy systems, and consider safer frameworks and memory-safe languages.
A U.S. court sentenced Illya Angelov to 61 months for operating the Mario Kart botnet, which prosecutors said infected about 3,000 computers daily and sold backdoor access used by ransomware groups targeting 72 companies.
CISA and the FBI warn that actors linked to Russian Intelligence Services are using social engineering to take over commercial messaging app accounts. The agencies report thousands of compromised accounts and urge users to protect verification codes and scrutinize links
Researchers report HoneyMyte updated CoolClient in 2025 to deploy browser-login stealers and data-theft and reconnaissance scripts. DNS and WHOIS analysis refined its reported IoCs and found related domains and IPs; some flagged entities may be reclassified.
Unit 42 says it has tracked recruiter-impersonation phishing since August 2025, targeting senior professionals with personalized lures and fake ATS-compliance problems that pressure candidates to buy resume services. It advises verifying recruiters and never paying fees
LiteLLM versions 1.82.7 and 1.82.8 contained malware that harvested credentials, spread through Kubernetes clusters and installed a systemd backdoor. Researchers said the compromise likely involved Trivy CI/CD; both versions were removed from PyPI.
The UK NCSC warned that AI-assisted “vibe coding” could spread insecure software as organizations build more bespoke tools. It urged secure-by-default code generation, model-integrity checks, and automated code review and testing.
Flare's analysis of hundreds of posts in fraud-oriented online communities found recurring resale offers for premium AI accounts and API access. Suggested acquisition methods were not directly documented; the article recommends stronger account protections and activity
Firefox 149 adds a browser-only VPN with up to 50 GB of monthly traffic, blocks notifications from SafeBrowsing-flagged sites, and fixes 46 security vulnerabilities, more than half rated high severity.
The FCC added foreign-made consumer routers to its Covered List, restricting sales of new models in the U.S. Conditional exemptions and an approval pathway apply; existing routers remain available, while consumers may face fewer models and higher prices.
DOE’s CESER office published a 2026–2030 plan to develop security technologies, harden U.S. energy infrastructure, and improve emergency preparedness and recovery from natural disasters and cyberattacks.
Huntress says a phishing campaign using Railway infrastructure obtained Microsoft OAuth tokens valid for up to 90 days and affected hundreds of organizations. Huntress blocked Railway domains for 60,000 tenants; Railway says it banned linked accounts and domains.
Aleksey Volkov pleaded guilty to selling corporate network access to Yanluowang affiliates and was sentenced to 81 months in prison. Investigators linked him to about $1.5 million in ransom proceeds; he must pay more than $9.16 million in restitution.
Aleksei Volkov was sentenced to 81 months in U.S. prison after pleading guilty to selling unauthorized network access used in dozens of ransomware attacks. The article attributes over $9 million in actual losses and more than $24 million in intended losses to the cases.
Aleksei Volkov was sentenced to 81 months for facilitating ransomware attacks that caused over $9 million in actual losses. Separately, prosecutors charged BlackCat negotiator Angelo Martino and seized nearly $9.2 million in cryptocurrency.
CrowdStrike observed Tycoon2FA activity drop to about 25% of pre-disruption levels after 330 domains were seized, then return to early 2026 levels within days. The platform continues targeting Microsoft 365 and Gmail accounts.
NTT Security reports that WaterPlum uses malicious VS Code projects to auto-run tasks and deliver StoatWaffle, which includes browser-stealing and RAT modules. Microsoft added settings and prompts to reduce unintended task execution.
Huntress announced Managed ITDR for Google Workspace, which monitors suspicious logins and inbox rules. The company says its SOC stopped a stolen-credential attack involving suspicious infrastructure and alert-suppressing Gmail rules.
Darktrace announced updates combining adaptive security training, email defense, cross-channel message analysis for Slack, Teams and Zoom, and DMARC with attack-surface intelligence.
Varonis says its generally available Atlas platform inventories enterprise AI, assesses configurations and data exposure, tests live endpoints for prompt injection and jailbreaks, and provides runtime guardrails, monitoring, and compliance controls.
A U.S. court sentenced James Junior Aliyu to 90 months for his role in a business email compromise scheme that used spoofed payment instructions to redirect wire transfers. Prosecutors estimate the ring stole about $6 million since at least 2017.
The FBI and CISA warned that Russian actors are phishing users to take over Signal accounts, while an FBI alert linked Iran’s MOIS and Handala Hack to Telegram-connected malware used to monitor targets and exfiltrate files.
CrowdStrike says Falcon Next-Gen SIEM will support third-party EDR, beginning with Microsoft Defender, without requiring a Falcon sensor. The announcement also covers data pipelines, federated search, indicator management, and query translation.
A pre-RSAC 2026 roundup covers security vendors’ product launches, including AI-agent governance and runtime protection, prompt-injection defenses, AI-driven SOC and exposure remediation, identity security, and vulnerability-management integrations.
