Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
Seqrite Labs says APT28 exploited Zimbra’s stored XSS flaw CVE-2025-66376 in Operation GhostMail against Ukrainian government entities, harvesting email and account data. CISA added the flaw to its exploited-vulnerability catalog and ordered federal agencies to patch.
Two Handala websites display FBI seizure notices after the group’s Stryker attack, which reportedly wiped about 80,000 devices. Handala acknowledged the seizures; officials have not publicly announced the action, and access to site data is unknown.
Augur Security says Iranian-linked groups expanded infrastructure activity before the February 2026 US-Israeli strikes, while an estimated 60-plus hacktivist groups coordinated cyber activity afterward.
White House officials say the U.S. will not authorize private companies to conduct offensive cyberattacks, while pursuing more routine government cyber operations and greater industry cooperation to identify threats and support government-led responses.
ThreatFabric reports that Perseus Android malware, distributed through sideloaded IPTV apps, scans notes for sensitive information and abuses Accessibility Services for device control. It targets financial institutions and crypto apps, especially in Turkey and Italy.
CISA urged organizations to harden Microsoft Intune after an attack on Stryker reportedly wiped nearly 80,000 devices. Handala claimed it stole 50 terabytes of data; recommended safeguards include least privilege, MFA and multi-admin approval.
Cybersecurity startup Raven emerged from stealth with $20 million in funding. It says its platform monitors applications at runtime to detect and block anomalous behavior, exploits, malicious code, and risky AI-agent activity.
OFAC sanctioned six individuals and two entities tied to a DPRK IT-worker scheme that allegedly uses fraudulent identities to secure jobs, funnel revenue to North Korea, and sometimes steal data or extort employers.
Tulsi Gabbard defended omitting foreign election threats from the annual assessment. Lawmakers warned the risk persists and cited CISA cuts and vacancies; Gabbard said she observed an FBI search of a Georgia election office at the president’s request.
At his confirmation hearing, Markwayne Mullin declined to commit to restoring CISA’s workforce or budget after major cuts. Senators warned that reduced capacity could weaken cyber defenses amid U.S.-Iran tensions.
Lookout researchers attribute a watering-hole campaign targeting Ukrainians to UNC6353. DarkSword reportedly steals data from iPhones within minutes; Apple patched the exploited vulnerabilities in late 2025.
Rapid7 argues that faster vulnerability exploitation is shrinking defenders’ response window and recommends preemptive security. It reports ransomware leak posts rose 46.4% from 2024 to 2025 and urges basic security hygiene.
At Fal.Con Gov 2026, CrowdStrike announced GovCloud additions including Falcon Flex, XIoT protection, external attack surface management and behavioral malware analysis; Charlotte AI natural-language and Response Agent features are planned for later this year.
XBOW raised $120 million in a Series C round at a valuation above $1 billion. The company says its AI-powered platform autonomously tests applications for vulnerabilities and validates findings through exploitation.
CISA Acting Director Nick Andersen said the agency has seen no rise in Iranian cyber threats since U.S.-Israeli strikes began. CISA remains engaged with Stryker after a March 11 attack attributed to Handala and is reviewing CVE remediation timelines.
Native emerged from stealth with $42 million in funding for a platform that translates security policies into enforceable controls across AWS, Azure, Google Cloud and Oracle Cloud Infrastructure.
A weekly security roundup reports a demonstrated DNS-based escape from AWS Bedrock AgentCore, Google’s completed $32 billion Wiz acquisition, Interpol’s Operation Synergia results, and developments in AI security.
Tal Be’ery says a fourth WhatsApp View Once bypass uses a modified client; Meta says unofficial clients are outside the feature’s security model and bug bounty scope. Be’ery also proposed DRM, which Meta says is unsuitable.
Mesh Security says its CSMA platform links existing tools in a context graph to map multi-hop paths to sensitive assets, prioritize them with threat intelligence, coordinate fixes, and identify detection gaps.
CRIL reports escalating conflict-linked cyber activity across the Middle East, including campaigns by more than 70 hacktivist groups, infrastructure targeting, malicious crisis lures and reported connectivity and maritime disruptions.
Latvian and Ukrainian authorities announced the dismantling of a vishing network that used police and bank impersonation to trick victims into installing AnyDesk and surrendering banking access. Investigators estimate losses at about €2 million.
Researchers identified 433 components targeted by a renewed GlassWorm campaign. The malware uses compromised GitHub accounts, invisible Unicode obfuscation, and Solana-based C2 to deliver an information stealer; researchers also shared checks for possible compromise.
The Energy Department’s CESER office is preparing its first strategic plan to strengthen energy-sector cyber resilience, with a focus on private-sector partnerships, AI for cyber defense and timely information for operators. Release is expected soon.
World launched a beta that lets users link AI agents to World ID, an iris-based identity token. The company says sites could use it to limit Sybil-style bot activity, but adoption and biometric verification remain hurdles.
