Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3802 articles
GTIG and iVerify report that Coruna contains 23 exploits across five chains targeting iOS 13–17.2.1. They describe its use against Ukrainian users and in later campaigns, and recommend updating to iOS 17.3 or newer.
ClearSky reports a suspected espionage campaign targeting Ukraine: phishing ZIPs deliver BadPaw, which installs the MeowMeow backdoor. Researchers attribute it with high confidence to a Russian state-aligned actor and low confidence to APT28; targets and success are unT
The FBI and partners dismantled Leakbase, seizing its database and infrastructure in a multi-country operation that resulted in 13 arrests. Officials say the forum traded stolen credentials and sensitive data; the scale of victim losses remains under investigation.
LastPass warns that phishing emails spoof its support team and use fake forwarded threads to lure users to credential-stealing pages. The company says its systems were not compromised and is working to take down the sites.
Microsoft's KB5075039 update fixes a Windows 10 Recovery Environment startup failure introduced by KB5068164. Installing it requires a WinRE partition of at least 256MB; Microsoft advises backing up data before resizing partitions.
Bitwarden announced Windows 11 sign-in with passkeys stored in its encrypted vault. The feature is available on all plans and requires Entra ID-joined devices, FIDO2 sign-in, and a registered Entra ID passkey.
A custom scanner reportedly found about 240,000 OpenClaw instances reachable on the public internet, most online. The article says console access requires an authentication token and advises against direct exposure and recommends configuration audits.
Europol, Microsoft and partners announced a joint effort disrupting Tycoon 2FA, a phishing-as-a-service platform. The operation seized 330 active domains; Microsoft attributed large-scale phishing activity and an estimated 96,000 victims to the service.
Zurich agreed to acquire Beazley for about $11 billion, expanding its cyberinsurance business. The deal awaits shareholder and regulatory approvals, with completion expected in the second half of 2026.
California's privacy agency fined PlayOn Sports $1.1 million, saying users—including high school students—had to accept ad tracking to access tickets and services. The settlement requires clearer disclosures, compliant opt-outs, risk assessments and minor-data privacy.
Arctic Wolf attributes a year-long campaign targeting government and critical infrastructure in Pakistan and Bangladesh to Sloppy Lemming, describing BurrowShell, two payload-delivery chains, and resilient infrastructure.
AttackIQ released an AEV attack graph emulating LokiLocker behaviors, including persistence, defense evasion, shadow-copy deletion, discovery and file encryption, to help teams test security controls. It draws on BlackBerry reporting and internal analysis.
Sophos CTU reports increased Iranian hacktivist activity after Feb. 28 U.S.-Israeli strikes. Handala and APTIran make unverified intrusion or disruption claims; BaqiyatLock is recruiting affiliates. CTU urges patching, phishing monitoring, reduced exposure and readiness
The article reports that U.S. and Israeli operations against Iran combined kinetic strikes with cyber and information operations, while actors and hacktivists conducted phishing, DDoS, defacements and other activity across the region.
Google's March 2026 Android update fixes 129 vulnerabilities and highlights CVE-2026-21385, a high-severity Qualcomm display-component flaw Qualcomm says may be under limited, targeted exploitation. Qualcomm says fixes were available to customers in January.
Nemesis 2.2 links Windows DPAPI keys and Chromium files to automate forward and retroactive decryption, including App-Bound Encryption data when the required key material is available. User credentials are not persistently stored.
Wiz says its commercial platform has been certified in Spain’s CPSTIC catalog, enabling public and private organizations to adopt it in alignment with the Spanish National Security Framework.
AWS said drone strikes directly hit two UAE data centers and damaged a Bahrain facility after a drone landed nearby, disrupting power and causing structural and water damage. Recovery was progressing, and AWS advised some customers to shift workloads.
Fig Security emerged from stealth with $38 million in seed and Series A funding. Its platform maps detection and response pipelines and alerts teams to potential disruptions caused by environmental changes.
DarkWebInformer reports that actor “lucy” is selling allegedly compromised EU police email accounts for $1,000 each, advertising their use to impersonate law enforcement and submit fraudulent emergency data requests to major platforms.
Team Cymru says CyberStrikeAI was observed on infrastructure linked to a campaign targeting more than 500 FortiGate devices. Researchers found 21 IPs running the platform and warn its automation may lower barriers to attacks on exposed edge devices.
Google plans identity checks and fees for Android developers distributing apps outside Play, citing security; enforcement starts in four countries in September. Critics warn of limits on sideloading, privacy and open-source apps.
Amazon says drone strikes physically damaged AWS facilities in the UAE and Bahrain, disrupting services in both regions. Repairs and software-based recovery are underway; the UK NCSC warned of increased Iranian cyberattack risk.
Google says CVE-2026-21385, a high-severity flaw in a Qualcomm Graphics component used by Android, may face limited, targeted exploitation. The March 2026 Android update includes 129 vulnerability fixes.
