Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3802 articles
Microsoft says attackers abuse OAuth redirects to send government and public-sector targets to malicious pages, delivering malware or, in some campaigns, using EvilProxy to intercept credentials and session cookies.
Unit 42 reports escalating retaliatory cyber activity after U.S. and Israeli operations. It says Iran’s connectivity fell to 1–4%, while groups including Handala and Russian Legion made unverified claims of access to Israeli systems.
Singapore will require locally sold residential routers to meet CLS Level 2 by the end of 2027. The change follows a 2025 operation that found more than 2,700 compromised devices in Singapore, including residential routers.
Researchers used low-cost receivers to capture unencrypted tire pressure sensor transmissions and track vehicles. They warn the signals could reveal driving patterns and potentially enable targeted tracking or spoofed alerts.
Google is testing Merkle Tree Certificates with Cloudflare as an alternative to bulky post-quantum X.509 chains, with plans for a Chrome Quantum-resistant Root Store by Q3 2027.
Arctic Wolf says the SloppyLemming actor ran a year-long espionage campaign from January 2025 against government and critical-infrastructure targets in Pakistan, Bangladesh and Sri Lanka, using malicious PDFs, Excel implants and 112 Cloudflare domains.
Joint Chiefs Chairman Gen. Dan Caine said U.S. cyber and space operations disrupted Iranian communications and sensor networks to support Operation Epic Fury. The article also reports other cyber activity and concerns about retaliation.
Prophet Security describes two customer investigations by its AI SOC platform: a compromised AWS credential used for reconnaissance and a TOAD phishing email. The vendor says the investigations correlated telemetry across multiple sources and exposed their queries for,
Unit 42 reports an active SMS campaign distributing a malicious RedAlert Android app and increased hacktivist activity amid Iran’s internet connectivity falling to 1–4%. It also summarizes actor claims and recommends defensive measures.
Huntress describes Linux threats including cross-OS ransomware, WSL abuse, developer credential theft, and rapid exploitation. It reports an observed React2Shell attack that installed PeerBlight and attempted to deploy XMRig.
Microsoft researchers report a campaign using trojanized gaming utilities shared through browsers and chat platforms to deliver a RAT, establish persistence, and enable data theft and additional payload deployment.
Alex Rodrigo Valenzuela Monje, known as VAL4K, was extradited from Chile and arraigned in the U.S. He pleaded not guilty to charges tied to allegedly selling more than 26,000 payment card records through Telegram channels.
Ring ended its planned partnership with Flock after backlash over a lost-pet feature in its Super Bowl ad. The article also reports subscription cancellations and legal threats amid wider concerns about surveillance and access to camera footage.
CISA's updated analysis says RESURGE can remain dormant on compromised Ivanti Connect Secure devices, exploiting CVE-2025-0282 and using forged TLS certificates, ECC, SSH tunnels and traffic checks to conceal access. CISA urges mitigation and threat hunting.
Nick Andersen, CISA’s executive assistant director for cybersecurity, has been appointed acting director, replacing Madhu Gottumukkala, who is moving to a DHS role. Sean Plankey remains nominated to lead the agency.
AWS announced Security Hub Extended, bringing curated third-party security vendors into Security Hub for cross-domain findings correlation. AWS says the plan also offers consolidated billing; existing integrations remain available through its standard program.
The roundup covers vishing used to steal SaaS credentials, exploited SolarWinds and Dell flaws, the FBI’s RAMP forum seizure, ransomware evasion, Ivanti exploitation, a thwarted attack on Poland’s energy systems, and WinRAR-based espionage.
Team Cymru says it observed 21 IPs running CyberStrikeAI from January 20 to February 26, 2026, and NetFlow communications targeting Fortinet FortiGate devices. It provides the IPs; suspected Chinese state ties remain an assessment.
The NCSC says the direct cyber threat from Iran to the UK has not significantly changed, but warns of heightened indirect risk for organisations with Middle East operations or supply chains and urges proportionate precautions.
Truffle Security found 2,863 live public Google API keys, while Quokka identified over 35,000 in Android apps. Researchers say enabling the Generative Language API can give existing keys Gemini access; Google says it is blocking leaked keys. Exploitation is unknown.
The article surveys Indonesian cyber threats in 2026, including Android RATs, ClickFix and Coretax phishing, espionage, ransomware, DDoS and credential theft, and recommends stronger MFA, mobile and supply-chain security, and cross-sector coordination.
Shadowserver found more than 900 FreePBX instances still infected after attacks exploiting CVE-2025-64328 began in December 2025. Fortinet attributes EncystPHP deployments to INJ3CTOR3; FreePBX 17.0.3 and access controls are recommended.
The DOJ says it seized $61 million in Tether allegedly tied to pig-butchering scams, tracing funds to wallets used to launder victims’ proceeds. Tether says it has frozen about $4.2 billion in illicit assets, including nearly $250 million tied to scam networks since 202
The Pentagon designated Anthropic a supply chain risk after talks over military use of Claude broke down. Trump ordered federal agencies to phase out Anthropic technology, while Anthropic disputes the designation’s legal scope and OpenAI reports a separate DoD agreement
