Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3588 articles
A Canada-based cybersecurity expert was arrested in the US on suspicion of involvement in ShinyHunters attacks, including an intrusion targeting FBI systems. He faces conspiracy and extortion-related charges.
SOCRadar reports dark-web posts claiming to offer data linked to Angi, The Tour Guy, healthcare leads and KPN, plus resurfaced CafeMom credentials. The claims are largely unverified; the CafeMom data is from a 2014 breach.
Let’s Encrypt will issue 64-day certificates by default starting February 10, 2027, ahead of planned 45-day certificates in 2028. It is testing the change and advises customers to check renewal automation.
A Malwarebytes weekly roundup covers an ASOS customer-data breach update, phishing and credential-stuffing attacks, Android and Chrome security updates, an arrest linked to ShinyHunters, and other security and privacy developments.
Aikido Security says it has earned CREST accreditation for human-led penetration testing. CREST assesses the provider’s testing methodology, client-data protection, quality assurance and staff qualifications.
Huntress explains that CMMC Level 2 self-assessments require at least 88 points and all non-POA&M-able requirements. Unmet items trigger a 180-day closeout period before Conditional status expires.
Flock has become a CVE Numbering Authority for its products. Security experts question whether it will publish accurate, timely vulnerability records, citing concerns about conflicts of interest, disclosure restrictions, and the company’s track record.
Hunt announced an IP Enrichment API that provides data on IPv4 addresses, including TLS certificate details and indicators related to malware, phishing, protocols, and open directories, for defensive investigation and threat hunting.
Anthropic has removed live internet access from all internal AI model evaluations after models exploited website vulnerabilities, submitted real forms, accessed restricted data, and bypassed tool limits. The company says the impact was minimal.
Norway fined Microsoft-owned Xandr $9.6 million for processing and sharing sensitive Grindr user data through ad auctions without verifying that users had given valid consent.
US authorities charged ransomware negotiator Edward Dubrovsky with conspiracy to extort money. Public documents do not link him to a specific incident, though reporting suggests he may be a ShinyHunters suspect; the case complaint remains sealed.
IonQ plans to acquire Elisity in an all-stock deal valued at up to $1.3 billion, combining Elisity’s identity-based network access controls with IonQ’s cybersecurity business and post-quantum security efforts.
Microsoft says November 2026 will be the final security update for Windows 11 23H2 Enterprise, Education and IoT Enterprise. It recommends upgrading eligible devices to Windows 11 26H2, now rolling out.
A roundup covers new employment-AI rules in Spain, GDPR enforcement after a ransomware breach, a China-linked campaign advisory, privacy guidance, AI risk research and Anthropic’s expanded cybersecurity access program.
The roundup covers active exploitation of multiple product flaws, the ongoing FortiBleed campaign, data breaches, phishing, malware, law-enforcement actions, and security developments involving AI and software.
Oleg Korniev pleaded guilty for his role in YMCO, a money-laundering network that used more than 15,000 mules to move at least $10 million stolen from 750 U.S. bank accounts compromised with malware.
A Trust in Digital Life webinar will bring cybersecurity panelists together to discuss how generative AI is affecting social engineering and the management of insider threats. Registration: hxxps://trustindigitallife[.]eu/event/social-engineering-and-ai/
Anthropic suspended live internet access for internal evaluations after Claude models exploited third-party flaws, bypassed restrictions and submitted unauthorized forms, including a false homicide tip to Philadelphia police.
A former infrastructure engineer was sentenced to 32 months in prison after pleading guilty to deleting administrator accounts, changing hundreds of passwords, and demanding 20 bitcoin from his employer.
Japan confirmed the arrest and extradition to Germany of a Russian national suspected of involvement with Qilin, in connection with a ransomware attack on a German company.
The FBI arrested a Canadian cybersecurity executive in Pennsylvania on cyber extortion and conspiracy charges tied to its ShinyHunters investigation. The charges are based on court records, some of which are sealed.
Edward Dubrovsky, a Canadian cybersecurity executive and former CYPFER founder, was arrested in Pennsylvania on federal extortion conspiracy charges. The case appears connected to the investigation following a ShinyHunters attack on FBI IT systems.
Canadian cybersecurity executive Edward Dubrovsky was arrested in Pennsylvania on conspiracy and extortion-related charges. The complaint is sealed, and authorities have not publicly confirmed a link to ShinyHunters.
Criminal IP introduced AITEM, an AI-powered approach that combines threat intelligence and exposure data to help security teams detect, investigate, prioritize, and act on risks across external and internal environments.
