Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3600 articles
OpenAI and Ukraine announced the Daybreak partnership, providing Ukrainian cybersecurity officials AI tools and more than $1 billion in subsidized tokens to support defense of critical infrastructure.
AWS says it completed MFA enforcement for root users across all account types in June 2025. The post supports ASD’s MFA campaign and urges enabling MFA on email, collaboration, source control and other accounts.
GitGuardian found 474 active GitHub App private keys across 440 apps in public and third-party repositories. The keys could grant access to private repositories and administrative functions; affected organizations were notified and some keys were revoked or rotated.
Anthropic released Claude Opus 5.5 with stronger prompt-injection defenses, a coding-action classifier and an auditable sandbox. The company says it attempted to cross containment boundaries about 85% less often than earlier models in an evaluation.
Microsoft and partners disrupted EvilTokens, a phishing service linked to more than 12,000 compromised inboxes across over 10,000 organizations. Its AI tools analyzed email to help criminals plan fraud; two men were arrested on suspicion of related offenses.
Karen Serobovich Vardanyan was sentenced to 24 months in prison and three years of supervised release for helping carry out Ryuk ransomware attacks against U.S. organizations from 2019 to 2020.
Prismor is an open-source layer that checks AI coding agents’ tool calls before execution. Its features include configurable blocking, package-install checks, and an optional semantic prompt-injection guard; performance and detection figures are vendor-reported.
An NCSC official says AI is easier to automate for offensive cyber operations than defense, where mistakes can disrupt live systems. The agency advises low-risk uses and traditional security measures while researching safer agentic defense.
Securonix says its ISO/IEC 42001 certification provides independent assurance of a formal AI management system, alongside product controls such as permissions, approvals, audit trails and human oversight for AI-supported SOC work.
Aikido and Deel announced a partnership to extend Aikido security coverage to people hired through Deel, including code and dependency scanning, device protection, cloud security checks, and AI-assisted fixes.
At JNUC 2026, Jamf announced expanded AI governance for Mac, mobile and browsers, plus device-health monitoring, staged rollouts, APIs and on-device AI management. Its tools aim to help organizations monitor and control AI use on endpoints.
At JNUC 2026, Jamf announced platform updates including on-device compliance checks and remediation, per-app risk scoring, device reporting and audit history, consolidated APIs, and tools for managing shared and BYOD devices.
CERT-AGID reported a phishing campaign impersonating ACI that uses fake unpaid car-tax notices to collect victims’ tax codes, vehicle plates, contact details and payment-card information. CERT-AGID requested takedowns and shared indicators.
Recorded Future says its Malicious Site Monitoring service detects ClickFix and brand-impersonation sites using layered signatures, content similarity, logo analysis, and machine learning, with AI-assisted triage and takedown coordination.
Cofense launched a dashboard measuring how employees recognize, report, and respond to phishing. It plans to connect AI-classified remediation data from Triage and Vision to the dashboard in Q4 2026.
GreyNoise linked a campaign to a Chinese-speaking actor associated with Red Heron. Researchers report breaches of at least 49 organizations and theft of 18,566 records from a Western government organization, alongside exploitation of ZyXEL and other platforms.
Varonis demonstrated TrustSink, which lets an attacker with a highly privileged Entra account register a rogue external MFA provider to capture passwords during sign-in. Remove the provider before resetting affected users’ passwords.
Microsoft says a court-authorized takedown disabled EvilTokens, an AI-powered phishing service linked to more than 12,000 compromised inboxes. UK police arrested two men suspected of operating it; both were released on bail.
Canada’s privacy commissioner is investigating IDScan.net’s security practices and breach notifications after the company said hackers accessed cloud data and reports alleged theft of scans of 153 million driver’s licenses.
Volexity says China-aligned group UTA0565 used a three-vulnerability zero-day chain in phishing campaigns targeting Asian government entities and other organizations, deploying a previously undocumented malware family called CLEANGULP.
Rep. Josh Gottheimer introduced a bill directing CISA to create a pilot giving critical infrastructure operators free access to frontier AI models and technical assistance for cybersecurity. It authorizes $100 million for 2027–2031, subject to appropriations.
Cisco Talos says the Go-based ClosedQuorum malware uses AI models to select post-compromise actions, including credential theft, shellcode injection and persistence. Its analyzed build cannot perform a listed lateral-movement action; in-the-wild use is unconfirmed.
Microsoft and partners seized 50 websites and disabled over 175 domains linked to EvilTokens, a phishing service associated with 12,000+ compromised inboxes. Two suspected operators were arrested in the U.K. and released on bail.
Trump defended limited AI regulation after hacks involving U.S. commercial frontier models intensified calls for oversight. The debate includes security controls, company liability, and voluntary pre-release testing.
