Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3606 articles
Five alleged Black Axe leaders were extradited from South Africa to the U.S. to face charges over an alleged 2011–2021 fraud scheme using romance scams, advance-fee fraud, and threats to extract payments.
Homebrew 7.0.0 closes eight security advisories, adds the brew vulns scanner using OSV[.]dev records, and expands provenance checks and sandboxing across macOS and Linux.
F6 identified more than 360 fake sites targeting users in Uzbekistan, Belarus and Tajikistan with bogus payment and income offers, seeking personal details, passport scans and app installations. The campaign’s perpetrators and victim count are unknown.
Kaspersky linked Gorilla RAT and Monkey Ransomware to attacks attributed to pro-Ukraine group Hacking Cat, noting shared tools complicate attribution. The group disputes some of the attribution.
Five alleged Black Axe members were extradited from South Africa to face U.S. wire fraud and money laundering charges over romance scams prosecutors say targeted more than 100 victims from 2011 to 2021.
Apple OS 27 adds macOS binary allow/deny controls, device-bound app configuration, declarative identity and credential management, streamlined privacy prompts, and expanded fleet monitoring and diagnostics for enterprise admins.
Apple’s OS 27 release adds education-focused identity, device-management, visibility and family-safety features, which the article says can help schools simplify administration and support secure learning environments.
CISA found that roughly 40% of vulnerabilities in its 2024 Known Exploited Vulnerabilities catalog stemmed from longstanding, preventable weaknesses. Experts warn that AI could speed discovery and exploitation, increasing the urgency of Secure by Design.
Five alleged leaders of Black Axe’s South African wing were extradited to the U.S. to face charges tied to romance and advance-fee scams, identity theft and money laundering.
Homebrew 7.0.0 adds the `brew vulns` scanner, a Homebrew-specific OSV advisory database, and stricter macOS install sandboxing. The release also fully launches BrewUI on macOS 26 and later.
Microsoft released emergency Windows updates to fix Remote Desktop failures caused by September security updates, plus Hyper-V and some USB audio issues. Some USB Audio Class 1.0 problems remain unresolved.
Bitsight says Beacon is now generally available to monitor vendors for exposure, vulnerabilities, malicious activity, stolen credentials and compromise. Its MCP and agentic capabilities bring updated cyber-risk intelligence into AI-enabled workflows.
Microsoft says its September 2026 security updates can disrupt USB Audio Class 1.0 devices on Windows 11 24H2 and later. A fix is in progress; switching to 2-channel audio may help some users.
Rapid7 says Forrester named it among notable MDR providers in its Q3 2026 landscape report, which points to convergence between managed detection and response and exposure management. Rapid7 also outlines its approach and buyer evaluation questions.
China rejected Anthropic CEO Dario Amodei’s call for limits on its AI development. The debate follows a U.S. advisory alleging Chinese developers tried to distill capabilities from advanced U.S. AI models.
Microsoft says September 2026 security updates can disrupt Remote Desktop Services on Windows Server, Windows 10, and Windows 11. Group Policy mitigations are available; restarting affected VMs or removing updates may temporarily restore access.
Debian 13.7 bundles 92 previously issued security advisories and corrections to 106 source packages, including kernel, library, application, and boot-chain fixes. The release updates the installer and kernel ABI to 6.12.107+deb13.
The NSA plans to replace its directorates with five mission centers, including cybersecurity and AI. Gen. Joshua Rudd set a 30-day implementation timeline, with full operational capability expected by January; some organizational details remain unsettled.
Sophos researchers found an underground forum ad for Luciferus, an uncensored AI service that responded to a prompt for a Python remote access trojan. They say the service reflects growing cybercriminal commercialization of AI.
A roundup of recent privacy and cybersecurity developments covers smart-glasses and shareholder-data concerns, shadow AI, third-party assessments, cyber readiness, risk-management guidance and alleged large-scale AI model distillation.
Microsoft disclosed two campaigns: one sent over a million executive-impersonation payment scam emails, while another used passkey-themed lures to compromise cloud accounts, establish MFA persistence, and collect data from Microsoft services.
The week’s security developments include active exploitation of flaws across major products, a rootkit on compromised F5 BIG-IP APM devices, confirmed data breaches, and reports of AI agents helping attackers exploit PaperCut at 395 organizations.
Anthropic CEO Dario Amodei urged the AI industry to slow development and proposed outside evaluators to monitor safety. He cited risks including malicious cyber use; OpenAI and Anthropic also described safety actions.
Anthropic says it disrupted a Russia-linked campaign that used Claude against more than 20 organizations, and describes other groups using AI for credential theft, data theft, vulnerability research and attacks on political and media targets.
