Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3613 articles
ReversingLabs’ free Artifactory plugin checks npm, PyPI, Maven, NuGet and RubyGems package requests against Spectra Assure Community intelligence, allowing teams to block packages flagged as risky.
Sysdig’s August 2026 briefing covers ChainDrop’s npm poisoning, Ghostjacking risks in AI coding agents, Claude Code use in ransomware intrusions, Cl0p’s exploitation of PTC Windchill, and governance updates. Sysdig says 7 of 8 AI-enabled attacks used ordinary command-ex
Palo Alto Networks acquired Console, an AI-native platform it says will expand Cortex with natural-language workflows for investigating signals, prioritizing work, and automating security actions.
Sevii says its new AI security module analyzes alerts, hunts for context and can autonomously contain threats, including isolating compromised laptops and disabling accounts.
The U.S. Coast Guard created the Office of Maritime Cybersecurity Policy to set maritime cyber policy, coordinate compliance and enforcement, and liaise with industry and government. The move follows a GAO report identifying gaps, though a direct link was not stated.
Five Venezuelan nationals pleaded guilty after trying to install remotely activated malware on Kansas ATMs to force cash dispensing. The attempts failed. The FBI reported more than 700 jackpotting incidents in 2025, causing over $20 million in losses.
Wiz’s Continuous Vulnerability Assessment updates its vulnerability catalog when new vulnerabilities are discovered and reassesses customer exposure in near-real time. The service is in public preview and includes remediation context through Wiz’s Green Agent.
A weekly threat-intelligence roundup covers Medusa ransomware’s impact, a Sandworm-linked campaign, attacks disrupting ports and water utilities, major data theft, arrests, and new macOS malware.
Step Security says Harden-Runner now supports GitHub Actions runners hosted on AWS CodeBuild, with runtime monitoring for network activity, file writes and process execution. Support requires specific CodeBuild settings and Harden-Runner versions.
Spur’s sponsored article describes Monocle Session Enrichment, which adds real-time VPN, proxy, anonymization and network signals to sessions so organizations can apply existing edge policies to authentication and other risky activity.
ANY.RUN's August roundup describes campaigns abusing legitimate remote-management tools, Microsoft 365 sessions, hiring processes and business-themed files to gain access, steal credentials and deploy remote-control malware against U.S. and European organizations.
This weekly roundup covers the FBI’s QTYF disruption, OpenAI’s account of AI agents accessing Hugging Face, PaperCut exploitation, ZBT router backdoors, Fire Ant intrusions, and social-engineered malware and ransomware campaigns.
Investigations say DPRK-linked job-fraud operators are targeting roles beyond IT, using synthetic identities, forged documents, VPNs and AI. Cases span healthcare, finance, sales and marketing; one PurpleDelta cluster applied to jobs at more than 1,100 companies.
Project Watershed 250 is a six-month Texas pilot bringing federal, state and private-sector expertise to identify water-system weaknesses, test defenses and scale protections. Texas Cyber Command and the Office of the National Cyber Director will oversee it.
Microsoft is investigating an Exchange Online outage causing authentication errors, email delays and mailbox failures. It cites a core authentication configuration issue; OneDrive, SharePoint, Teams, Purview and Defender XDR are also affected.
PaperCut says attackers exploited two zero-days in NG and MF servers to install SimpleHelp and AnyDesk. Emergency patches are available; customers are urged to restrict access, preserve evidence, review logs, and rebuild suspected compromised servers.
AWS Console Private Access is generally available, routing supported console traffic through PrivateLink in isolated VPCs and allowing policies to restrict sign-ins from unexpected networks. IAM Identity Center sign-in still requires public internet access.
Microsoft says false Defender Antivirus disabled alerts appear after recent updates on supported Windows client and server versions, although protection remains active. A fix is planned for a future update.
Two Nigerian men were extradited to the U.S. and charged in sextortion schemes linked to the deaths of two minors. The case is part of Operation Artemis, targeting Nigeria-based rings that prey on U.S. minors.
Halo-record is an open-source Python package that hash-chains AI-agent actions for independent tamper checks. It redacts and hashes raw arguments, but cannot detect omitted records; completeness requires an external witness.
OpenClaw 2.0 migrates sessions to SQLite and adds credential checks, shared cloud sessions, and incognito mode. The release warns that sharing is not isolation, incognito does not hide activity from providers or operators, and browser snapshots are unencrypted.
This ThreatsDay roundup covers Dysphoria’s nearly 296,000 compromised IoT devices, attacks targeting 100+ exposed U.S. water systems, SharePoint flaw probing, and new phishing, malware, botnet, and AI-agent threats.
Finland’s appeals court restored the case against three Eagle S officers, ruling that Finland has jurisdiction and that the crew’s conduct after authorities contacted the ship was not protected as a maritime accident.
Step Security added deny-list egress policies to Harden-Runner, letting teams block specified domains and IPs while leaving other destinations reachable. The vendor says policies can be centrally applied and cautions they do not replace allow lists.
