Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3619 articles
SOCRadar says records for 2,188 organizations indicate 2,085 had data collection end before poisoned LiteLLM packages appeared, pointing to the earlier Trivy compromise. The figures measure exposure, not confirmed credential use or a complete census.
Google Cloud’s roadmap targets full post-quantum readiness by 2029, with milestones for mitigating store-now-decrypt-later risk, protecting signatures and identity, and preparing customers to adopt quantum-safe settings.
The episode covers GitHub revoking npm token privileges that bypass 2FA, growing DPRK-linked use of NullReceiver to conceal malware infrastructure, and security challenges involving AI skills and software supply chains.
Apple says its latest high-confidence alerts warn that specific iPhone users may have been targeted by mercenary spyware. The alerts do not identify the spyware; users can verify them at account[.]apple[.]com and enable Lockdown Mode.
Researchers say Evooo1Bot, a previously undocumented Mirai-based malware, has exploited unpatched internet-facing devices for at least a month. Its capabilities include encrypted C2, SSH scanning, honeypot avoidance, credential sniffing and SOCKS proxy abuse.
A roundup of Black Hat and DEF CON 2026 highlights covers CloudShell security research, indirect prompt injection risks in AI agents, threat actor trial abuse, education-sector breaches, and hands-on security events.
Ukrainian authorities say they shut down 94 fraud call centers after 411 searches, seizing equipment, cash, and cryptocurrency wallet access tools. Twenty-six people were notified as suspects; forensic analysis is ongoing.
XBOW testing found mid-tier models increasingly capable in offensive security, with GPT-5.5 improving web application testing. Anthropic reported coordinated agents found 266 vulnerabilities across 15 open-source projects, versus 21 for individually assigned agents.
Former Brightly Software contractor Cameron Nicholas Curry was sentenced to two years for stealing employee and compensation data, threatening disclosure and extorting $7,540.92 after demanding $2.5 million. The FBI identified him through operational security mistakes.
A presidential memo would enlist private companies in federal cyber operations against transnational criminal groups. Experts debate its legal and ethical risks, attribution dangers, oversight, and how 60-day implementation guidance will define the program.
Flock Safety will require departments to use audit tools, suspend accounts during suspicious-activity reviews and require case codes for searches, with emergency bypasses, as it responds to reported officer misuse and privacy concerns.
A wave of tools claims to remove Claude’s invisible AI watermark, but Anthropic has released no public detector to verify those claims. Many tools strip metadata, while integrations into agent workflows raise software supply-chain concerns.
A White House memorandum directs the National Coordination Center to establish a program for vetted security firms to propose limited cyber operations against foreign criminal groups under U.S. government authority, with legal and financial safeguards.
Twenty-one cybersecurity-related deals were announced in July 2026, including acquisitions and agreements spanning identity security, detection engineering, network security, and observability.
A Trump memorandum lays the groundwork for vetted private firms to support federally overseen cyber operations against foreign transnational criminal organizations, subject to existing laws including the Computer Fraud and Abuse Act.
WhatsApp is testing an optional Scam Alert feature that uses on-device machine learning to flag likely scam messages from non-contacts. The company says message content stays on-device, though users may opt to share five messages to improve accuracy.
Team8 announced $365 million in additional capital: $265 million for its third fund and $100 million for portfolio investments. The venture firm backs startups across sectors including cybersecurity and AI.
ReliaQuest says its GreyMatter OT Engineer agent is available to help triage operational technology incidents by analyzing packet captures, enriching alerts with asset context, and correlating OT signals with IT telemetry.
Fortinet patched eight vulnerabilities, including authentication flaws in FortiWeb and FortiManager and a FortiClient for Windows buffer overflow. The company did not report any of the flaws as exploited in the wild.
Microsoft issued fixes for 419 vulnerabilities, including three zero-days. CVE-2026-68820 was reportedly exploited and linked by Microsoft to Lazarus Group. The article says AI-assisted discovery is driving rising patch counts and warns the new advisory format may makee
Microsoft’s mandatory KB5120249 update for Windows 10 versions 22H2 and 21H2 includes August 2026 security fixes, resolves an SMB File History backup issue, and expands rollout of new Secure Boot certificates.
California Governor Gavin Newsom announced an AI cyber defense program to protect the state's critical infrastructure. The article frames it as a response to limited federal investment and urges managing AI risks while supporting innovation.
The FBI says hackers use password guessing, fake support scams and cloned login pages to steal explicit content from social media accounts, which may then be sold or used for harassment, sextortion and stalking.
StepSecurity's analysis of CloudSEK's dataset reports 78,330 secrets exposed across CI/CD pipelines at 2,186 organizations from March 19–24, 2026, and outlines credential-rotation, audit, dependency-pinning and runner-control measures.
