Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3621 articles
A seller named exfilar is offering Branch deep-link keys for $15,000, claiming they come from public developer packages rather than a breach. The keys could enable phishing through a shared domain trusted by 2,553 apps.
Group-IB reports that attackers combined SpyNote RAT and WindRelay in an Android fraud campaign, using social engineering and live NFC relaying to make fraudulent transactions. The activity reportedly took 13 minutes and targeted users in three European countries.
Socket researchers found over 737 Chrome extensions impersonating VPN and proxy brands and routing traffic through one provider’s SOCKS5 proxies. Google removed over 200; more than 500 reportedly remain available.
Dream researchers say suspected Chinese hackers used Hermes and OpenClaw in a near-autonomous operation against Taiwan’s government, reportedly extracting over 2,500 personnel records and expanding to government suppliers and other organizations.
Researchers found 737 free VPN and proxy extensions impersonating brands; 520 of 522 in a bulk corpus routed traffic through shared SOCKS5 infrastructure. Separately, a returned AI Sidebar extension added affiliate-link monetization.
The FBI warns that criminals target adults’ and children’s online accounts to steal explicit content for sextortion or sale. The FBI and NCAA also warn of schemes targeting student-athletes and recommend strong passwords, caution with unsolicited messages, and MFA.
Check Point reports Lazarus used Windows zero-day CVE-2026-68820 in Operation Dream Job attacks on defense, aerospace and aviation targets, deploying FudModule, Troy and RelayShell. Microsoft patched the flaw in its latest Patch Tuesday updates.
Wazuh and Clober announced a partnership under which Clober will use Wazuh’s platform for security monitoring, threat detection, vulnerability management, and compliance.
AI security startup Mindgard raised $30 million in Series A funding. The company says its red-teaming platform has found more than 150 vulnerabilities in AI products, including a zero-day code execution flaw in Cursor IDE.
WhatsApp is beta-testing an optional on-device machine-learning feature that flags suspicious messages from non-contacts. The company says message content stays on-device, with model releases and limited usage analytics subject to safeguards.
Signal’s Automatic Key Verification uses key transparency and independent audits by Cloudflare and Trail of Bits to check that contacts’ phone numbers or usernames match their public keys, complementing manual safety-number checks.
Intel and AMD announced patches for more than 80 vulnerabilities. Intel addressed 72 flaws across its products, while AMD issued advisories covering 12 vulnerabilities, including issues that could enable privilege escalation, denial of service, or code execution.
Siemens, Schneider Electric and Phoenix Contact issued August 2026 ICS advisories covering flaws that could enable unauthenticated code execution, command execution, denial of service and other impacts across their products.
Unit 42 says Kimwolf/Aisuru’s latest version uses Chrome-like HTTP/2 floods and Ethereum Name Service lookups, with a Tor fallback, to evade filtering and takedowns. Researchers linked command servers to a network in Saint Petersburg.
CERT-UA reports that Sandworm-linked UAC-0145 has targeted IT professionals with fake job offers, steering them to a trojanized WireGuard client that executes embedded PowerShell and fetches additional payloads. It recommends limiting corporate access to managed, EDR-
Google says Chrome blocked more than 7 billion unwanted Android notifications per day in Q1 2026. Its defenses include automatic permission revocation, analysis of related sites, and rate limits to curb notifications used for scams, phishing, malware, and payment fraud.
The NSA confirmed Kerianne Tobitsch began as general counsel on June 15, 2026. She will oversee lawyers reviewing clandestine operations and is expected to be involved in efforts to renew FISA Section 702.
Unit 42 reports that Kimwolf v7 adds browser-like HTTP/2 DDoS flooding and a more resilient C2 setup using ENS, Tor and a local proxy. It targets Android TV boxes and Linux IoT devices; the researchers recommend disabling or restricting ADB.
Microsoft’s August updates address 398 CVEs, including actively exploited Windows driver flaw CVE-2026-68820 and four unauthenticated RCE flaws. Check Point Research attributes the zero-day’s use to Lazarus; Microsoft has not publicly attributed it.
Microsoft’s August 2026 updates fix 421 CVEs, including an exploited Windows afd.sys zero-day that enables local privilege escalation. The release also addresses publicly disclosed Windows flaws and vulnerabilities across Microsoft products.
NIST is seeking public input on modernizing the National Vulnerability Database as AI increases vulnerability discovery and exploitation, focusing on automation, faster enrichment, transparency and remediation. Its relationship with Gold Eagle remains unclear.
A Black Hat and DEF CON roundup covers a cross-cluster compromise involving Hugging Face infrastructure, North Korean-linked intrusions, a worm that infected 400-plus npm packages, AI-agent security research, product launches and $1.27 billion in funding.
CIS announced updates to six security benchmarks, including new versions for Azure Database Services, PostgreSQL 13 and 14, AWS Database Services, FortiGate 7.4.x and HPE Aruba CX switches.
SAP released 28 security notes for August 2026, including fixes for critical flaws that could enable authentication bypass, command execution, information disclosure or system crashes. SAP did not report in-the-wild exploitation.
