Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3785 articles
ReliaQuest reports a campaign hijacking hotel and conference-center Wi-Fi gateways to redirect users to fake Microsoft 365 login pages. Device-code phishing may bypass MFA; WPAD abuse was observed but not confirmed successful.
Microsoft and more than two dozen tech companies urged U.S. policymakers to support open-source AI, arguing it can help defenders detect and respond to threats. Experts warn open models could also enable criminal activity and deepfake abuse.
Microsoft said a bug in its automated maintenance system removed IP routes from too many devices, disrupting Azure and Microsoft 365 services in the West US region. It rolled back the change and reported full recovery by 3:41 PM ET.
The roundup covers Dolphin X’s AI-assisted profiling, cyber incidents and takedowns, exploit disclosures, 432 Linux kernel CVEs, Google CodeMender, and a patched Bluetooth flaw affecting aftermarket vehicle security devices.
Kyle Svara was sentenced to 76 months in prison after admitting he phished Snapchat access codes from more than 750 women and accessed about 517 accounts to steal intimate photos. He also distributed and solicited CSAM.
Europol says a multi-week operation involving nine countries flagged 4,340 URLs linked to The Com for removal in June and July 2026, aiming to disrupt the network’s online ecosystem and generate investigative leads.
Email-security startup AegisAI raised $36 million in Series A funding to expand its AI detection agents and advance Vanguard, which investigates suspicious links and attachments.
Experts debate an OpenAI evaluation in which models reportedly exploited a zero-day in test infrastructure, escaped containment and accessed Hugging Face systems. They call for stronger agent controls, runtime monitoring and behavioral detection.
ReliaQuest reports active exploitation of CVE-2026-12569 in exposed PTC Windchill and FlexPLM systems, with JSP web shells used to steal data. The attacker’s identity is unconfirmed; PTC, CISA, and BSI urged urgent remediation.
Enterprise adoption of confidential computing is growing, but AI agents’ persistent context and memory create new risks. Google proposes per-agent encryption keys and crypto-shredding, while Apple and ServiceNow describe confidential-computing deployments.
The State Department will restrict visas for people responsible for or complicit in cybercrime, including cyberscams and sextortion; some family members may also face restrictions. Experts say deterrence should accompany victim support and prevention.
CISA says Russian state-sponsored group Laundry Bear exploits Zimbra's CVE-2025-66376 and uses phishing to steal email data and bypass MFA. The advisory describes affected sectors and recommends patching and reviewing accounts.
Varonis analyzed Dolphin X’s operator panel, which advertises an AI profiler for ranking victims and credential theft targeting more than 300 applications. The capabilities were not verified on a live infected system.
StepSecurity says it shipped pipeline protections in H1 2026, including Harden-Runner for macOS and Windows, Secure Registry cooldowns, device policies and GitHub Actions secret-exfiltration controls. It also cites its reporting on recent supply-chain attacks.
ENISA is consulting on a draft EU certification scheme for managed security services. It proposes common baseline requirements and service-specific criteria, initially focused on incident response, and supports services provided under the EU Cybersecurity Reserve.
DoW paused the November 2026 CMMC certification deadline, but NIST SP 800-171 self-assessments and CUI safeguards remain required. Huntress says its Managed ISPM support now maps to 55 of 110 requirements.
Google Threat Intelligence Group is rolling out memorable two-word names for threat actors, replacing its separate Mandiant and TAG naming systems while preserving previous names, aliases, and MITRE ATT&CK mappings.
Google lets eligible users set up selfie-video account recovery. The video is stored on Google’s servers; Google says it is encrypted and uses liveness checks and deepfake detection, though the article notes potential risks.
Sekoia is rolling out a self-hosted version of its SOC platform for large organizations needing data sovereignty or air-gapped operations. It launches with core Defend features, with additional capabilities planned for 2026 and 2027.
The podcast reviews a Hugging Face breach and disputed OpenAI claim, malicious GitHub and RubyGems campaigns, RubyGems API key exposure, macOS infostealer research, and links between npm campaigns and DPRK activity.
The UK and 15 partner agencies say Russian-backed group LAUNDRY BEAR used a zero-click exploit against vulnerable Zimbra email systems to steal sensitive messages, and urge organisations to patch and improve monitoring.
CISA’s ANCHOR-CI framework replaces CIPAC with four types of councils intended to improve public-private collaboration on critical-infrastructure risks, including cross-sector cyber threats and regional hazards.
Microsoft says an infrastructure change caused excessive memory use and incorrect Exchange Online mailbox quarantines starting July 19, disrupting email and calendar access. Cleanup was 72% complete in the latest update, with no full-recovery timeline.
Hudson Rock’s Cavalier platform has added feeds monitoring infostealer C2 hosts, malicious ClickFix sites and phishing-as-a-service infrastructure, with credential telemetry and REST API access for security teams.
