Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3793 articles
Oak has emerged from stealth with $60 million in seed funding to develop its AI-powered Identity Operating System, which the company says governs human, AI, and machine identities across enterprise environments.
Splunk and Zoom issued patches for multiple flaws, including critical and high-severity issues. Zoom’s CVE-2026-53412 could enable remote account takeover; Splunk fixes include a command-safeguards bypass and path traversal. Neither company mentioned in-the-wild use.
Trend Micro, ESET, Tenable, Tanium and Palo Alto Networks issued patches for product vulnerabilities, including a Tenable Agent path traversal that may enable remote code execution. The article says there is no evidence of exploitation for the latest flaws.
The Trump administration announced Gold Eagle, a Treasury Department-led clearinghouse intended to use AI to identify, validate, prioritize, and coordinate remediation of vulnerabilities. Officials said the effort depends on reauthorization of the CISA 2015 Act, which6
Mozilla, Google, Adobe and Broadcom issued security updates covering critical flaws across Firefox, Chrome, Adobe products and VMware Avi Load Balancer. Firefox exploit code is public, but Mozilla says it knows of no in-the-wild attacks.
Harden-Runner v2.20.0 adds support for Bitrise Build Hub macOS runners, joining other third-party GitHub Actions providers. StepSecurity says the tool provides outbound network monitoring, workflow-step event correlation and detections.
Huntress added an HTML editor to Managed SAT, allowing administrators to create tailored phishing simulations. The company says custom scenarios complement its expert-curated campaigns and are subject to link sanitization.
Dutch authorities arrested suspects linked to an international investment fraud network that allegedly used fake platforms, call centers and cryptocurrency transfers. Police linked at least 550 fraud reports and $28.6 million in reported losses to the group.
OFAC added four cryptocurrency addresses linked to Iran’s central bank to its designation. The wallets received $165 million in stablecoins, and Tether froze $131 million. Tether has frozen nearly $475 million across OFAC-identified addresses.
At his Senate confirmation hearing, Jay Clayton faced questions about the 2020 election and mail-in ballot claims. He described the DNI’s role in addressing foreign election threats and said he would support cyberthreat information sharing and Section 702 renewal.
Certo Software reports that cyberstalkers can use brief physical access to sign Chrome into their own Google account and enable sync, potentially exposing a victim’s browsing history and saved passwords. It recommends clearer sync and account alerts.
CIS updated benchmarks for SQL Server, macOS, MariaDB, Intune and Snowflake, and released Build Kits for several Windows and Linux platforms. Intune updates add or revise security settings.
Attackers compromised two AsyncAPI GitHub repositories and abused release workflows to publish five malicious npm versions carrying a multi-stage RAT. One researcher said automated data harvesting failed; versions were removed, but exposed systems need cleanup and their
The US unsealed an indictment charging three Russian nationals and two companies with allegedly running hosting services used for cybercrime. Authorities cited attacks on at least 42 entities in 21 states and offered up to $10 million for information.
Microsoft is withholding KB5101650 from some Dell PCs after a conflict involving the Windows USB-C Connection Manager and Intel IPF driver was linked to shutdowns, poor performance, heat, and battery drain. A fix is in development.
DarkOwl reports that Dark_Alpha advertised FortiGate access tied to the FortiBleed credential-compromise campaign, including a listing of 6,355 U.S. device accesses. The actor also posted listings targeting organizations in several countries.
U.S. prosecutors charged three Russian nationals accused of operating Media Land and ML.Cloud, hosting services allegedly used by ransomware groups and linked to more than $62 million in damage. Multiple governments have imposed sanctions.
Dutch intelligence agencies say Russian state-backed hackers target exposed internet-connected cameras to monitor military logistics and, in Ukraine, help locate troops. They advise changing default credentials, updating firmware and reviewing configurations.
Windows 10 update KB5099539 delivers July 2026 fixes for 570 vulnerabilities, including two exploited and one publicly disclosed zero-day, and adds security hardening. Consumer ESU updates are available through October 12, 2027.
Spanish police say a fraud and money-laundering network linked to investment scams and business email compromise generated €140 million. Authorities arrested four suspects, seized devices and froze €3 million for victims.
Finnish authorities issued a wanted notice for Aleksanteri Kivimäki after the Supreme Court declined his appeal, finalizing his nearly seven-year conviction in the Vastaamo case involving stolen psychotherapy records from about 33,000 patients.
U.S. prosecutors unsealed an indictment accusing three Russians tied to Media Land and ML Cloud of supporting cybercriminals. The indictment cites 44 unnamed victims and $62 million in losses; the U.S. is offering up to $10 million for information.
The Treasury-led Gold Eagle initiative will coordinate AI-discovered vulnerability information between government and industry. The White House says its VINTS platform is already collecting reports and prioritizing patches.
Step Security says Harden-Runner v2.20.0 can block outbound calls to endpoints not on an allowed list on macOS and Windows GitHub-hosted runners, extending a capability previously available on Linux runners.
