Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3793 articles
Microsoft's July Patch Tuesday addresses 622 CVEs. The company flags two privilege-escalation flaws in SharePoint Server and AD FS as exploited; the release also completes Kerberos RC4 hardening and includes a SharePoint authentication-bypass fix.
Microsoft’s Patch Tuesday addressed a record 622 vulnerabilities, including two actively exploited zero-days in Active Directory Federation Services and SharePoint Server. SAP also patched critical flaws in NetWeaver Application Server and Approuter.
Microsoft's July 2026 Patch Tuesday fixes 622 vulnerabilities, including two reported as exploited zero-days affecting AD FS and SharePoint Server. The roundup also highlights critical flaws across Windows and other products.
Fake security emails targeting LastPass and Bitwarden users lead to counterfeit DocuSign pages. LastPass says its systems were not compromised; the malicious site prompted downloads and was later taken offline.
Microsoft released July 2026 cumulative updates KB5101650 and KB5099414 for Windows 11 versions 25H2, 24H2, and 23H2, addressing 571 vulnerabilities and delivering numerous reliability, accessibility, and feature updates.
Microsoft’s July 2026 Patch Tuesday addresses 570 vulnerabilities, including two actively exploited privilege-escalation flaws and a publicly disclosed BitLocker bypass.
A researcher reported that Grok Build could upload full local repositories to Google cloud storage through a separate server-controlled mechanism, unaffected by /privacy. The article says uploads were later disabled server-side.
The U.S. Treasury sanctioned First VPN Services (1VPNS), its alleged administrator Dmytro Rashevskyi, and Yegeniy Vladimirovich Silayev over alleged support for ransomware operations, including infrastructure and malware-disguising tools.
The US, UK and EU announced sanctions against cybercriminals and enablers, including Trickbot administrator Vitaly Kovalev (“Stern”), whose associated wallets received over $300 million in ransom payments.
SAP’s July 2026 security updates fix 16 vulnerabilities, including three critical flaws in NetWeaver, Approuter, and Commerce Cloud. SAP says it has no evidence the flaws have been exploited.
ReliaQuest says Jalisco uses OAuth device-code phishing and OmegaLord imitates a PDF Reader login to target Microsoft 365 accounts and work around MFA. It recommends restricting device registration and blocking device-code authentication.
Microsoft will make passkeys the Entra ID default starting September 2026 and retire SMS and voice authentication on February 1, 2027. Users relying on phone-based MFA will be prompted to register passkeys.
The U.S. sanctioned 1VPNS, its administrator Dmytro Rashevskyi, and cryptor seller Yegeniy Silayev for supporting ransomware attacks. A multinational operation dismantled 1VPNS and seized 33 servers across 27 countries.
A joint advisory says Russian FSB Center 16 actors target poorly secured routers at critical infrastructure organizations, using SNMP to copy device configurations and exploiting known Cisco flaws. Agencies recommend hardening network-device access and updating firmware
Valarian raised $50 million in Series A funding to expand its ACRA platform, which the company says governs AI models and other Kubernetes workloads with per-workload policies, isolation and runtime controls.
The Pentagon suspended CMMC phase two, which was due to require Level 2 third-party assessments for new contracts from November 2026, while a task force reviews the program. Phase one requirements remain in force.
StepSecurity’s Device Policy lets teams approve or block VS Code extensions and versions across developer devices, with policy deployment through MDM or its agent on macOS, Windows, and Linux.
ENISA has launched a podcast series on cybersecurity topics. Its first episode explores Frontier AI’s impact on cybersecurity and discusses ENISA recommendations for building capabilities to address machine-speed threats.
CYBERA says it traced a permit-fee impersonation ring to 53 verified US mule accounts across 23 email campaigns. The scammers target property owners using public records and seek payment by wire or other fast-moving payment rails.
The firing of two EAC commissioners and DOJ threats of prosecution over voter-registration and ballot issues have heightened election-security concerns. Oregon and Arizona are building local support and ballot-tracking efforts as officials report reduced federal help.
Jscrambler says malicious releases of its npm package were downloaded 1,479 times before removal. The package ran an infostealer during installation; the company revoked publishing credentials and released safe version 8.22.
A joint advisory from the U.S. and 12 partner countries says FSB Center 16 is targeting network devices with weak credentials and old Cisco flaws, and urges defenders to disable Smart Install, strengthen authentication and monitor suspicious logins.
The EU and UK imposed sanctions on Russian individuals and entities over alleged cyberespionage and destructive attacks, including activity attributed to Turla. The EU cited a 2010-onward campaign; the UK also targeted figures linked to GRU activity and Lumma Stealer.
ASEC reports phishing emails posing as project proposals that deliver JavaScript malware. The script runs PowerShell to decrypt and load SnakeKeylogger in memory, which steals browser data, system information, and keystrokes and exfiltrates them via SMTP or Telegram.
