Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3793 articles
A security-news roundup covers a ransomware operation involving AI agents, new funding and acquisitions in security, Robinhood’s passkey-based access approvals, and Mexico’s plans to strengthen national cybersecurity.
Wiz says its ASM platform now automates subdomain discovery and combines external reconnaissance with cloud, code, and runtime context to identify exposed assets and risks. The article also describes its Red Agent for finding logic-based vulnerabilities.
The NCSC plans Cyber Shield, a sovereign capability using paired AI agents to find and fix vulnerabilities across government and critical infrastructure. Initial testing is planned, but the program has no timeline and some functions require further research.
EclecticIQ Intelligence Center 3.8 adds reusable Keyword lists for organizational context, letting teams apply and update terms across searches, monitoring rules, and Intelligence Compass configurations.
An amended lawsuit alleges Grok was used to create and share nonconsensual CSAM from minors’ photos and adds Stability AI over Stable Diffusion safeguards. The claims, including allegations about xAI’s response to law enforcement, are not independently verified here.
Spanish police arrested an alleged Cyber Army of Russia Reborn member after an FBI tip. Authorities say he supported a linked hacker and participated in activities attributed to NoName057(16); police seized devices and froze a cryptocurrency wallet.
Spanish police arrested a man suspected of supporting CARR and Z-Pentest, aiding a CARR-linked hacker, and participating in operations attributed to NoName057(16). No formal charges have been filed; police seized devices and froze wallets.
A campaign observed in late June and early July 2026 used payment and shared-folder lures and a compromised Croatian rental website to broker Microsoft 365 device-code authentication. Researchers linked its tooling to DEBULL and related PhaaS kits.
Reuters, citing three sources, reports that CISA is using Anthropic’s Mythos to scan federal code repositories and has reportedly found many vulnerabilities. Their severity, affected agencies and the scope of the review were not disclosed.
Proofpoint says the UNK_MassTraction cluster used two Roundcube flaws to target U.S. and Canadian universities. Researchers confirmed fewer than 10 victims and say they lack evidence about what, if anything, was stolen.
Canada’s CSE says it conducted state-authorized cyber operations in 2025 against an extremist group, fentanyl-chemical traffickers and a ransomware gang, and disrupted infrastructure used by 10 major ransomware gangs.
The article says Illinois’ SB 315 requires annual AI safety disclosures and audits, reporting of significant incidents within 72 hours (24 hours for imminent threats), and restricts certain high-risk AI uses. Resecurity promotes related services.
StepSecurity announced a policy to block unreviewed GitHub Actions workflows from accessing secrets and a detection for exfiltration attempts. The article describes four campaigns that used injected workflows to steal credentials.
Unit 42 reports a campaign using phishing and impersonated Microsoft Teams IT calls to install EtherRAT through remote-access tools and a malicious MSI. EtherRAT uses Ethereum smart contracts for C2; Microsoft has added external-caller warnings and bot lobby controls.
Team Cymru analysis describes a phishing campaign impersonating 34+ brands to target marketing professionals with fake interviews. Nested redirects lead to a browser-in-the-browser Google sign-in form designed to steal credentials.
Wiz describes how its Runtime Sensor and Security Graph combine live workload telemetry with cloud context, highlighting recent detection, forensics, and AI-security capabilities alongside customer examples.
FEMA says SLCGP and TCGP funds can cover individually purchased CIS services under federal procurement standards, while bundled membership fees are ineligible. FEMA also removed the NCSR requirement for four grant programs.
Silent Push describes integrations that send its threat-intelligence data to Splunk, automate triage and blocking through Tines, and add threat context to ServiceNow incidents. The vendor reports Threat Check lead times averaging 154 days.
Socket reports that the PolinRider campaign has targeted open-source developers since December 2025, compromising repositories and packages to deliver DEV#POPPER and OmniStealer. It identified 162 malicious release artifacts across 108 packages.
Zscaler identified two campaigns using indirect prompt injection to target AI agents with payment scams and a fake DeBank site. In a test of 26 LLMs, four made a payment and two misidentified the fraudulent site as DeBank.
Apple is moving toward more frequent, out-of-band security updates for its devices and Safari. Experts say faster patches may help address AI-accelerated vulnerability exploitation, but delayed installs and limits in iOS security tools remain concerns.
GitHub’s enterprise public monitoring scans public git content, pull request comments and issues for organizational secrets, but not private repositories or documented workflow logs. The article recommends pairing alerts with CI egress controls.
A roundup of new AI and privacy rules, NIS2 security measures, AI deployment guidance, and updated security-planning recommendations, alongside developments affecting EU–U.S. data transfers.
Flipper Devices says Flipper Zero firmware will remain maintained by a smaller team as full-time feature development ends. Community contributions will shape priorities, with changes subject to stricter review and integration and regression testing.
