Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3793 articles
Researchers say Avalon uses a phishing-delivered ISO, shortcut and MSBuild chain to steal data, evade defenses, move laterally and deploy CrownX ransomware. The article also describes JADEPUFFER and LLM-driven Telegram malware.
Google, the FBI and partners disrupted NetNut, a residential proxy botnet. Google estimates it involved at least 2 million compromised devices and blocked its C2 infrastructure; Play Protect warned users and disabled infected apps.
SecurityWeek rounds up a hacker’s sentencing, KDDI’s likely 14.22-million-person breach, malware and attack reports, open-source zero-day PoCs, pro-Russia influence operations, ATM jackpotting convictions, and Cisco and Synology security fixes.
Peter Stokes, 19, was extradited from Finland to the US to face charges over alleged Scattered Spider activity. Prosecutors say he and co-conspirators hacked a jewelry retailer in 2025, stole data and demanded an $8 million ransom.
Google says a joint effort with the FBI and partners significantly degraded NetNut, a residential proxy network believed to involve more than 2 million infected Android devices and used by threat actors.
A Supreme Court ruling on FTC commissioner removals has raised doubts about oversight independence required by the EU-U.S. Data Privacy Framework. Max Schrems and noyb plan a legal challenge as European officials assess the implications.
The UK’s National Cyber Action Plan has been delayed again amid Labour leadership uncertainty, though the government says it remains committed to publication. A Cyber Resilience Pledge launch with FTSE 350 companies is still expected.
The episode discusses GitHub account-security changes, six allegedly malicious npm packages targeting AI companies, an FBI FLASH notice on TeamPCP, and security concerns as AI IDEs increasingly use Open VSX.
This week’s roundup covers ransomware phishing, a Claude Cowork sandbox escape, a reported Apple Hide My Email flaw, RAT activity, prompt-injection research, and CISA-confirmed ransomware exploitation of Microsoft Defender’s BlueHammer flaw.
Google and partners say they reduced NetNut/Popa’s pool of home-device proxies by millions. GTIG estimates the network spans at least 2 million devices, but warns it may reemerge through resellers or rival networks.
Broker miyako advertised five listings offering root-level RCE and shell access to Linux firewalls, reportedly across organizations in four countries. Each listing was priced at $400 and observed on July 2, 2026.
Peter Stokes, an alleged Scattered Spider member, was extradited to the US and remains in federal custody facing cybercrime charges. Authorities allege he participated in data theft and extortion attempts, including attacks on two businesses in 2025.
SOCRadar links the FortiBleed credential-harvesting campaign to INC and Lynx ransomware, citing an operator observed in both negotiation panels and overlapping targets. It reports 12 ransomware incidents, with hundreds of endpoints encrypted.
The administration lifted restrictions on Anthropic’s Claude Fable 5 and restored Mythos 5 access for select government-approved U.S. organizations. The restrictions followed concerns that researchers bypassed safeguards to find and potentially exploit software flaws.
Wiz announced the general availability of Wiz MCP, which connects AI assistants and agents to its Security Graph, AI Agent analyses, and reusable Skills for security workflows such as vulnerability triage, threat investigation, remediation, and compliance.
LayerX demonstrated that a game-themed webpage could manipulate tested AI browsers into retrieving sensitive SSH credentials in a controlled test. OpenAI patched the issue; responses from other vendors varied.
Peter Stokes, 19, was extradited from Finland to the U.S. to face fraud, conspiracy and computer-intrusion charges. Prosecutors allege he aided Scattered Spider in at least four breaches; the allegations are not proof of guilt.
The U.S. extradited Peter Stokes from Finland to face charges over alleged Scattered Spider intrusions. The FBI says attackers used help-desk social engineering and credential resets in a jewelry retailer breach, then demanded $8 million.
Cofense reports that phishing campaigns fingerprint victims’ devices and browsers to tailor landing pages and payloads, including FleetDeck for macOS and Tiflux RAT for Windows. It recommends cross-platform monitoring and FIDO2 authentication.
A White House executive order and OMB memo accelerate U.S. federal post-quantum cryptography migration, setting agency deadlines and outlining inventory, risk-prioritization, contractor, and critical-infrastructure expectations.
Renown Health says it has cut access provisioning from 20 days to under 24 hours and introduced facial-recognition-supported self-service password resets. Its CISO also described plans for risk-based password management and governance for AI agents.
Huntress is expanding its managed phishing simulations to Canadian learners, using English-language scenarios based on familiar Canadian brands and situations alongside global threat scenarios.
Recorded Future says Gartner named it the sole Leader among 17 vendors in its first Cyberthreat Intelligence Technologies Magic Quadrant. The article connects the assessment to Japan’s active cyber defense law, due to take effect in October 2026.
Google says it disrupted NetNut, a residential proxy network linked to a botnet of at least 2 million devices, by disabling related accounts and services and using Play Protect to warn users and disable known apps.
