Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3793 articles
Adversa AI reports that Bash obfuscation can bypass guards in 10 of 11 tested open-source AI agents, potentially enabling attacker-supplied commands to run with a developer’s authority under specific conditions.
Kali Linux 2026.2 adds nine tools, upgrades its kernel, and updates NetHunter. VM images now omit graphics firmware, reducing the initrd to 60 MB and cutting boot time by about three times in a QEMU test.
The U.S. is offering up to $10 million for information on Russia-linked groups UNC5792 and UNC4221. The FBI says they use social engineering to steal messaging-account credentials and backup recovery keys.
Ukraine's SSU says it and the FBI uncovered a long-running Russian intelligence campaign using fake messaging-app support SMS to steal credentials and sensitive information. The article also describes separate phishing activity attributed to named actors.
The Supreme Court ruled 6-3 that police searches of cellphone location history require a warrant, potentially constraining geofence searches. It sent Okello Chatrie’s case back to the Fourth Circuit to assess whether his warrant was constitutional.
A Huntress demonstration escalated a standard Microsoft 365 account to Global Admin in five and a half minutes by exploiting excessive application permissions. In a 12,000-tenant review, common gaps included weak MFA and over-privileged users.
Hunt.io's Hunt v3 rebuild adds threat-hunting features including passive DNS history, netblock browsing, vulnerability workflows, AttackCapture analysis, persistent alerts, more than 60 API endpoints, and an OAuth-enabled MCP server.
A Senate discussion draft of the AI AGENT Act would let users of large platforms choose an AI agent provider vetted for privacy, data security and user-interest safeguards, with human identity links and permission controls.
WhatsApp is rolling out username reservations so users can connect without sharing phone numbers. Optional username keys add control over first-time contacts; availability will expand gradually over the coming months.
Microsoft found a Perplexity-impersonating Chrome extension that sent searches and address-bar keystrokes to an attacker-controlled server before redirecting users to real results. Google removed it; Microsoft found no proof of password theft.
Microsoft extended Windows Server 2022 hotpatching through October 2027 for enrolled Datacenter: Azure Edition systems, allowing monthly security updates without restarts. Other updates may still require reboots; broader default enablement is planned for May 2026.
WhatsApp is gradually rolling out usernames that let users hide their phone numbers from non-contacts. Users can reserve names ahead of launch and optionally require a key before others can message them.
In a 6-3 ruling in Chatrie v. United States, the Supreme Court held that government collection of phone location data through a geofence warrant is a Fourth Amendment search, but did not decide whether the warrant in Chatrie’s case was valid.
Blackpoint reports attackers exploited SimpleHelp flaw CVE-2026-48558 to deploy TaskWeaver and Djinn Stealer. The cross-platform stealer targets developer, cloud, AI-tool and cryptocurrency credentials; administrators should patch and rotate credentials.
The U.S. State Department is offering up to $10 million for information on UNC5792 and UNC4221. Authorities say the groups used fake support messages to steal Signal backup recovery keys and access private communications.
WhatsApp is opening username reservations ahead of a gradual rollout later this year. Usernames will let people message without showing their phone number to new contacts or businesses; an optional username key adds a secondary messaging requirement.
Barra dos Coqueiros Municipality says it detected an attempted cyberattack against municipal technology servers, took measures to control the situation and alerted state and federal police. No successful compromise is described.
AI security startup Straiker raised $64 million in a Series A round, bringing its total funding to $85 million. Its platform provides AI-agent discovery, pre-deployment adversarial testing and runtime protection, according to the company.
Wiz says its Sensor Workload Scanner is generally available for on-premises VMware, bare-metal and self-hosted Kubernetes workloads, extending its risk visibility, runtime threat detection and attack-path analysis across hybrid environments.
Wiz describes how its exposure management products combine cloud and on-premises security data to help public-sector agencies prioritize risks, map attack paths and coordinate remediation.
OpenAI is limiting GPT-5.6 Sol to administration-approved customers, while Anthropic received approval for limited Mythos 5 access by cyber defenders and infrastructure providers amid U.S. review of advanced AI models’ cybersecurity risks.
The article says a federal executive order sets 2030 and 2031 post-quantum cryptography deadlines and urges CISOs to establish ownership, map cryptographic dependencies, fund migration plans and build crypto-agility, citing harvest-now-decrypt-later risks.
The US is offering up to $10 million for information on UNC5792 actors. CISA and the FBI warn that UNC5792 and UNC4221 are seeking messaging-app Backup Recovery Keys to access victims’ historical conversations.
OpenAI is previewing GPT-5.6 Sol to approved partners, describing it as its strongest cybersecurity model. The company reports vulnerability-finding and patch-development strengths, alongside real-time safeguards and automated red-teaming.
