Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3799 articles
A federal judge ruled that the Trump administration’s SAVE voter database violated federal privacy laws and ordered it dismantled. The court cited unreliable citizenship data and voters whose registrations were wrongly canceled.
The Trump administration plans to accelerate civilian agencies’ shift to quantum-resistant encryption, potentially moving the deadline from 2035 to 2029 or 2030. Agencies missing the new deadline would explain why to OMB; military networks are excluded.
SOCRadar says a campaign active since at least February 2026 targeted over 430,000 FortiGate firewalls, using a custom sniffer to capture authentication data. Fortinet said the earlier credential collection involved previously compromised credentials, not a new flaw or
Five Eyes agencies warn that advanced AI cyber capabilities could become broadly available within months, urging organizations to address weak patching, access controls, exposed systems and other basic security gaps.
Wiz has launched its Runtime Sensor for Windows, offering runtime threat monitoring, response, and vulnerability validation for Windows workloads across cloud and hybrid environments.
Microsoft attributes an attack on 141 Mastra npm packages to North Korean group Sapphire Sleet. A compromised maintainer account added a malicious dependency whose installer could download and run malware; affected users are advised to check systems and rotate secrets.
EU member states approved Ukraine’s access to the EU Cybersecurity Reserve, allowing it to request expert incident response and recovery support when attacks exceed its own capabilities.
Five Eyes cyber agencies warn AI is accelerating cyber threats and urge leaders to strengthen foundational security, resilience, patching, access controls, and incident readiness while using AI to improve defence.
The roundup covers EU AI Act amendments, proposed Canadian privacy legislation, new Vermont privacy laws, CISA’s risk-based federal remediation directive, and the FTC’s final order following Illuminate Education’s student-data breach.
XLab reports that AryStinger has compromised more than 4,000 outdated routers, mainly D-Link models, and some NAS systems. The botnet supports scanning, proxying, DNS tampering and network monitoring; researchers have not linked it to a known actor.
Microsoft attributes the compromise of more than 140 Mastra npm packages to North Korean actor Sapphire Sleet. The packages delivered a dependency that deployed a cross-platform stealer targeting credentials, API keys, and cryptocurrency wallets.
CERT-AGID reports active campaigns impersonating Italy’s Revenue Agency to collect tax, crypto, and banking details; one uses an adaptive fake portal and a bogus error message to prompt victims to call a fraudulent office.
Unit 42 reports “FortiBleed” password spraying against exposed Fortinet devices, followed by credential extraction, offline cracking and reuse. MSSQL targeting was observed; Sophos targeting was reported. An IAB’s sale claim remains unvalidated.
Human Rights Watch says Bulgarian export records show Circles received licenses to sell surveillance tools to agencies in 10 countries from 2018–2023, raising concerns about EU controls. Bulgaria says it enforces human-rights rules; current sales are unclear.
Authorities from four countries seized domains, took down more than 100 SocGholish servers and disinfected nearly 15,000 compromised websites, disrupting a malware platform linked to ransomware and espionage activity.
ESET reports that The Gentlemen supplies affiliates with EDR-killing tools, including eight GentleKiller variants that abuse vulnerable drivers. It also identified the browser-data stealer OxideHarvest and noted rapid adoption of BYOVD exploits.
Dutch authorities and international partners disrupted SocGholish infrastructure, took down 106 servers and cleaned 14,971 infected WordPress sites. Owners were urged to update CMS software, change credentials and remove suspicious accounts.
SecurityWeek’s roundup covers a critical phpBB flaw, a WordPress plugin supply-chain attack, malicious JetBrains plugins stealing AI keys, other security issues, and recent actions by AWS, Apple and the US DOT.
Anthony Belford was indicted on one cyberstalking count for allegedly using fake social media and email accounts to impersonate and harass a Georgia college student with AI-generated nude images and false claims.
Hudson Rock says it processed 2,732 ethical disclosures after its FortiBleed report, shared data with national CERTs, and added the dataset to Cavalier, its API and a free lookup portal. It says NCSC, CISA and INCD issued guidance using its intelligence.
CISA urged organizations to harden internet-facing Fortinet devices after reports of the FortiBleed credential-theft campaign. SOCRadar reported more than 86,000 credentials, while researchers and Huntress described verified logins and affected organizations.
Cisco announced an agreement to acquire identity security company WideField Security, whose tools discover identities, assess exposure and authentication hygiene, monitor sessions, and provide behavioral analytics. Financial terms were not disclosed.
Authorities in four countries, Europol and private partners disrupted SocGholish infrastructure, taking down 106 command-and-control servers and domains and removing malware from nearly 15,000 infected WordPress sites.
A multinational operation disrupted the SocGholish (FakeUpdates) botnet, taking down 106 servers and remediating nearly 15,000 infected websites. Authorities also warned that traffic distribution systems are used to deliver ransomware and phishing attacks.
