Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3799 articles
Google says the suspected Chinese government-linked group UNC6508 targeted North American medical, academic and military research organizations, using InfiniteRed malware and email content-compliance rules to collect information.
NewCore emerged from stealth with $66 million in seed funding and announced an identity platform for human, machine, and agentic identities. The company says its Secure Split Key design addresses attacks on SAML signing infrastructure.
Oleksii Lytvynenko pleaded guilty in the U.S. to wire fraud conspiracy tied to Conti. He admitted joining the group and developing a malware loader; sentencing is scheduled for September 10, 2026.
The article reports that a June 12, 2026 U.S. export directive led Anthropic to disable Claude Fable 5 and Mythos 5 worldwide after a code-review jailbreak surfaced known flaws. It says deemed-export rules made nationality-based access controls impractical.
The FBI, Google and Black Lotus Labs dismantled Outsider Enterprise under Operation Riptide. Authorities attribute more than 3.8 million stolen card records and estimated $1.9 billion in losses to its AI-assisted SMS phishing campaigns.
The roundup covers new and proposed rules on GDPR breach notifications, AI content labeling, consumer IoT privacy, data intermediaries, health information, surveillance pricing and conversational AI, alongside an AI-model access suspension linked to a reported jailbreak
The U.S. ordered Anthropic to suspend foreign access to Fable 5 and Mythos 5 over a reported jailbreak that could prompt a model to identify software flaws. Anthropic disputed the finding’s severity and said it is working to restore access.
GitHub says npm 12 will block dependency install scripts by default, responding to supply-chain attacks that abused automatic script execution. Developers can review and approve trusted scripts ahead of the change.
Anthropic says it disabled Fable 5 and Mythos 5 worldwide after a U.S. directive barred foreign nationals from accessing them. The order reportedly followed a narrow jailbreak; Anthropic disputes the assessment and is seeking to restore access.
Anthropic says a U.S. order requires it to suspend foreign nationals’ access to Fable 5 and Mythos 5 over national security concerns. The company disputes the rationale, citing its safeguards and the limited scope of the alleged jailbreak.
Anthropic said it took its Fable 5 and Mythos 5 AI models offline after a US directive aimed at preventing foreign nationals from using them. The company cited cybersecurity fears but said the directive did not specify the national security concerns.
Section 702 is set to lapse after Congress and the White House failed to agree on renewal. Existing court-approved orders may continue, but new orders could be unavailable, and telecom providers’ compliance remains uncertain.
A Missouri bankruptcy court administrator approved a $46.8 million settlement fund for victims of the 2023 23andMe breach. Victim payouts depend on harm, while more than $14 million is allocated to claims administrator Kroll.
The FBI, Google and Lumen disrupted Outsider in Operation Ghost Hook, seizing servers, domains and about $100,000 in payment wallets. Authorities linked its phishing infrastructure to nearly 3.9 million stolen cards and estimated losses of $1.9 billion.
Reports describe AUR packages delivering the atomic-lockfile npm package and Linux malware that targets credentials and developer secrets, with optional eBPF rootkit capabilities. AUR maintainers are working to remove malicious commits.
Oleksii Lytvynenko pleaded guilty to wire-fraud conspiracy tied to Conti attacks in 2021–22. He admitted possessing data from 12 victims and helping code a loader; court documents say Conti targeted over 1,000 victims and collected more than $150 million.
Maine temporarily disabled public access to its breach-notification portal after fake disclosures impersonating Discord and VRChat were submitted. The state removed the hoaxes and is reviewing procedures; VRChat confirmed its filing was fraudulent.
Google sued a Chinese cybercrime network it accuses of using Gemini and the Outsider phishing-as-a-service kit for smishing. Google says the operation targeted more than 100,000 people and is working with U.S. carriers to block messages.
Former Conti member Oleksii Lytvynenko pleaded guilty to conspiracy to commit wire fraud. Prosecutors say he developed malware used in Conti attacks on more than 1,000 victims; he faces up to 20 years in prison.
U.S. authorities seized CFAKE[.]com and SOCFAKE[.]com under the TAKE IT DOWN Act, alleging they hosted thousands of nonconsensual AI-generated or altered sexual images. A French suspect was arrested, and investigators seized cryptocurrency.
SecurityWeek’s roundup covers reported Google security layoffs, the AudiA6 crypto-laundering takedown, a $400 million Coupang fine, Oxford’s CareerConnect breach, an actively exploited LiteLLM flaw, and other security developments.
The proposed EU Cloud and AI Development Act would grade cloud and AI services by sovereignty level. The article outlines potential implications for public-sector suppliers and security data, while noting the proposal still needs approval.
CyberCorps is adding AI-focused training for scholarship recipients as Congress pushes to expand scholarships and recommends $60 million–$70 million for FY2027, against a proposed $21.7 million budget.
Microsoft fixed WUSA failures affecting Windows 11 24H2/25H2 and Windows Server 2025 when installing updates from network shares containing multiple .msu files. June 2026 cumulative updates include the fix.
