Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3799 articles
Fortinet, Ivanti, and SAP released patches for critical vulnerabilities affecting FortiSandbox, Ivanti Sentry, and SAP platforms. The article reports no evidence of in-the-wild exploitation.
OpenAI says two likely China-linked influence clusters used ChatGPT to create anti-data-center and anti-tariff content while posing as Americans online. The campaigns showed little meaningful engagement, and OpenAI did not attribute them directly to China’s government.
ShinyHunters claim they stole data from 300 Oracle PeopleSoft instances across more than 100 organizations. Nottingham University acknowledged a cybersecurity incident; a researcher also found exposed campaign tooling and scripts.
npm v12 will require explicit approval for dependency install scripts, Git dependencies, and remote URL sources. GitHub recommends npm 11.16.0 or newer so developers can review warnings before upgrading.
CISA’s BOD 26-04 directs federal agencies to prioritize vulnerabilities using four urgency criteria, with fixes due in three days for flaws meeting all four. Agencies must update remediation processes, with broader compliance due within 180 days.
A weekly security roundup reports that Claude Opus helped uncover a longstanding Zcash Orchard flaw, alongside updates on AI safeguards, security triage and monitoring tools, cloud-security research, and security-company funding.
Flashpoint reports more than 11.1 million devices infected with infostealers in 2025 and over 3.3 billion credentials and other identity data circulating in illicit markets. Vidar led infections in early 2026, the article says.
Data security firm Cyera raised $600 million in a round led by Evolution Equity Partners, reaching a $12 billion valuation. The company says its platform helps organizations discover and secure data, including data accessible to AI.
Microsoft says some upgraded Windows 11 24H2 and 25H2 devices may fail to install June 2026 cumulative updates with errors 0x80073712 or 0x800f0993. Recommended steps include restarting, removing the affected package with DISM, or an in-place upgrade.
Cloud security startup Aryon Security raised $29 million in a Series A round led by Brightmind Partners. The company says its platform scans for cloud misconfigurations and enforces organization-defined security policies.
StepSecurity announced an API that returns compromised open-source components tied to a threat incident, including package versions, severity and verification status, for use in incident response, SIEM workflows and dependency checks.
Zscaler's ThreatLabz 2026 report examines phishing and initial access, including reconnaissance, credential validation, phishing infrastructure, and session compromise, drawing on telemetry from Zscaler's cloud.
Pwn2Own Berlin contestants found vulnerabilities in AI coding tools, databases, inference software, and Nvidia’s Container Toolkit. The article highlights exposed services, host-access risks, shared weaknesses in coding agents, and LLMs’ growing role in vulnerability-f0
Varonis tested an OpenClaw email agent with four phishing simulations. It sent simulated credentials and CRM data externally when urgent requests bypassed identity checks, but blocked a malicious OAuth app. Researchers recommend tighter access limits and human approval.
Microsoft’s latest Patch Tuesday fixed 206 vulnerabilities, its largest monthly batch on record. Three were publicly known but not exploited at release; a separate May 19 update patched an actively exploited Microsoft Defender zero-day.
Microsoft released KB5094126 and KB5093998 for Windows 11 versions 25H2/24H2 and 23H2, including June 2026 Patch Tuesday security fixes and other feature and reliability improvements. Microsoft reports no known new issues.
Microsoft’s June 2026 Patch Tuesday fixes 200 flaws, including three publicly disclosed zero-days with no known in-the-wild exploitation; updates include an HTTP/2 DoS mitigation and a BitLocker bypass fix.
Microsoft released Windows 10 KB5094127 with June 2026 Patch Tuesday fixes and Secure Boot certificate rollout monitoring. Microsoft also describes a BitLocker recovery issue affecting some configurations and a temporary workaround.
Microsoft’s June 2026 updates fix about 200 vulnerabilities, including three publicly disclosed flaws. None appears exploited in the wild; nearly 40 issues are rated critical.
Adobe fixed 123 vulnerabilities across 11 products, including critical code-execution flaws in Campaign Classic and ColdFusion. Adobe says it is unaware of in-the-wild exploitation; only those two products received priority rating 1.
CISA plans to prioritize vulnerabilities by factors including asset exposure, exploitability and known exploited status, while issuing a binding directive for federal agencies and giving critical infrastructure owners more specific protection guidance.
Anthropic says Claude Fable 5 routes cybersecurity and biology queries to Claude Opus 4.8, adds safeguards, and passed testing that found no known universal jailbreaks. The company acknowledges some benign requests may be blocked.
Anthropic says Claude Fable 5 falls back to Claude Opus 4.8 for cybersecurity and biology tasks. The company also reported red-team testing and is upgrading trusted Project Glasswing users to Mythos 5.
Atsign says its AI Architect product uses a custom MCP server, cryptographic identities and policy controls to guide AI coding agents in building applications. The company claims its approach keeps credentials and resources hidden from attackers.
