Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3800 articles
Atsign says its AI Architect product uses a custom MCP server, cryptographic identities and policy controls to guide AI coding agents in building applications. The company claims its approach keeps credentials and resources hidden from attackers.
SAP released 15 security notes, including fixes for four critical flaws in NetWeaver, Commerce Cloud and Data Hub. Issues include SAML identity tampering, RFC-related memory corruption, missing Spring Security headers and directory traversal.
New Shai-Hulud variants targeted more than 100 npm and PyPI packages. The Miasma and Hades variants harvest credentials and spread through accessible packages; researchers identified 471 malicious artifacts.
Apple says iOS 27 will let Safari and the Passwords app automatically update eligible weak, duplicate, or compromised passwords. A developer beta is available, and Apple says processing uses on-device models and Private Cloud Compute.
WhatsApp says NSO Group used social engineering and malicious links to target users despite a court injunction. WhatsApp is seeking a contempt order and says it removed NSO-related test accounts and groups.
Armenia’s Civil Contract party won nearly half the vote after an eight-month Russia-linked influence campaign used fabricated news, manipulated videos, bots and false polling-station bomb threats, according to researchers and authorities.
NFCShare is reportedly distributed as fake banking-app updates on GitHub, stealing card details and PINs through NFC prompts from customers of banks across Europe. New APK packaging reportedly disrupts some automated analysis tools.
The UK has given Apple, Google and other tech firms three months to add device-level controls that detect and block nude images of children. The government says legislation, fines and criminal liability could follow noncompliance.
Meta says WhatsApp disrupted alleged NSO-linked phishing attempts after user reports, removed test accounts and groups, and identified malicious-link lures. WhatsApp urged users to update their apps and operating systems.
Meta says it disrupted an NSO Group-linked spearphishing campaign on WhatsApp and filed a contempt complaint alleging the spyware maker violated an injunction barring it from targeting WhatsApp users.
Meta says it blocked spear-phishing attempts linked to NSO Group, removed related WhatsApp test accounts and groups, and is seeking a federal contempt order. It advises at-risk users to update apps and enable strict account settings.
In sponsored content, Wazuh describes its managed SIEM/XDR platform for hybrid and multi-cloud environments, highlighting automated operations, endpoint monitoring, scalable indexing, and an AI analyst that generates weekly assessments and remediation recommendations.
A Security emerged from stealth after raising $37 million. The company says its platform uses AI agents to map and validate exploit paths across enterprise environments, then initiate remediation and adjust compensating controls.
WhatsApp says it detected an NSO-linked social-engineering attempt using malicious links, disabled test accounts and groups, and is seeking contempt proceedings over an alleged violation of a permanent injunction.
Twenty-six cybersecurity-related M&A deals were announced in May 2026. Highlighted transactions include acquisitions intended to expand AI and browser security, identity management, endpoint data protection, and industrial cybersecurity capabilities.
A new White House executive order prioritizes federal cyber defenses, creates voluntary early access to frontier AI models, and establishes an AI Cybersecurity Clearinghouse for vulnerability and remediation information. Its impact depends on implementation and industry
Resecurity reports that Silent Ransom Group uses compromised routers and other devices for fast-flux DNS, identifying nodes across 18 countries and 22 ISPs rotating records for two domains linked to the group.
OpenAI is expanding Lockdown Mode to limit outbound requests that could enable prompt-injection data exfiltration, and Active Sessions to review and end logins. It also describes Advanced Account Security protections announced earlier.
EclecticIQ’s customer case study describes how consultant Jeremy Nichols uses its Intelligence Center to prioritize threat intelligence, automate repetitive work, and help analysts focus on investigation and response.
A newsletter roundup covers ENISA’s assessment of EU sector readiness, an Italian warning over workplace AI stress analysis, and new government actions and laws on cybersecurity, AI governance, and consumer data privacy.
Mandiant says the Silent Ransom Group targeted dozens of organizations with invoice-themed phishing and fake IT support calls, then stole sensitive data for extortion. The FBI also warned of in-person theft attempts.
Seattle cybersecurity startup Emphere raised $2.1 million in pre-seed funding to develop its AI-powered vulnerability remediation platform, which the company says analyzes software dependencies and applies and validates fixes.
OpenAI is rolling out an optional ChatGPT Lockdown Mode that limits web and external-service access to reduce prompt-injection data-exfiltration risks. It disables or restricts several features but does not eliminate all risk.
An autonomous agent reported 21 confirmed FFmpeg zero-days, including flaws up to 23 years old, while Chrome 149 patched a record 429 bugs. The article urges rapid updates, including bundled FFmpeg copies.
