Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3800 articles
Offroad emerged from stealth with $7 million in seed funding and an agentic AI identity-risk platform. Its audit of 2,890 public OAuth apps found 918 with at least one structural exposure signal.
Willow emerged from stealth with an identity and access platform for enterprise AI agents and announced $7 million in seed funding. It offers agent identities, runtime access controls, shadow-AI discovery, and audit logs.
A cybersecurity industry roundup covers CrowdStrike and Palo Alto earnings, Microsoft’s dispute with a researcher over Windows zero-day disclosures, expanded access to Anthropic’s Mythos, and new security tools, funding and acquisitions.
Proofpoint says financially motivated group TA4922 has expanded targeting into Europe and South Africa, using social engineering, credential phishing, and malware including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT.
Disruption Week, a joint law-enforcement and tech-industry operation targeting scam networks in Southeast Asia, disrupted over 1.4 million accounts and related infrastructure, led to 63 arrests, and froze more than $3.8 million in cryptocurrency.
CISA Acting Director Nick Andersen says the agency will issue a binding directive for federal agencies focused partly on AI vulnerability management and testing, and help establish the executive order’s cyber clearinghouse.
Europol says Operation Kratos 2 led to 29 arrests, dismantled nine piracy groups and took down more than 27,000 illegal streaming URLs. Investigators also identified thousands of related domains and IP addresses.
OFAC sanctioned Iran’s Nobitex and three other exchanges, citing sanctions evasion, IRGC-linked transactions, and wallets associated with ransomware actors. Chainalysis estimated IRGC-linked addresses received over half of Iran’s crypto value in Q4 2025.
Proofpoint reports that the financially motivated TA4922 group has expanded targeting into Europe and South Africa, using localized phishing and malware including Atlas RAT, RomulusLoader, and SilentRunLoader.
DHS Secretary Markwayne Mullin told Congress CISA could operate with 2,800 staff, compared with about 2,200 now. Proposed fiscal 2027 cuts, state and local support, and the agency's vacant director position remain under debate.
U.S. agencies report attacks on internet-exposed automatic tank gauge systems, where weak authentication and software flaws can enable settings or alerts to be changed. They urge operators to remove internet exposure and strengthen access controls.
Sysdig’s May 2026 briefing covers ShinyHunters’ claim of Canvas data theft, a TeamPCP supply-chain attack, exposed CISA contractor credentials, an LLM-driven marimo intrusion, rapid exploitation of AI-related flaws, and other cloud security findings.
The episode discusses the Miasma package campaign, Moika’s credential-stealing packages, shifts toward CI pipeline attacks, and trends in malicious packages and AI skills.
Arctic Wolf reports that Kali365 has expanded beyond Microsoft 365 to target AWS, Okta, Xerox DocuShare and Russian services. Its device-code phishing captures OAuth tokens after victims complete authentication, while researchers identified 126 active malicious hosts.
Google is rolling out Fake Call Detection on Android 12 and later. When both parties use supported Google apps, encrypted signals help verify calls; if a contact’s device confirms it is not calling, the recipient is warned.
Operation KRATOS 2 involved authorities from 13 countries, who dismantled nine crime groups, arrested 29 suspects and removed more than 27,000 illegal streaming URLs. Europol warned of malware, spyware and data-theft risks to users.
Researchers report that Weedhack targets Minecraft players through YouTube and SEO poisoning, CountLoader has infected an estimated 86,000 machines, and pirated streaming sites distribute a cryptocurrency miner through fake updates.
McAfee reports that the WeedHack infostealer campaign has affected 116,464 systems, targeting Minecraft players through malicious mods, clients, cheats and utilities promoted on YouTube and through SEO poisoning.
Google’s June 2026 Android update patches 124 vulnerabilities. Google says CVE-2025-48595, a Framework flaw affecting Android 14, 15, 16 and 16 QPR2, may be under limited, targeted exploitation.
McAfee telemetry attributes 116,464 impacted systems to the WeedHack campaign, which distributes malicious Minecraft tools and steals credentials and wallet data. Its premium tier adds remote-access features.
A revised executive order makes federal testing of frontier AI models voluntary, limits access to up to 30 days and rules out mandatory licensing. Treasury will lead a cybersecurity clearinghouse for vulnerability coordination.
Defense officials say the Pentagon wants cyber considered from the start of military planning and security built into AI systems, citing the value of combining cyber effects with physical operations.
Trump's order creates a voluntary federal process to review advanced AI systems for national-security risks for up to 30 days before release. The White House says frontier labs may share cyber models to support critical-infrastructure security and government defenses.
AttackIQ released two assessments emulating The Gentlemen ransomware’s reported TTPs, including persistence, Defender evasion, Active Directory discovery, SMB lateral movement and file encryption, to help customers test security controls.
