Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3800 articles
Anthropic is adding about 150 organizations across 15 countries to Project Glasswing after Claude Mythos Preview flagged more than 10,000 high- or critical-severity vulnerabilities. Over 90% of 1,752 reviewed findings were confirmed valid; triage and patching remain key
Google's June 2026 Android update fixes 124 vulnerabilities, including CVE-2025-48595, which it says may be under limited, targeted exploitation. The flaw affects Android 14 and later; the update has two patch levels.
Anthropic is expanding Project Glasswing to about 150 organizations, giving them access to Mythos for security work. The company reports more than 23,000 potential vulnerabilities identified, but says only 75 critical and high-severity issues have been patched.
The roundup covers active exploitation of a PAN-OS flaw, an unpatched Gogs zero-day, GlassWorm C2 takedowns, CERT-In patching guidance, and campaigns involving AI, OAuth phishing and remote-access malware.
After Colorado Gov. Jared Polis commuted her sentence for seven felonies tied to breaching Mesa County election facilities, Tina Peters reiterated election-fraud claims and vowed to seek expungement; Democrats and election officials criticized the commutation.
Spanish police arrested a suspect over the publication of sensitive personal data linked to state institutions. Authorities seized devices; INCIBE said its systems were not directly compromised.
Silent Push says DriveSurge uses zTDS to route visitors of thousands of compromised sites to ClickFix or fake browser-update lures. Researchers also found a macOS-targeting JavaScript payload and recommend avoiding commands users do not understand.
Wiz describes how its platform covers OpenShift security across posture and compliance, deployment controls, runtime monitoring, and investigations in cloud, hybrid, on-premises, and air-gapped environments.
USPS proposed ballot-mailing rules with unique barcodes and verification steps after a judge declined, on procedural grounds, to block Trump’s order. Critics warn the changes could enable ballot tracking or interference.
Dutch police say they disrupted a botnet of 17 million devices after a researcher reported it. Authorities identified 200 control servers; several were seized, and the hosting provider took down the network. Local media linked the operation to Asocks.
Wiz announced general availability of API Security Posture Management, which discovers cloud APIs, assesses exposure and exploitability, maps risks to cloud resources and sensitive data, and provides remediation guidance.
Microsoft says KB5089573 and later updates fix KB5089549 installation failures on Windows 11 devices with low EFI System Partition space. Known Issue Rollback and Group Policy are workarounds for devices not yet updated.
Microsoft restored My Sign-Ins after an outage blocked some users from setting up MFA or accessing the service, returning 504 errors. It attributed the issue to a cache configuration change and failover that drove high CPU and memory use during peak EU traffic.
Dragos acquired Phosphorus to expand connected-device security capabilities for operational networks. Customers are expected to gain expanded asset visibility and device intelligence first, followed by automated remediation workflows and a unified platform.
Researchers say the codexui-android npm package and two BrutalStrike-linked Android apps stole Codex tokens and sent them to sentry[.]anyclaw[.]store. Separately, Google elevated a finding about delayed API-key revocation to a P0 bug.
A monthly roundup covers alleged ShinyHunters data theft, a French data-breach arrest, malware on Hugging Face and OpenVSX, espionage campaigns, and the arrest of Dream Market’s suspected administrator.
Researchers demonstrated 47 zero-days at Pwn2Own Berlin 2026, including exploits affecting AI tools, Microsoft products, and VMware ESXi. Trend Micro says it shipped nine network filters ahead of vendor patches.
A global regulatory roundup covers cybersecurity guidance, AI and data-protection oversight, DMA enforcement, alleged exposure of AI conversation metadata, and warnings about heightened cyber threats.
Dutch authorities and the NCSC dismantled a botnet involving at least 17 million devices and more than 200 Netherlands-based servers. Local reporting linked the unnamed botnet to Asocks; a hosting provider took it offline after authorities seized some servers.
Ramanan Pathmanathan was sentenced to 33 years in U.S. federal prison after pleading guilty to producing child sexual abuse material and coercing a minor. Prosecutors said he used fake Instagram and Facebook Messenger identities to target more than 145 children.
Microsoft condemned pseudonymous researcher Nightmare Eclipse’s releases of six Windows zero-days with proof-of-concept code. Three have been exploited, while three remain unpatched with no confirmed exploitation; Microsoft says its Digital Crimes Unit will pursue enab現
European intelligence officials say Russia is intensifying efforts to obtain Western technology through front companies, intermediaries and cyber operations, including attacks on firms and critical infrastructure.
A Commerce inspector general report found NIST’s NVD backlog grew to over 27,000 unprocessed vulnerabilities amid planning failures, inefficient enrichment and duplicated work with CISA. NIST agreed to six recommendations.
Zachary Sweeney pleaded not guilty to charges alleging child exploitation and CSAM distribution while involved with 764. Prosecutors cite FBI investigations dating to 2022; agents previously seized devices they could not examine because of encryption and passwords.
