Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3800 articles
WatchGuard and ESET report active Grandoreiro and BTMOB campaigns targeting organizations and users in Europe and Latin America, using phishing, DLL side-loading, WebRTC-related communications and Android accessibility services to steal financial data and enable remote.
OMB’s M-26-14 replaces the prior federal logging mandate with separate priorities for real-time monitoring and deeper forensic retention. CISA is directed to issue a Logging Reference Architecture within 90 days; eSentire also promotes its logging services.
CERT-AGID reports email and SMS phishing impersonating SEND and PagoPA, directing users to fake traffic-fine payment pages to steal credit card details. It is coordinating takedowns and sharing related indicators.
GCHQ chief Anne Keast-Butler warned that AI is changing cyber offense and defense, describing GCHQ’s development of defensive capabilities integrated with agentic AI and citing growing AI-enabled risks from China and Russia.
The FBI warned that Silent Ransom Group targets U.S. law firms with fake IT support calls and phishing, and may send an associate to attach a storage device when remote access fails. The group reportedly steals data without encrypting systems.
OpenAI outlined a five-part plan for the 2026 midterms, including cybersecurity support for election officials, reliable voting information, deepfake watermarking, limits on election interference, and an Associated Press data-sharing partnership.
GCHQ Director Anne Keast-Butler warned that AI is being weaponized and Russia is escalating hybrid activity. She said GCHQ plans to integrate agentic AI into cyber defense and urged greater cybersecurity urgency.
Wiz Forensics is generally available to Runtime Sensor customers, automatically collecting threat-scoped artifacts when detections fire and using AI to analyze evidence for investigation verdicts.
The FBI warns that Silent Ransom Group actors are targeting U.S. law firms by impersonating IT support, seeking remote access, or visiting in person to connect storage devices and steal data for extortion.
CrowdStrike, Google and The Shadowserver Foundation disrupted Glassworm by cutting off four C2 channels. The botnet targeted developers through malicious extensions and packages; infected hosts now beacon to 164.92.88[.]210.
The newsletter covers Megalodon’s reported compromise of more than 5,500 GitHub repositories to steal CI secrets and credentials, alongside supply-chain security findings and other security industry developments.
RevEng.AI raised $15 million in Series A funding and says its BinNet AI platform analyzes compiled software without source code to identify vulnerabilities, backdoors, and other security issues.
Catalin Dragomir was sentenced to 56 months in U.S. prison after pleading guilty to obtaining information from a protected computer and aggravated identity theft. Prosecutors said he hacked an Oregon state network and sold access to it and other networks.
Microsoft’s optional KB5089573 preview for Windows 11 25H2 and 24H2 includes performance and reliability changes, Windows Hello refinements, and expanded phased delivery of replacement Secure Boot certificates; it contains no security updates.
Dutch police arrested a 35-year-old man suspected of repeatedly hacking AFC Ajax. Ajax said flaws exposed data on hundreds and enabled ticket transfers and stadium-ban changes; RTL reported API access to over 300,000 accounts. Ajax patched the flaws.
The FBI says Silent Ransom Group is posing as IT support to target law firms, using remote access or in-person USB drives to steal data and extort victims without deploying file-encrypting ransomware.
Putin appointed former Rostec cybersecurity executive Andrei Kozlov as aide to Security Council Secretary Sergei Shoigu. The Insider reported leaked data linking Kozlov’s clearance to GRU unit 26165, associated with APT28; the connection remains alleged.
Dutch authorities arrested two IT entrepreneurs over alleged EU sanctions violations, searching business sites and data centers and seizing more than 800 servers. Investigators allege the infrastructure supported Russian-linked cyberattacks and disinformation; MIRhos
EVERY8D says service disruptions followed server-disk data corruption and system anomalies. Trend Micro is conducting forensics; initial findings show no concrete evidence of mass customer-data leakage, while the cause and impact remain under investigation.
OMB memo M-26-14 replaces federal logging guidance from 2021 with a risk-based approach. CISA has 90 days to develop a logging architecture; experts warn rescinding the old guidance first could delay agency prioritization.
Apple released ML-KEM and ML-DSA implementations in corecrypto, plus formal verification tools and documentation. Apple says verification uncovered a missing ML-DSA step that could have silently broken digital signatures if it had reached production.
ANY.RUN’s May 2026 roundup describes six campaign patterns, including fake invitations, Agent Tesla document lures, OTP phishing, fileless delivery from compromised B2B sites, ScreenConnect remote-access chains and BlobPhish browser-based credential theft.
Anthropic says Project Glasswing identified over 10,000 high- or critical-severity vulnerabilities. Partner and evaluation results include Cloudflare and Mozilla findings, while Anthropic cites human triage and patching capacity as the main bottleneck.
Microsoft is previewing automatic isolation in Defender for Endpoint to limit lateral movement and contain attacks. Isolated devices lose network access but remain connected to the service for monitoring.
