Goldman Sachs says it is working with Anthropic and cybersecurity partners to assess risks from Mythos, which Anthropic says can find and exploit sophisticated software vulnerabilities. The model is being shared with 11 organizations through Project Glasswing.
Basic-Fit confirmed unauthorized access to a centralized member-data system and download of personal information. Up to 1 million members may be affected; the company says access was stopped within minutes and the investigation is ongoing.
The TierOne dark web forum announced an exploit-writing contest running April 13–May 14, 2026, with $10,000 in prizes. Topics include RCE, IDOR, firmware attacks and AV/EDR bypasses; the ransomware group cry0 reportedly sponsors it.
Zimbabwe officials cite rising cyber fraud and plan an AI Cyber Shield, a national operations centre and incident-response team. They estimate mobile money fraud exceeds US$30 million annually and say phishing and social engineering have risen over 40%.
A reported ransomware incident at Dutch software vendor ChipSoft led 11 hospitals to disconnect its systems. Z-CERT is coordinating support; no critical care stoppages or indications of patient-data leakage were reported.
Authorities say a joint FBI and Indonesian police operation dismantled W3LL phishing infrastructure, seized domains and detained its suspected developer. The service targeted corporate accounts and was linked to more than $20 million in attempted fraud.
This roundup covers APT28 router-based DNS hijacking, the reported $285 million Drift Protocol theft, EU uncertainty over voluntary CSAM scanning, recoverable Signal notification data on iPhones, and a new U.S. Treasury digital-asset cybersecurity initiative.
Researchers say TotalRecall Reloaded can inject into Windows Recall’s less-protected AIXHost.exe as the current user, extracting decrypted screenshots and indexed data after Windows Hello authentication; Microsoft closed the report as “Not a Vulnerability.”
FBI forensic extraction reportedly recovered incoming Signal message fragments from an iPhone’s notification database, even after Signal was removed. The article says the source was notification previews, not Signal’s encrypted storage.
Treasury’s OCCIP will provide eligible U.S.-based digital-asset firms with threat intelligence at no cost. The initiative responds to rising attacks, including a reported $280 million theft from Drift that the article attributes to alleged North Korean hackers.
GitLab released CE and EE updates fixing 12 vulnerabilities, including CVE-2026-5173, an authenticated WebSocket access-control bypass. Self-managed users should upgrade to 18.10.3, 18.9.5, or 18.8.9.
The FCC is considering expanded customer verification, monitoring, record-retention requirements, and per-call penalties for voice providers to curb illegal robocalls, following enforcement concerns including a proposed fine against Voxbeam.
