ARTICLES 2026 JULY

ARTICLES 2026 JULY 2026 January(387) February(431) March(447) April(451) May(495) June(499) July(647) August(62) September(0) October(0) November(0) December(0) | YEARS(3 234) STATISTICS (0)

DATE	NAME	Info	CATEG.	WEB
31.7.26	Three Recent Chrome Releases Fix 1,442 Flaws, More Than Prior 23 Updates Combined	Google on Thursday announced that it fixed a whopping 1,072 security bugs in Chrome versions 149 and 150, surpassing the total number of	Vulnerebility	The Hacker News
31.7.26	Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw	An academic study has disclosed a "widespread class" of security vulnerabilities impacting 4G and 5G core networks that, if successfully exploited, could trigger denial-of-service (DoS) attacks and even session hijacking, allowing an attacker to seize control of a user's network session.	Vulnerebility	The Hacker News
31.7.26	Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks	Palo Alto Networks' Unit 42 says a Chinese-speaking threat actor used DeepSeek through the open-source Hermes Agent framework to launch	Social	The Hacker News
31.7.26	Researchers Expose Flying Eagle Criminal Ecosystem Behind Fake Chinese Police App	Researchers linked the Flying Eagle Android RAT to fake police apps, uncovering 170 servers in a growing cybercrime ecosystem. Hunt.io researchers and independent journalist NetAskari started with ...	BigBrothers	SECURITYAFFAIRS
31.7.26	Why brand impersonation is becoming an initial access vector	Brand impersonation now drives initial access, using fake sites and apps to deliver malware, making rapid takedowns essential to disrupt attacks. Attackers recently poisoned more than 700 websites	Hack	SECURITYAFFAIRS
31.7.26	Cybercriminals Are Leveraging Autonomous AI Offensive Security Agents	Resecurity warns AI offensive agents are lowering hacking barriers, fueling an AI-driven race between attackers and defenders. Resecurity analyzed how autonomous offensive security agents such as ...	AI	SECURITYAFFAIRS
31.7.26	Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations	Anthropic on Thursday became the latest artificial intelligence (AI) company to reveal that three of its models, including Claude Opus 4.7,	AI	The Hacker News
31.7.26	DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware	Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting	APT	The Hacker News
30.7.26	Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database	A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service's Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz.	Vulnerebility	The Hacker News
30.7.26	Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents	Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished	Hack	The Hacker News
30.7.26	OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia	Our experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging.	APT	SECURELIST
30.7.26	Toy Ghouls’ new toy: the GenieLocker ransomware	The new GenieLocker ransomware family has been active since March 2026. It has been used in attacks against organizations in the Russian Federation, primarily in the manufacturing sector, and attributed to the Toy Ghouls group by open-source intelligence (link in Russian).	Ransom	SECURELIST
30.7.26	Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts	South Korean authorities and four security firms have disclosed a state-sponsored campaign that compromised trusted domestic websites. The attackers used those sites to exploit locally installed financial-security	APT	The Hacker News
30.7.26	SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT	The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver (BYOVD)	APT	The Hacker News
30.7.26	Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation	The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access (OWA), to target U.S. and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors.	APT	The Hacker News
30.7.26	FCC Blocks New Foreign-Produced Robots and Power Inverters Over Cyber Risks	The Federal Communications Commission (FCC) added foreign-produced mobile robots and networked power inverters to its Covered List on July	BigBrothers	The Hacker News
30.7.26	Hackers target US firms in FastJson RCE zero-day attacks	Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges.	Vulnerebility	BleepingComputer
30.7.26	Arista patches VeloCloud Orchestrator zero-day exploited in attacks	Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks.	Vulnerebility	BleepingComputer
30.7.26	New Dysphoria DDoS botnet spreads to 200k devices worldwide	A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations.	BotNet	BleepingComputer
30.7.26	New Certighost PoC exploit lets attackers hijack Windows domains	A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain.	Exploit	BleepingComputer
30.7.26	Apple sued over fake App Store crypto wallet app stealing $1.8M in Bitcoin	Apple is being sued by three people who claim approximately $1.8 million in Bitcoin was stolen after downloading and using a fraudulent Sparrow Wallet application from the App Store.	Cryptocurrency	BleepingComputer
30.7.26	Coca-Cola confirms data theft in Fairlife ransomware attack	The Coca-Cola Company has confirmed that hackers stole data from its dairy subsidiary, Fairlife, during a ransomware attack earlier this month.	Ransom	BleepingComputer
30.7.26	Ernst & Young data breach claimed by ShinyHunters extortion gang	The ShinyHunters extortion gang has claimed responsibility for a recently disclosed Ernst & Young data breach, saying it obtained credentials for some of the company's systems via a supply-chain attack.	Incindent	BleepingComputer
30.7.26	GitHub, PyPI add time-based defenses against supply chain attacks	GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect against supply-chain attacks and to limit their impact.	Security	BleepingComputer
30.7.26	Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet	Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than 2 billion weekly downloads between them.	APT	The Hacker News
30.7.26	Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a newly disclosed security flaw impacting Cisco Secure	Exploit	The Hacker News
30.7.26	Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads	Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from	Vulnerebility	The Hacker News
30.7.26	Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory	Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo , an open-source agent meta-harness for Anthropic Claude Code	AI	The Hacker News
30.7.26	Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape	Broadcom has released security updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of	Vulnerebility	The Hacker News
29.7.26	A “No-Logs” VPN That Kept 58 Million Connection Logs: Inside the NotVPN / SplitVPN Breach	A threat actor on the Altenen cybercrime forum is distributing a 17 GB SQL database they claim was stolen from SplitVPN (formerly NotVPN), a Russian VPN used to bypass internet blocks.	CyberCrime	MYSTERIUMVPN
29.7.26	VPN Breach Exposes 58 Million Connection Logs Despite “No-Logs” Claims	A breached “no-logs” VPN exposed 58 million connection logs and millions of user, device, and payment records, contradicting its privacy claims.	Incindent	SECURITYAFFAIRS
29.7.26	Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline	A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27, triggering a	Incindent	The Hacker News
29.7.26	Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments	Cybersecurity researchers have disclosed details of a large-scale fraud campaign that involves creating lookalike websites of major Russian	APT	The Hacker News
29.7.26	Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser	Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise	Hack	The Hacker News
29.7.26	73% of Organizations Say They Are Not Fully Ready for a Major Cyberattack	Most organizations have incident response plans, security tools, and technical teams in place. Yet new research suggests that many still lack	Security	The Hacker News
29.7.26	Russia Charges Telegram Founder Pavel Durov With Aiding Terrorist Activity	The Federal Security Service of the Russian Federation (FSB) on Wednesday said it charged Telegram founder Pavel Durov for allegedly	BigBrothers	The Hacker News
29.7.26	Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass	Cybersecurity researchers have shared additional technical details about a recently patched critical security flaw impacting Check Point Security Management Server and Multi-Domain Security Management Server (MDS) that has come under active exploitation in the wild.	Vulnerebility	The Hacker News
29.7.26	New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands	Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A user with ordinary repository write access can	Vulnerebility	The Hacker News
29.7.26	Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates	Source code for the Flying Eagle Android remote access trojan (RAT) framework is circulating through criminal Telegram channels. Hunt.io and	Virus	The Hacker News
29.7.26	OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach	OpenAI on Tuesday revealed the rogue artificial intelligence (AI) agent that escaped its sealed evaluation environment and broke into Hugging Face's production environment , and also hacked multiple third-party accounts and services as part of the attack.	AI	The Hacker News
29.7.26	Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js	Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT)	Virus	The Hacker News
29.7.26	New Crypter-as-a-Service Cruciferra Fuels Stealthy Malware Attacks Worldwide	Proofpoint uncovered Cruciferra, a crypter-as-a-service that helps hackers evade antivirus and deliver malware in multiple campaigns.	Cryptocurrency	SECURITYAFFAIRS
29.7.26	Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack	Anthropic says Claude Mythos Preview helped derive an end-to-end key-recovery attack against HAWK-256 and a 200- to 800-fold speedup for an attack on seven-round AES-128. The HAWK attack exploits a previously unused symmetry in the lattice behind the signature scheme. Anthropic's released implementation gives an expected end-to-end runtime of about three hours and 42 minutes on a 96-core server.	AI	The Hacker News
29.7.26	Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process	A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's other persistence mechanisms get	BotNet	The Hacker News
28.7.26	How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old Vulnerability	A 20-year-old vulnerability gave us access to bare-metal servers - and a foothold in the no man’s land of data center infrastructure.	Vulnerebility	LAVAHQ.IO
28.7.26	Fast Remediation Is the New Trust Model: JFrog and OpenAI Collaboration on Zero-Day Security Findings	In the Era of AI-Discovered vulnerabilities, trust belongs to the fastest responders and the level of collaboration established. As AI models continuously expose new classes of vulnerabilities, software products are being held to an entirely new security standard.	AI	JFROG
28.7.26	AutoIT Payload Injector	For a long time, AutoIT has been pretty common in the malware ecosystem. Threat actors still use it because it’s easy to write and powerful. Indeed, it can perform all the required actions to inject a payload into a remote process as you’ll see below.	Virus	SANS
28.7.26	Java Spring Boot "heapdump" scans	Spring Boot exposes the endpoint "/actuator/heapdump" to collect debug information. By default, the endpoint will return a file heapdump.hprof, which includes a binary heapdump that can be used to analyze the current state of the application.	Security	SANS
28.7.26	Scans for ESAFENET CDG 3 Document Management System Weak Logins	ESAFENET's CDG showed up in our data before. The company focused on secure document management and data leakage prevention solutions. The "CDG" stands for "Content Data Guard", and the product appears to be mostly targeting the Chinese market.	Security	SANS
28.7.26	Mirage Kitten targets Middle East and Africa region with new malware	Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.	APT	SECURELIST
28.7.26	24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login	Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller (BMC) management interfaces exposing Intelligent Platform Management Interface (IPMI) protocol to the public internet.	Hack	The Hacker News
28.7.26	JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach	JFrog has confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory while trying to reach the open internet from a sealed evaluation environment. Artifactory is JFrog's software repository	Vulnerebility	The Hacker News
28.7.26	Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root	OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws in network services	Vulnerebility	The Hacker News
28.7.26	Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays	The Iranian state-backed hacking group tracked as Nimbus Manticore (aka GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549)	APT	The Hacker News
28.7.26	Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In	JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security	Vulnerebility	The Hacker News
28.7.26	Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit	STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked	AI	The Hacker News
28.7.26	Microsoft Says New Cybersecurity AI Model Helps MDASH Hit 95.95% at Half the Cost	Microsoft has launched its first cybersecurity-specific model inside MDASH , its multi-model vulnerability identification and remediation	AI	The Hacker News
28.7.26	Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw	A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in	Exploit	The Hacker News
28.7.26	NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework	NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelligence (AI) agents.	AI	The Hacker News
28.7.26	Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption	Dysphoria , an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device	IoT	The Hacker News
28.7.26	Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw	Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval() function inside vBulletin and execute code	Vulnerebility	The Hacker News
27.7.26	n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process	n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. Security Joes found the flaw	Vulnerebility	The Hacker News
27.7.26	Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update	Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver	Phishing	The Hacker News
27.7.26	Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware	The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate	APT	The Hacker News
27.7.26	TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments	Cybersecurity researchers have flagged fresh malicious cyber activity by a threat actor with ties to East Asia targeting government entities in the	Social	The Hacker News
27.7.26	LockBit5 and Qilin Lead Ransomware Attacks Against Italian Organizations	A new report links 148 ransomware attacks to Italian organizations in H1 2026, with manufacturing the most targeted sector.	Ransom	SECURITYAFFAIRS
27.7.26	Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 Credentials	Hackers compromised hotel Wi-Fi gateways to redirect users to fake Microsoft 365 login pages and steal credentials.	Incindent	SECURITYAFFAIRS
27.7.26	GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption	GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published	Hack	The Hacker News
26.7.26	Steam forum ClickFix attacks infect gamers with XMRig cryptominers	Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptominers.	Cryptocurrency	BleepingComputer
26.7.26	Malicious sites use JavaScript to build malware in browser memory	A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory.	Virus	BleepingComputer
26.7.26	ShinyHunters data leaks fuel $2,000 sextortion email scam	Threat actors are using email addresses exposed in data breaches leaked by the ShinyHunters extortion group to send sextortion emails demanding $2,000 in Bitcoin.	Incindent	BleepingComputer
26.7.26	OpenAI confirms ChatGPT is down worldwide	ChatGPT, the famous artificial intelligence chatbot that allows users to converse with various personalities and topics, has connectivity issues worldwide.	AI	BleepingComputer
26.7.26	OnTrac notifies customers of data breach after network hack	OnTrac parcel delivery company is informing that hackers breached its corporate network and may have accessed personal details belonging to its customers.	Incindent	BleepingComputer
26.7.26	Hermes AI agent used to automate attack on Thai Finance Ministry	A threat actor used the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation activity during an alleged breach of Thailand's Ministry of Finance.	AI	BleepingComputer
26.7.26	Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts	Hackers are changing the DNS settings on Wi-Fi devices at hotels and conference centers to redirect users to fake Microsoft 365 login pages.	Hack	BleepingComputer
26.7.26	Microsoft blames massive Microsoft 365 outage on maintenance bug	Microsoft says a bug in its automated network maintenance request system caused Thursday's massive outage by mistakenly removing IP routes from more devices than intended, disrupting Azure and Microsoft 365 services.	OS	BleepingComputer
26.7.26	Chick-fil-A data breach affects more than 13,000 customers	Chick-fil-A has confirmed that over 13,000 customers had their accounts breached in a wave of credential stuffing attacks targeting its website and mobile app between June 17 and June 19.	Incindent	BleepingComputer
26.7.26	Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack	Slopsquatting, phantom squatting, and HalluSquatting all exploit the same late-binding attack pattern, where AI coding agents trust hallucinated package, repo, or domain names. ActiveState explains how pre-fetch verification and governed dependency management can help stop these attacks before malicious code enters the pipeline.	AI	BleepingComputer
26.7.26	Europol flags 4,340 URLs for removal in 'The Com' crackdown	Europol has flagged 4,340 URLs for removal during a multi-week operation targeting online content linked to "The Com," a loosely organized network of nihilistic violent extremist groups.	BigBrothers	BleepingComputer
26.7.26	Man gets six years for hacking 750 women's Snapchat accounts	An Illinois man was sentenced on Tuesday to 76 months in prison and three years of supervised release for hacking the Snapchat accounts of over 750 women to steal nude photos.	Hack	BleepingComputer
26.7.26	Clop ransomware targets Windchill, FlexPLM in data theft attacks	The Clop ransomware gang (also tracked as Cl0p) is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign.	Ransom	BleepingComputer
26.7.26	New Dolphin X malware uses AI to rank high-value targets	A new Dolphin X remote access trojan claims to use an AI-powered profiling feature to score and rank infected users, helping cybercriminals identify which victims should be targeted first.	Virus	BleepingComputer
26.7.26	Australian energy provider Origin says data breach exposes client data	Origin Energy has confirmed that an unauthorized party accessed and subsequently leaked customer data online, exposing sensitive personally identifiable information (PII), among others.	Incindent	BleepingComputer
26.7.26	Fake Claude app promoted by Bing ads pushes SectopRAT malware	A malvertising campaign on the Bing search service is pushing a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to deliver the SectopRAT malware.	Virus	BleepingComputer
26.7.26	Russian hackers exploit Zimbra zero-click flaw for email theft	CISA is warning that the Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is targeting organizations using Zimbra Collaboration email servers by combining phishing attacks with the exploitation of a now-patched Zimbra vulnerability.	APT	BleepingComputer
26.7.26	Hackers abuse Notepad++ plugins to stealthily install malware	Ukraine's CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence	BigBrothers	BleepingComputer
26.7.26	Microsoft 365 outage affects Teams, SharePoint and other services	Microsoft is impacted by a massive outage affecting Teams and Microsoft 365 services, primarily affecting users in North America.	OS	BleepingComputer
26.7.26	FedRAMP Rev5 Is Ending: What the 20x Transition Really Requires	FedRAMP 20X replaces point-in-time assessments with continuous, machine-readable evidence that demonstrates security controls are working. Anecdotes explains what the transition from Rev5 to FedRAMP 20X means and how organizations can prepare for continuous, evidence-based assurance.	Security	BleepingComputer
26.7.26	EU fines Google $1 billion for search, app store antitrust violations	The European Commission fined Google €890 million ($1 billion) on Thursday after finding the company had violated the European Union's Digital Markets Act (DMA), which ensures fair online competition.	BigBrothers	BleepingComputer
26.7.26	Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable	A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun	Virus	The Hacker News
25.7.26	Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available	Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring	Vulnerebility	The Hacker News
25.7.26	Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git	Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It	Vulnerebility	The Hacker News
25.7.26	Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE	Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in	Ransom	The Hacker News
25.7.26	DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts	The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to	Ransom	The Hacker News
25.7.26	New RefluXFS Linux flaw lets attackers gain root privileges	A nine-year-old race condition vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges.	Vulnerebility	BleepingComputer
25.7.26	New msaRAT malware uses Chrome, Edge browsers to route C2 traffic	The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers.	Virus	BleepingComputer
25.7.26	Microsoft working to fix Exchange Online mailbox quarantine issue	Microsoft is working to resolve an ongoing Exchange Online issue that has been mistakenly quarantining customers' mailboxes since Sunday.	OS	BleepingComputer
25.7.26	Check Point warns of SmartConsole zero-day exploited in attacks	Israeli cybersecurity firm Check Point Software has addressed an actively exploited zero-day flaw in the company's SmartConsole graphical user interface (GUI) admin panel.	Exploit	BleepingComputer
25.7.26	Upbound says hack caused $13 million in fraudulent Acima leases	The Upbound Group fintech company disclosed that threat actors who stole data from its systems leveraged it to create $13 million in Acima leases.	Incindent	BleepingComputer
25.7.26	South Korea discloses data breach impacting diplomats worldwide	South Korea disclosed that hackers breached the National Diplomatic Academy's online education system for ten months and stole personal information belonging to current and former employees of the Ministry of Foreign Affairs (MFA), including overseas diplomats.	Incindent	BleepingComputer
25.7.26	Swiss rail giant Stadler rejects $12.3M ransom demand after cyberattack	Swiss rail vehicle manufacturer Stadler Rail says the Everest ransomware gang demanded about $12.3 million after breaching a data exchange platform shared with one of its suppliers.	Ransom	BleepingComputer
25.7.26	How enterprise GenAI can amplify ransomware risk — and how to contain it	Enterprise AI can accelerate ransomware attacks when AI assistants and agents inherit excessive permissions or compromised identities. Acronis explains how identity controls, governance, and least-privilege access help reduce AI-enabled ransomware risk while supporting secure AI adoption.	AI	BleepingComputer
25.7.26	New InfraTrust report reveals infrastructure flaws admins should patch first	Eclypsium has launched InfraTrust, a new infrastructure cybersecurity knowledge base and monthly InfraTrust Pulse report designed to help organizations prioritize vulnerabilities affecting infrastructure, firmware, networking, and edge devices.	Vulnerebility	BleepingComputer
25.7.26	Adobe Chrome extension flaw let sites access private WhatsApp chats	The Adobe Acrobat extension for Chrome could be used to access conversations and data rendered in WhatsApp Web without any form of authentication.	Social	BleepingComputer
25.7.26	CISA orders urgent action on actively exploited Langflow RCE flaw	The Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday ordered U.S. government agencies to prioritize patching an actively exploited vulnerability in the Langflow visual framework for building AI agents.	Exploit	BleepingComputer
25.7.26	Microsoft to stop Exchange 2016 / 2019 security updates in October	Microsoft to stop Exchange 2016 / 2019 security updates in October	OS	BleepingComputer
25.7.26	Chick-fil-A discloses data breach after credential stuffing attacks	American fast food restaurant chain Chick-fil-A is notifying customers of a data breach after their accounts were hacked in a wave of recent credential stuffing attacks.	Incindent	BleepingComputer
25.7.26	Beyond the Model: Harnessing Frontier AI for Stronger Cyber Defense	When CrowdStrike tested frontier AI to understand how its capabilities perform in vulnerability research, we learned the greatest differentiator was not the model used, but the harness around it.	AI blog	CROWDSTRIKE
25.7.26	Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks	In February 2026, Socket.dev published research on a multi-stage npm supply chain worm operating under the internal flag SANDWORM_MODE. The campaign spanned 19 malicious packages in total across two unique publisher aliases and demonstrated a new class of supply chain attacks that targeted AI-augmented development workflows.	AI blog	CROWDSTRIKE
25.7.26	The AI era of cybercrime has arrived: The 2026 Cybercrime in the age of AI report	New research reveals how AI is rewiring cybercrime today, and how you can prepare for what’s coming tomorrow.	AI blog	THREATDOWN
25.7.26	The guardrails problem just played out on both sides of the same incident	No hacker. No threat actor. No crime. Just an AI model, an authorized test, and a guardrails problem playing out on both sides of the same incident.	Incident blog	THREATDOWN
25.7.26	The stack had a good run. Defense systems are the future.	Something shifted in late 2025 that I don't think our industry has fully reckoned with yet.	ICS blog	SOPHOS
25.7.26	In code we trust? Why the most trusted software receives the least scrutiny.	Recent CVEs across GitHub, Anthropic, Google, dbt, and MISP expose a simple truth: the most trusted code is often the least questioned. As organizations connect AI agents to production systems, those overlooked assumptions can become powerful new attack paths.	Vulnerebility blog	SOPHOS
25.7.26	Sophos joins Anthropic's Project Glasswing	As a Project Glasswing member, Sophos gains access to Claude Mythos 5, an advanced frontier model not currently available to the public, to find and fix software vulnerabilities before AI-driven attackers can exploit them.	AI blog	SOPHOS
25.7.26	When the "attacker" is an AI agent	Last week, Hugging Face disclosed a security incident of a new kind: an intrusion carried out end to end by an autonomous AI agent.	AI blog	SOPHOS
25.7.26	Updated Cyber Threat Actor Naming System	Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors. This new naming taxonomy represents an effort to standardize tracking across platforms and public reporting.	APT blog	GTI
25.7.26	Announcing InfraTrust, the source of intelligence on security risks across hardware infrastructure	Today we’re excited to announce InfraTrust, a global hardware infrastructure security knowledgebase making mission critical infrastructure security data available faster, so you have it when you need it to defend your enterprise. InfraTrust is a searchable, continuously updated source of security advisories and risk data from major enterprise hardware infrastructure vendors.	Cyber blog	Eclypsium
25.7.26	Email threat landscape: Q2 2026 trends and insights	In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi-stage attack chains.	Spam blog	Microsoft blog
25.7.26	Law Enforcement Takes Down Kratos/Sneaky2FA Phishing Service, With an Assist From TrendAI™	Kratos, the phishing-as-a-Service (PhaaS) platform behind a large share of recent Microsoft 365 credential theft, has been taken offline by the BKA and ZIT in an operation dubbed Olympus Blade.	Phishing blog	Trend Micro
25.7.26	Volume Is Not Risk: Making Sense of the 'Vulnpocalypse'	A briefing for security leaders on separating vulnerability disclosure volume from exploitable risk in 2026.	Vulnerebility blog	Trend Micro
25.7.26	Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass	Device code phishing abuses a legitimate authentication feature designed for devices with limited input capabilities. This article breaks down how the technique works, examines a recent observed case, and outlines the layered security measures organizations can implement.	Phishing blog	Trend Micro
25.7.26	Federal Agencies Warn of Ongoing PLC Exploitation Against Critical U.S. Infrastructure	TrendAI™ Research breaks down what changed in CISA’s updated advisory on an ongoing PLC exploitation, why this activity might be more dangerous than a similar campaign in 2023, and how organizations can take action now to protect themselves.	ICS blog	Trend Micro
25.7.26	Inside the OpenAI – Hugging Face Incident: The AI Breach With No Human Attacker Behind It	OpenAI’s own models broke out of a test sandbox and into Hugging Face’s servers to solve an evaluation, with no human attacker involved. The incident showed how keeping agentic AI safe now depends on how it’s contained, not just on how it’s trained.	AI blog	Trend Micro
25.7.26	13M+ Emails Sent in Tech Support Scam Targeting Users, Organizations in Japan	We analyzed a sustained tech support scam campaign that sent more than 13 million emails to Japanese addresses, with workplace-themed lures suggesting a possible expansion toward enterprise targets.	Spam blog	Trend Micro
25.7.26	The Signs Were There: What the First Autonomous Ransomware Case Confirms	An AI agent has run a ransomware intrusion on its own for the first time, from break-in to data destruction. The autonomous attacks TrendAI™ Research predicted are beginning to arrive, and defending against them shifts from blocking known indicators to detecting behavior.	Ransom blog	Trend Micro
25.7.26	Joomla Multiple COM Extensions Unauthenticated File Uploads to RCE	Joomla! Multiple COM_Extensions Unauthenticated File Uploads to RCE	Vulnerebility blog	SonicWall
25.7.26	Russian Global Webmail Espionage	Unit 42 has observed a persistent cyberespionage campaign we track as CL-STA-1114. This activity cluster overlaps with activity from a Russian threat actor tracked by other vendors as Void Blizzard and LAUNDRY BEAR.	APT blog	Palo Alto
25.7.26	Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy	We conducted this research in close partnership with Siemens, reflecting our shared commitment to advancing the security and resilience of critical infrastructure.	ICS blog	Palo Alto
25.7.26	Preview: Cisco Talos at Black Hat USA 2026	Here’s some of the ways Talos is showing up at Black Hat, alongside our friends at Cisco and Splunk.	Cyber blog	CISCO TALOS
25.7.26	Don’t swing at everything	Thorsten explores Q2 2026 stats, the artificial buffer zone of 2026, and why smart, prioritized patching is more critical than ever.	AI blog	CISCO TALOS
25.7.26	Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel	The Chaos ransomware group uses new malware "msaRAT" that hijacks browsers. The malware doesn't communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker's IP from victims via WebRTC over TURN.	Malware blog	CISCO TALOS
24.7.26	When the "Autonomous Attacker" Is Your Own AI Model	Two disclosures, five days apart, described the same intrusion from opposite ends — one from the victim, one from the party that turned out to be responsible — and together they make one of the more instructive incidents of the year for defenders.	AI	SANS
24.7.26	Rondo Meets Geoserver	This isn't a new attack, but something I saw "pop-up" in our logs this week	Security	SANS
24.7.26	Captive Portal Detection	Not everything our honeypots detect is an attack. Sometimes it is just "odd traffic", and this is one example: Our "First Seen" list currently includes "http://detectportal.firefox.co m/success.txt" as one of the new URLs detected by our honeypots.	Security	SANS
24.7.26	WordPress Exploitation Underway (CVE-2026-63030)	Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number.	Vulnerebility	SANS
24.7.26	Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged	Disclosure note: This research was conducted jointly by Hunt.io and Bob Diachenko, security researcher and journalist. Thailand's national CERT and NCSA were notified on July 15, 2026, and acknowledged receipt the same day. Publication was held for the standard 7-day disclosure window.	AI	HUNT.IO
24.7.26	BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery	The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been	Phishing	The Hacker News
24.7.26	Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller	Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a	Exploit	The Hacker News
24.7.26	ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link	Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single	AI	The Hacker News
24.7.26	Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers	A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing	Vulnerebility	The Hacker News
24.7.26	Seeing AI Agents Is Not Enough. Security Teams Must Enforce What They Can Do	AI agent security is moving through a familiar maturity curve: adoption, then visibility, and finally, control. But what we've collectively discovered is	AI	The Hacker News
24.7.26	Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry	Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands,	AI	The Hacker News
24.7.26	Golden Chickens Resurfaces With Four New Malware Families and Modular Implants	The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings.	APT	The Hacker News
24.7.26	NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats	Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and	AI	The Hacker News
24.7.26	Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say	Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need	Exploit	The Hacker News
24.7.26	Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks	The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new campaign that involves the use of a malicious program	APT	The Hacker News
24.7.26	Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes	A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail	APT	The Hacker News
23.7.26	Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days from TA458	The Russia-aligned threat actor TA458, the group behind Operation RoundPress, continues to focus on webmail targeting using half-click exploits as a way to steal highly sensitive email data.	APT	PROOFPOINT
23.7.26	TA488 Targets Zimbra Mailservers with Half-Click Exploits	Proofpoint uncovered that Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) was exploiting a previously unknown vulnerability against Zimbra mailservers for at least five months during 2025, until the issue was patched with CVE-2025-66376.	APT	PROOFPOINT
23.7.26	Unpacking “Cruciferra”: An Analysis of a Sophisticated Crypter Service	Cruciferra is a sophisticated crypter service used by multiple unrelated cybercriminal threat clusters.	Cryptocurrency	PROOFPOINT
23.7.26	Ransomware in 2026: Same Business, New Rules	The ransomware economy has been rewired. Meet the eight ransomware groups driving the shift, from affiliate breakaways to AI-assisted attacks based on Group-IB Threat Intelligence.	Ransom	GROUP-IB
23.7.26	INC Ransomware affiliate targets ESXi & NAS Devices in AD environment	Using the Hunt.io platform, Ctrl-Alt-Intel researchers discovered an exposed operator working directory containing evidence of an active ransomware intrusion against a Chinese technology organisation.	Ransom	Ctrl-Alt-Intel
23.7.26	Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files	Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to	AI	The Hacker News
23.7.26	Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge	The Chaos ransomware group ran its command-and-control through the victim's own browser. Cisco Talos on Thursday detailed msaRAT , the Rust	Ransom	The Hacker News
23.7.26	China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks	An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx . The cluster has targeted government,	APT	The Hacker News
23.7.26	Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers	Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack	Hack	The Hacker News
23.7.26	Google Adds Selfie Video Recovery for Users Locked Out of Their Accounts	Google on Thursday announced a new way for users to sign-in to their accounts by letting them take a selfie video. The selfie for sign-in , per the	Security	The Hacker News
23.7.26	OpenAI says its AI models hacked Hugging Face during testing	OpenAI says its AI models, including GPT‑5.6 Sol and a pre-release model, hacked into the Hugging Face artificial intelligence repository while being tested in a sandboxed testing environment.	AI	BleepingComputer
23.7.26	Police dismantle Kratos phishing platform, arrest developer	Authorities in Germany and the U.S. dismantled the central infrastructure of Kratos, a phishing-as-a-service (PhaaS) platform with global reach, and its developer was arrested in Indonesia.	Phishing	BleepingComputer
23.7.26	FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware	A large-scale operation dubbed 'FakeGit' is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads.	Virus	BleepingComputer
23.7.26	Critical SharePoint RCE flaw exploited to steal machine keys	Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched.	Vulnerebility	BleepingComputer
23.7.26	Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak	The Anubis ransomware gang has claimed responsibility for the cyberattack on Coca-Cola's Fairlife dairy subsidiary, threatening to publish allegedly stolen corporate data unless the company pays a ransom.	Ransom	BleepingComputer
23.7.26	Critical wp2shell WordPress flaws exploited to install webshells	Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers.	Vulnerebility	BleepingComputer
23.7.26	Closing the Identity Gaps in Critical Infrastructure Security	Critical infrastructure attacks often begin with stolen credentials, compromised devices, or trusted accounts. Specops Software explains why Zero Trust should verify both user identities and device trust before granting access to critical systems.	Vulnerebility	BleepingComputer
23.7.26	US seizes over 1,000 websites in FIFA World Cup piracy crackdown	The U.S. Justice Department has seized more than 1,000 websites and blocked 1,970 domains used to stream FIFA World Cup 2026 matches without authorization.	CyberCrime	BleepingComputer
23.7.26	Critical Palo Alto VPN bug now exploited by Qilin ransomware gang	The Qilin ransomware gang is exploiting a critical PAN-OS GlobalProtect authentication bypass flaw to breach victims' networks, according to cybersecurity company Arctic Wolf.	Ransom	BleepingComputer
23.7.26	Microsoft shares manual fix for WSUS sync delays and timeouts	Microsoft has shared manual mitigations to help IT administrators fix Windows Server Update Services (WSUS) servers affected by a known issue that causes Windows Update scans to fail or time out.	OS	BleepingComputer
23.7.26	Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs	RefluXFS , a new Linux kernel flaw disclosed on July 22 and tracked as CVE-2026-64600 , lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access. Qualys said default	Vulnerebility	The Hacker News
23.7.26	Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access	Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain	Vulnerebility	The Hacker News
23.7.26	GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier	Beginning July 27, 2026, GitHub will cut public bug bounty payouts by at least half at every severity level. Critical findings will drop from $20,000-$30,000+ to a fixed $10,000, while its permanent invite-only VIP tier will pay $30,000 or more.	Vulnerebility	The Hacker News
23.7.26	Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs	Cybersecurity researchers have disclosed details of a new local privilege escalation (LPE) vulnerability in snap-confine that an unprivileged user can	OS	The Hacker News
23.7.26	Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data	Cybersecurity researchers have disclosed details of a now-patched vulnerability chain in the Adobe Acrobat Chrome extension that has over	Social	The Hacker News
23.7.26	Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication	A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case	Exploit	The Hacker News
22.7.26	The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results	The JFrog Security Research team has discovered and disclosed a typosquatted NuGet package named Newtonsoftt.Json.Net. Note the double t and the .Net suffix. This package has been masquerading as the popular Newtonsoft.Json library while quietly shipping a trojanized fork.	Hack	JFROG
22.7.26	Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA	German and US law enforcement have taken down the core infrastructure of Kratos , described by German investigators as one of the world's most	BigBrothers	The Hacker News
22.7.26	Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library	Cybersecurity researchers have discovered a NuGet typosquat that's unlike the typical information-stealing malware distributed via package registries:	Virus	The Hacker News
22.7.26	Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents	A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the	AI	The Hacker News
22.7.26	OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark	OpenAI on Tuesday said a combination of its artificial intelligence (AI) models, including GPT-5.6 Sol and an "even more capable pre-release model," was behind the security incident that targeted Hugging Face's production infrastructure last week.	AI	The Hacker News
22.7.26	Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs	Apple has moved to address a security flaw in its Hide My Email service that enabled users' real email addresses to be unmasked, effectively	OS	The Hacker News
21.7.26	AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code	Hidden text on a web page was enough to make Kiro , AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code	Vulnerebility	The Hacker News
21.7.26	Google Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software Vulnerabilities	Google's DeepMind on Tuesday announced the release of Gemini 3.5 Flash Cyber , a specialized artificial intelligence (AI) model built atop 3.5	AI	The Hacker News
21.7.26	Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC	A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per	Vulnerebility	The Hacker News
21.7.26	A new extortion cocktail: office printers, small ransoms, and BitLocker	We cover two recent cases of BitLocker extortion using RDP, MSSQL, RMM tools, web shells, and printers. The story includes TTPs and recommendations.	Ransom	SECURELIST
21.7.26	Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access	Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin	Ransom	The Hacker News
21.7.26	Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities	Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management	Vulnerebility	The Hacker News
21.7.26	New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery	Kaspersky GReAT experts describe a new Project CAV3RN C2 module. It uses Outlook calendar for communication via Microsoft Graph and has a backup connection via DNS AAAA responses.	Hack	SECURELIST
21.7.26	Windows LegacyHive zero-day flaw gets free, unofficial patches	Free unofficial patches are available for a recently disclosed Windows zero-day flaw that allows attackers to escalate privileges on up-to-date Windows systems.	Vulnerebility	BleepingComputer
21.7.26	Estée Lauder discloses data breach via Oracle E-Business flaw	Cosmetics giant Estée Lauder is notifying customers of a data breach after hackers exploited a flaw in Oracle E-Business Suite that the company used for human resources (HR) operations.	Incindent	BleepingComputer
21.7.26	SonicWall SMA1000 flaws exploited as zero-days to push custom malware	Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances.	Exploit	BleepingComputer
21.7.26	Hackers steal $23.7 million in crypto from Ostium in off-chain attack	The Ostium trading platform announced that an attacker stole $23.75 million from its liquidity provider vault last week, after compromising off-chain infrastructure used to feed prices into the protocol.	Cryptocurrency	BleepingComputer
21.7.26	Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes	Researchers escaped the sandboxes in Cursor, Codex, Gemini CLI and Antigravity by having the AI agent write files that trusted host tools later run. Multiple CVEs, patches, and Google downgrading two Antigravity findings.	AI	BleepingComputer
21.7.26	JadePuffer agentic attacks now target AI model data with ransomware	The JadePuffer autonomous AI agent has upgraded with custom malware called EncForge that focuses on encrypting AI assets, such as training datasets, vector databases, and model checkpoints.	Ransom	BleepingComputer
21.7.26	New HollowGraph malware uses Microsoft Graph for stealthy C2 comms	A malicious component dubbed HollowGraph uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and exfiltrate stolen data.	Virus	BleepingComputer
21.7.26	An AI SOC Evaluation Guide for Security Leaders	Choosing an AI SOC platform requires understanding how it will perform in your own environment, not just during an evaluation. Prophet Security shares a practical framework for assessing AI SOC solutions, including how to validate accuracy, operating models, long-term reliability, and production readiness.	AI	BleepingComputer
21.7.26	Hugging Face warns an autonomous AI agent hacked its network	The Hugging Face artificial intelligence repository disclosed that attackers gained access to internal datasets and credentials after breaching its production infrastructure using an autonomous AI agent system.	AI	BleepingComputer
21.7.26	Microsoft confirms Windows Server Update Services sync delays	Microsoft is working to fix a known issue affecting Windows Server Update Services (WSUS) servers, which has caused synchronization problems for more than a week.	OS	BleepingComputer
21.7.26	Windows KB5121767 OOB update fixes shutdowns on some Dell PCs	Microsoft has released emergency updates to fix a known issue causing some Dell PCs to shut down after installing the July 2026 Windows 11 security updates.	OS	BleepingComputer
21.7.26	Critical ServiceNow code execution flaw now exploited in attacks	Attackers have begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform, according to threat intelligence company Defused.	Exploit	BleepingComputer
21.7.26	Hackers abuse ViPNet software to target Russian govt agencies	An advanced threat actor is abusing the update mechanism for the ViPNet private networking product suite to target Russian organizations, including government agencies.	BigBrothers	BleepingComputer
21.7.26	Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs	An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent.	OS	The Hacker News
21.7.26	New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit	A cloud tenant using nothing but ordinary GPU access can push a data center's power draw up and down fast enough to threaten the grid it runs	Attack	The Hacker News
21.7.26	WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning	Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code	Exploit	The Hacker News
21.7.26	New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack	Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER , the AI-agent-driven operator it first documented earlier this month.	Ransom	The Hacker News
21.7.26	Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution	Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according to Defused Cyber . In a	AI	The Hacker News
21.7.26	FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware	Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence	Virus	The Hacker News
20.7.26	Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign	A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-	AI	The Hacker News
20.7.26	HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050	A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator	Virus	The Hacker News
20.7.26	Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine	At least one Russian intelligence service is systematically hijacking internet-connected security cameras across Europe and Ukraine, using the feeds to watch military transport routes, weapons shipments bound	BigBrothers	The Hacker News
20.7.26	New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction	Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266 , is a heap-based buffer overflow	Vulnerebility	The Hacker News
20.7.26	Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs	A solo Russian-speaking threat actor known as " bandcampro " outsourced a chunk of their operations to Google's open-source Gemini	APT	The Hacker News
20.7.26	World's Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent	In an ironic twist, open-source artificial intelligence (AI) platform Hugging Face revealed that it was the victim of a hack perpetrated by an	AI	The Hacker News
20.7.26	SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines	Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three	Hack	The Hacker News
20.7.26	Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution	F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker	Vulnerebility	The Hacker News
20.7.26	UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware	Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their	APT	The Hacker News
20.7.26	SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access	A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access (SMA)	Exploit	The Hacker News
19.7.26	Update now: 7-Zip fixes RCE flaw exploitable with malicious archives	7-Zip version 26.02 was released to fix a remote code execution vulnerability that could allow attackers to execute malicious code by convincing users to open specially crafted compressed files.	Vulnerebility	BleepingComputer
19.7.26	WordPress Core "wp2shell" RCE flaws get public exploits, patch now	Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately	Vulnerebility	BleepingComputer
19.7.26	Microsoft warns of surge in ACR Stealer attacks on customers	Microsoft has observed a surge in attacks using the ACR Stealer malware to steal browser-stored passwords, authentication tokens, and sensitive documents from its enterprise customers.	Virus	BleepingComputer
19.7.26	The Future of Age Verification: Your Face Never Leaves Your Device	As age verification laws expand worldwide, organizations face growing pressure to protect users' privacy while meeting regulatory requirements. Incode explains how on-device age estimation verifies age without transmitting or storing facial images, reducing biometric privacy risks while supporting compliance.	Security	BleepingComputer
19.7.26	Abbott probes two cyber incidents amid extortion claims	Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, while also investigating a separate claim that attackers breached its LabCentral portal and stole company data.	Incindent	BleepingComputer
19.7.26	HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload	A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on OpenSSL servers with a malicious payload of just 11 bytes.	Vulnerebility	BleepingComputer
19.7.26	Ernst & Young discloses data breach after support system hack	Ernst & Young is notifying customers of a data breach caused by the compromise of a third-party support ticket system used by its IT personnel.	Incindent	BleepingComputer
19.7.26	Inside the Search for "Clean" Residential Proxies for Carding	Residential proxies are no longer the silver bullet they once were for carding. Flare explains why cybercriminals increasingly seek "clean" residential proxies and combine them with browser fingerprints, device profiles, and other identity signals to evade modern fraud detection.	CyberCrime	BleepingComputer
19.7.26	New Windows LegacyHive zero-day gives hackers admin privileges	A security researcher using the "Nightmare Eclipse" handle has released a Windows zero-day exploit dubbed LegacyHive that allows attackers to escalate privileges on up-to-date Windows systems.	Vulnerebility	BleepingComputer
19.7.26	Windows Server 2022 reach end of mainstream support in 90 days	Microsoft announced that Windows Server 2022 will reach the mainstream end date in October 2026, but will switch to extended support and continue receiving security updates for five more years.	OS	BleepingComputer
19.7.26	US charges two over laundering $43 million from investment fraud	U.S. prosecutors on Thursday charged a New York man and woman for their roles in a large-scale crime ring that laundered money stolen in cyber investment fraud scams	CyberCrime	BleepingComputer
19.7.26	CISA urges immediate action on actively exploited Fortinet flaws	CISA on Thursday ordered government agencies to prioritize patching two actively exploited vulnerabilities in the Fortinet FortiSandbox threat detection platform.	Exploit	BleepingComputer
19.7.26	New ClickLock macOS malware traps users into revealing login password	A new macOS information-stealing malware dubbed ClickLock terminates all visible processes to force users into entering their system login password.	Virus	BleepingComputer
19.7.26	Coca-Cola says Fairlife ransomware attack halts US dairy production	The Coca-Cola Company disclosed today that a ransomware attack impacting its Fairlife dairy subsidiary has disrupted operations, temporarily suspending production of Fairlife products across the United States.	Ransom	BleepingComputer
19.7.26	Claude Chrome extension flaw lets malicious extensions trigger AI actions	A flaw in Anthropic's Claude for Chrome browser extension could allow a malicious extension to trigger predefined AI actions by simulating user clicks, potentially allowing it to abuse Claude's access to connected services such as Gmail, Google Docs, Google Calendar, and Salesforce.	AI	BleepingComputer
19.7.26	New OkoBot framework deploys 20 payloads to steal data, crypto	A new malicious framework called OkoBot is delivering more than 20 payloads in attacks focused on stealing cryptocurrency wallet seed phrases, credentials, and other sensitive data.	Incindent	BleepingComputer
19.7.26	AI Agents Broke the Security Playbook. Here's What Replaces It.	Traditional security workflows were built for environments that changed at human speed. Token Security explains why AI agents require a new approach: building on a live identity foundation while giving security teams the flexibility to create workflows tailored to their own environments.	AI	BleepingComputer
19.7.26	23andMe to pay $18 million in new genetics data breach settlement	Genetic testing company 23andMe has agreed to pay $18 million to settle claims from a coalition of 43 attorneys general that it failed to protect customers' genetic data.	Incindent	BleepingComputer
19.7.26	Scattered Spider members behind TfL hack get five years in prison	Two leading members of the Scattered Spider cybercrime collective were sentenced to five years and six months in prison each for hacking Transport for London (TfL) in 2024.	CyberCrime	BleepingComputer
19.7.26	Windows 11 24H2 Home and Pro reach end of support in 90 days	Microsoft announced on Wednesday that systems running Windows 10 Enterprise LTSB 2016 and Home and Pro editions of Windows 11 24H2 will stop receiving updates in three months.	OS	BleepingComputer
19.7.26	CISA orders feds to patch actively exploited Oracle flaw by Saturday	CISA has ordered federal agencies to secure their systems by Saturday against ongoing attacks exploiting a critical vulnerability in the Oracle E-Business Suite financial application.	Exploit	BleepingComputer
19.7.26	Russian hackers trojanize WebEx, Zoom apps to push Starland malware	A financially motivated Russian threat actor tracked as UAT-11795 is using trojanized software to steal credentials and cryptocurrency by deploying a new backdoor called Starland RAT.	Cryptocurrency	BleepingComputer
19.7.26	New Spirals ransomware encrypts victim network in under 24 hours	A new ransomware actor called Spirals completed a corporate intrusion, from initial access to data theft and encryption, in less than 24 hours.	Ransom	BleepingComputer
19.7.26	Dutch police bust investment fraud ring stealing over €100 million	The Dutch Police announced the arrest of multiple individuals suspected of being part of an international investment fraud scheme estimated to have tens of thousands of victims.	CyberCrime	BleepingComputer
18.7.26	Zoom warns of critical account takeover vulnerability	Zoom is warning of a critical vulnerability in its desktop client and software development kit for Windows that could be exploited by an unauthenticated party to hijack accounts.	Vulnerebility	BleepingComputer
18.7.26	Google Gemini CLI abused as a hacking agent, malware botnet operator	A Russian-speaking threat actor known as "bandcampro" used Google's open-source Gemini CLI AI tool as a hacking agent and to operate a small-scale botnet.	AI	BleepingComputer
18.7.26	AsyncAPI npm packages infected with credential-stealing malware	Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that delivered a remote access trojan with info-stealing capabilities.	Virus	BleepingComputer
18.7.26	CISA warns admins to patch actively exploited SharePoint flaws	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned Tuesday that attackers are actively exploiting three vulnerabilities to hack Internet-exposed on-premises SharePoint Server instances.	Exploit	BleepingComputer
18.7.26	Microsoft: Some Dell PCs shut down after recent Windows updates	Microsoft is blocking this month's Windows 11 security updates on some Dell devices because they are causing shutdowns and performance issues.	OS	BleepingComputer
18.7.26	US charges alleged operators of Russian bulletproof hosting service	U.S. federal prosecutors have unsealed charges against three Russian nationals, accusing them of providing bulletproof hosting (BPH) services to ransomware gangs that caused over $62 million in damages to victims worldwide.	BigBrothers	BleepingComputer
18.7.26	SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now	SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, in zero-day attacks and urges customers to install the newly released security updates.	Exploit	BleepingComputer
18.7.26	Spanish Police take down €140 million cyber fraud ring, arrest four	The Spanish Police dismantled a cybercrime and money-laundering organization that made €140 million ($160 million) from investment fraud and business email compromise (BEC) attacks	CyberCrime	BleepingComputer
18.7.26	Nearly 300 GitHub repos pose as legit software to push malware	A threat actor has published hundreds of fake GitHub repositories impersonating legitimate software and security projects to distribute infostealer malware.	Virus	BleepingComputer
18.7.26	Microsoft releases Windows 10 KB5099539 extended security update	Microsoft has released the Windows 10 KB5099539 extended security update, which includes this month's record-breaking July 2026 Patch Tuesday fixes, along with additional security improvements.	OS	BleepingComputer
18.7.26	Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days	Today is Microsoft's July 2026 Patch Tuesday, and with it comes security updates for a record-breaking 570 flaws, including two zero-day vulnerabilities exploited in attacks and one publicly disclosed.	OS	BleepingComputer
18.7.26	Windows 11 KB5101650 & KB5099414 cumulative updates released	Microsoft has released Windows 11's June 2026 Update for version 25H2, 24H2, and 23H2, bringing fixes for over 570 security issues.	OS	BleepingComputer
18.7.26	Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown	Progress Software has confirmed that a high-severity zero-day vulnerability is behind the emergency shutdown of ShareFile Storage Zone Controllers last week and has released security updates to patch the flaw.	Vulnerebility	BleepingComputer
18.7.26	LastPass, Bitwarden users targeted with fake security alerts	LastPass is warning users about an ongoing phishing campaign that is using fake security notices to direct them to fraudulent websites.	Security	BleepingComputer
18.7.26	You Don't Have to Run an Exploit to Know If You're Vulnerable	Many vulnerabilities cannot be safely validated with live exploits, either because no exploit exists or the affected systems are too critical to test. Picus explains how TTP chaining helps organizations determine exploitability by validating the attack techniques an exploit depends on, without launching the exploit itself.	Exploit	BleepingComputer
18.7.26	Microsoft Entra ID gets passkeys default authentication starting September	Microsoft has announced that passkeys will become the default authentication method for the Entra ID enterprise identity service starting September 2026.	Security	BleepingComputer
18.7.26	New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code	Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has	Vulnerebility	The Hacker News
18.7.26	HelloNet campaign — new malicious modules launched through the ViPNet update system	We identified targeted infection attempts against large Russian organizations using the ViPNet update system (a software suite for creating secure networks).	Cryptocurrency	SECURELIST
18.7.26	Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT	Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a	Virus	The Hacker News
18.7.26	New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens	A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS	BotNet	The Hacker News
18.7.26	The Scam Will Go On: Beware of Fake Offers for Celine Dion Concert Tickets	Group-IB discovers a sophisticated multi-layered scam scheme targeting fans with fake ticket sales on two fronts: social network platforms and fraudulent websites impersonating official distributors.	Spam blog	GROUP-IB
18.7.26	Inside the Matching Engine: How Distributed Tokenization Identifies Compromised Cards Without Exposing Them	Discover how Distributed Tokenization identifies compromised cards at pre-authorization without exposing raw card data — a technical deep-dive for fraud operations and risk teams.	Hacking blog	GROUP-IB
18.7.26	SonicWall SMA1000 vulnerabilities in active exploitation	On July 14, 2026, SonicWall disclosed two vulnerabilities in SonicWall SMA1000 appliances. Models 6210, 7210, and 8200v are affected.	Vulnerebility blog	SOPHOS
18.7.26	GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access	Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial workflows. This report, based on insights derived from Mandiant incident response engagements, Gemini, and GTIG’s proactive research, highlights the dual nature of the current threat environment where AI serves as both a sophisticated engine for adversary operations and a high-value target for attacks. We explore the following developments:	AI blog	GTI
18.7.26	Demystifying AI Exploits: A Blueprint for AI-Assisted Vulnerability Management	As highlighted in the Mandiant M-Trends 2026 report, the mean time-to-exploit (TTE) has dropped to -7 days, meaning vulnerabilities are often exploited a week before a patch even exists.	Hacking blog	GTI
18.7.26	The Risk of Exposed Cloud Functions and How to Harden	Mandiant security assessments frequently identify publicly exposed serverless applications that lack authentication, often as a result of specific business requirements. Serverless deployments typically run custom-developed code that incorporates third-party packages, making them targets for a wide range of application-level attacks, including:	Hacking blog	GTI
18.7.26	Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain	Introduction Seqrite Labs recently identified a malware distribution campaign that abused the credibility of government institutions to increase infection success rates. The threat actors impersonated legitimate government departments and distributed malicious emails disguised as official notifications related to taxation,...	Malware blog	Seqrite
18.7.26	Operation ShadowRecruit: A Recruitment-Themed Malware Campaign Leveraging ControlR and Google Sheets to Target Indian Job Seekers	Contents Introduction Key Targets Industries Affected Geographical focus Infection Chain Initial Findings Looking into the Decoy Document Technical Analysis Stage 1 – Initial Infection through LNK file Stage 2 – PowerShell Downloader Analysis Stage 3 – The .NET Dropper...	Hacking blog	Seqrite
18.7.26	Spirals: New Stealthy Ransomware Deployed Against Asian IT Company	Attack using previously unseen ransomware payload occurred in June 2026. The skill of its operators suggests wider campaigns may follow.	Ransom blog	SECURITY.COM
18.7.26	Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor	Four years after Symantec first uncovered Daxin, the most advanced malware we had seen from a China-linked actor, it has been found running inside a Taiwan manufacturing firm, deployed with a novel new backdoor.	APT blog	SECURITY.COM
18.7.26	GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses	Third iteration of ransomware from Hyadina developers who first launched the Monster ransomware in 2022.	Ransom blog	SECURITY.COM
18.7.26	ACR Stealer: Two observed intrusion chains amid increased threat activity	From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments.	Malware blog	Microsoft blog
18.7.26	Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery	hreat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm.	Hacking blog	Microsoft blog
18.7.26	Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet	TrendAI™ Research analyzed over 200 Gemini CLI session logs showing how a Russian-speaking threat actor used AI to run a live botnet, finishing a full C&C migration in six minutes while doing just 11% of the work himself.	AI blog	Trend Micro
18.7.26	The PhantomGate Campaign — Obfuscation, Persistence, and Covert Surveillance	This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of PhantomGate malware. This family uses a series of obfuscated .LNK and .BAT files to download a malicious binary via PowerShell commands. Embedded payloads provide additional functionality for controlling webcams and capturing audio, using legitimate libraries to help bypass security.	Malware blog	SonicWall
18.7.26	Microsoft Security Bulletin Coverage for July 2026	Microsoft’s July 2026 Patch Tuesday has 576 vulnerabilities, of which 255 are Elevation of Privilege. Microsoft had said last week in this blog that “As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release”.	OS Blog	SonicWall
18.7.26	The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)	The security of the npm ecosystem reached a critical inflection point in September 2025. The Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious packages, marked the end of the “nuisance” era of npm attacks and the beginning of a high-consequence threat landscape.	Malware blog	Palo Alto
18.7.26	TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development	We identified a previously undocumented modular internet-of-things (IoT) botnet framework named TuxBot v3 Evolution.	BotNet blog	Palo Alto
18.7.26	Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy	We conducted this research in close partnership with Siemens, reflecting our shared commitment to advancing the security and resilience of critical infrastructure.	Vulnerebility blog	Palo Alto
18.7.26	AI Security Report 2026	For years, the cyber security industry tracked AI as a force multiplier: something that made existing attack techniques faster, cheaper, and more accessible. That framing was accurate. But the Annual AI Security Report 2026 from Check Point Research documents a transition that goes further. AI has crossed from assistant to operator. Where it once helped attackers prepare, it now runs the operation.	AI blog	CHECKPOINT
18.7.26	UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign	Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.	Malware blog	CISCO TALOS
18.7.26	The Hunter's Paradox: Is it time to embrace automated threat hunting?	Humans can no longer keep up with the volume and velocity of security data on their own, but AI can't be fully trusted. David discusses the merits of both and muses on what the future might look like.	AI blog	CISCO TALOS
18.7.26	[Video] Where protection starts: Cisco Talos Intelligence Integrations	Every day, defenders make high-consequence decisions with incomplete information. Learn how Cisco Talos Intelligence Integrations help reduce uncertainty by turning the latest threat intelligence into proactive protections across Cisco technologies.	Cyber blog	CISCO TALOS
18.7.26	The serpent’s tongue: Luring the Python out of its den	This blog examines the full lifecycle of a Python package, from hosting on repositories such as PyPI or custom web servers, through source and wheel distribution formats, to the final installation into virtual or system-wide Python environments.	Cyber blog	CISCO TALOS
18.7.26	Begun, the Patch Wars have	Long foretold, the Great Patching has begun and it’s a doozy. Buckle in as Joe takes you through the story.	Vulnerebility blog	CISCO TALOS
18.7.26	Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities	Microsoft has released its monthly security update for July 2026, which includes 622 vulnerabilities affecting a range of products, including 57 that Microsoft marked as "critical."	Vulnerebility blog	CISCO TALOS
18.7.26	WolfSSL, GeoVision, VTK vulnerabilities	Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three vulnerabilities in WolfSSF, fourteen in GeoVision, and one vulnerability in VTK-DICOM. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to	Vulnerebility blog	CISCO TALOS
18.7.26	Forgotten UEFI shims undermining Secure Boot	ESET researchers discovered 11 vulnerable UEFI shim bootloaders signed by Microsoft that allow attackers to bypass UEFI Secure Boot by exploiting decade-old vulnerabilities	OS Blog	Eset
17.7.26	GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft	Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster dubbed CylindricalCanine . Expel,	Hack	The Hacker News
17.7.26	E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants	The European Commission on Thursday ordered Google to give rival AI assistants the same reach into Android that Gemini already has: the	BigBrothers	The Hacker News
17.7.26	Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man	Armenia has held a Russian tourist named Aleksandr Ermakov in a detention center since June 28, on a U.S. extradition request for a REvil	CyberCrime	The Hacker News
17.7.26	ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files	ACR Stealer , an infostealer in circulation since 2024, is walking out of enterprise networks with saved browser passwords, live session tokens,	Virus	The Hacker News
17.7.26	New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage	Cybersecurity researchers have discovered a previously undocumented malware called GoSerpent that has been put to use in cyber attacks	Virus	The Hacker News
17.7.26	New phishing kits target Microsoft 365 accounts, evade MFA	Two new phishing kits, Jalisco and OmegaLord, have been discovered in attacks targeting Microsoft 365 accounts, using techniques that defeat multi-factor authentication (MFA).	Phishing	BleepingComputer
17.7.26	SAP warns of critical flaws in NetWeaver and Commerce Cloud	SAP has addressed 16 vulnerabilities across multiple products as part of its July 2026 security updates, including three critical flaws in NetWeaver, Commerce Cloud, and AppRouter	Vulnerebility	BleepingComputer
17.7.26	Microsoft starts testing cleaner Windows Search without ads	Microsoft is now testing a cleaner and faster version of Windows Search that should prioritize relevant results over ads and promotional content.	Security	BleepingComputer
17.7.26	US sanctions VPN, malware providers for enabling ransomware attacks	The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned two individuals and one entity for enabling ransomware attacks against U.S. organizations.	Ransom	BleepingComputer
17.7.26	Japan's largest taxi operator shuts systems after cyberattack	Japan's largest taxi operator, Nihon Kotsu, announced that its systems were compromised in a cyberattack, forcing the company to shut down part of its infrastructure.	Incindent	BleepingComputer
17.7.26	Hackers backdoor Jscrambler npm package with infostealer malware	The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm package that has been downloaded almost 1,500 times.	Virus	BleepingComputer
17.7.26	New CrashStealer malware poses as Apple crash reporting tool	A new macOS information-stealing malware called CrashStealer pretends to be Apple's crash-reporting tool to steal credentials, keychain data, and crypto wallets.	Virus	BleepingComputer
17.7.26	CISA warns of actively exploited RCE flaws in Joomla extensions	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are exploiting vulnerabilities in the iCagenda and Balbooa Forms extensions for Joomla to achieve remote code execution through arbitrary file uploads.	Vulnerebility	BleepingComputer
17.7.26	Lidl discloses online shop breach after service provider hack	German discount supermarket chain Lidl notified customers in Germany, Belgium, and the Netherlands that attackers stole their personal information in a breach at a service provider.	Incindent	BleepingComputer
17.7.26	Breach at the Beach: Play the Ultimate Entra ID CTF	Learn how attackers abuse Entra ID through a free hands-on Capture the Flag. Varonis created the Breach at the Beach CTF to teach defenders how to investigate Entra ID attack techniques using realistic scenarios.	Incindent	BleepingComputer
17.7.26	UK charges suspects linked to Russian Coms call spoofing platform	UK authorities charged five people following a National Crime Agency (NCA) investigation into Russian Coms, a major caller ID spoofing platform used by criminals to make over 1.8 million scam calls.	BigBrothers	BleepingComputer
17.7.26	EU sanctions Russian GRU military hackers over cyberattacks	The European Union and the United Kingdom jointly sanctioned dozens of Russian individuals and entities and accused Russia of coordinating a network of hacking groups responsible for attacks across Europe.	BigBrothers	BleepingComputer
17.7.26	US and allies warn of Russian critical infrastructure attacks	Cybersecurity agencies from the United States and eight other countries have issued a joint warning that Russian state hackers are targeting vulnerable and poorly configured routers to infiltrate critical infrastructure networks.	BigBrothers	BleepingComputer
17.7.26	RedHook Android malware now uses Wireless ADB for shell access	A new version of the RedHook Android malware abuses the Android Wireless Debugging (Wireless ADB) mechanism in a novel way to gain shell-level privileges without requiring a computer connection.	Virus	BleepingComputer
17.7.26	Australia warns of global campaign targeting vulnerable CMS platforms	The Australian Cyber Security Centre (ACSC) issued an alert about a global exploitation campaign targeting vulnerable content management systems (CMS) and plugins.	CyberCrime	BleepingComputer
17.7.26	CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a newly patched security flaw impacting Microsoft	Exploit	The Hacker News
17.7.26	Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack	Owen Flowers , 18, and Thalha Jubair , 20, were each sentenced to five and a half years at Woolwich Crown Court on Thursday, 16 July 2026, for	CyberCrime	The Hacker News
16.7.26	n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer	n8n , the workflow automation platform, handed out the wrong accounts at login. On Enterprise instances configured to trust more than one	Hack	The Hacker News
16.7.26	New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands	Cybersecurity researchers have called attention to a new modular malware called TELEPUZ that's been spreading via websites infected with ClickFix lures since late April 2026. "The malware is full-featured,	Virus	The Hacker News
16.7.26	New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password	ClickLock Stealer , a new macOS infostealer, answers a victim's refusal by killing their apps on a loop until they hand over the login password. It	Virus	The Hacker News
16.7.26	20+ Hijacked Government Websites Became an Attack Channel	More than 20 Brazilian government websites were hijacked and turned into malware delivery channels in an active PhantomEnigma campaign	Hack	The Hacker News
16.7.26	New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands	Ask an AI agent to summarize the reviews on a product page, and a single planted review can make it click "Buy Now" instead. Ask a coding	AI	The Hacker News
16.7.26	Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor	An advanced malware previously attributed to a China-linked threat actor has resurfaced after more than four years within a Taiwan manufacturing	Virus	The Hacker News
16.7.26	Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide	Pull the certificate off the flash of a Shark RV2320EDUS robot vacuum, and you can run root commands on other people's Shark vacuums across	Vulnerebility	The Hacker News
16.7.26	OpenAI’s GPT-Red Automates Prompt Injection Testing to Harden GPT-5.6 Sol	OpenAI has disclosed details of GPT-Red , an internal automated red-teaming model that scales prompt injection vulnerability discovery with	AI	The Hacker News
16.7.26	Zoom Patches Critical Windows Flaw That Could Enable Account Takeover	Zoom has released security updates for a critical security flaw impacting Zoom Workplace for Windows that could facilitate account takeover. The	Vulnerebility	The Hacker News
16.7.26	TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development	Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things (IoT) botnet framework dubbed TuxBot v3	IoT	The Hacker News
16.7.26	OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps	A malware framework called OkoBot has been running on Windows machines since April 2025, and one of its modules is built to con	Virus	The Hacker News
16.7.26	Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws	Mozilla has released updates to address two critical flaws in Firefox for which it warned that exploit code has been published. The vulnerabilities are listed below - CVE-2026-15718 , an invalid pointer in the JavaScript:	Vulnerebility	The Hacker News
16.7.26	Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday	Security researcher Chaotic Eclipse (aka Nightmare-Eclipse ) has released a new proof-of-concept (PoC) exploit called LegacyHive.	Vulnerebility	The Hacker News
16.7.26	Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution	Open a repository in Cursor on Windows and, if a file named git.exe is sitting in the project root, Cursor runs it. No click, no approval dialog, no	Vulnerebility	The Hacker News
16.7.26	Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware	Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to	Virus	The Hacker News
15.7.26	Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands	SonicWall has warned of active exploitation of two zero-day vulnerabilities impacting Secure Mobile Access (SMA) 1000 series appliances, one of which could be exploited to achieve arbitrary command execution.	Vulnerebility	The Hacker News
15.7.26	Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack	Microsoft shipped its largest Patch Tuesday on record today, and two of the fixes close holes that attackers are already exploiting. The release	Vulnerebility	The Hacker News
14.7.26	SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data	SAP has rolled out updates to address multiple vulnerabilities as part of its July 2026 security updates, including a critical flaw in SAP NetWeaver	Vulnerebility	The Hacker News
14.7.26	Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads	Any other browser extension that can run a script on claude.ai can still trigger Claude for Chrome tasks aimed at your Gmail, your latest Google	AI	The Hacker News
14.7.26	LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts	Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan (RAT) codenamed LabubaRAT that	Virus	The Hacker News
14.7.26	RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata	Cybersecurity researchers have disclosed details of two access control-related flaws impacting the RabbitMQ message broker service that could	Vulnerebility	The Hacker News
14.7.26	11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot	Cybersecurity researchers have discovered 11 old, Microsoft-signed, Unified Extensible Firmware Interface (UEFI) applications that could be abused to bypass Secure Boot on most systems using the modern	OS	The Hacker News
14.7.26	Study of 85 Crypto Wallet Extensions Finds Address Leaks and Cross-Site Tracking Risks	Researchers at KU Leuven tested 85 of the most popular crypto wallets that run as browser extensions and found that the wallets themselves	Cryptocurrency	The Hacker News
14.7.26	How Pentera Turns AI Security Workflows into Validation Engines	AI security agents are starting to influence real security decisions. They summarize findings, prioritize remediation, recommend next steps, and	AI	The Hacker News
14.7.26	OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials	At least two distinct threat actors are weaponizing a novel evasion technique called OAuth client ID spoofing in cloud campaigns, while	Hack	The Hacker News
14.7.26	Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read	xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not	AI	The Hacker News
14.7.26	U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support	The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) has designated two individuals and a VPN service provider for enabling	Ransom	The Hacker News
14.7.26	Defending SaaS-based applications against ShinyHunters OAuth abuse	In a series of campaigns observed between mid-2025 and mid-2026, Microsoft identified threat actor activity with overlapping tradecraft commonly associated with ShinyHunters, including voice phishing (vishing), supply chain compromise, and misconfigured guest access to target customer SaaS-based applications such as Salesforce instances.	Phishing blog	Microsoft blog
14.7.26	148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet	A campaign of 148 npm packages disguised as student web proxies turned visitors' browsers into a distributed denial-of-service botnet for	BotNet	The Hacker News
14.7.26	Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity	Attackers whose methods line up with the data-extortion group ShinyHunters have spent the past year walking into corporate Salesforce environments without exploiting a single flaw in the platform. The way in	APT	The Hacker News
13.7.26	CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks	Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that's capable of harvesting sensitive data from	Virus	The Hacker News
13.7.26	Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found	Google and Microsoft have pulled ModHeader , a popular header-editing extension with roughly 1.6 million installs across Chrome and Edge, after	Hack	The Hacker News
13.7.26	Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft	A new phishing-as-a-service (PhaaS) operation called Forg365 is using a combination of device code phishing , adversary-in-the-middle (AitM) tactics, antibot evasion, artificial intelligence (AI)-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts.	Phishing	The Hacker News
13.7.26	Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory	Cybersecurity researchers have flagged an intrusion in which an unknown threat actor leveraged a vibe-coded PowerShell script for Active Directory	AI	The Hacker News
13.7.26	Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365	An attacker running a live Microsoft 365 phishing operation left a Python web server listening on a public port with directory listing switched on.	Phishing	The Hacker News
13.7.26	iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and	Exploit	The Hacker News
12.7.26	Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install	The jscrambler npm package was compromised, and simply installing its 8.14.0 release runs an infostealer on your machine. Published on July 11, 2026, the malicious version carries a preinstall hook that drops and executes a native binary, one build each for Windows, macOS, and Linux.	Virus	The Hacker News
12.7.26	Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns	Cybersecurity researchers have disclosed details of sustained cyber espionage activity against several Pakistani law enforcement	APT	The Hacker News
12.7.26	'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets	A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostcommit,' slipped past AI code reviewers CodeRabbit and Bugbot, which never open image files at all, then convinced a coding agent to read a repo's .env and write every secret into the code as a list of numbers.	AI	BleepingComputer
12.7.26	New U-Boot flaws could enable stealthy firmware attacks	Six vulnerabilities in the widely used U-Boot bootloader have been discovered that could allow attackers to execute malicious code during device boot, potentially enabling stealthy firmware attacks that compromise security protections and install persistent malware.	Vulnerebility	BleepingComputer
12.7.26	Ryuk ransomware member pleads guilty in the US, faces 15 years in prison	A 34-year-old Armenian man has pleaded guilty to hacking U.S. companies and deploying the infamous Ryuk ransomware to encrypt their systems.	Ransom	BleepingComputer
12.7.26	Police suspects Dutch hackers were involved in Odido breach	The Dutch National Police (Politie) says it has found "strong indications" that Dutch hackers have been involved in a February breach at the telecommunications provider Odido.	BigBrothers	BleepingComputer
12.7.26	Progress urges ShareFile admins to shut down servers over “credible” threat	Progress Software is emailing ShareFile customers who use Storage Zone Controllers to immediately shut down their servers after identifying what it describes as a "credible external security threat" targeting the on-premises secure file-sharing software.	Vulnerebility	BleepingComputer
12.7.26	Hackers exploit critical auth bypass in Gitea Docker image	Hackers are actively exploiting a critical vulnerability in the official Docker image for the Gitea self-hosted Git service that allows attackers to impersonate any user, including administrators.	Exploit	BleepingComputer
12.7.26	Money launderer accused of stealing seized crypto while in prison	A Bulgarian national has been charged with stealing $290,000 in government-seized cryptocurrency while serving 121 months in prison for helping launder millions stolen from American fraud victims	Cryptocurrency	BleepingComputer
12.7.26	The Replicant in Your Directory: AI Agents and the Identity Security Gap	AI agents are accelerating the growth of non-human identities, making it harder for organizations to understand what exists, who owns it, and what it can access. Netwrix explains why stronger visibility and identity governance are essential as AI expands the enterprise attack surface.	AI	BleepingComputer
12.7.26	Zimbra urges customers to patch critical web client XSS flaw	The Zimbra security team urged customers to patch a critical vulnerability affecting the Classic Web Client used to access the Zimbra Collaboration suite.	Vulnerebility	BleepingComputer
12.7.26	Former ransomware negotiator gets 4 years for BlackCat attacks	A former employee of cybersecurity incident response company DigitalMint was sentenced to 70 months in prison for targeting U.S. companies in BlackCat (ALPHV) ransomware attacks.	Ransom	BleepingComputer
12.7.26	OpenMandriva Linux says contributor tried to sabotage the project	The OpenMandriva Linux project announced that it was the target of an attempted act of internal sabotage after a dispute among contributors.	OS	BleepingComputer
12.7.26	Injective SDK on npm infected with cryptocurrency wallet stealer	Hackers compromised the Injective Labs SDK project's GitHub repository and used it to publish a malicious package on the Node Package Manager (npm) that stole cryptocurrency wallet private keys and mnemonic seed phrases.	Cryptocurrency	BleepingComputer
11.7.26	New Helix vishing group emerges in SharePoint data theft attacks	A new data-extortion group called Helix is using identity-focused tactics such as voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to steal data from SharePoint environments.	Phishing	BleepingComputer
11.7.26	Microsoft expects more Windows security updates from AI-discovered flaws	Microsoft says Windows users should expect to see an increase in security updates as the company increasingly relies on artificial intelligence to discover vulnerabilities in its codebase.	AI	BleepingComputer
11.7.26	New Forg365 phishing platform uses AI to target Microsoft 365 accounts	A new phishing-as-a-service (PhaaS) operation called Forg365 focuses on stealing Microsoft 365 accounts by combining adversary-in-the-middle (AiTM) and device code methods with AI-assisted lure generation.	AI	BleepingComputer
11.7.26	The Hidden Security Risks of Reduced Summer IT Coverage	Security operations don't slow down when IT teams take vacation, but staffing levels often do. Kaseya explains how AI-driven automation can help organizations maintain consistent security operations and reduce reliance on manual processes year-round.	AI	BleepingComputer
11.7.26	Microsoft to retire the OWA Light client in Exchange Server	Microsoft has announced plans to disable Outlook Web Access (OWA) Light, the lightweight version of the Outlook Web App email client, in a future Exchange Server update.	OS	BleepingComputer
11.7.26	Police arrests 5,800 suspects in global anti-fraud crackdown	Law enforcement agencies have arrested 5,811 suspects and seized $293 million in illicit assets in a global anti-fraud operation spanning 97 countries.	BigBrothers	BleepingComputer
11.7.26	AssuranceAmerica data breach exposes records of 6.9 million drivers	American insurance company AssuranceAmerica has disclosed a data breach impacting nearly 7 million drivers after attackers gained access to its systems earlier this year.	Incindent	BleepingComputer
11.7.26	Microsoft patches RoguePlanet Defender zero-day vulnerability	Microsoft has released a security patch to address a Defender zero-day vulnerability known as "RoguePlanet," disclosed after the June 2026 Patch Tuesday.	Vulnerebility	BleepingComputer
11.7.26	Mount Royal University confirms breach as hackers claim attack	Mount Royal University in Calgary says hackers stole and then deleted data from its file storage systems after breaching the university's network.	Incindent	BleepingComputer
11.7.26	Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials	Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment applications.	Virus	BleepingComputer
11.7.26	Hackers exploit Roundcube flaw to spy on academic researchers	A China-linked threat cluster has been exploiting vulnerable Roundcube servers at U.S. and Canadian universities to steal credentials and deploy backdoor malware.	Exploit	BleepingComputer
11.7.26	Entra passkey enrollment vishing targets Microsoft 365 users	A threat actor has been targeting organizations across multiple sectors with voice-based fake security requests that ask Microsoft 365 users to enroll a new Entra passkey.	Phishing	BleepingComputer
11.7.26	3 Ways AI Powers Service Desk Attacks and How to Prevent Them	Specops Software explains how AI is making service desk impersonation attacks more convincing, personalized, and scalable, along with practical steps organizations can take to strengthen onboarding and identity verification.	AI	BleepingComputer
11.7.26	Telco giant KDDI says data breach affects over 12 million people	Japanese telecommunications giant KDDI says that millions of people had their email addresses and passwords exposed after attackers breached an email platform used by five internet service providers (ISPs) in the country.	Incindent	BleepingComputer
11.7.26	CISA orders feds to prioritize patching Langflow auth bypass flaw	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) gave federal agencies until Friday to patch an actively exploited vulnerability in the Langflow visual framework for building AI agents.	Vulnerebility	BleepingComputer
11.7.26	Ubiquiti warns of new max severity UniFi OS vulnerability	Ubiquiti has released security updates to patch seven critical vulnerabilities in UniFi OS, including a maximum-severity flaw that can be exploited in command injection attacks.	Vulnerebility	BleepingComputer
11.7.26	"Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?	Anyone who deals with phishing messages caught by basic security filters knows that most phishing samples tend to blend into one another, since only a small set of techniques and approaches keeps reappearing in them. That is precisely why it is worth pausing on the occasional message that does something a little out of the ordinary.	Phishing	SANS
11.7.26	Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions	Zimbra is urging customers to apply updates to address a critical security vulnerability impacting the Classic Web Client that could result in	Vulnerebility	The Hacker News
11.7.26	URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat	Progress Software has told ShareFile customers to shut down the Windows servers running their Storage Zone Controllers, confirming to	Vulnerebility	The Hacker News
11.7.26	Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages	Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the	Hack	The Hacker News
11.7.26	Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot	Researchers at firmware security firm Binarly have found six new flaws in U-Boot, the small program that starts up hardware as varied as home	Vulnerebility	The Hacker News
11.7.26	Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched	Researchers at Ledger's Donjon security team have shown that a precisely timed laser pulse, aimed at the chip inside a Tangem crypto	Hack	The Hacker News
11.7.26	Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws	Details have emerged about three now-patched security flaws in the OpenClaw personal artificial intelligence (AI) assistant that, if	Social	The Hacker News
11.7.26	Phishing in the Balkans: Fake Traffic Fines, Real Losses	This blog documents Group-IB’s research into an SMS phishing campaign targeting Serbian road users through the impersonation of Serbia's state road authority, and how it can be linked to both Darcula and Phoenix PhaaS platforms with victims across the globe.	Phishing blog	GROUP-IB
11.7.26	Connecting Scattered Spider: Defining A Cybercrime Collective Through Shared TTPs	This blog covers Group-IB’s overview of Scattered Spider, backed by Group-IB’s proprietary intelligence, providing additional information to what has already been reported publicly, with added clarification on 0ktapus and how it is related to Scattered Spider.	Hacking blog	GROUP-IB
11.7.26	RedHook Returns with a Dangerous Upgrade	Group-IB analysts examine this resurfaced Android Remote Access Trojan, demonstrating new, sophisticated and malicious functionalities including autonomous privilege abuse, expanded command-and-control capabilities, and a robust persistence stack.	Malware blog	GROUP-IB
11.7.26	Sophos named a 2026 Gartner® Peer Insights™ Customers’ Choice for Email Security	Sophos has been named a 2026 Gartner® Peer Insights™ Customers’ Choice in the 2026 Gartner® Peer Insights™ Voice of the Customer for Email Security. This marks Sophos’ entry into the report, as well as Sophos’ first ever Customers’ Choice distinction for Email Security.	Cyber blog	SOPHOS
11.7.26	When AI agents look like attackers: what behavioral telemetry tells us	An X-Ops analysis of how AI coding agents trigger endpoint detection rules designed for adversaries	AI blog	SOPHOS
11.7.26	"Exploit mitigation" stalled around 2008. The attacks didn't.	AI turns a patched bug into a working exploit in hours. Why endpoint exploit mitigation stalled in 2008, and what a default-on mitigation layer looks like now.	AI blog	SOPHOS
11.7.26	The ‘Ghost’ in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI	The "Golden SAML" technique, first described by CyberArk researchers in 2017, and further detailed by Mandiant researchers in 2021, remains one of the most effective methods for threat actors to forge identity assertions in the Microsoft ecosystem.	Hacking blog	GTI
11.7.26	The Two BIOS Passwords Everyone Confuses	When someone tells me “we set the BIOS password on the fleet,” my first question is always “which one?” Because there are at least two firmware passwords on a modern machine, they do completely different things, and the failure I see most often is a team that sets one, assumes it covers the other, and leaves a gap they do not know they have.	Hacking blog	Eclypsium
11.7.26	Post-Mythos Cybersecurity: Can You Automate Infrastructure Assurance with AI?	Programs like Anthropic’s Mythos and OpenAI’s Daybreak are changing how organizations think about security architecture, internal engineering, staffing, and vendor commitments. OpenAI describes Daybreak as a defender-focused program for finding, validating, and fixing vulnerabilities before attackers can exploit them.	AI blog	Eclypsium
11.7.26	From Invoice to AnyDesk: Uncovering a Phishing Campaign Targeting Russian Aerospace Organizations	Table of Contents Introduction Infection Chain Technical Analysis Conclusion Seqrite Coverage Indicators of Compromise (IOCs) MITRE ATT&CK Mapping Introduction The Seqrite Threat Research Team identified a targeted spear-phishing campaign disguised as a legitimate business invoice. The phishing email impersonates a legitimate...	Phishing blog	Seqrite
11.7.26	Inside the Underground Economy: 5 Dark Web Trends Shaping the 2026 Threat Landscape	Cyble breaks down how dark web ecosystems are evolving in 2026 with ransomware, initial access brokers, AI-driven attacks, and underground threat activity.	Cyber blog	Cyble
11.7.26	Mid-Year Threat Trends: What H1 2026 Signals for the Rest of the Year	H1 2026 threat intelligence trends show rising ransomware, AI-driven attacks, and identity risks reshaping the global cyber risk outlook for 2026.	Cyber blog	Cyble
11.7.26	Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App	CRIL analyzes Glitch SPY, an Android RAT with 70+ commands, crypto-clipping, and a silent remote browser, giving attackers full device control.	Malware blog	Cyble
11.7.26	GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses	Third iteration of ransomware from Hyadina developers who first launched the Monster ransomware in 2022.	Ransom blog	SECURITY.COM
11.7.26	GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware	GigaWiper is a destructive backdoor that combines multiple wiping and ransomware-like capabilities into a single operational platform.	Malware blog	Microsoft blog
11.7.26	rclone Remote-Control API Unauthenticated Command Execution	rclone Remote-Control API Unauthenticated Command Execution (CVE-2026-41179)	Vulnerebility blog	SonicWall
11.7.26	Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation	In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide.	Malware blog	Palo Alto
11.7.26	Cavern Manticore: Exposing Iran-Linked Modular C2 Framework	Note: SysAid was not compromised, and no SysAid vulnerability was involved. The attacker had already gained access to the victim environment and abused a legitimate software-deployment feature to deploy malware onto another machine within it.	APT blog	CHECKPOINT
11.7.26	Winning 54% of the time	With Wimbledon's help, Hazel argues against the popular myth that "Attackers only need to be right once, but defenders need to be right 100% of the time."	Cyber blog	CISCO TALOS
11.7.26	UAT-7810 continues building ORB networks using new malware	Talos’ latest findings on UAT-7810 indicate that the threat actor continues to develop their custom-made malware.	Malware blog	CISCO TALOS
11.7.26	ESET Threat Report H1 2026	A view of the H1 2026 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts.	Cyber blog	Eset
10.7.26	New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic	The China-linked cybercrime group known as Silver Fox has been attributed to a new Rust-based remote access trojan (RAR) called	Virus	The Hacker News
10.7.26	Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers	A single wrong variable on one line in XQUIC, Alibaba's QUIC and HTTP/3 library, lets any remote client crash the server with a short burst of	Vulnerebility	The Hacker News
10.7.26	Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites	A cybercrime crew left one of its own servers wide open on the internet for three weeks, and it exposed the operation's inner workings: the	Hack	The Hacker News
10.7.26	Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking	Researchers ran 281 of the most popular free VPN apps on the Google Play Store through a new testing system and found that many fail at the	Security	The Hacker News
10.7.26	Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access	A threat actor has been targeting organizations spanning multiple sectors with voice-based fake security requests that prompt Microsoft	Hack	The Hacker News
10.7.26	Attackers Exploit 'Ill Bloom' Vulnerability to Drain $3.1 Million From Cryptocurrency Wallets	Security firm Coinspect has disclosed a crypto wallet flaw it calls Ill Bloom , and attackers are already using it. The flaw is in how some wallet	Exploit	The Hacker News
10.7.26	Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks	A 41-year-old former ransomware negotiator has been sentenced to nearly six years (i.e., 70 months) in prison in the U.S. for their role in conspiring with the now-defunct BlackCat ransomware operators to	Ransom	The Hacker News
10.7.26	My Stack Simulator	The stack is a memory region where a program stores temporary data - like local variables and return addresses. Think of the stack as a pile of plates in your kitchen: you can only add a new plate to the top, and you can only take one away from the top too. Programs use this same "last in, first out" principle to keep track of what they're doing.	Security	SANS
10.7.26	_HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_ [Guest Diary]	Every so often a honeypot hit comes along that is less about the exploit and more about the intent behind it. While reviewing DShield logs I ran into a scanning bot that caught my eye: a URI string that appeared to be a plea for help.	Exploit	SANS
10.7.26	Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs	Datadog Security Labs is warning of "several overlapping campaigns" that are systematically enumerating corporate GitHub organizations, repositories, and user accounts through the GitHub API.	Hack	The Hacker News
10.7.26	New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware	Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper . What stands out is how it is built: not one tool but three older destructive programs bolted into one, offered as commands the operator	Virus	The Hacker News
10.7.26	npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk	GitHub has officially announced the release of npm version 12 with install scripts disabled by default, along with deprecating granular access	Hack	The Hacker News
9.7.26	Threat landscape for industrial automation systems. Q1 2026	This report contains industrial threat statistics for Q1 2026, including industrial threat distribution by type, source, region and industry.	ICS	SECURELIST
9.7.26	Summer of Clearinghouses	Everyone seems to have announced a clearinghouse over the past few weeks. We did too. Ours is called Athena , and the main thing that sets it	Security	The Hacker News
9.7.26	GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses	Cybersecurity researchers have flagged a new ransomware family called GodDamn that employs the PoisonX kernel driver to neutralize security	Ransom	The Hacker News
9.7.26	Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges	Microsoft has released security updates for a Defender vulnerability known as RoguePlanet, nearly a month after details of the flaw became	Vulnerebility	The Hacker News
9.7.26	CISA orders feds to patch max severity ColdFusion flaw by Friday	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered government agencies to patch an actively exploited maximum-severity flaw in the Adobe ColdFusion commercial web app development platform by Friday.	Vulnerebility	BleepingComputer
9.7.26	Accenture confirms breach after hacker offers stolen data for sale	IT services giant Accenture has confirmed it suffered a security breach after a threat actor claimed to have stolen 35 GB of source code and other data from the company.	Incindent	BleepingComputer
9.7.26	Chinese hackers develop LONGLEASH malware to expand ORB network	Chinese hackers tracked as 'UAT-7810' are actively evolving their malware to expand their Operational Relay Box (ORB) network by compromising internet-facing networking devices, primarily unpatched Ruckus routers.	Virus	BleepingComputer
9.7.26	Hidden backdoor in Tenda router firmware grants admin access	A hidden authentication backdoor has been found in multiple Tenda router firmware versions, potentially allowing an attacker to gain administrative access to the device's web management panel.	Virus	BleepingComputer
9.7.26	Spain arrests suspected member of pro-Russian hacktivist groups	The National Police in Spain have arrested a man who is suspected of being an active member of the CyberArmy of Russia Reborn (CARR) and Z-Pentest, both pro-Russian hacktivist groups.	BigBrothers	BleepingComputer
9.7.26	The GitHub Actions Attack Pattern Your CI Security Scanners Miss	ActiveState explains how GitHub Actions attack chains can evade traditional CI security scanners, why passing a scan doesn't guarantee a secure pipeline, and how organizations can better govern their CI/CD workflows.	Hack	BleepingComputer
9.7.26	New Januscape Linux flaw allows VM escape on Intel, AMD devices	A 16-year-old Linux kernel vulnerability, dubbed Januscape, allows attackers to escape a virtual machine and execute arbitrary code on the host.	Vulnerebility	BleepingComputer
9.7.26	Microsoft to enable Windows settings backup by default for orgs	Microsoft says the Windows settings backup and restore tool will be enabled by default on Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems after upgrading to Windows 11 26H2	OS	BleepingComputer
9.7.26	BeyondTrust warns of critical flaws in remote access software	BeyondTrust warned customers to patch two critical security flaws in its Remote Support (RS) and Privileged Remote Access (PRA) software that could allow attackers to bypass authentication.	Vulnerebility	BleepingComputer
9.7.26	Microsoft testing new Cloud Rebuild Windows 11 recovery feature	Microsoft has begun testing the Cloud Rebuild recovery feature in the latest Windows 11 Insider Preview builds released for users in the Experimental channel.	OS	BleepingComputer
9.7.26	Phishing poses as big-brand job interview to steal Google accounts	A phishing campaign is impersonating more than 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, in fake job interviews to steal Google account credentials from marketing professionals.	Phishing	BleepingComputer
9.7.26	Fake IT support calls on Microsoft Teams push EtherRAT malware	Threat actors are abusing Microsoft Teams voice calls by impersonating corporate IT support staff to trick employees into installing the EtherRAT malware, giving attackers initial access to corporate networks.	Virus	BleepingComputer
9.7.26	Vietnam arrests suspects behind HiAnime anime piracy service	Vietnamese authorities have arrested and are prosecuting seven suspects believed to have run HiAnime, the largest anime piracy streaming service before its shutdown in June.	BigBrothers	BleepingComputer
9.7.26	Software Is Now Written at the Speed of Thought. Security Isn't.	Every evolution in software development has reduced the friction between an idea and a deployable application. AI may remove the final barrier, but it also removes many of the moments where security decisions have traditionally taken place.	AI	BleepingComputer
9.7.26	Max severity Adobe ColdFusion flaw now exploited in attacks	Attackers are now exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, according to vulnerability intelligence company KEVIntel.	Exploit	BleepingComputer
9.7.26	Friendly Fire: Hijacking Defensive Cyber AI Agents for Remote Code Execution	We are revealing a proof-of-concept exploit that enables remote code execution in Anthropic’s Claude Code CLI (with Claude Sonnet 4.6 & 5, Opus 4.8) and OpenAI’s Codex CLI (with GPT-5.5) when employed to defensively assess the security of an open-source or third-party library.	AI blog	AINOW
9.7.26	Fake 7-Zip downloads are turning home PCs into proxy nodes	A convincing lookalike of the popular 7-Zip archiver site has been serving a trojanized installer that silently converts victims’ machines into residential proxy nodes—and it has been hiding in plain sight for some time.	Hacking blog	MALWAREBYTES
9.7.26	Meta's New AI Image Tool Lets Others Use Your Public Instagram Photos in AI Images	Meta has announced that its new artificial intelligence (AI) model Muse Image lets people use public Instagram posts and reels to generate AI	AI	The Hacker News
9.7.26	Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It	Ask an AI coding agent to scan open-source code for security holes, and it might run the attacker's code on your own machine instead. That is the	AI	The Hacker News
9.7.26	GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents	Researchers at Wiz found that a flaw in six popular AI coding assistants lets a booby-trapped code project quietly take control of a developer's	AI	The Hacker News
9.7.26	Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes	Cybersecurity researchers have disclosed details of a new threat actor dubbed Lurking Lizard that has been operating an end-to-end malicious	Hack	The Hacker News
9.7.26	AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers	Sophos looked at a week of its own endpoint data and found that AI coding agents such as Claude Code, Cursor, and OpenAI Codex are	AI	The Hacker News
8.7.26	New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware	AI coding assistants have a habit of making things up. Ask one to fetch a popular tool, and it will sometimes hand back a real-sounding name for a	AI	The Hacker News
8.7.26	Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS	Ubiquiti has shipped updates to address multiple critical security flaws impacting UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and	Vulnerebility	The Hacker News
8.7.26	New Ghost Phishing Wave Is Breaking Traditional Email Security	A recent EvilTokens campaign targeting businesses across the US and Europe is exposing a new email security blind spot. This “ghost phishing” technique keeps the malicious page hidden until it decrypts and comes to	Phishing	The Hacker News
8.7.26	SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users	A new banking fraudulent operation is targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges using	Virus	The Hacker News
8.7.26	GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures	New research shows that a signed Git commit's hash is not the one-of-a-kind name that much of the software world assumes it to be. Given any	Security	The Hacker News
8.7.26	GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in Code	An AI coding assistant that refuses to answer a dangerous request in its chat box can answer it anyway if the same request is broken into small, ordinary-looking steps inside a code editor. That is the finding of a new study of GitHub Copilot by researchers Abhishek Kumar and Carsten Maple.	AI	The Hacker News
8.7.26	China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware	A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box (ORB) network by	APT	The Hacker News
8.7.26	More Odd DNS Records: NIMLOC	Yesterday, I talked about NAPTR records and how they are related to RCS. But there is another "odd" record that shows up in my DNS logs. This one isn't new, but I don't think I ever covered it: NIMLOC. At least that is what Zeek calls it. But let's see what it is all about.	Security	SANS
8.7.26	RCS and DNS: The NAPTR Record	Over the last year, with recent updates to iOS and Android, RCS (Rich Communication Services) has become an increasingly used protocol.	OS	SANS
8.7.26	Why Ask Credentials If There Are Secret Codes?	This morning, an interesting phishing email hit my mailbox. It targets Metamask, a cryptocurrency wallet, available as a browser extension and a mobile app, that lets users store, send, and receive crypto money.	Security	SANS
8.7.26	When prompts become shells: RCE vulnerabilities in AI agent frameworks	AI agents have fundamentally changed the threat model of AI model-based applications. By equipping these models with plugins (also called tools), your agents no longer just generate text; they now read files, search connected databases, run scripts, and perform other tasks to actively operate on your network.	AI blog	Microsoft blog
8.7.26	15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros	Researchers at Nebula Security have disclosed GhostLock ( CVE-2026-43499 ), a 15-year-old Linux kernel flaw that lets any logged-in user take full root control of a machine that has not been patched. The vulnerable	Vulnerebility	The Hacker News
8.7.26	CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulnerabilities (	Exploit	The Hacker News
8.7.26	RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service	A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service. It lets even low-skill	Virus	The Hacker News
8.7.26	Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots	A critical flaw in Google's Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code	Vulnerebility	The Hacker News
7.7.26	DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts	A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts	Phishing	The Hacker News
7.7.26	Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data	A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization's private repositories, researchers at Noma Security have shown. The attacker needs only to open a normal-looking issue on a public repository, with no stolen credentials and no access to the organization.	Hack	The Hacker News
7.7.26	Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker	U.S. prosecutors linked an alleged Scattered Spider hacker to a break-in at a luxury jewelry retailer using a persistent Windows device ID,	CyberCrime	The Hacker News
7.7.26	Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants	Cybersecurity researchers have disclosed details of a now-patched critical session isolation vulnerability in Writer , an enterprise generative	AI	The Hacker News
7.7.26	Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities	A suspected China-aligned threat activity cluster has been observed exploiting Roundcube webmail software belonging to physics and	Exploit	The Hacker News
7.7.26	When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website	The OAuth 2.0 Device Authorization Grant specification was designed to streamline authentication for Smart TVs, IoT devices, and printers. Today, threat actors are weaponizing it.	Phishing	SECURELIST
7.7.26	CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware	Several versions of firmware released by Chinese network device manufacturer Tenda have been found to embed an undocumented	BigBrothers	The Hacker News
7.7.26	BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA	BeyondTrust has released updates to address two critical security flaws affecting Remote Support (RS) and Privileged Remote Access (PRA) products that, if successfully exploited, could allow unauthenticated	Vulnerebility	The Hacker News
7.7.26	Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations	An Iranian hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS) has been wielding a previously undocumented modular	APT	The Hacker News
6.7.26	16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems	A use-after-free bug in Linux's KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host kernel	Vulnerebility	The Hacker News
6.7.26	Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure	Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig	Vulnerebility	The Hacker News
6.7.26	Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT	A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance	Virus	The Hacker News
6.7.26	New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions	Researchers at Shandong University have shown a fast new way to pull data off computers that are cut off from every network. The technique,	Virus	The Hacker News
6.7.26	New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS	Cybersecurity researchers have flagged a novel Java-based remote access trojan (RAT) called QuimaRAT that's capable of targeting Windows, Linux, and macOS environments. According to LevelBlue, the cross-platform malware is advertised under a malware-as-a-service (MaaS) model, costing anywhere between $150 for one month to $1,200 for lifetime access.	Virus	The Hacker News
6.7.26	Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages	Researchers found a flaw in Opera GX , the gaming-focused version of the Opera browser, that let a malicious website silently install a browser	Vulnerebility	The Hacker News
6.7.26	SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing	Scanners meant to catch malicious add-on "skills" for AI coding agents can be fooled by a few simple changes that leave the malware working, according to a new study from researchers at the Hong Kong University of Science and Technology.	Virus	The Hacker News
5.7.26	Flipper Zero firmware development continues with community help	Flipper Devices says development of the Flipper Zero firmware will continue, albeit with a smaller internal team and greater reliance on community contributions.	Security	BleepingComputer
5.7.26	JadePuffer ransomware used AI agent to automate entire attack	Researchers identified what they believe is the first documented case of a ransomware operation, JadePuffer, conducted entirely by a large language model (LLM) agent.	Ransom	BleepingComputer
5.7.26	NetNut proxy network disrupted, 2 million infected devices cut off	A joint operation involving Google has disrupted NetNut, a residential proxy network that gave access to millions of compromised Android devices, including smart TVs and streaming boxes.	Virus	BleepingComputer
5.7.26	ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit	A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse into an extensive toolkit designed to compromise Microsoft 365.	Phishing	BleepingComputer
5.7.26	Google loses final appeal to overturn €4.1 billion EU fine	Court of Justice of the European Union (CJEU) has dismissed Google's final appeal against a €4.1 billion ($4.7 billion) antitrust fine over the company's use of Android to promote its Chrome browser and search service.	BigBrothers	BleepingComputer
5.7.26	ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds	ConsentFix and ClickFix attacks steal Microsoft 365 tokens in seconds using fake prompts and OAuth flows. Learn how these MFA bypass tactics work and how to defend against them.	Hack	BleepingComputer
5.7.26	Microsoft fixes bug that removed Copilot buttons in Outlook	Microsoft has fixed a known issue causing the Copilot Chat or Copilot buttons in Classic Outlook to disappear for Windows users with the Copilot Chat (Basic) license.	OS	BleepingComputer
5.7.26	Cisco finally confirms attackers exploiting Unified CM flaw	Cisco confirmed that attackers are now exploiting a Unified Communications Manager (Unified CM) vulnerability patched in early June.	Exploit	BleepingComputer
5.7.26	CISA: Microsoft SharePoint RCE flaw now actively exploited	CISA warned on Wednesday that attackers have begun exploiting a high-severity Microsoft SharePoint remote code execution vulnerability patched in May.	Exploit	BleepingComputer
5.7.26	Opera rolls out Paste Protect feature to fight ClickFix attacks	Opera has introduced Paste Protect, a security feature designed to block ClickFix-style attacks that trick users into executing malicious commands through social engineering.	Hack	BleepingComputer
5.7.26	Alleged Scattered Spider hacker extradited to the United States	A dual United States and Estonian citizen has been extradited to the U.S. to face charges alleging he was a member of the Scattered Spider hacking collective.	CyberCrime	BleepingComputer
5.7.26	Medtronic notifies customers impacted by ShinyHunters data breach	Healthcare device firm Medtronic is notifying affected customers about a data breach that exposed their personal data to an unauthorized third party.	Incindent	BleepingComputer
5.7.26	FortiBleed credential-theft campaign linked to Lynx ransomware	The massive FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware operations, suggesting the stolen Fortinet credentials were intended to fuel future network intrusions.	Ransom	BleepingComputer
5.7.26	Kubota says hackers had month-long access to network systems	Kubota North America Corporation disclosed that hackers had access to some of its network systems for more than a month earlier this year.	Hack	BleepingComputer
5.7.26	New ChocoPoC malware targets researchers via trojanized PoC exploits	New ChocoPoC malware targets researchers via trojanized PoC exploits	Virus	BleepingComputer
5.7.26	DHS confirms hackers breached HSIN info-sharing platform	The Department of Homeland Security is investigating a cyberattack that compromised the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by federal, state, local, and private-sector partners.	Hack	BleepingComputer
5.7.26	Hackers target Microsoft 365 accounts with 81 million login attempts	An aggressive password-spraying campaign targeting Microsoft 365 environments generated more than 81 million login attempts over a two-week period.	Hack	BleepingComputer
5.7.26	Turning Indicators into Intelligence in OpenCTI with Criminal IP	Threat intelligence is only as useful as the context behind it. Criminal IP explains how its integration enriches threat indicators in OpenCTI with risk scoring, infrastructure intelligence, and phishing analysis.	CyberCrime	BleepingComputer
5.7.26	Over 900 Oracle E-Business instances exposed to ongoing attacks	Over 900 Oracle E-Business Suite (EBS) instances have been found exposed online amid ongoing attacks exploiting a critical security flaw.	Hack	BleepingComputer
5.7.26	U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case	A U.S. government entity paid about $1 million to keep stolen files from being leaked, according to a new case study by Rakesh Krishnan for	BigBrothers	The Hacker News
5.7.26	North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign	The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web	APT	The Hacker News
4.7.26	Microsoft fixes GIF functionality in the Windows Emoji Panel	Microsoft has fixed the GIF functionality in the Emoji Panel for Windows 11 users after the provider shut down its service.	OS	BleepingComputer
4.7.26	Amazon fined $2.25M for withholding evidence from fraud victims	The U.S. Federal Trade Commission (FTC) says Amazon will pay a $2.25 million civil penalty to settle charges that it blocked identity theft victims' access to transaction records.	CyberCrime	BleepingComputer
4.7.26	Adobe patches seven max severity ColdFusion, Campaign flaws	Adobe has released security patches for seven maximum-severity vulnerabilities in the ColdFusion web app development platform and the Campaign Classic marketing automation platform.	Vulnerebility	BleepingComputer
4.7.26	Anthropic to restore Claude Fable access on Wednesday	Anthropic has confirmed that the Department of Commerce has lifted export controls on Claude's two most powerful models, Fable 5 and Mythos 5.	AI	BleepingComputer
4.7.26	Anthropic rolls out Sonnet 5 with near-Opus 4.8 performance at a lower price	Anthropic is now rolling out Sonnet 5, and it's almost as good as the Opus range, but it is designed to be cheaper than the company's flagship model.	AI	BleepingComputer
4.7.26	New BioShocking attack manipulates AI browser into data theft	A new prompt injection attack dubbed "BioShocking" could trick AI-powered browsers into treating real-world risky actions as part of a fictional scenario, causing them to ignore any safety guardrails.	AI	BleepingComputer
4.7.26	Microsoft accelerates quantum-safe roadmap as risks grow	Microsoft announced today that it is accelerating its quantum-safe security roadmap, saying advances in quantum computing are bringing the need to replace today's encryption standards sooner than previously expected.	Safety	BleepingComputer
4.7.26	Malicious PyPI packages give hackers control of Telegram bot servers	A campaign active since last November has been targeting Python developers building Telegram bots with trojanized Pyrogram forks that allow attackers to read arbitrary files on compromised servers.	BotNet	BleepingComputer
4.7.26	Fake Perplexity extension on Chrome Web Store tracked searches	A malicious extension in the Chrome Web Store is masquerading as the Perplexity AI answer engine, intercepting search traffic and collecting browsing information.	Security	BleepingComputer
4.7.26	Lessons from the Underground: How to Combat Business Email Compromise	Business Email Compromise is more than an email scam. It's a coordinated operation involving compromised accounts, financial research, and cash-out networks. Flare explores how underground forums reveal how BEC attacks are planned and executed.	Security	BleepingComputer
4.7.26	Insurance giant Aflac discloses data breach after subsidiary hack	American insurance giant Aflac has disclosed a new data breach after attackers breached its Japan subsidiary's systems and stole personal and bank account information of 4.38 million customers.	Incindent	BleepingComputer
4.7.26	Microsoft adds smarter bot protection to Teams meetings	Microsoft has introduced a new Teams admin policy that allows organizers to prevent third-party bots from joining meetings without approval.	BotNet	BleepingComputer
4.7.26	Kali Linux 2026.2 released with 9 new tools, NetHunter updates	Kali Linux 2026.2, the second release of the year, is now available for download, featuring 9 new tools and numerous Kali NetHunter improvements.	OS	BleepingComputer
4.7.26	Blackfield ransomware asks Nidec Corporation for $2 million ransom	The Blackfield ransomware gang is asking for a $2 million ransom from Nidec Corporation, a large Japanese manufacturer of electronic components for automotive and computing applications.	Ransom	BleepingComputer
4.7.26	CISA: Windows BlueHammer flaw now exploited by ransomware gangs	CISA confirmed on Monday that ransomware gangs are now exploiting a Microsoft Defender privilege escalation vulnerability, dubbed BlueHammer, that has previously been abused in zero-day attacks.	Ransom	BleepingComputer
4.7.26	Nissan discloses employee data breach linked to Oracle zero-day attacks	Nissan is warning that it suffered a data breach affecting current and former employees after threat actors exploited an Oracle PeopleSoft vulnerability in data theft attacks previously linked to the ShinyHunters extortion group.	Incindent	BleepingComputer
4.7.26	Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices	Security firm runZero has disclosed seven vulnerabilities in FatFs , a small filesystem library that lets a device read and write the FAT and	Vulnerebility	The Hacker News
4.7.26	New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android	A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access take full control of a machine	OS	The Hacker News
4.7.26	New Avalon Malware Framework Packs CrownX Ransomware Capabilities	Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's distributed by	Ransom	The Hacker News
4.7.26	North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets	Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup polyfill tooling to	APT	The Hacker News
4.7.26	GachiLoader adopts AI skill lure	AI skills are threat actors’ newest and most dangerous lures.	AI blog	THREATDOWN
4.7.26	A double-edged bleeding edge: Classifying AI threats	Sophos X-Ops presents a working taxonomy for attacks using, and targeting, AI	AI blog	SOPHOS
4.7.26	Vect and TeamPCP partner for ransomware campaigns	Credentials harvested through supply chain compromises enable large‑scale ransomware deployment	Ransom blog	SOPHOS
4.7.26	Google’s Continued Disruption of Malicious Residential Proxy Networks	Today, in coordination with the FBI, Lumen, and others, Google took action against the NetNut residential proxy network, also known as Popa. This action builds on our disruption of the IPIDEA proxy network that took place in January 2026, and is a continuation of Google’s objective to dismantle malicious residential proxy networks.	Hacking blog	GTI
4.7.26	The Bear Necessities: A Look at the Drivers, Dynamics, and Applications of the Pro-Russia Influence Ecosystem	Four years into Russia’s full-scale invasion of Ukraine, the pro-Russia influence ecosystem has evolved from a tool of war back into a global strategic asset. Since the mobilization of this ecosystem to support frontline objectives, we have witnessed the expedited development of new influence assets linked to multiple, expansive, covert information operations (IO) campaigns and a revitalization of pro-Russia hacktivism at an unprecedented scale.	APT blog	GTI
4.7.26	Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment	Authors: Dixit Panchal & Soumen Burma Table of Contents: Introduction: Key Targets: Infection Chain: Initial Findings about Campaign: Initial Mail: Email Attachment: Lure: Official GoI, Income Tax Document: Technical Analysis: Infrastructural Artefacts & Threat actor Attributions. Campaign Timeline. Conclusion:...	Cyber blog	Seqrite
4.7.26	Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App	CRIL analyzes Glitch SPY, an Android RAT with 70+ commands, crypto-clipping, and a silent remote browser, giving attackers full device control.	Malware blog	Cyble
4.7.26	The BYOVD Epidemic: How Attackers Are Weaponizing Trusted Windows Drivers to Kill Security	Bring Your Own Vulnerable Driver (BYOVD) has gone from a niche tactic to a standard part of the ransomware playbook and Windows' own kernel hardening does little to stop it.	Hacking blog	SECURITY.COM
4.7.26	Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud	In this blog entry, researchers from the TrendAI™ MDR team discuss how they mapped the full end-to-end operation of SHADOW-WATER-063’s Banana RAT banking malware by analyzing server-side artifacts and victim-side data.	Malware blog	Trend Micro
4.7.26	Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware	Void Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections.	Malware blog	Trend Micro
4.7.26	TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry	In this blog entry, TrendAI™ Research examines a wave of phishing emails observed in May 2026 that targeted Japanese accommodation facilities using Booking.com, detailing the victims, attack techniques used, and characteristics of the malware involved.	Malware blog	Trend Micro
4.7.26	Android Arsink RAT Revisited Targeting User Credentials	The SonicWall Capture Labs threat research team identified an ongoing Android Remote Access Trojan (RAT) campaign that employs multiple techniques to harvest sensitive user information through phishing and data exfiltration activities by impersonating the actual app icons and using similar names.	Malware blog	SonicWall
4.7.26	Joomla Content Editor Remote Code Execution	The SonicWall Capture Labs threat research team became aware of a PHP code upload and execution vulnerability in Joomla products, assessed its impact, and developed mitigation measures. Joomla is a free, open-source Content Management System (CMS) used to build and manage websites and online applications.	Vulnerebility blog	SonicWall
4.7.26	Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector	Unit 42 researchers found that large language models (LLMs) consistently hallucinate web domains for legitimate brands. Adversaries are actively weaponizing this vector by registering these nonexistent domains to intercept traffic generated by AI systems.	AI blog	Palo Alto
4.7.26	Threat Brief: Mitigating Large-Scale Credential Attacks	Unit 42 is aware of a large-scale password spraying and credential theft campaign (“FortiBleed”) against Fortinet devices. We observed attempts targeting MSSQL devices as well, and have seen reports of Sophos devices also being targeted.	Hacking blog	Palo Alto
4.7.26	CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure	Throughout 2025, we observed a cluster of activity targeting government entities and critical infrastructure in Southeast Asia. Specifically, the activity targeted state-owned enterprises in the energy and government sectors.	APT blog	Palo Alto
4.7.26	Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique	AI can turn high-level malicious ideas into concrete techniques, and can independently design and implement novel attack paths that have not yet appeared in real-world campaigns.	AI blog	CHECKPOINT
4.7.26	ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365	Talos has identified "ARToken," a phishing-as-a-service platform that targets Microsoft 365. The ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token persistence, email access, BEC operations, and SharePoint exfiltration.	Phishing blog	CISCO TALOS
4.7.26	Catan and Mouse	What do board games and cybersecurity have in common? Pattern recognition. Strategy. Adaptation. In this week’s Threat Source Bill explores why curiosity may be a defender’s most valuable skill.	Cyber blog	CISCO TALOS
4.7.26	Martin Lee: Running through the Arctic (and the threat landscape)	Ever wonder how someone goes from studying human viruses to leading cybersecurity teams? In this Humans of Talos, we’re joined by Martin Lee, EMEA Lead, to talk about his journey into the industry.	Cyber blog	CISCO TALOS
4.7.26	Cyber readiness for SMBs: Getting the basics right	AI is changing cybercrime, but SMB cyber readiness still largely depends on closing the familiar gaps	Cyber blog	Eset
4.7.26	This month in security with Tony Anscombe – June 2026 edition	Three-day patching deadlines, exposed fuel-tank systems, scams costing billions of dollars, and social media bans for children all gave Tony plenty to unpack in June 2026	Cyber blog	Eset
4.7.26	Inside the inbox: Why cybercriminals want to break into your email account	Your inbox is an identity system all of its own: whoever owns it may own a lot more	Cyber blog	Eset
3.7.26	Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer	A previously undocumented threat actor known as Armored Likho has been attributed to cyber attacks targeting government agencies and the	Virus	The Hacker News
3.7.26	European Parliament Member Investigating Spyware Was Hacked With Pegasus	A new report from the Citizen Lab has revealed that former Member of the European Parliament Stelios Kouloglou had his mobile device	BigBrothers	The Hacker News
3.7.26	PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords	Cybersecurity researchers have flagged a new macOS information stealer called PamStealer that employs a series of clever tricks to infect systems	Virus	The Hacker News
3.7.26	Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects	Kaspersky Compromise Assessment specialists analyze trends from the service’s 2025 projects and provide tips on how to enhance your organization’s security.	Security	SECURELIST
3.7.26	Google’s Continued Disruption of Malicious Residential Proxy Networks	Today, in coordination with the FBI, Lumen, and others, Google took action against the NetNut residential proxy network, also known as Popa. This action builds on our disruption of the IPIDEA proxy network that took place in January 2026, and is a continuation of Google’s objective to dismantle malicious residential proxy networks.	CyberCrime	GTI
3.7.26	Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices	Google has significantly degraded NetNut , one of the biggest networks that turns home devices into rented relays for other people's traffic.	CyberCrime	The Hacker News
3.7.26	Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials	Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability	Ransom	The Hacker News
2.7.26	ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API	The threat actor known as ToddyCat has been attributed to a new malware called Umbrij that's designed to gain surreptitious access to a victim's email correspondence via the Google API. "In this campaign, the	APT	The Hacker News
2.7.26	AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack	Security firm Sysdig says it has found what it believes is the first ransomware attack run from start to finish by an AI agent. Its Threat	AI	The Hacker News
2.7.26	NAIC says public data stolen in ShinyHunters' PeopleSoft breach	The National Association of Insurance Commissioners (NAIC) says the ShinyHunters extortion group stole only publicly available data, outdated logs, and configuration files after breaching its systems by exploiting a zero-day vulnerability in an Oracle PeopleSoft server.	Incindent	BleepingComputer
2.7.26	WhatsApp rolls out usernames to help users hide their phone number	WhatsApp is finally allowing users to reserve usernames, a privacy feature that lets them hide their phone numbers from people not in their contact list.	Social	BleepingComputer
2.7.26	Microsoft extends Windows Server 2022 hotpatching until October 2027	Microsoft has extended Windows Server 2022 hotpatching until October 2027, one year after the mainstream end date of October 2026.	OS	BleepingComputer
2.7.26	U.S. offers $10 million for hackers targeting WhatsApp, Signal users	The U.S. Department of State is offering up to $10 million for information that helps identify or locate members of the UNC5792 and UNC4221 hacker groups, which are linked to Russia's intelligence and military services.	Social	BleepingComputer
2.7.26	Agentic AI Has an Identity Problem and Attackers Know It	AI agents can access data, trigger workflows, and take action across enterprise systems. Token Security explains why governing these privileged identities is becoming essential for enterprise security.	AI	BleepingComputer
2.7.26	Critical SimpleHelp flaw exploited to deploy new stealer malware	Hackers are exploiting a recently disclosed critical vulnerability (CVE-2026-48558) in SimpleHelp to deploy Djinn Stealer, a previously undocumented cross-platform information stealer targeting Windows, macOS, and Linux.	Vulnerebility	BleepingComputer
2.7.26	Hackers now exploit critical Oracle E-Business flaw in attacks	Attackers have begun exploiting a critical vulnerability (CVE-2026-46817) in the Oracle E-Business Suite (EBS) financial application, according to threat intelligence company Defused.	Vulnerebility	BleepingComputer
2.7.26	US seizes hundreds of FIFA World Cup illegal streaming domains	The U.S. Justice Department's Criminal Division has seized nearly 400 web domains used for illegally streaming matches at the FIFA World Cup.	CyberCrime	BleepingComputer
2.7.26	Data breach exposes up to 14.2 million email logins at six ISPs	Japanese telecommunications operator KDDI Corporation disclosed a data breach where threat actors gained access to one of its email systems used by five other internet service providers (ISPs) in the country.	Incindent	BleepingComputer
2.7.26	The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign	Kaspersky experts have uncovered a malicious network infrastructure for delivering AsyncRAT. The Trojan is dropped via compromised ScreenConnect software. In this post, we break down the infection chain and analyze the C2 infrastructure.	CyberCrime	SECURELIST
2.7.26	FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations	The recently discovered financially-motivated FortiBleed campaign has been attributed to INC and Lynx ransomware operations, indicating that the verified, stolen credentials were intended for follow-on intrusions. "An	Ransom	The Hacker News
2.7.26	New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos	Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living. The malware, called ChocoPoC ,	Virus	The Hacker News
2.7.26	SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting Microsoft SharePoint	Exploit	The Hacker News
2.7.26	Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters	Argo CD , a widely used tool for deploying software to Kubernetes, has an unpatched flaw in its repo-server component that lets an unauthenticated	Vulnerebility	The Hacker News
2.7.26	19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges	A teenager accused of belonging to the hacking group Scattered Spider has been extradited from Finland to face U.S. charges of conspiracy,	BigBrothers	The Hacker News
2.7.26	SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT	Unknown threat actors are leveraging the ScreenConnect remote access tool as a way to deploy and execute AsyncRAT . Kaspersky said the	Virus	The Hacker News
2.7.26	VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer	Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to	Virus	The Hacker News
1.7.26	Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique	AI can turn high-level malicious ideas into concrete techniques, and can independently design and implement novel attack paths that have not yet appeared in real-world campaigns.	Hack	CHECKPOINT
1.7.26	Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures	A Brazilian banking trojan called Ousaban is going after Windows users who bank in Spain and Portugal. Fortinet's FortiGuard Labs identified	Virus	The Hacker News
1.7.26	Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic	Adobe has released patches for multiple maximum-severity security flaws impacting Adobe ColdFusion and Adobe Campaign Classic. The	Vulnerebility	The Hacker News
1.7.26	Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands	Two flaws in Cursor, an AI code editor, could let a single, ordinary-looking prompt break out of the editor's safety sandbox and run any command on	Vulnerebility	The Hacker News
1.7.26	Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts	A recently disclosed critical security flaw impacting Progress Kemp LoadMaster is seeing active exploitation attempts, according to an	Exploit	The Hacker News
1.7.26	AI-Generated Browser Ransomware Abuses Chromium API on Windows and Android	Cybersecurity researchers have flagged a new malware artifact generated using DeepSeek that constructed a novel attack path	AI	The Hacker News
1.7.26	Microsoft Accelerates Post-Quantum Cryptography Shift to 2029	Microsoft on Tuesday said it's accelerating its quantum safe security roadmap, stating technology advances in quantum computing are making it essential to replace existing encryption standards sooner than previously expected.	BigBrothers	The Hacker News
1.7.26	Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware	Large language models keep inventing web addresses that do not exist. Attackers have started buying those made-up domains before anyone	AI	The Hacker News
1.7.26	Anthropic Restores Claude Fable 5 After U.S. Lifts Jailbreak-Linked Export Controls	Anthropic is putting Claude Fable 5 back online worldwide. On June 30 , the U.S. Commerce Department lifted the export controls it had imposed	AI	The Hacker News
1.7.26	Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts	Cybersecurity researchers have warned of a "massive, ongoing, automated password spray attack" aimed at Microsoft's Azure command-	Hack	The Hacker News
1.7.26	Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery	ClickFix , the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious	Hack	The Hacker News
1.7.26	ToddyCat: your hidden email assistant. Part 2	An in-depth analysis of Umbrij, a new tool used by the ToddyCat APT group to compromise corporate email communications in Gmail. The attack targeted OAuth authorization tokens, allowing threat actors to gain access to Google services.	APT	SECURELIST
1.7.26	June 2026 Apple Updates	Apple released updates for iOS/iPadOS, macOS, and Safari on Monday. There have been no updates for other Apple operating systems (visionOS, watchOS, tvOS). Usually, Apple updates all products at the same time.	OS	SANS
1.7.26	Adding some Automation to the favicon.ico method of Host Recon	I'm in the throes of target host recon for another pentest, and thought I'd share some workflow / automation stuff.	Hack	SANS
1.7.26	YARA-X 1.18.0 and 1.19.0 Release	YARA-X's 1.18.0 release brings 3 improvements and 2 bugfixes.	Security	SANS
1.7.26	Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service	Citrix on Tuesday released security updates to address multiple flaws in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly	Vulnerebility	The Hacker News