Cyber Security News
.png)
ClickFix Attacks Evolve to Better Hide Malicious Payloads
Threat actors are now hiding payloads by using DNS TXT records and browser cache pre-fetching, making it tougher to spot early attack stages. Read more
Chinese Hackers Impersonate US Officials for AI Cyber Espionage
An emerging threat group known as TA419 established seemingly legitimate professional relationships with AI policy experts working for US think tanks, universit… Read more
Pentagon personnel database breach exposes personal data of millions
A Pentagon personnel database was breached for nine months without anyone noticing. Over three million people are affected. Read more in my article on the Ho… Read more
Apple Zero-Day Vulnerability Weaponized in Targeted Attacks
Attackers are exploiting CVE-2026-86950, an out-of-bounds write flaw, in an extremely sophisticated fashion, according to Apple. Read more
Best Practices
FBI removes contractor working with its PeopleSoft system after data breach says report
The US Federal Bureau of Investigation has removed an Accenture contractor working on its PeopleSoft installation over their role in a da… Read more
New Linux malware turns vulnerable IoT devices into proxy nodes
A new Linux backdoor is turning vulnerable internet-facing devices into remotely controlled proxy nodes, while using the public Session T… Read more
Google’s bug bounty pause highlights growing AI vulnerability triage challenge
AI is accelerating the discovery of software vulnerabilities, but it is also creating a new bottleneck for defenders: deciding which mach… Read more
Dell patches 18 critical flaws that could hand attackers the keys to storage and Kubernetes
Dell’s security team has had a busy week. The company has announced a slew of Common Vulnerabilities and Exposures (CVEs) impacting it… Read more
Citrix warns of actively exploited NetScaler flaw days after zero-day patch rush
Citrix has warned customers about another high-severity vulnerability in its NetScaler ADC and NetScaler Gateway products, just days afte… Read more
New Threats and Vulnerabilities
Fake ChatGPT Gemini and Claude Ad Portals Capture Credentials and MFA Codes
Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial intelligence (AI)… Read more
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate… Read more
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users Mailboxes
Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privil… Read more
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco sa… Read more
Patch Management
French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks
An attacker used stolen passwords of staff at France’s tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July… Read more
101 Malicious npm Packages Add Developers WhatsApp Accounts to Groups Without Consent
Cybersecurity researchers have identified a cluster of 101 npm packages that are used to trap developers into a WhatsApp group subscriber campaign dubbed Phanto… Read more
WordPress Backdoor Rebuilds Itself After Cleanup Using Files Database and Shared Memory
Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final pay… Read more
AI Coding Agents Exposed 13000 Internal Images Including Billing Records on GitHub
AI coding agents asked to share screenshots of code changes for review have put internal company images in public GitHub repositories, security company Glow sai… Read more
AI and Security
Get rid of Apples AI bloatware and reclaim 12 GB of storage with this open source tool
Apple’s attempt to integrate AI into its various operating systems hasn’t been entirely well received, nor has the decision to make Apple Intelligence increasi… Read more
OpenAI alerts 100+ orgs that its misaligned models attempted to break in – or worse
OpenAI’s agents have repeatedly strayed beyond their intended scope. Two separate reports detail the activity, including one from Sam Altman’s company saying i… Read more