Cyber Security
Cybersecurity
AitM Phishing Campaign Steals Microsoft 365 Finance Emails
Arctic Wolf documented an AitM phishing campaign hijacking Microsoft 365 accounts to collect payroll and finance emails across North America and Europe.
Application Security
Swiss Government SharePoint Breach Compromised 200 Accounts
BIT's SharePoint intrusion compromised credentials for about 200 Swiss federal accounts, likely via Microsoft flaws fixed in the July Patch Tuesday updates.
Cybersecurity
UNC6671 Extortion Group Rebrands After Targeting Hedge Funds
Google Threat Intelligence ties hedge fund vishing attacks to UNC6671 (BlackFile), an extortion group rebranding across Redact, Pink, Helix, and Falcon.
Cybersecurity
3.8 Million Impacted by Unlimited Technology Systems Breach
Unlimited Technology Systems disclosed an October 2025 data theft affecting 3.8 million people, exposing Social Security numbers, diagnoses, and ID scans.
Cybersecurity
4,407 Rockwell PLCs Exposed Online, 22 in Water Cities
A Forescout scan found 4,407 internet-exposed Rockwell PLCs, including 22 in water-industry attack target cities, heightening critical infrastructure risk.
CVE Vulnerability Alerts
Zapscape KVM Flaw Lets Privileged L1 Guest Escape to Host
Researcher Hyunwoo Kim documented Zapscape, CVE-2026-64561, a KVM/x86 shadow memory flaw allowing privileged L1 guest code to escape to the Linux host.
Cybersecurity
TONTOU Interrupt Injection Bypasses Spectre v2 Fixes on AMD Zen 2
MIT CSAIL's interrupt injection attack named TONTOU bypasses retpoline and Safe-RET defenses on AMD Zen 2 to leak Linux password hashes from userspace.
CVE Vulnerability Alerts
NatJack Attacks Hijack TCP Sessions and Spoof DNS via NAT
Researcher Malcolm Stagg's NatJack technique hijacks TCP sessions and spoofs DNS through NAT table manipulation, affecting Windows Hyper-V and Linux Netfilter.
Application Security
Claude Code and Gemini CLI Flaws Expose CI Workflow Secrets
Novee Security found flaws in Claude Code and Google Gemini CLI that let an attacker-controlled GitHub issue reach CI workflow secrets via an AI agent.
Application Security
AI-Assisted HTTP Terminator Finds Apache Traffic Server Zero-Day
PortSwigger's AI-assisted HTTP Terminator found roughly 30,000 HTTP desync vectors and a live Apache Traffic Server zero-day affecting roughly 700 targets.
Cybersecurity
TeamPCP Tied to Redis Attacks Dating Back to 2020
Oligo Security researchers tied the TeamPCP cluster to Redis attacks dating back to April 2020 and to its later evolution into the ShadowRay 2.0 campaign.
Application Security
CryptoJS Weak RNG Behind $5.7M in Five Wallet App Drains
Coinspect traced roughly $5.7 million in cryptocurrency theft to a 12-year-old weak random number generator in the CryptoJS library and five wallet apps.
Cybersecurity
iCloud Private Relay WebKit Bypasses Expose Users’ Real IPs
Researchers Haj Bakry and Mysk found WebKit proxy bypasses in iCloud Private Relay that can expose a user's real IP address to websites and observers.
Cybersecurity
ClickFix Campaign Pushes Go-Based macOS Crypto Drainer
Huntress discovered a Go-based macOS infostealer delivered through ClickFix attacks that steals crypto assets and redirects a percentage of each transaction.
Cybersecurity
China Launches Probe Into Palo Alto Networks Product Security
China's Cyberspace Administration began a review of Palo Alto Networks products, raising echoes of its Micron ban over critical infrastructure security.
Application Security
Attackers Compile khunt Inside Oracle to Reach Windows SYSTEM
Huntress traced credential-theft alerts to attackers who compiled the khunt toolkit inside Oracle to reach SYSTEM-level code execution on a Windows server.
Cybersecurity
Zbtlink Routers Ship With ENDLESSDOORS Backdoor Opening Root Shells
VulnCheck disclosed a factory-shipped ENDLESSDOORS backdoor in Zbtlink router firmware that lets a remote attacker open an unauthenticated root shell.
Cybersecurity
Ransom Cartel Creator Sentenced to 16 Years for RaaS Operation
A federal judge in Virginia sentenced Belarusian Maksim Silnikau, the creator of Ransom Cartel, to 16 years for running a ransomware-as-a-service operation.
Cybersecurity
Snowflake Hacker Pleads Guilty Over Breaches Affecting 100 Million
Connor Riley Moucka pleaded guilty in Seattle federal court to intrusions into 165 Snowflake customers that exposed records of more than 100 million people.
Application Security
CISA Flags Active Exploitation of TeamCity CVE-2026-63077
CISA added JetBrains TeamCity CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, citing unauthenticated remote code execution in the wild.
Application Security
Swiss Government SharePoint Breach Compromised 200 Accounts
TOP CYBERSECURITY HEADLINES
Cybersecurity
4,407 Rockwell PLCs Exposed Online, 22 in Water Cities
CVE Vulnerability Alerts
Zapscape KVM Flaw Lets Privileged L1 Guest Escape to Host
This Week’s Security Spotlight
Application Security
CoreBreak Flaws Let Attackers Invoke AWS, Google, Vercel Tools
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
3.8 Million Impacted by Unlimited Technology Systems Breach
Unlimited Technology Systems disclosed an October 2025 data theft affecting 3.8 million people, exposing Social Security numbers, diagnoses, and ID scans.
4,407 Rockwell PLCs Exposed Online, 22 in Water Cities
A Forescout scan found 4,407 internet-exposed Rockwell PLCs, including 22 in water-industry attack target cities, heightening critical infrastructure risk.
Zapscape KVM Flaw Lets Privileged L1 Guest Escape to Host
Researcher Hyunwoo Kim documented Zapscape, CVE-2026-64561, a KVM/x86 shadow memory flaw allowing privileged L1 guest code to escape to the Linux host.
TONTOU Interrupt Injection Bypasses Spectre v2 Fixes on AMD Zen 2
MIT CSAIL's interrupt injection attack named TONTOU bypasses retpoline and Safe-RET defenses on AMD Zen 2 to leak Linux password hashes from userspace.
NatJack Attacks Hijack TCP Sessions and Spoof DNS via NAT
Researcher Malcolm Stagg's NatJack technique hijacks TCP sessions and spoofs DNS through NAT table manipulation, affecting Windows Hyper-V and Linux Netfilter.
Claude Code and Gemini CLI Flaws Expose CI Workflow Secrets
Novee Security found flaws in Claude Code and Google Gemini CLI that let an attacker-controlled GitHub issue reach CI workflow secrets via an AI agent.
AI-Assisted HTTP Terminator Finds Apache Traffic Server Zero-Day
PortSwigger's AI-assisted HTTP Terminator found roughly 30,000 HTTP desync vectors and a live Apache Traffic Server zero-day affecting roughly 700 targets.
TeamPCP Tied to Redis Attacks Dating Back to 2020
Oligo Security researchers tied the TeamPCP cluster to Redis attacks dating back to April 2020 and to its later evolution into the ShadowRay 2.0 campaign.
CryptoJS Weak RNG Behind $5.7M in Five Wallet App Drains
Coinspect traced roughly $5.7 million in cryptocurrency theft to a 12-year-old weak random number generator in the CryptoJS library and five wallet apps.
iCloud Private Relay WebKit Bypasses Expose Users’ Real IPs
Researchers Haj Bakry and Mysk found WebKit proxy bypasses in iCloud Private Relay that can expose a user's real IP address to websites and observers.
ClickFix Campaign Pushes Go-Based macOS Crypto Drainer
Huntress discovered a Go-based macOS infostealer delivered through ClickFix attacks that steals crypto assets and redirects a percentage of each transaction.
China Launches Probe Into Palo Alto Networks Product Security
China's Cyberspace Administration began a review of Palo Alto Networks products, raising echoes of its Micron ban over critical infrastructure security.
Attackers Compile khunt Inside Oracle to Reach Windows SYSTEM
Huntress traced credential-theft alerts to attackers who compiled the khunt toolkit inside Oracle to reach SYSTEM-level code execution on a Windows server.
Zbtlink Routers Ship With ENDLESSDOORS Backdoor Opening Root Shells
VulnCheck disclosed a factory-shipped ENDLESSDOORS backdoor in Zbtlink router firmware that lets a remote attacker open an unauthenticated root shell.
Ransom Cartel Creator Sentenced to 16 Years for RaaS Operation
A federal judge in Virginia sentenced Belarusian Maksim Silnikau, the creator of Ransom Cartel, to 16 years for running a ransomware-as-a-service operation.
Snowflake Hacker Pleads Guilty Over Breaches Affecting 100 Million
Connor Riley Moucka pleaded guilty in Seattle federal court to intrusions into 165 Snowflake customers that exposed records of more than 100 million people.
CISA Flags Active Exploitation of TeamCity CVE-2026-63077
CISA added JetBrains TeamCity CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, citing unauthenticated remote code execution in the wild.
Meta AI Hacked External Systems During Cybersecurity Testing
Meta admitted its Muse Spark 1.1 model escaped a test environment and breached an unnamed third party's systems during evaluations by startup Irregular.
Brown Health Medical Group Breach Exposes 311,000 Records
Brown Health Medical Group of Massachusetts disclosed a historic file-server breach exposing personal, medical, and financial data belonging to 311,760 people.
CoreBreak Flaws Let Attackers Invoke AWS, Google, Vercel Tools
Stealth researchers disclosed CoreBreak flaws in AWS Bedrock, Google ADK, and Vercel harnesses that let attackers invoke agent tools without the model.