Cyber Security
Cybersecurity
4,407 Rockwell PLCs Exposed Online, 22 in Water Cities
A Forescout scan found 4,407 internet-exposed Rockwell PLCs, including 22 in water-industry attack target cities, heightening critical infrastructure risk.
CVE Vulnerability Alerts
Zapscape KVM Flaw Lets Privileged L1 Guest Escape to Host
Researcher Hyunwoo Kim documented Zapscape, CVE-2026-64561, a KVM/x86 shadow memory flaw allowing privileged L1 guest code to escape to the Linux host.
Cybersecurity
TONTOU Interrupt Injection Bypasses Spectre v2 Fixes on AMD Zen 2
MIT CSAIL's interrupt injection attack named TONTOU bypasses retpoline and Safe-RET defenses on AMD Zen 2 to leak Linux password hashes from userspace.
CVE Vulnerability Alerts
NatJack Attacks Hijack TCP Sessions and Spoof DNS via NAT
Researcher Malcolm Stagg's NatJack technique hijacks TCP sessions and spoofs DNS through NAT table manipulation, affecting Windows Hyper-V and Linux Netfilter.
Application Security
Claude Code and Gemini CLI Flaws Expose CI Workflow Secrets
Novee Security found flaws in Claude Code and Google Gemini CLI that let an attacker-controlled GitHub issue reach CI workflow secrets via an AI agent.
Application Security
AI-Assisted HTTP Terminator Finds Apache Traffic Server Zero-Day
PortSwigger's AI-assisted HTTP Terminator found roughly 30,000 HTTP desync vectors and a live Apache Traffic Server zero-day affecting roughly 700 targets.
Cybersecurity
TeamPCP Tied to Redis Attacks Dating Back to 2020
Oligo Security researchers tied the TeamPCP cluster to Redis attacks dating back to April 2020 and to its later evolution into the ShadowRay 2.0 campaign.
Application Security
CryptoJS Weak RNG Behind $5.7M in Five Wallet App Drains
Coinspect traced roughly $5.7 million in cryptocurrency theft to a 12-year-old weak random number generator in the CryptoJS library and five wallet apps.
Cybersecurity
iCloud Private Relay WebKit Bypasses Expose Users’ Real IPs
Researchers Haj Bakry and Mysk found WebKit proxy bypasses in iCloud Private Relay that can expose a user's real IP address to websites and observers.
Cybersecurity
ClickFix Campaign Pushes Go-Based macOS Crypto Drainer
Huntress discovered a Go-based macOS infostealer delivered through ClickFix attacks that steals crypto assets and redirects a percentage of each transaction.
Cybersecurity
China Launches Probe Into Palo Alto Networks Product Security
China's Cyberspace Administration began a review of Palo Alto Networks products, raising echoes of its Micron ban over critical infrastructure security.
Application Security
Attackers Compile khunt Inside Oracle to Reach Windows SYSTEM
Huntress traced credential-theft alerts to attackers who compiled the khunt toolkit inside Oracle to reach SYSTEM-level code execution on a Windows server.
Cybersecurity
Zbtlink Routers Ship With ENDLESSDOORS Backdoor Opening Root Shells
VulnCheck disclosed a factory-shipped ENDLESSDOORS backdoor in Zbtlink router firmware that lets a remote attacker open an unauthenticated root shell.
Cybersecurity
Ransom Cartel Creator Sentenced to 16 Years for RaaS Operation
A federal judge in Virginia sentenced Belarusian Maksim Silnikau, the creator of Ransom Cartel, to 16 years for running a ransomware-as-a-service operation.
Cybersecurity
Snowflake Hacker Pleads Guilty Over Breaches Affecting 100 Million
Connor Riley Moucka pleaded guilty in Seattle federal court to intrusions into 165 Snowflake customers that exposed records of more than 100 million people.
Application Security
CISA Flags Active Exploitation of TeamCity CVE-2026-63077
CISA added JetBrains TeamCity CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, citing unauthenticated remote code execution in the wild.
Application Security
Meta AI Hacked External Systems During Cybersecurity Testing
Meta admitted its Muse Spark 1.1 model escaped a test environment and breached an unnamed third party's systems during evaluations by startup Irregular.
Cybersecurity
Brown Health Medical Group Breach Exposes 311,000 Records
Brown Health Medical Group of Massachusetts disclosed a historic file-server breach exposing personal, medical, and financial data belonging to 311,760 people.
Application Security
CoreBreak Flaws Let Attackers Invoke AWS, Google, Vercel Tools
Stealth researchers disclosed CoreBreak flaws in AWS Bedrock, Google ADK, and Vercel harnesses that let attackers invoke agent tools without the model.
Cybersecurity
ClickFix Malware Gate Fingerprints macOS Users Before Lures
Microsoft detailed a ClickFix campaign spanning 250 domains that fingerprints macOS visitors server-side before deciding whether to show an infostealer lure.
Application Security
SAP Patches Zero-Day in Commerce Cloud Data Hub Adapter
Application Security
CISA Adds Metabase SQL Injection Zero-Day to KEV With Aug 14 Deadline
Application Security
SharePoint RCE CVE-2026-55040 First Confirmed Ransomware Exploit
TOP CYBERSECURITY HEADLINES
Application Security
SharePoint RCE CVE-2026-55040 First Confirmed Ransomware Exploit
This Week’s Security Spotlight
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
NatJack Attacks Hijack TCP Sessions and Spoof DNS via NAT
Researcher Malcolm Stagg's NatJack technique hijacks TCP sessions and spoofs DNS through NAT table manipulation, affecting Windows Hyper-V and Linux Netfilter.
Claude Code and Gemini CLI Flaws Expose CI Workflow Secrets
Novee Security found flaws in Claude Code and Google Gemini CLI that let an attacker-controlled GitHub issue reach CI workflow secrets via an AI agent.
AI-Assisted HTTP Terminator Finds Apache Traffic Server Zero-Day
PortSwigger's AI-assisted HTTP Terminator found roughly 30,000 HTTP desync vectors and a live Apache Traffic Server zero-day affecting roughly 700 targets.
TeamPCP Tied to Redis Attacks Dating Back to 2020
Oligo Security researchers tied the TeamPCP cluster to Redis attacks dating back to April 2020 and to its later evolution into the ShadowRay 2.0 campaign.
CryptoJS Weak RNG Behind $5.7M in Five Wallet App Drains
Coinspect traced roughly $5.7 million in cryptocurrency theft to a 12-year-old weak random number generator in the CryptoJS library and five wallet apps.
iCloud Private Relay WebKit Bypasses Expose Users’ Real IPs
Researchers Haj Bakry and Mysk found WebKit proxy bypasses in iCloud Private Relay that can expose a user's real IP address to websites and observers.
ClickFix Campaign Pushes Go-Based macOS Crypto Drainer
Huntress discovered a Go-based macOS infostealer delivered through ClickFix attacks that steals crypto assets and redirects a percentage of each transaction.
China Launches Probe Into Palo Alto Networks Product Security
China's Cyberspace Administration began a review of Palo Alto Networks products, raising echoes of its Micron ban over critical infrastructure security.
Attackers Compile khunt Inside Oracle to Reach Windows SYSTEM
Huntress traced credential-theft alerts to attackers who compiled the khunt toolkit inside Oracle to reach SYSTEM-level code execution on a Windows server.
Zbtlink Routers Ship With ENDLESSDOORS Backdoor Opening Root Shells
VulnCheck disclosed a factory-shipped ENDLESSDOORS backdoor in Zbtlink router firmware that lets a remote attacker open an unauthenticated root shell.
Ransom Cartel Creator Sentenced to 16 Years for RaaS Operation
A federal judge in Virginia sentenced Belarusian Maksim Silnikau, the creator of Ransom Cartel, to 16 years for running a ransomware-as-a-service operation.
Snowflake Hacker Pleads Guilty Over Breaches Affecting 100 Million
Connor Riley Moucka pleaded guilty in Seattle federal court to intrusions into 165 Snowflake customers that exposed records of more than 100 million people.
CISA Flags Active Exploitation of TeamCity CVE-2026-63077
CISA added JetBrains TeamCity CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, citing unauthenticated remote code execution in the wild.
Meta AI Hacked External Systems During Cybersecurity Testing
Meta admitted its Muse Spark 1.1 model escaped a test environment and breached an unnamed third party's systems during evaluations by startup Irregular.
Brown Health Medical Group Breach Exposes 311,000 Records
Brown Health Medical Group of Massachusetts disclosed a historic file-server breach exposing personal, medical, and financial data belonging to 311,760 people.
CoreBreak Flaws Let Attackers Invoke AWS, Google, Vercel Tools
Stealth researchers disclosed CoreBreak flaws in AWS Bedrock, Google ADK, and Vercel harnesses that let attackers invoke agent tools without the model.
ClickFix Malware Gate Fingerprints macOS Users Before Lures
Microsoft detailed a ClickFix campaign spanning 250 domains that fingerprints macOS visitors server-side before deciding whether to show an infostealer lure.
Cisco Patches Critical SD-WAN, IOS XE, and FMC Flaws
Cisco patched two dozen flaws including critical Catalyst SD-WAN and IOS XE command-injection bugs plus an FMC authentication bypass in a new advisory release.
Open VSX Purges 77 Evil-Twin Extensions Stealing Developer Data
Open VSX removed 77 malicious evil-twin extensions impersonating developer tools and exfiltrating machine, Git, and CI/CD data to one attacker domain.
ChainDrop npm Worm Poisons 440 Packages, Steals Cloud Credentials
The ChainDrop npm worm, a new Shai-Hulud variant, poisoned over 440 registry packages and uses stolen tokens to republish malware and reach cloud credentials.