Cyber Security
Cybersecurity
MonsterCloud Owner Charged With Secretly Paying Ransoms, $19M Billed
Federal prosecutors charged MonsterCloud owner Zohar Pinhasi with wire fraud, alleging he billed victims over $19 million while secretly paying ransom gangs.
Cybersecurity
US Offers $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks
The State Department's Rewards for Justice program offers up to $10 million for information on Zhang Yu, a Chinese national indicted over the HAFNIUM hacks.
Cybersecurity
Georgia Power, Alabama Power Portal Breach Hits 400,000 Accounts
An unauthorized party accessed the Georgia Power and Alabama Power customer portal, exposing about 400,000 accounts, including partial SSNs and contact data.
Application Security
Chrome 155 Patches 247 Vulnerabilities, Including Four Critical
Google released Chrome 155 with fixes for 247 vulnerabilities, four of them critical use-after-free flaws. Google reports no in-the-wild exploitation.
Cybersecurity
Four US States Sue TP-Link Over China Risks and Security Claims
Florida, Iowa, Montana and Nebraska sued router maker TP-Link, alleging misleading security claims and concealed China ties. TP-Link calls the claims baseless.
Application Security
Atlassian CVE-2026-21589 Exploited Within Two Hours of PoC Details
Attackers probed Atlassian Data Center flaw CVE-2026-21589 within two hours of watchTowr publishing details; Previdian logged 15 attempts from three IPs.
Application Security
Adversa AI: Encrypted Instructions Can Make Copilot CLI Leak Secrets
Adversa AI says encrypted prompt injections on web pages can trick GitHub Copilot CLI into leaking .env secrets. GitHub declined to call it a vulnerability.
Cybersecurity
ASOS Confirms Breach After Hackers Hijack App Push Notifications
ASOS confirmed a breach after attackers sent a fake push alert claiming a Snowflake hack; names and contact details may be exposed, but not card ...
Application Security
Ninja Forms, WPC Product Bundles XSS Flaws Used to Backdoor Sites
Attackers are exploiting stored XSS flaws in Ninja Forms and WPC Product Bundles to install a fake plugin with four persistence mechanisms on WordPress.
CVE Vulnerability Alerts
Pwn2Own Ireland 2026 Day One: 32 Zero-Days, $388,500 in Payouts
Researchers demonstrated 32 unique zero-day exploits on day one of Pwn2Own Ireland 2026, earning $388,500 against phones, routers, printers and AI platforms.
Application Security
Attackers Scan for Rejetto HFS Session-Forgery Flaw CVE-2026-61500
Scanning has begun for CVE-2026-61500 in Rejetto HFS, a flaw that lets attackers forge admin cookies and reach remote code execution on versions 3.0.0-3.2.0.
CVE Vulnerability Alerts
Dell Patches Root-Level Flaw CVE-2026-86360 in System Update Tool
Dell fixed a critical path traversal, CVE-2026-86360, in its System Update CLI that lets unauthenticated remote attackers run code as root, plus four more bugs.
CVE Vulnerability Alerts
Android October 2026 Update Patches 25 Flaws, Seven Rated Critical
Google's Android security bulletin for patch level 2026-10-01 fixes 25 vulnerabilities, seven of them critical, with no in-the-wild exploitation reported.
Application Security
LibreOffice, OpenOffice Flaws Run Code From Spreadsheets Silently
CVE-2026-63277 in LibreOffice and CVE-2026-59265 in Apache OpenOffice let malicious spreadsheets run code through JDBC drivers with no macro warning shown.
Cybersecurity
Gentlemen Ransomware Affiliate Used MCP as Command Channel
CloudSEK found Gentlemen RaaS affiliate Azazel using Model Context Protocol as a command channel in live intrusions that hit 24-plus victims in six countries.
Cybersecurity
UIC College of Medicine Hit by Booba Ransomware, 344 GB Claimed
The University of Illinois Chicago says data was taken from College of Medicine servers; the Booba ransomware gang claims 344 GB stolen from the school.
Cybersecurity
Denmark CPR Breach Exposes Data of 8.8 Million People
Attackers abused a private firm's lawful lookup rights to pull names, addresses and CPR numbers of 8.8 million people from Denmark's Central Person Register.
Application Security
Atlassian Fixes Critical CVE-2026-21589 in Eight Data Center Products
Atlassian disclosed CVE-2026-21589, a CVSS 9.3 path traversal flaw that lets unauthenticated attackers read web-root files in eight Data Center products.
Cybersecurity
FBI Drops Accenture Contractor After ShinyHunters PeopleSoft Breach
The FBI removed an Accenture contractor over an unapplied patch that let ShinyHunters breach FBIJobs.gov, as a suspected group leader was arrested in Jordan.
Cybersecurity
Nikkei Discloses Microsoft 365 and Google Workspace Account Breaches
Nikkei says attackers breached two employee email accounts, exposed data on 1,646 people and sent about 9,000 phishing emails from a Microsoft 365 account.
TOP CYBERSECURITY HEADLINES
Application Security
Trojanized Terraform Provider Hides FLATROOF and ROOFDECK Backdoors
Application Security
AnyPwn Heap Overflow in AnyDesk for Linux Gives Root RCE, PoC Public
This Week’s Security Spotlight
Application Security
GhostAction Campaign Hits 500+ GitHub Accounts to Steal API Keys
Application Security
Atlassian CVE-2026-21589 Exploited Within Two Hours of PoC Details
CVE Vulnerability Alerts
Dell Patches Root-Level Flaw CVE-2026-86360 in System Update Tool
CVE Vulnerability Alerts
Android October 2026 Update Patches 25 Flaws, Seven Rated Critical
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Chrome 155 Patches 247 Vulnerabilities, Including Four Critical
Google released Chrome 155 with fixes for 247 vulnerabilities, four of them critical use-after-free flaws. Google reports no in-the-wild exploitation.
Four US States Sue TP-Link Over China Risks and Security Claims
Florida, Iowa, Montana and Nebraska sued router maker TP-Link, alleging misleading security claims and concealed China ties. TP-Link calls the claims baseless.
Atlassian CVE-2026-21589 Exploited Within Two Hours of PoC Details
Attackers probed Atlassian Data Center flaw CVE-2026-21589 within two hours of watchTowr publishing details; Previdian logged 15 attempts from three IPs.
Adversa AI: Encrypted Instructions Can Make Copilot CLI Leak Secrets
Adversa AI says encrypted prompt injections on web pages can trick GitHub Copilot CLI into leaking .env secrets. GitHub declined to call it a vulnerability.
ASOS Confirms Breach After Hackers Hijack App Push Notifications
ASOS confirmed a breach after attackers sent a fake push alert claiming a Snowflake hack; names and contact details may be exposed, but not card ...
Ninja Forms, WPC Product Bundles XSS Flaws Used to Backdoor Sites
Attackers are exploiting stored XSS flaws in Ninja Forms and WPC Product Bundles to install a fake plugin with four persistence mechanisms on WordPress.
Pwn2Own Ireland 2026 Day One: 32 Zero-Days, $388,500 in Payouts
Researchers demonstrated 32 unique zero-day exploits on day one of Pwn2Own Ireland 2026, earning $388,500 against phones, routers, printers and AI platforms.
Attackers Scan for Rejetto HFS Session-Forgery Flaw CVE-2026-61500
Scanning has begun for CVE-2026-61500 in Rejetto HFS, a flaw that lets attackers forge admin cookies and reach remote code execution on versions 3.0.0-3.2.0.
Dell Patches Root-Level Flaw CVE-2026-86360 in System Update Tool
Dell fixed a critical path traversal, CVE-2026-86360, in its System Update CLI that lets unauthenticated remote attackers run code as root, plus four more bugs.
Android October 2026 Update Patches 25 Flaws, Seven Rated Critical
Google's Android security bulletin for patch level 2026-10-01 fixes 25 vulnerabilities, seven of them critical, with no in-the-wild exploitation reported.
LibreOffice, OpenOffice Flaws Run Code From Spreadsheets Silently
CVE-2026-63277 in LibreOffice and CVE-2026-59265 in Apache OpenOffice let malicious spreadsheets run code through JDBC drivers with no macro warning shown.
Gentlemen Ransomware Affiliate Used MCP as Command Channel
CloudSEK found Gentlemen RaaS affiliate Azazel using Model Context Protocol as a command channel in live intrusions that hit 24-plus victims in six countries.
UIC College of Medicine Hit by Booba Ransomware, 344 GB Claimed
The University of Illinois Chicago says data was taken from College of Medicine servers; the Booba ransomware gang claims 344 GB stolen from the school.
Denmark CPR Breach Exposes Data of 8.8 Million People
Attackers abused a private firm's lawful lookup rights to pull names, addresses and CPR numbers of 8.8 million people from Denmark's Central Person Register.
Atlassian Fixes Critical CVE-2026-21589 in Eight Data Center Products
Atlassian disclosed CVE-2026-21589, a CVSS 9.3 path traversal flaw that lets unauthenticated attackers read web-root files in eight Data Center products.
FBI Drops Accenture Contractor After ShinyHunters PeopleSoft Breach
The FBI removed an Accenture contractor over an unapplied patch that let ShinyHunters breach FBIJobs.gov, as a suspected group leader was arrested in Jordan.
Nikkei Discloses Microsoft 365 and Google Workspace Account Breaches
Nikkei says attackers breached two employee email accounts, exposed data on 1,646 people and sent about 9,000 phishing emails from a Microsoft 365 account.
Ex-Engineer Gets 32 Months for Locking 3,000 Employer Devices
Daniel Rhyne, a former core infrastructure engineer, was sentenced to 32 months for locking over 3,000 devices at a New Jersey firm and demanding 20 ...
Senate Passes Health Care Cybersecurity and Resilience Act
The US Senate passed the bipartisan Health Care Cybersecurity and Resilience Act by unanimous consent, sending grants and coordination measures to the House.
ClickFix Variant Smuggles Payloads Through Browser Cache
Microsoft Threat Intelligence says a new ClickFix variant hides a script in the browser cache as a PNG, sidestepping the Windows Run dialog's character limit.