Cyber Security
Application Security
n8n Sandbox Escape GHSA-gv7g-jm28-cr3m Exposes Host OS Commands
n8n versions before 2.31.5 let authenticated users escape the expression sandbox via arrow functions and Reflect.get(), executing OS commands on the host.
Cybersecurity
Operation BlueDash Delivers RMM Tools via Fake Teams Lures
Operation BlueDash deploys Level RMM and ScreenConnect against enterprises through fake Microsoft Teams and Zoom pages linked to a Nigerian threat actor.
Cybersecurity
Cruciferra Crypter Combines BYOVD and Process Ghosting to Kill EDR
Cruciferra, a MaaS crypter active since fall 2025, bypasses EDR via BYOVD and Process Ghosting. TA4922, Silver Fox, and 11 malware families are linked to ...
Cybersecurity
Victims Sue Apple Over $1.8M Bitcoin Theft Via Fake Sparrow App
Three individuals sued Apple over a fake iOS Sparrow Wallet app that stole $1.8 million in Bitcoin by harvesting seed phrases. Apple was warned in ...
Cybersecurity
ShinyHunters Claims Ernst & Young Breach via Third-Party System
ShinyHunters posted Ernst & Young to its leak site, claiming a supply-chain attack on a third-party ticket system that exposed client tax and financial data.
Cybersecurity
Origin Energy Breach Exposes Data on 900,000 Australian Customers
Origin Energy disclosed a breach affecting 900,000 Australian customers, exposing names, bank account fragments, and addresses amid unconfirmed ransom claims.
Cybersecurity
MedusaHVNC Hides Covert Browser Sessions in Windows Desktops
BlackFog exposed MedusaHVNC, a MaaS RAT that runs browsers on a hidden Windows virtual desktop to commit banking fraud without the victim's awareness.
Application Security
Fastjson CVE-2026-16723 Under Active Attack With No Patch
Fastjson CVE-2026-16723, a CVSS 9.0 Java RCE flaw with no patch, is under active attack against financial services, healthcare, computing, and retail targets.
Cybersecurity
TELESHIM Backdoor Hits Middle East Governments via Telegram C2
Zscaler ThreatLabz uncovered TELESHIM, MIXEDKEY, and BINDCLOAK — three new malware families an East Asia-linked APT used against Middle Eastern governments.
Cybersecurity
DentaQuest Breach Affects 23.4 Million, PHI and SSNs Exposed
DentaQuest's breach notification confirms up to 23.4 million Medicaid dental enrollees potentially affected, with SSNs and dental PHI stolen in a network hack.
Cybersecurity
PEAR Ransomware Breach at MCBS Hits 1.26 Million Patients
PEAR ransomware group claimed 3 TB stolen from MCBS, a medical billing firm whose breach exposed 1.26 million patients at seven healthcare organizations.
Application Security
SourTrade Malvertising Assembles Malware in Browser Memory
SourTrade malvertising downloads encrypted fragments and assembles a Windows executable in browser memory, evading file-based detection across 12 countries.
Cybersecurity
ShinyHunters Breach Data Fuels $2,000 Bitcoin Sextortion Wave
Attackers are sending $2,000 Bitcoin sextortion emails that cite specific ShinyHunters-breached companies to make false surveillance threats appear credible.
Cybersecurity
Steam ClickFix Campaign Installs SYSTEM-Level XMRig Miner
Attackers target Steam discussion forums with ClickFix social engineering, tricking players into running PowerShell that installs a SYSTEM-level XMRig miner.
Application Security
GitHub and PyPI Add Time-Based Defenses Against Supply Chain Poisoning
GitHub's new Dependabot 72-hour cooldown and PyPI's 14-day release lock target two supply chain attack vectors that compromised major package ecosystems.
Application Security
Rockwell Patches Four Arena Code Execution Flaws Across Sectors
Rockwell Automation patched four memory corruption CVEs in Arena, its simulation software used by hospitals, supply chain firms, and defense contractors.
Cybersecurity
Scattered Spider TfL Hackers Sentenced to Five and a Half Years
UK authorities sentenced two Scattered Spider members to five-and-a-half years each for the 2024 Transport for London attack, the UK's largest cybercrime case.
Cybersecurity
ClickLock macOS Stealer Uses App-Kill Loop to Coerce Passwords
Group-IB documented ClickLock, a macOS stealer using a 210ms app-kill loop to coerce macOS passwords, hitting more than 100 victims across 33 countries.
Cybersecurity
Elastic Exposes TELEPUZ: C Malware Sold as MaaS via ClickFix Chain
Elastic Security Labs disclosed TELEPUZ, a C-based malware distributed through a ClickFix-to-Vidar chain with VirusTotal volumes indicating a MaaS operation.
Cybersecurity
Russian Threat Actor Uses Gemini CLI to Run Dental Clinic Botnet
Trend Micro documented Russian actor 'bandcampro' using Gemini CLI as a hacking assistant in a dental clinic botnet attack on an OpenDental patient database.
Application Security
PHP Warns of Two Critical RCE Flaws as Embargoed Details Leak
CVE Vulnerability Alerts
Qilin, INC Ransomware Exploit PAN-OS Flaw, Then Pivot to VMware
TOP CYBERSECURITY HEADLINES
This Week’s Security Spotlight
Application Security
Siemens Software Center Flaw Exploited in ROMULUS ClickFix Attacks
Application Security
Microsoft Confirms Windows Update Breaks Exchange Sign-In, Mail Flow
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Victims Sue Apple Over $1.8M Bitcoin Theft Via Fake Sparrow App
Three individuals sued Apple over a fake iOS Sparrow Wallet app that stole $1.8 million in Bitcoin by harvesting seed phrases. Apple was warned in ...
ShinyHunters Claims Ernst & Young Breach via Third-Party System
ShinyHunters posted Ernst & Young to its leak site, claiming a supply-chain attack on a third-party ticket system that exposed client tax and financial data.
Origin Energy Breach Exposes Data on 900,000 Australian Customers
Origin Energy disclosed a breach affecting 900,000 Australian customers, exposing names, bank account fragments, and addresses amid unconfirmed ransom claims.
MedusaHVNC Hides Covert Browser Sessions in Windows Desktops
BlackFog exposed MedusaHVNC, a MaaS RAT that runs browsers on a hidden Windows virtual desktop to commit banking fraud without the victim's awareness.
Fastjson CVE-2026-16723 Under Active Attack With No Patch
Fastjson CVE-2026-16723, a CVSS 9.0 Java RCE flaw with no patch, is under active attack against financial services, healthcare, computing, and retail targets.
TELESHIM Backdoor Hits Middle East Governments via Telegram C2
Zscaler ThreatLabz uncovered TELESHIM, MIXEDKEY, and BINDCLOAK — three new malware families an East Asia-linked APT used against Middle Eastern governments.
DentaQuest Breach Affects 23.4 Million, PHI and SSNs Exposed
DentaQuest's breach notification confirms up to 23.4 million Medicaid dental enrollees potentially affected, with SSNs and dental PHI stolen in a network hack.
PEAR Ransomware Breach at MCBS Hits 1.26 Million Patients
PEAR ransomware group claimed 3 TB stolen from MCBS, a medical billing firm whose breach exposed 1.26 million patients at seven healthcare organizations.
SourTrade Malvertising Assembles Malware in Browser Memory
SourTrade malvertising downloads encrypted fragments and assembles a Windows executable in browser memory, evading file-based detection across 12 countries.
ShinyHunters Breach Data Fuels $2,000 Bitcoin Sextortion Wave
Attackers are sending $2,000 Bitcoin sextortion emails that cite specific ShinyHunters-breached companies to make false surveillance threats appear credible.
Steam ClickFix Campaign Installs SYSTEM-Level XMRig Miner
Attackers target Steam discussion forums with ClickFix social engineering, tricking players into running PowerShell that installs a SYSTEM-level XMRig miner.
GitHub and PyPI Add Time-Based Defenses Against Supply Chain Poisoning
GitHub's new Dependabot 72-hour cooldown and PyPI's 14-day release lock target two supply chain attack vectors that compromised major package ecosystems.
Rockwell Patches Four Arena Code Execution Flaws Across Sectors
Rockwell Automation patched four memory corruption CVEs in Arena, its simulation software used by hospitals, supply chain firms, and defense contractors.
Scattered Spider TfL Hackers Sentenced to Five and a Half Years
UK authorities sentenced two Scattered Spider members to five-and-a-half years each for the 2024 Transport for London attack, the UK's largest cybercrime case.
ClickLock macOS Stealer Uses App-Kill Loop to Coerce Passwords
Group-IB documented ClickLock, a macOS stealer using a 210ms app-kill loop to coerce macOS passwords, hitting more than 100 victims across 33 countries.
Elastic Exposes TELEPUZ: C Malware Sold as MaaS via ClickFix Chain
Elastic Security Labs disclosed TELEPUZ, a C-based malware distributed through a ClickFix-to-Vidar chain with VirusTotal volumes indicating a MaaS operation.
Russian Threat Actor Uses Gemini CLI to Run Dental Clinic Botnet
Trend Micro documented Russian actor 'bandcampro' using Gemini CLI as a hacking assistant in a dental clinic botnet attack on an OpenDental patient database.
DragonForce Posts Eighteen Victims Across Eight Countries in 48 Hours
DragonForce posted eighteen victims across eight countries in 48 hours, including a US defense subcontractor, four law firms, and chemical manufacturers.
Coca-Cola Files SEC 8-K After Ransomware Hits Fairlife Dairy
Coca-Cola filed an SEC Form 8-K disclosing a ransomware attack on Fairlife dairy that suspended all U.S. production. No group has yet claimed the attack.
CISA Adds SharePoint CVE-2026-58644 to KEV After Zero-Day Confirmed
CISA added SharePoint CVE-2026-58644, a CVSS 9.8 deserialization flaw, to KEV after Microsoft confirmed zero-day exploitation. Federal deadline is July 19.