Cyber Security
Application Security
Arista VeloCloud CVSS 10.0 Flaw Under Active Exploitation
CVE-2026-93952 (CVSS 10.0) in on-premises VeloCloud Orchestrator under active exploit. Unauthenticated attackers access privileged internal functions.
CVE Vulnerability Alerts
Linux KVM Flaw on ARM64 Exposes Host Memory to Guest VMs
CVE-2026-89775 in Linux kernel KVM for ARM64 processors exposes freed host memory to guest VMs, enabling guest-to-host privilege escalation when nested virtualization is enabled.
Application Security
SharePoint Flaw Enables Authenticated RCE Despite Spoofing Rating
CVE-2026-65660, initially classified by Microsoft as spoofing with CVSS 6.5, enables authenticated remote code execution on SharePoint Server per researcher analysis.
Application Security
Malicious npm Package indexed-btree Hides Payload in Runtime Code
indexed-btree npm package hides malicious behavior in application runtime code instead of lifecycle scripts, evading npm security controls, per Checkmarx researchers.
Application Security
SideCopy Expands India Targeting to Academic Institutions
SideCopy threat actor expanded targeting from Indian government to academic institutions using spear-phishing with ReverseRAT and mshta.exe abuse, per Trellix research.
AI Security
Meta Muse AI App Flaw Lets Local Malware Redirect Voice Input
Researcher Patrick Wardle published proof-of-concept on September 21 showing malware can hijack Meta Muse AI assistant by changing a hidden setting to redirect voice input.
Application Security
WordPress Patches Comment2Shell Anonymous-to-RCE Attack Chain
WordPress patched CVE-2026-93485 (Comment2Shell) in version 7.1.1 on September 17, a flaw allowing anonymous comments to achieve RCE when viewed by administrators.
Application Security
Fake LastPass Authenticator Uses Signed Driver to Disable EDR
Fake LastPass Authenticator installer distributed via GitHub installs Microsoft-signed kernel driver to disable antivirus and EDR before deploying password stealer.
CVE Vulnerability Alerts
Issabel Framework Flaw Enables Unauthenticated OS Command Execution
CVE-2026-89026 in Issabel Framework under active exploitation allows unauthenticated attackers to execute arbitrary OS commands remotely via hard-coded credentials.
Cybersecurity
KREMLIN Banking Malware Hijacks Chrome and Edge for Credential Theft
Previously undocumented Brazilian banking malware KREMLIN installs malicious extensions on Chrome and Edge, bypassing security checks to steal credentials and session tokens.
Cybersecurity
North Korean Jade Sleet Breaches Indian IT Provider
North Korean Jade Sleet group compromised an Indian IT services firm using FLATROOF and ROOFDECK backdoors, targeting developers for supply chain attacks.
Cybersecurity
Malicious npm Packages Bypass Install-Script Detection
npm attackers hide malware in runtime code execution instead of install scripts, evading traditional supply chain defenses targeting the indexed-btree package.
AI Security
Researchers Escape OpenAI Codex Sandbox, Compromise Staff Accounts
Security researchers broke out of OpenAI's Codex sandbox using two methods and chained vulnerabilities to compromise ChatGPT and Codex staff accounts.
AI Security
Single Browser Extension Hijacks AI Assistants Across Five Browsers
BragJack proof-of-concept uses a single malicious extension and Prompt Forcing to hijack AI assistants in Chrome, Edge, Opera Neon, Perplexity, and Claude.
Cybersecurity
North Korean WaterPlum Stole $10.7M After Infecting 30,000 Devices
North Korean WaterPlum hackers compromised 30,000 devices globally in eight-month campaign, stealing over $10.7 million in cryptocurrency traced to Pyongyang.
Cybersecurity
ShinyHunters Breaches Clop Ransomware Leak Site, Threatens Gang
ShinyHunters extortion gang compromised Clop's Tor leak site, claiming to have stolen server data and private keys, threatening to extort the ransomware gang.
AI Security
Viral AI Actress Service Face-Scans Callers, Tracks Emotions
Tilly Norwood's Talking Tilly video call service scans every caller's face for age verification and monitors emotions before shutdown on September 27.
AI Security
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September 8.
Application Security
GoldFactory and Mantax Otax Target Indonesian Android Bank Users
Two concurrent Android banking malware campaigns — GoldFactory's Gigabud trojan and Mantax Otax ransomware-spyware hybrid — target Indonesian users with credential theft and harassment.
Application Security
Thousands of Scam Apps Exploit Google Play Early Access Program
Malicious developers abuse Google Play's Early Access program to push thousands of deceptive Android apps promising money, rewards, and premium content that do not deliver.
CVE Vulnerability Alerts
PHP2Shell Attacks on Check Point Gateways Deploy TSGA, ESXi Wiper
TOP CYBERSECURITY HEADLINES
CVE Vulnerability Alerts
Citrix Patches 28 NetScaler Flaws and Critical Console Auth Bypass
This Week’s Security Spotlight
CVE Vulnerability Alerts
Barracuda Flaws CVE-2026-116606 and CVE-2026-111560 Exploited
CVE Vulnerability Alerts
Intel and AMD Patch Over 200 Vulnerabilities in November Updates
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Malicious npm Package indexed-btree Hides Payload in Runtime Code
indexed-btree npm package hides malicious behavior in application runtime code instead of lifecycle scripts, evading npm security controls, per Checkmarx researchers.
SideCopy Expands India Targeting to Academic Institutions
SideCopy threat actor expanded targeting from Indian government to academic institutions using spear-phishing with ReverseRAT and mshta.exe abuse, per Trellix research.
Meta Muse AI App Flaw Lets Local Malware Redirect Voice Input
Researcher Patrick Wardle published proof-of-concept on September 21 showing malware can hijack Meta Muse AI assistant by changing a hidden setting to redirect voice input.
WordPress Patches Comment2Shell Anonymous-to-RCE Attack Chain
WordPress patched CVE-2026-93485 (Comment2Shell) in version 7.1.1 on September 17, a flaw allowing anonymous comments to achieve RCE when viewed by administrators.
Fake LastPass Authenticator Uses Signed Driver to Disable EDR
Fake LastPass Authenticator installer distributed via GitHub installs Microsoft-signed kernel driver to disable antivirus and EDR before deploying password stealer.
Issabel Framework Flaw Enables Unauthenticated OS Command Execution
CVE-2026-89026 in Issabel Framework under active exploitation allows unauthenticated attackers to execute arbitrary OS commands remotely via hard-coded credentials.
KREMLIN Banking Malware Hijacks Chrome and Edge for Credential Theft
Previously undocumented Brazilian banking malware KREMLIN installs malicious extensions on Chrome and Edge, bypassing security checks to steal credentials and session tokens.
North Korean Jade Sleet Breaches Indian IT Provider
North Korean Jade Sleet group compromised an Indian IT services firm using FLATROOF and ROOFDECK backdoors, targeting developers for supply chain attacks.
Malicious npm Packages Bypass Install-Script Detection
npm attackers hide malware in runtime code execution instead of install scripts, evading traditional supply chain defenses targeting the indexed-btree package.
Researchers Escape OpenAI Codex Sandbox, Compromise Staff Accounts
Security researchers broke out of OpenAI's Codex sandbox using two methods and chained vulnerabilities to compromise ChatGPT and Codex staff accounts.
Single Browser Extension Hijacks AI Assistants Across Five Browsers
BragJack proof-of-concept uses a single malicious extension and Prompt Forcing to hijack AI assistants in Chrome, Edge, Opera Neon, Perplexity, and Claude.
North Korean WaterPlum Stole $10.7M After Infecting 30,000 Devices
North Korean WaterPlum hackers compromised 30,000 devices globally in eight-month campaign, stealing over $10.7 million in cryptocurrency traced to Pyongyang.
ShinyHunters Breaches Clop Ransomware Leak Site, Threatens Gang
ShinyHunters extortion gang compromised Clop's Tor leak site, claiming to have stolen server data and private keys, threatening to extort the ransomware gang.
Viral AI Actress Service Face-Scans Callers, Tracks Emotions
Tilly Norwood's Talking Tilly video call service scans every caller's face for age verification and monitors emotions before shutdown on September 27.
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September 8.
GoldFactory and Mantax Otax Target Indonesian Android Bank Users
Two concurrent Android banking malware campaigns — GoldFactory's Gigabud trojan and Mantax Otax ransomware-spyware hybrid — target Indonesian users with credential theft and harassment.
Thousands of Scam Apps Exploit Google Play Early Access Program
Malicious developers abuse Google Play's Early Access program to push thousands of deceptive Android apps promising money, rewards, and premium content that do not deliver.
Four Nation-State Groups Deploy BlueMoon Kit Within 12 Days
APT31 and three additional nation-state actors deployed the BlueMoon exploit kit chaining Chrome and Windows zero-days within a two-week window, with researchers suspecting AI assistance.
NSA, CISA, FBI Accuse Six Chinese AI Firms of Model Distillation
US intelligence agencies accuse DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of extracting billions of tokens from OpenAI, Anthropic, Google, and SpaceX at industrial ...
UNC3569 Exploits Sogou Input Method to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited a vulnerability in Tencent's Sogou Input Method, one of the most widely used Chinese typing tools for Windows, to install GRAYRABBIT backdoor ...