Cyber Security
Identity and Access Management
How Device Code Phishing Abuses OAuth Flows on Google and Azure
Cybercriminals are increasingly exploiting the OAuth 2.0 device code flow to bypass multi-factor authentication, a tactic known as device code phishing. Researchers warn that while ...
Cybersecurity
Balancer Protocol Breached in $128 Million Attack on DeFi Pools
A sophisticated exploit has drained over $128 million from Balancer Protocol’s v2 liquidity pools, marking one of DeFi’s largest breaches this year. Attackers used flash ...
Application Security
OpenAI Assistants API Abused in New Malware Campaign Leveraging Covert C2 Channel
Microsoft has uncovered a new backdoor malware strain using OpenAI’s Assistants API as a covert command-and-control channel. The discovery marks one of the first cases ...
Application Security
Indian Government Issues High-Severity Warning for Google Chrome Users
CERT-In warns Chrome users in India to update immediately after multiple high-severity vulnerabilities were discovered that allow remote attackers to hijack systems via malicious webpages.
Cybersecurity
South Korea’s Telecom Giants Grapple With Cyber Breaches and Executive Shakeups
South Korea’s telecom giants SK Telecom, KT, and LG Uplus are facing severe cyberattacks, financial losses, and leadership shakeups, exposing systemic weaknesses in national telecom ...
Data Security
Proton Warns of 300 Million Stolen Credentials Fueling Global Data Breach Crisis
Proton’s Data Breach Observatory uncovered 300 million stolen credentials circulating on the dark web, exposing corporations and individuals worldwide to identity theft and financial fraud ...
News
Conti Ransomware Associate Oleksii Lytvynenko Charged After U.S. Extradition
Ukrainian national Oleksii Lytvynenko has been extradited to the U.S. to face charges for aiding the Conti ransomware group, marking a major milestone in cross-border ...
Data Security
University of Pennsylvania Data Breach Exposes 1.2 Million Donor Records
A data breach at the University of Pennsylvania has reportedly exposed the personal information of 1.2 million donors after a hacker—who began by emailing “we ...
Application Security
Open VSX Access Tokens Leaked, Allowing Malicious Extensions in Supply Chain Threat
A credential leak in the Open VSX registry allowed attackers to publish malicious VS Code extensions, exposing a major supply chain risk. Swift token revocation ...
CVE Vulnerability Alerts
Australia Issues Urgent Warning as Cisco IOS XE Exploit Sees Ongoing Attacks
Australian authorities have issued an urgent warning over active exploitation of CVE-2023-20198, a critical Cisco IOS XE flaw used to deploy the persistent “BadCandy” webshell. ...
Application Security
Bronze Butler Exploited Zero-Day in Motex Lanscope to Deploy Gokcpdoor Malware
China-linked APT group Bronze Butler exploited a zero-day flaw in Motex Lanscope Endpoint Manager to deploy an upgraded Gokcpdoor malware variant in targeted Japanese organizations. ...
Application Security
Google’s AI-Powered Search Signals the Return of Ads: What it Means for Security and Strategy
Google is integrating advertising into its AI-powered Search Generative Experience (SGE), embedding sponsored results directly within AI summaries and answer boxes. The move redefines ad ...
News
China-Linked UNC6384 Exploits Windows Zero-Day to Target EU Diplomats
China-linked APT group UNC6384 has launched a cyberespionage campaign exploiting a Windows zero-day flaw to infiltrate European diplomatic networks. Researchers say the operation, uncovered by ...
Cybersecurity
Reputation.com Data Leak Exposes 120 Million Internal Logs Containing Customer Session Data
A misconfigured server at Reputation.com exposed 120 million internal logs containing session cookies and backend data, potentially allowing attackers to hijack customer social media accounts.
Cybersecurity
Hackers Claim Breach of Viz Media Executive Account, Exfiltrating 250GB of Corporate Data
Hackers claim to have breached Viz Media’s vice president’s Google Drive, stealing 250GB of corporate data, credentials, and licensing documents now being sold on dark ...
Cybersecurity
Russian Police Arrest Teenagers Behind Meduza Infostealer Operation
Russian police arrested three teenagers behind the Meduza Infostealer operation, exposing a teenage-run malware service that stole credentials and state data across multiple systems.
Application Security
CISA and NSA Issue Joint Guidance to Secure Microsoft Exchange Servers
CISA and NSA have issued new guidance to secure Microsoft Exchange servers, urging organizations to minimize exposure, disable legacy protocols, and adopt Zero Trust to ...
Cybersecurity
Former L3Harris Executive Admits to Selling Classified Cybersecurity Data to Russian Exploit Dealer
A former L3Harris executive pleaded guilty to leaking U.S. cyber exploit intelligence to a Russian broker. The insider threat case exposes severe national security and ...
Application Security
WhatsApp Enhances Security With Passkey-Enforced Encrypted Chat Backups
WhatsApp is rolling out passkey-encrypted backups for Android and iOS, securing chat history in the cloud with biometric or screen-lock authentication to enhance end-to-end encryption.
Application Security
Critical “Brash” Vulnerability in Chromium’s Blink Engine Can Instantly Crash Browsers
A flaw in Chromium’s Blink engine, dubbed “Brash,” lets attackers crash browsers like Chrome and Edge with a single malicious URL, exposing a major denial-of-service ...
Application Security
AI-Generated Malicious VS Code Extension Raises Concerns Over Marketplace Security
TOP CYBERSECURITY HEADLINES
Application Security
Truffle Security Secures $25 Million to Expand Secrets Scanning Capabilities
This Week’s Security Spotlight
Application Security
Malicious Android Apps Garner 40 Million Downloads on Google Play, Zscaler Finds
Application Security
OpenAI Assistants API Abused in New Malware Campaign Leveraging Covert C2 Channel
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Indian Government Issues High-Severity Warning for Google Chrome Users
CERT-In warns Chrome users in India to update immediately after multiple high-severity vulnerabilities were discovered that allow remote attackers to hijack systems via malicious webpages.
South Korea’s Telecom Giants Grapple With Cyber Breaches and Executive Shakeups
South Korea’s telecom giants SK Telecom, KT, and LG Uplus are facing severe cyberattacks, financial losses, and leadership shakeups, exposing systemic weaknesses in national telecom ...
Proton Warns of 300 Million Stolen Credentials Fueling Global Data Breach Crisis
Proton’s Data Breach Observatory uncovered 300 million stolen credentials circulating on the dark web, exposing corporations and individuals worldwide to identity theft and financial fraud ...
Conti Ransomware Associate Oleksii Lytvynenko Charged After U.S. Extradition
Ukrainian national Oleksii Lytvynenko has been extradited to the U.S. to face charges for aiding the Conti ransomware group, marking a major milestone in cross-border ...
University of Pennsylvania Data Breach Exposes 1.2 Million Donor Records
A data breach at the University of Pennsylvania has reportedly exposed the personal information of 1.2 million donors after a hacker—who began by emailing “we ...
Open VSX Access Tokens Leaked, Allowing Malicious Extensions in Supply Chain Threat
A credential leak in the Open VSX registry allowed attackers to publish malicious VS Code extensions, exposing a major supply chain risk. Swift token revocation ...
Australia Issues Urgent Warning as Cisco IOS XE Exploit Sees Ongoing Attacks
Australian authorities have issued an urgent warning over active exploitation of CVE-2023-20198, a critical Cisco IOS XE flaw used to deploy the persistent “BadCandy” webshell. ...
Bronze Butler Exploited Zero-Day in Motex Lanscope to Deploy Gokcpdoor Malware
China-linked APT group Bronze Butler exploited a zero-day flaw in Motex Lanscope Endpoint Manager to deploy an upgraded Gokcpdoor malware variant in targeted Japanese organizations. ...
Google’s AI-Powered Search Signals the Return of Ads: What it Means for Security and Strategy
Google is integrating advertising into its AI-powered Search Generative Experience (SGE), embedding sponsored results directly within AI summaries and answer boxes. The move redefines ad ...
China-Linked UNC6384 Exploits Windows Zero-Day to Target EU Diplomats
China-linked APT group UNC6384 has launched a cyberespionage campaign exploiting a Windows zero-day flaw to infiltrate European diplomatic networks. Researchers say the operation, uncovered by ...
Reputation.com Data Leak Exposes 120 Million Internal Logs Containing Customer Session Data
A misconfigured server at Reputation.com exposed 120 million internal logs containing session cookies and backend data, potentially allowing attackers to hijack customer social media accounts.
Hackers Claim Breach of Viz Media Executive Account, Exfiltrating 250GB of Corporate Data
Hackers claim to have breached Viz Media’s vice president’s Google Drive, stealing 250GB of corporate data, credentials, and licensing documents now being sold on dark ...
Russian Police Arrest Teenagers Behind Meduza Infostealer Operation
Russian police arrested three teenagers behind the Meduza Infostealer operation, exposing a teenage-run malware service that stole credentials and state data across multiple systems.
Trend Vision One Identity Security Review: Unified Identity-Centric Threat Detection and Risk Management for the Enterprise
Trend Vision One Identity Security delivers unified visibility into human and non-human identities, posture assessment and threat detection across cloud, hybrid and on-premises infrastructure for ...
CISA and NSA Issue Joint Guidance to Secure Microsoft Exchange Servers
CISA and NSA have issued new guidance to secure Microsoft Exchange servers, urging organizations to minimize exposure, disable legacy protocols, and adopt Zero Trust to ...
Former L3Harris Executive Admits to Selling Classified Cybersecurity Data to Russian Exploit Dealer
A former L3Harris executive pleaded guilty to leaking U.S. cyber exploit intelligence to a Russian broker. The insider threat case exposes severe national security and ...
WhatsApp Enhances Security With Passkey-Enforced Encrypted Chat Backups
WhatsApp is rolling out passkey-encrypted backups for Android and iOS, securing chat history in the cloud with biometric or screen-lock authentication to enhance end-to-end encryption.
Critical “Brash” Vulnerability in Chromium’s Blink Engine Can Instantly Crash Browsers
A flaw in Chromium’s Blink engine, dubbed “Brash,” lets attackers crash browsers like Chrome and Edge with a single malicious URL, exposing a major denial-of-service ...
CISA Adds XWiki and Broadcom VMware Flaws to Known Exploited Vulnerabilities Catalog
CISA has added critical XWiki and VMware vulnerabilities to its Known Exploited list, confirming active attacks and urging immediate patching under federal security mandates.
OpenAI Upgrades GPT-5 to Better Handle Conversations Involving Emotional Distress
OpenAI’s October GPT-4 update improves how the model handles emotionally charged conversations. The upgrade enhances safety, empathy, and redirection for users expressing distress while reducing ...