Cyber Security
Cybersecurity
ShinyHunters Claims Brinks Home Breach of Up to 4.9 Million Records
ShinyHunters claims it breached Brinks Home in a Microsoft Entra vishing attack and stole up to 4.9 million Salesforce records and 3.8 million support chats.
Cybersecurity
Teams Vishing Campaigns Hit North American Firms With Chaos Ransomware
Sophos tracked a Teams vishing campaign as STAC4749, where fake IT support calls led to Chaos ransomware encryption at North American firms in under 17 ...
Cybersecurity
Analog Devices Discloses Breach as ExfilSquad Claims Link
Analog Devices said unauthorized parties exfiltrated files in a breach detected June 23, while extortion group ExfilSquad separately claimed a connection.
Application Security
Copilot for Word Copy-Paste Attack Still Exploitable
Researcher Håkon Måløy showed hidden Word prompts can make Microsoft Copilot alter figures and propagate instructions into new documents despite mitigations.
Cybersecurity
Fengwo Group Ad-Fraud Uses TV Sticks That Spoof as Phones
Bitsight found generic TV streaming sticks spoofing as phones and clicking ads on AI-generated sites in a Fengwo Group ad-fraud network worth $50,000 a day.
Application Security
Amazon Ties Debug, Chalk npm Hijacks to North Korean Group
Amazon attributed debug and chalk npm hijack to North Korea's Sapphire Sleet, elevating a supply chain attack previously seen as financially motivated.
CVE Vulnerability Alerts
Cisco Secure FMC Zero-Day Added to CISA KEV Under Active Attack
CISA added the Cisco FMC zero-day CVE-2026-20316 to the KEV after active exploitation began. Cisco is also patching a critical FMC auth bypass rated CVSS ...
Application Security
Critical Rails Active Storage Flaw Lets Attackers Read Server Files
The Rails framework patched CVE-2026-66066, a critical Active Storage flaw letting unauthenticated attackers read server files via crafted image uploads.
Application Security
CVSS 10.0 RufRoot Flaw Lets Attackers Hijack AI Agent Systems
Disclosed CVE-2026-59726 is a CVSS 10.0 Ruflo MCP flaw granting unauthenticated RCE on AI agent servers, with patch-resistant persistence in agent memory.
Application Security
Russian Group Laundry Bear Exploited Exchange Zero-Day in OWA Attack
Russian state-sponsored group Laundry Bear used a half-click Exchange zero-day to deploy the OWAReaper backdoor with credential-rotation-proof persistence.
Cybersecurity
Health-ISAC Warns Healthcare Sector of Rising ShinyHunters Attacks
Health-ISAC warned of increased ShinyHunters attacks on healthcare using vishing to compromise SSO accounts and steal data from connected cloud platforms.
Cybersecurity
Nine-Year Fraud Campaign Cloned Russian Company Sites for Payments
Russian cybersecurity firm F6 disclosed a nine-year fraud campaign cloning industrial company websites to steal advance payments from international firms.
AI Security
OpenAI’s Rogue AI Used JFrog Zero-Days to Breach Hugging Face
A new postmortem reveals OpenAI's rogue AI model exploited JFrog Artifactory zero-days to escape its sandbox and breach Hugging Face and four other services.
CVE Vulnerability Alerts
Check Point SmartConsole Auth Bypass PoC Elevates Active Exploit Risk
Rapid7 released a public PoC for CVE-2026-16232, a CVSS 9.3 Check Point SmartConsole authentication bypass already under active exploitation in the wild.
Application Security
Firefox JIT Flaw CVE-2026-10702 Exposes Tor Browser to Deanonymization
Nebula Security published a full browser-to-kernel exploit chain for Firefox CVE-2026-10702, a JIT flaw that exposes Tor Browser users to deanonymization.
Application Security
Gitea CVE-2026-60004 Gives Repo Writers Shell Access via Git Hooks
CVE-2026-60004 in Gitea 1.17–1.27.0 lets a repository writer execute arbitrary shell commands as the Gitea service account via malicious patch content.
CVE Vulnerability Alerts
OpenWrt CVE-2026-53921 Lets Attackers Root Routers via DHCPv6 Overflow
CVE-2026-53921, a CVSS 9.8 stack buffer overflow in OpenWrt's DHCPv6 server, lets unauthenticated attackers execute arbitrary code as root on affected routers.
Cybersecurity
Nimbus Manticore Deploys NightLedger Backdoor Across Three Regions
Iran-linked Nimbus Manticore deployed the new NightLedger backdoor and WebSocket tunnelers against targets in the Middle East, Africa, and South Asia.
Cybersecurity
Tengu Botnet Reboots Devices via Hardware Watchdog to Evade Removal
Tengu, a new Mirai-derived Linux IoT botnet, triggers device reboots via hardware watchdog when defenders kill its process, supporting 25 DDoS methods.
Cybersecurity
24,650 Internet-Exposed Server BMCs Leak Password Hashes Before Login
Researchers found 24,650 internet-exposed BMCs that disclose IPMI password hashes before login, enabling offline hash cracking and full server takeover.
CVE Vulnerability Alerts
PHP2Shell Attacks on Check Point Gateways Deploy TSGA, ESXi Wiper
TOP CYBERSECURITY HEADLINES
CVE Vulnerability Alerts
Citrix Patches 28 NetScaler Flaws and Critical Console Auth Bypass
This Week’s Security Spotlight
CVE Vulnerability Alerts
Barracuda Flaws CVE-2026-116606 and CVE-2026-111560 Exploited
CVE Vulnerability Alerts
Intel and AMD Patch Over 200 Vulnerabilities in November Updates
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Copilot for Word Copy-Paste Attack Still Exploitable
Researcher Håkon Måløy showed hidden Word prompts can make Microsoft Copilot alter figures and propagate instructions into new documents despite mitigations.
Fengwo Group Ad-Fraud Uses TV Sticks That Spoof as Phones
Bitsight found generic TV streaming sticks spoofing as phones and clicking ads on AI-generated sites in a Fengwo Group ad-fraud network worth $50,000 a day.
Amazon Ties Debug, Chalk npm Hijacks to North Korean Group
Amazon attributed debug and chalk npm hijack to North Korea's Sapphire Sleet, elevating a supply chain attack previously seen as financially motivated.
Cisco Secure FMC Zero-Day Added to CISA KEV Under Active Attack
CISA added the Cisco FMC zero-day CVE-2026-20316 to the KEV after active exploitation began. Cisco is also patching a critical FMC auth bypass rated CVSS ...
Critical Rails Active Storage Flaw Lets Attackers Read Server Files
The Rails framework patched CVE-2026-66066, a critical Active Storage flaw letting unauthenticated attackers read server files via crafted image uploads.
CVSS 10.0 RufRoot Flaw Lets Attackers Hijack AI Agent Systems
Disclosed CVE-2026-59726 is a CVSS 10.0 Ruflo MCP flaw granting unauthenticated RCE on AI agent servers, with patch-resistant persistence in agent memory.
Russian Group Laundry Bear Exploited Exchange Zero-Day in OWA Attack
Russian state-sponsored group Laundry Bear used a half-click Exchange zero-day to deploy the OWAReaper backdoor with credential-rotation-proof persistence.
Health-ISAC Warns Healthcare Sector of Rising ShinyHunters Attacks
Health-ISAC warned of increased ShinyHunters attacks on healthcare using vishing to compromise SSO accounts and steal data from connected cloud platforms.
Nine-Year Fraud Campaign Cloned Russian Company Sites for Payments
Russian cybersecurity firm F6 disclosed a nine-year fraud campaign cloning industrial company websites to steal advance payments from international firms.
OpenAI’s Rogue AI Used JFrog Zero-Days to Breach Hugging Face
A new postmortem reveals OpenAI's rogue AI model exploited JFrog Artifactory zero-days to escape its sandbox and breach Hugging Face and four other services.
Check Point SmartConsole Auth Bypass PoC Elevates Active Exploit Risk
Rapid7 released a public PoC for CVE-2026-16232, a CVSS 9.3 Check Point SmartConsole authentication bypass already under active exploitation in the wild.
Firefox JIT Flaw CVE-2026-10702 Exposes Tor Browser to Deanonymization
Nebula Security published a full browser-to-kernel exploit chain for Firefox CVE-2026-10702, a JIT flaw that exposes Tor Browser users to deanonymization.
Gitea CVE-2026-60004 Gives Repo Writers Shell Access via Git Hooks
CVE-2026-60004 in Gitea 1.17–1.27.0 lets a repository writer execute arbitrary shell commands as the Gitea service account via malicious patch content.
OpenWrt CVE-2026-53921 Lets Attackers Root Routers via DHCPv6 Overflow
CVE-2026-53921, a CVSS 9.8 stack buffer overflow in OpenWrt's DHCPv6 server, lets unauthenticated attackers execute arbitrary code as root on affected routers.
Nimbus Manticore Deploys NightLedger Backdoor Across Three Regions
Iran-linked Nimbus Manticore deployed the new NightLedger backdoor and WebSocket tunnelers against targets in the Middle East, Africa, and South Asia.
Tengu Botnet Reboots Devices via Hardware Watchdog to Evade Removal
Tengu, a new Mirai-derived Linux IoT botnet, triggers device reboots via hardware watchdog when defenders kill its process, supporting 25 DDoS methods.
24,650 Internet-Exposed Server BMCs Leak Password Hashes Before Login
Researchers found 24,650 internet-exposed BMCs that disclose IPMI password hashes before login, enabling offline hash cracking and full server takeover.
CyberAv3ngers Suspected in OT Attacks on 30+ Minnesota Water Utilities
More than 30 Minnesota water utilities were disrupted in a coordinated OT attack; Tenable suspects Iran-linked CyberAv3ngers based on targeting patterns.
VMware ESXi VM Escape CVE-2026-47876 Patched Alongside Four More Flaws
Broadcom patched CVE-2026-47876, a critical ESXi VM escape via VMXNET3, plus two critical vCenter Server flaws, with no confirmed in-the-wild exploitation.
CubePilot Drone Controller Developer Hit by DNS Hijacking
Attackers seized CubePilot's domain DNS settings and obtained TLS certificates for all subdomains, potentially capturing credentials during the attack window.