Cyber Security
Application Security
Critical SharePoint Zero-Day Exploited: Immediate Steps Against CVE-2025-53770 Vulnerability
A critical zero-day in Microsoft SharePoint, tracked as CVE-2025-53770, is being widely exploited in espionage and ransomware campaigns. Dubbed “ToolShell,” the flaw enables unauthenticated remote ...
Cybersecurity
Storm-0501 Shifts From On-Premises Ransomware to Cloud-Based Extortion
Microsoft warns Storm-0501 now focuses on cloud-native extortion: exfiltrating data, destroying backups, and encrypting cloud storage rather than encrypting on-premises endpoints.
Cybersecurity
CPAP Data Breach Exposes 90k Records of Military-Linked Customers
CPAP’s systems were breached in December 2024, exposing names, SSNs, and protected health information for over 90,000 individuals including military beneficiaries.
Cybersecurity
Healthcare Services Group Data Breach Impacts 624,000 Individuals After 2024 Network Intrusion
Healthcare Services Group reports a late-2024 intrusion that exposed personal data for 624,000 people; company offers identity protection and continues forensic investigations.
Cybersecurity
PromptLock Ransomware Uses AI to Encrypt and Steal Data
Researchers uncovered PromptLock, the first AI-powered ransomware generating malicious Lua scripts via LLM prompts. Though only a proof-of-concept, it highlights risks of weaponized AI in ...
Application Security
FreePBX Administrator Control Panels Under Active Zero-Day Exploit
Microsoft warns Storm-0501 now focuses on cloud-native extortion: exfiltrating data, destroying backups, and encrypting cloud storage rather than encrypting on-premises endpoints.
Cybersecurity
Miljödata Cyberattack Disrupts Services for More Than 200 Swedish Municipalities
A cyberattack on Miljödata disrupted services across 200+ Swedish municipalities and may have exposed sensitive personal data; a ransom demand of 1.5 BTC was reported.
Cybersecurity
Image-Scaling Prompt Injection Exposes Hidden Risks in AI Systems
Researchers show image-scaling prompt injection can hide executable instructions that surface only after downscaling, enabling LLM-driven data exfiltration across multiple AI platforms.
Cybersecurity
Auchan Notifies Customers After Loyalty Account Data Exposure in Cyberattack
Auchan disclosed a cyberattack exposing contact and loyalty data for several hundred thousand customers; bank details and passwords were not impacted, CNIL was notified.
Cybersecurity
Critical Docker Desktop SSRF Vulnerability Compromises Hosts Using Containers
A critical SSRF in Docker Desktop (CVE-2025-9074) let containers reach the Docker Engine API and bind host storage; Docker issued Docker Desktop 4.44.3 to fix ...
CVE Vulnerability Alerts
CISA Warns of Actively Exploited Git Arbitrary Code Execution Vulnerability
CISA warns of actively exploited Git vulnerability CVE-2025-48384 that enables arbitrary code execution via crafted submodules; federal patch deadline set for September 15.
Application Security
Coordinated Scans Surged Targeting Microsoft RDP Auth Servers
GreyNoise detected nearly 1,971 IPs scanning Microsoft RDP Web Auth portals to test timing flaws and enumerate usernames, potentially preparing credential-based attacks during US back-to-school ...
CVE Vulnerability Alerts
Citrix Fixes NetScaler RCE Flaw Exploited in Zero-Day Attacks
Citrix patches critical NetScaler RCE CVE-2025-7775 exploited in zero-day attacks; admins must upgrade affected NetScaler ADC and Gateway builds immediately.
Application Security
MathWorks Data Breach Exposes 10,000 Users in a Ransomware Attack
MathWorks disclosed a ransomware attack exposing PII for more than 10,000 users; intrusion lasted from April 17 to May 18, with services disrupted for nearly ...
Cybersecurity
Thousands of Grok AI Chats Leaked, Transcripts Indexed Publicly
Forbes found over 370,000 Grok conversations indexed by search engines after users clicked "share," exposing personal data, attachments, passwords, and illicit instructions including assassination plans.
Cybersecurity
Murky Panda Exploits Cloud Trust to Breach Customers in Supply Chain Attacks
Murky Panda hijacks trusted cloud relationships to reach downstream customers, abusing Entra ID and DAP paths, reading email, and escalating privileges after initial access via ...
Cybersecurity
Salesloft Breach Exposes OAuth Tokens Used in Salesforce Data-Theft Campaign
Salesloft breach exposed Drift OAuth tokens used to access Salesforce instances; attackers extracted AWS keys, passwords, and Snowflake tokens to pivot and exfiltrate data.
Application Security
Discord Message-Scraping Service Claims Access to 1.8 Billion Messages
A newly advertised data-scraping service claims to index 1.8 billion Discord messages, 207 million voice sessions, and profiles from 35 million users. Researchers warn the ...
Application Security
Silk Typhoon Hackers Hijack Captive Portals to Deliver PlugX Backdoor
Silk Typhoon used captive-portal AitM redirects to deliver a signed dropper that decrypts and side-loads a PlugX-variant backdoor, GTIG reports and blocks domains.
Cybersecurity
Farmers Insurance Data Breach Impacts 1.1 Million Customers in Salesforce Cyberattack
Farmers Insurance confirmed a third-party vendor database was breached on May 29, exposing PII for 1,111,386 customers in the wider Salesforce data theft campaign.
TOP CYBERSECURITY HEADLINES
Application Security
Ghost CMS CVE-2026-26980 Exploited in ClickFix Campaign
Application Security
Laravel Lang Supply Chain Attack Hijacks 700 Package Versions
This Week’s Security Spotlight
Application Security
Anthropic’s Project Glasswing Finds 10,000+ CVEs in One Month
Application Security
Trump Mobile Exposes 27,000 Customer Records via Insecure API
CVE Vulnerability Alerts
Cisco Secure Workload CVE-2026-20223 Earns CVSS 10.0
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Hackers Claim Attack on the US’s Biggest Sushi Supplier — Again?
Ransomware gang Lynx claims to have stolen True World Group data, posting invoices and employee records—raising fears of a new breach and business, identity risks.
FBI Issues Guidance as Fraudsters Pose as IC3 to Extort Victims
The FBI has issued a warning to the public about a cyber campaign impersonating the Internet Crime Complaint Center (IC3), using spoofed websites to trick ...
Fraudulent GitHub Repos Spread Atomic Stealer Malware Targeting macOS Users
A new cyber campaign is actively targeting macOS users with the Atomic Stealer (AMOS) malware, leveraging fake GitHub repositories disguised as legitimate software downloads. Security ...
Netskope’s IPO Raises $908M: SASE Leader Surges 18% on First Trading Day
Netskope, a California-based cybersecurity firm specializing in secure access service edge (SASE) solutions, has officially gone public in one of the largest cybersecurity IPOs of ...
SPLX Exposes AI Exploit: Prompt Injection Tricks ChatGPT Into Solving CAPTCHAs
A startling new report from AI security platform SPLX reveals how attackers can bypass the built-in guardrails of AI agents like ChatGPT through a sophisticated ...
Brussels, Berlin, London Hit Hard as Cyber Disruption Sparks Flight Chaos
A cyberattack on Collins Aerospace, a U.S.-based provider of passenger check-in and baggage handling software, plunged major European airports into chaos over the weekend. Beginning ...
Novakon Ignored Security Reports on ICS Weaknesses, Leaving 40,000+ Devices Exposed
A new security report has revealed serious, unpatched vulnerabilities in industrial control system (ICS) products manufactured by Novakon, a Taiwan-based subsidiary of iBASE Technology. Security ...
RevengeHotels Cybercrime Group Adopts AI and VenomRAT in Hotel Credit Card Theft Campaign
The cybercrime group known as RevengeHotels, also tracked as TA558, has launched a new wave of attacks against the hospitality sector, evolving its tactics with ...
ShadowLeak: Server-Side Data Theft Attack Discovered Against ChatGPT Deep Research
A groundbreaking new cyberattack dubbed ShadowLeak has been uncovered targeting ChatGPT’s Deep Research capability, marking a dangerous escalation in AI-related threats. Unlike prior exploits such ...
WatchGuard Firebox Vulnerability Could Let Hackers Take Over Networks
A new critical vulnerability, CVE-2025-9242, has been discovered in WatchGuard Firebox firewalls, putting thousands of networks worldwide at risk. The flaw stems from an out-of-bounds ...
How SystemBC’s 1,500 Infected VPS Servers Fuel Ransomware and Fraud
The SystemBC proxy botnet has quietly become one of the most persistent pillars of the cybercrime ecosystem. First detected in 2019, SystemBC is less about ...
Tiffany & Co. Data Breach Exposes Gift Card Details of 2,500+ Customers
Tiffany and Company, the iconic luxury jeweler under the LVMH umbrella, has confirmed a serious data breach impacting over 2,500 customers across the United States ...
Security Flaw in Yellow.ai Chatbot Allowed Cookie Theft and Account Hijacking
A critical flaw in Yellow.ai’s chatbot allowed malicious code injection and cookie theft, putting support agent accounts at risk. The vulnerability has been patched.
Russian Gang Claims Breach of U.S. Broadcaster; Executive Passport Exposed
Termite claims to have exfiltrated News-Press & Gazette data, posting screenshots that show a U.S. passport and employee contact records, heightening identity-theft concerns.
FBI Warns of UNC6040 and UNC6395 Threat Actors Targeting Salesforce
FBI warns that UNC6040 and UNC6395 are exploiting Salesforce through OAuth abuse and stolen tokens to steal corporate data, extort victims, and pivot into cloud ...
Retina Group of Florida and Hampton Regional Medical Center Report Patient Data Breaches
Retina Group of Florida and Hampton Regional Medical Center disclosed breaches exposing protected health information for approximately 153,000 patients; investigations, notifications, and monitoring are underway ...
Vietnam Credit Bureau Leak Claims Expose 160 Million Financial Records
ShinyHunters claims to sell 160 million CIC credit records from Vietnam. Researchers verified samples; authorities confirm a breach and opened an investigation.
Lakera’s Gandalf Network Joins Check Point in $300M AI Security Deal
In a major strategic move, Check Point Software Technologies has announced the acquisition of Lakera, a Zurich and San Francisco–based AI security firm founded by ...
Shai-Hulud Exposes Fragility of the Open-Source Software Supply Chain
A major supply chain attack is underway in the npm ecosystem. Dubbed Shai-Hulud, this worm-style campaign began with the compromise of the popular @ctrl/tinycolor package ...
ChatGPT Calendar Vulnerability Exposes User Emails in New AI Attack
A critical vulnerability has been uncovered in ChatGPT’s new calendar integration, exposing how attackers could exfiltrate sensitive user data—particularly emails—through a deceptively simple exploit. Security ...