Tag: cyber
-
Iranian Hacker Arrested Over Alleged $3.4 Billion Cyberattack on USA Infrastructure
An alleged Iranian hacker accused of hacking US infrastructure has been arrested in Montenegro following a joint operation by Montenegrin police and the U.S. Federal Bureau of Investigation (FBI). The suspect is expected to face charges related to computer fraud, hacking, conspiracy, and identity theft after authorities linked him to a years-long cyber campaign that…
-
KuinaExtractor Stealer Targets Browser Data, Crypto Wallets, Roblox, Steam, and Discord
A previously undocumented Rust-based infostealer they call KuinaExtractor, a family that has evolved from a capable early prototype into a hardened, stealth-focused threat now rebranded as “k0to.” Analysis of dozens of samples and function-level code comparisons reveals a clear single-operator lineage, steady feature expansion, and deliberate moves toward concealment rather than new capabilities. The actor’s…
-
WhatsApp Adds Security Warning Before Users Start Chat With Unknown Numbers
WhatsApp has introduced a new proactive security feature that warns users before they start conversations with unknown phone numbers. This update, currently being rolled out to both Android and iOS users, adds a trust verification layer at the very beginning of interactions, before a chat window is even opened. This marks a significant shift in…
-
Chinese-Speaking Hackers Deploy TinyRCT Backdoor Against Critical Energy Infrastructure
A Chinese-speaking threat cluster tracked as CL-STA-1062 has deployed a newly discovered .NET backdoor, TinyRCT, in targeted campaigns against government and critical energy infrastructure across Southeast Asia during 2025. The recent campaign combines common open-source tooling with bespoke malware. Operators consistently leverage publicly available utilities SoftEther VPN for tunneling, VNT and yuze for covert command-and-control,…
-
Mini Shai-Hulud Worm Poisons LeoPlatform npm Packages to Steal Developer and CI/CD Secrets
A fresh supply-chain wave tied to the Mini Shai-Hulud, Miasma, and Hades malware families is actively poisoning npm packages in the LeoPlatform and RStreams ecosystems and expanding into source-repository compromises. The intrusion blends registry poisoning, install-time execution via binding.gyp, Bun-staged JavaScript loaders, GitHub Actions abuse, and persistence hooks for IDEs and AI coding assistants an…
-
ChatGPT 5.6 Release Reportedly Delayed Following Trump Administration Security Request
OpenAI has reportedly delayed the full public release of its next-generation AI model, GPT-5.6, following a formal request from the Trump administration to limit early access to a select group of government-approved entities. This raises new concerns about the intersection of advanced AI capabilities and national security. According to a report by The Information on…
-
Windows Secure Boot Certificate Expiry Exposes Billions of PCs to Bootkit and Firmware Security Risks
Microsoft’s long-planned Secure Boot certificate rollover has reached a critical milestone, impacting more than just routine updates. The Microsoft Corporation KEK CA 2011 expired on June 24, 2026, the Microsoft UEFI CA 2011 expires on June 27, 2026, and the Microsoft Windows Production PCA 2011 is scheduled to expire on October 19, 2026. This requires…
-
CISA Adds Actively Exploited Cisco Unified CM Flaws to KEV Catalog
Tags: cisa, cisco, communications, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, risk, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting Cisco Unified Communications Manager (Unified CM) to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting active exploitation risks in enterprise communication environments. The newly listed flaw, tracked as CVE-2026-20230, involves a server-side request forgery (SSRF) vulnerability in Cisco Unified CM and Unified…
-
Mini Shai-Hulud Worm Poisons LeoPlatform npm Packages to Steal Developer and CI/CD Secrets
A fresh supply-chain wave tied to the Mini Shai-Hulud, Miasma, and Hades malware families is actively poisoning npm packages in the LeoPlatform and RStreams ecosystems and expanding into source-repository compromises. The intrusion blends registry poisoning, install-time execution via binding.gyp, Bun-staged JavaScript loaders, GitHub Actions abuse, and persistence hooks for IDEs and AI coding assistants an…
-
Healthcare leaders see a fatal cyber incident as inevitable
Healthcare practices run on a chain of outside vendors. An EMR system holds clinical records, a billing platform processes claims, a telehealth tool supports remote visits, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/26/cyber-incident-healthcare-vendor-risk/
-
Hackers Use Malicious Minecraft Fabric Mods to Deploy LoaderClient and WeedHack Stealer
Hackers are weaponizing malicious Minecraft Fabric mods to deliver LoaderClient. This stage-one malware loader steals session data and hands it off to the WeedHack stealer through a fileless, blockchain-backed execution chain. The campaign stands out for its use of EtherHiding, where the command-and-control URL is pulled from an Ethereum smart contract instead of a conventional…
-
Agentic AI Pentesting Platforms Comparison
Agentic AI transforms Penetration Testing from a periodic consulting practice to a continuous validation discipline. While traditional pentests remain relevant, particularly for complex business logic or regulated environments, the rapid evolution of cloud-native systems necessitates more frequent evaluations. Between formal tests, new services, exposed APIs, identity permissions and misconfigurations can emerge, leaving security teams with…
-
Shai-Hulud Hades Payload Hits 20 Leo/RStreams npm Packages in Fresh Supply Chain Attack
A fresh supply-chain wave by the Shai-Hulud/Hades family that infected 20 npm packages in the Leo/RStreams ecosystem, an AWS-native event streaming SDK widely used for Kinesis, Firehose, Lambda and S3-based pipelines. The malicious releases were detected shortly after publication and, while not a dramatic redesign of prior Hades/Miasma variants, demonstrate the malware family’s continued operational…
-
Langflow RCE Flaw Lets Attackers Execute Arbitrary Python Code Without Authentication
Tags: ai, authentication, cve, cyber, data-breach, exploit, flaw, framework, open-source, rce, remote-code-execution, vulnerabilityA critical unauthenticated remote code execution (RCE) vulnerability in Langflow, tracked as CVE-2026-33017, is being actively exploited in the wild within hours of its disclosure. This vulnerability allows attackers to execute arbitrary Python code on exposed instances without any authentication. It affects the widely used open-source AI workflow framework designed for building large language model…
-
Curl 8.21.0 Released With 18 Security Fixes
The curl project has announced the release of version 8.21.0, marking its 275th release and including a significant security update. This version addresses 18 newly disclosed vulnerabilities, reflecting an unusually high volume of security reports. Project maintainer Daniel Stenberg announced on June 24, 2026. This release sets a record for the number of vulnerabilities addressed…
-
Hackers Abuse Cloudflare-Hosted AWS Phishing Domains to Steal Console Logins
A concise but sophisticated phishing campaign that targeted AWS console users by abusing Cloudflare-hosted domains to deliver adversary-in-the-middle (AiTM) credential theft. Each domain served an almost identical clone of the AWS console sign-in page and implemented a server-driven flow that dynamically branched into email, SMS, or authenticator-app MFA challenges, enabling real-time capture of second factors.…
-
Google Chrome Update Patches 18 Security Flaws, Including Critical WebGL and Autofill Vulnerabilities
Google has released Chrome version 149.0.7827.196/197 for Windows and macOS, and version 149.0.7827.196 for Linux. This update addresses 18 security vulnerabilities, including several critical memory safety flaws in the WebGL and Autofill components. The announcement was made on June 23, 2026, and the update is being rolled out gradually over the coming days and weeks.…
-
DPRK-Linked macOS Implant Uses LaunchAgent Persistence and Python Stealer Module
The binary tracked as macOS.Gaslight as a Rust-based macOS implant and infostealer whose most novel features are analyst-directed prompt injection and a hardened Telegram-based command-and-control (C2) channel. We assess with high confidence that macOS.Gaslight aligns with DPRK-linked macOS activity clustered around BONZAI and AIRPIPE signatures. macOS.Gaslight is ad hoc signed, carries the identifier endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea, and…
-
macOS Flaw Lets Standard Users Disable EDR and MDM
macos-xpc-flaw-disable-edr-mdm-standard-user-xm-cyber First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/macos-xpc-flaw-disable-edr-mdm/
-
Commvault, Microsoft partner to bring cyber resilience services natively to Azure
First seen on scworld.com Jump to article: www.scworld.com/brief/commvault-microsoft-partner-to-bring-cyber-resilience-services-natively-to-azure
-
Commvault, Microsoft partner to bring cyber resilience services natively to Azure
First seen on scworld.com Jump to article: www.scworld.com/brief/commvault-microsoft-partner-to-bring-cyber-resilience-services-natively-to-azure
-
Scoring AI hackers when there is no answer key
AI models are solving more and more of the offensive-cyber tests built to measure them. Once a model solves most of a benchmark, that benchmark runs out of room and says … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/25/ai-offensive-cyber-evaluations-benchmark/
-
What your next cyber insurance renewal will demand
In this Help Net Security video, Michael Loewy, co-founder, Tide Foundation, explains how cyber insurance is rewriting security programs at renewal time. Insurers want more … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/25/cyber-insurance-controls-video/
-
ManageEngine AD360 Integrated Products Hit by Account Takeover Vulnerability
ManageEngine has disclosed a critical account takeover vulnerability, tracked as CVE-2026-11374, affecting various integrated products within its AD360 identity and access management suite. The flaw affects ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus when used with AD360 and via single sign-on (SSO) integration. This vulnerability stems from predictable SSO ticket generation, which…
-
LokiBot Malware Uses API Hashing and 3DES-Encrypted C2 to Hide Infostealer Activity
LokiBot, a long-lived infostealer first advertised in May 2015, continues to evolve. Recent samples demonstrate deliberate attempts to evade static detection and frustrate analysis by combining API hashing with 3DES-encrypted command-and-control (C2) configuration stored inside the binary. The result is a compact, stealthy loader that reconstructs and executes a traditional LokiBot payload while limiting observable…
-
Gemini 3.5 Flash Now Supports Agentic Computer Use for Enterprise Automation Tasks
Google has announced a significant enhancement to its AI platform with the release of Gemini 3.5 Flash, which now includes native support for agentic computer use. This new feature enables advanced enterprise automation across web, desktop, and mobile environments. Introduced on June 24, 2026, this capability was previously limited to the standalone Gemini 2.5 computer-use…
-
UK’s cultural institutions failing on cyber security, warns PAC
The UK’s national museums and galleries have failed to heed the lessons of high-profile cyber attacks and remain highly vulnerable. The Public Accounts Committee is calling on DCMS to do more to help. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366645049/UKs-cultural-institutions-failing-on-cyber-security-warns-PAC
-
UK’s cultural institutions failing on cyber security, warns PAC
The UK’s national museums and galleries have failed to heed the lessons of high-profile cyber attacks and remain highly vulnerable. The Public Accounts Committee is calling on DCMS to do more to help. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366645049/UKs-cultural-institutions-failing-on-cyber-security-warns-PAC