Tag: cyber
-
Criminal IP at Infosecurity Europe 2026: Introducing AITEM, the Next Chapter of Attack Surface Management
Torrance, United States / California, June 11th, 2026, CyberNewswire Criminal IP by AI SPERA, a cyber threat intelligence platform delivering decision-ready intelligence and attack surface visibility to security teams worldwide, participated in Infosecurity Europe 2026 at ExCeL London this week, marking the company’s second consecutive appearance at Europe’s leading cybersecurity event. Alongside live demonstrations of…
-
The FBI built its own replica small town to simulate real-world cyberattacks
Hidden inside a building in Alabama, the FBI has created its own small town as a dedicated cyber training ground for simulating cyberattacks. First seen on techcrunch.com Jump to article: techcrunch.com/2026/06/13/the-fbi-built-its-own-replica-small-town-to-simulate-real-world-cyberattacks/
-
The FBI built its own replica small town to simulate real-world cyberattacks
Hidden inside a building in Alabama, the FBI has created its own small town as a dedicated cyber training ground for simulating cyberattacks. First seen on techcrunch.com Jump to article: techcrunch.com/2026/06/13/the-fbi-built-its-own-replica-small-town-to-simulate-real-world-cyberattacks/
-
New Agentjacking Attack Hijacks AI Coding Agents to Execute Malicious Code
A newly disclosed Agentjacking attack class can silently weaponize AI coding agents against the very developers who rely on them, requiring no phishing, no server compromise, and no user interaction beyond a developer’s normal workflow of asking their AI assistant to investigate errors. Tenet Security’s Threat Labs developed and validated the technique, demonstrating how a…
-
Critical Splunk Enterprise Pre-Auth RCE Chain Exposes Databases
Tags: api, authentication, cve, cvss, cyber, flaw, rce, remote-code-execution, service, vulnerabilityA critical pre-authentication remote code execution (RCE) vulnerability in Splunk Enterprise has been disclosed, carrying a near-perfect CVSS score of 9.8. Tracked asCVE-2026-20253, the flaw was published by Splunk on June 10, 2026, and affects thePostgreSQL Sidecar Serviceintroduced in Splunk version 10. The root cause of CVE-2026-20253 lies in the PostgreSQL Sidecar Service’s HTTP API…
-
Critical Splunk Enterprise Pre-Auth RCE Chain Exposes Databases
Tags: api, authentication, cve, cvss, cyber, flaw, rce, remote-code-execution, service, vulnerabilityA critical pre-authentication remote code execution (RCE) vulnerability in Splunk Enterprise has been disclosed, carrying a near-perfect CVSS score of 9.8. Tracked asCVE-2026-20253, the flaw was published by Splunk on June 10, 2026, and affects thePostgreSQL Sidecar Serviceintroduced in Splunk version 10. The root cause of CVE-2026-20253 lies in the PostgreSQL Sidecar Service’s HTTP API…
-
How Security Debt Can Accumulate Faster Than Technical Debt
Security debt sounds like a tidy metaphor until the first breach turns it into a billing department with teeth. Technical debt behaves like clutter. Code gets ugly, builds slow down, developers complain, and deadlines wobble. Security debt behaves like contagion. One weak credential policy, one forgotten admin panel, and one logging gap cause the system…
-
Malicious 152 Chrome Extensions Caught Spoofing Google Organic Search Traffic
A massive, coordinated network of 152 malicious Google Chrome browser extensions has been dismantled after researchers caught the operation generating fake organic Google search traffic. Socket’s Threat Research Team discovered the operation spanning 38 separate Chrome Web Store publisher accounts and tracing back to three primary brand backends: tabplugins[.]com, yowgames[.]com, and chromewallpaper[.]com. Disguised as benign…
-
Anthropic Blocks Fable 5 and Mythos 5 Following U.S. National Security Directive
Anthropic has disabled all access to its Fable 5 and Mythos 5 artificial intelligence models following a sudden export-control directive from the United States government. Issued at 5:21 PM ET on June 13, 2026, the directive cited pressing national security concerns and strictly prohibited any foreign national from accessing the models. This restriction extends beyond…
-
Anthropic launches $15 million cyber defense program for state and local governments
First seen on scworld.com Jump to article: www.scworld.com/brief/anthropic-launches-15-million-cyber-defense-program-for-state-and-local-governments
-
How autonomous defense and remediation stands up to AI cyber threats
First seen on scworld.com Jump to article: www.scworld.com/perspective/how-autonomous-defense-and-remediation-stands-up-to-ai-cyber-threats
-
CISO role changes as cyber-risk appetites in the C-suite grow
As cybersecurity fears in the C-suite wane, the cyber-risk appetites of executives and boards are changing. Find out what it means for cybersecurity spending and the CISO role. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366644003/CISO-role-changes-as-cyber-risk-appetites-in-the-C-suite-grow
-
CISO role changes as cyber-risk appetites in the C-suite grow
As cybersecurity fears in the C-suite wane, the cyber-risk appetites of executives and boards are changing. Find out what it means for cybersecurity spending and the CISO role. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366644003/CISO-role-changes-as-cyber-risk-appetites-in-the-C-suite-grow
-
Anthropic Limits on OT Access to Mythos Draw Criticism
More OT Companies Ushered Into Project Glasswing. Anthropic has finally lifted the velvet rope and allowed a small handful of operational technology companies to join Project Glasswing, its invitation-only club whose members get access to Mythos, the most cyber-capable of the frontier lab’s large language models. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/anthropic-limits-on-ot-access-to-mythos-draw-criticism-a-31959
-
France accuses Israeli firm of interfering in Scottish elections and targeting SNP
Cyber agency says BlackCore targeted John Swinney, as well as interfering in France, New York and elsewhereFrance’s cyber-security agency has accused an Israeli firm called BlackCore of interfering in the Scottish elections earlier this year by targeting the first minister, John Swinney.The disinformation detection agency <a href=”https://www.sgdsn.gouv.fr/viginum”>Viginum said BlackCore had used proxy social media accounts…
-
The Cyber Express Weekly Roundup: AI Security Controls, Major Patch Releases, Public Sector Audits, and Emerging Online Scams
Tags: ai, control, cyber, cybercrime, cybersecurity, governance, government, risk, risk-management, scam, technology, threat, update, vulnerabilityThis week’s cybersecurity developments highlight a growing emphasis on proactive security measures, governance oversight, and risk management across both public and private sectors. From large-scale vulnerability remediation efforts and AI security enhancements to government-led technology reviews and event-driven cybercrime campaigns, organizations continue to face a complex threat landscape. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/tce-weekly-roundup-cybersecurity-ai/
-
GRU-Linked APT28 Uses MooBot Botnet and Compromised EdgeRouters for Cyber Operations
A notable operational pivot by the GRU-linked intrusion set APT28 (aka Fancy Bear, Sofacy, Forest Blizzard, Pawn Storm) that combines the MooBot botnet and compromised EdgeRouters to enable resilient cyber operations. This shift amplifies APT28’s long-standing focus on NATO, Ukrainian and critical-infrastructure targets by moving key capabilities from traditional cloud VPS and commodity hosting into…
-
Hackers Use Typosquatted npm Packages to Target Web3 Projects and Crypto Wallet Operators
Hackers have been using typosquatting npm packages to weaponize the trust Web3 teams place in open-source dependencies, turning routine installs into a path for wallet theft, secret harvesting, and staged malware delivery. The campaign is especially dangerous because it blends familiar Ethereum and blockchain branding with postinstall and preinstall abuse, allowing malicious code to execute…
-
Over 80% of Sports Organizations Targeted by Hackers in the Last Year
As the FIFA World Cup 2026 kicks off, a new Darktrace report warns that sports teams and bodies are a major target for cyber criminals First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/sports-organizations-targeted-by/
-
Attackers Can Exploit Microsoft Outlook and Word Flaws to Run Malicious Code
Microsoft has disclosed a set of critical remote code execution (RCE) vulnerabilities affecting Outlook and Word that could allow attackers to execute arbitrary code on targeted systems. The flaws, tracked as CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635, were released on June 9, 2026, and carry high severity ratings with CVSS scores of 8.4. Security researchers warn that…
-
Palo Alto PAN-OS Flaw Lets Attackers Run Arbitrary Commands With Root Privileges
Palo Alto Networks has released patches for three new PAN-OS vulnerabilities that could allow authenticated administrators or users to execute arbitrary commands with root privileges or force firewalls into repeated reboots, raising operational and security concerns for enterprises relying on PA-Series and VM-Series appliances. PAN-OS Root Command Injection via CLI and Web UI (CVE-2026-0273) CVE-2026-0273…
-
OnyxC2 Stealer Uses Cloudflare-Fronted C2 to Exfiltrate Browser Data and Credentials
A new commercial-grade information stealer, marketed as OnyxC2, surfaced on cybercrime forums in early 2026 and demonstrates how commodity malware is increasingly packaged as a full-service product. For $250 a month buyers receive a web-based control panel, a payload builder, tiered licensing, and even refund guarantees if a build is detected lowering the barrier for…
-
Tchap Messenger Hack Exposes Data of Over 73,000 French Government Employees
A suspected cyberattack targeting Tchap, the secure messaging platform used by French government agencies, has reportedly exposed sensitive data belonging to more than 73,000 government employees. According to threat intelligence reports shared by the ThreatMon monitoring account, a threat actor claims to have exfiltrated approximately 13.5 GB of internal data, covering nearly three years of…
-
OnyxC2 Stealer Uses Cloudflare-Fronted C2 to Exfiltrate Browser Data and Credentials
A new commercial-grade information stealer, marketed as OnyxC2, surfaced on cybercrime forums in early 2026 and demonstrates how commodity malware is increasingly packaged as a full-service product. For $250 a month buyers receive a web-based control panel, a payload builder, tiered licensing, and even refund guarantees if a build is detected lowering the barrier for…
-
Hackers Use UAE-India Diplomatic Lure to Deliver SHEETCREEP RAT via Google Sheets
An active espionage campaign tracked as SHEETCREEP that leverages a UAE”‘India diplomatic-themed ISO lure to deliver a compact C# remote access trojan (RAT) and uses Google Sheets as its command-and-control (C2) channel. The ISO, named UAE-India_Strategic_Partnership_Week.iso, contains a deceptively iconized LNK file that launches a C# dropper. The dropper extracts a decoy PDF to temp,…
-
Authorities Seize AudiA6 Crypto Laundering Service Used by Cybercriminal Gangs
Tags: crypto, cyber, cybercrime, finance, infrastructure, international, network, ransomware, serviceAuthorities have dismantled a major cryptocurrency laundering infrastructure known as “AudiA6,” disrupting a critical financial backbone used by ransomware gangs and cybercriminal networks to legitimize illicit proceeds. The coordinated international operation, supported by Europol and Eurojust, targeted a service believed to have laundered more than EUR 336 million between 2022 and 2025, marking one of…
-
Microsoft Teams Android Flaw Could Let Attackers Disclose Sensitive Information
Microsoft has disclosed a high-severity information disclosure vulnerability affecting its Teams application for Android, tracked as CVE-2026-42835. The flaw, publicly released on June 9, 2026, has been assigned a CVSS v3.1 base score of 8.1, categorizing it as an “Important” severity issue. According to Microsoft’s advisory, the vulnerability stems from improper neutralization of special elements…
-
Researcher Uses AI to Hack Google, Earns $500,000 Bug Bounty
Tags: access, ai, api, attack, bug-bounty, control, cyber, flaw, framework, google, infrastructure, service, vulnerabilityResearcher Arvin Shivram has earned $500,000 in bug bounties from Google’s Vulnerability Reward Program (VRP) by deploying an AI-powered fuzzing framework against Google’s internal API infrastructure, uncovering critical access-control flaws across multiple high-impact services in under 3 months. The research began after Shivram was invited to bugSWAT Mexico in October 2025, which reignited his interest in Google’s attack surface. Recognizing that…
-
Researcher Uses AI to Hack Google, Earns $500,000 Bug Bounty
Tags: access, ai, api, attack, bug-bounty, control, cyber, flaw, framework, google, infrastructure, service, vulnerabilityResearcher Arvin Shivram has earned $500,000 in bug bounties from Google’s Vulnerability Reward Program (VRP) by deploying an AI-powered fuzzing framework against Google’s internal API infrastructure, uncovering critical access-control flaws across multiple high-impact services in under 3 months. The research began after Shivram was invited to bugSWAT Mexico in October 2025, which reignited his interest in Google’s attack surface. Recognizing that…