Cyber Security News (RSS Feed)

World's #1 Premier Cybersecurity and Hacking News Portal

https://cybersecuritynews.com/

Public Key

npub13pstz4yme247djhn5cqs8wdrnwq26n5x8cvnt03dlep843la84ns0p5djv

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsgsc932jdu42lxete6vqgrhx3ehq9df6rruxf4hcklusn6cl7n6ecpz4mhxue69uhkummnw3ezuerpw3sju6rpw4esmptyxa

Publishing to

nostr.data.haus

Author Public Key

npub13pstz4yme247djhn5cqs8wdrnwq26n5x8cvnt03dlep843la84ns0p5djv

Show more details

Last Notes

2026-07-17 10:15:35 UTC

AWS Cost Explorer Bug Shows Trillion-Dollar Billing Estimates
AWS customers worldwide were startled after the AWS Billing and Cost Management Console and Cost Explorer began displaying extraordinarily high projected cloud costs. Some organizations reported estimated monthly bills reaching trillions of dollars, triggering budget alerts and prompting concerns over potential unauthorized AWS usage. AWS confirmed the issue through its Health Dashboard and AWS Support […]
The post https://cybersecuritynews.com/aws-cost-explorer-bug/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/aws-cost-explorer-bug/

2026-07-17 08:45:50 UTC

Top 10 Best Identity Threat Detection and Response (ITDR) Solutions in 2026
Identity has become the primary battleground of enterprise cybersecurity. Attackers increasingly bypass traditional defenses by stealing credentials, hijacking sessions, abusing privileged accounts, and exploiting misconfigurations across Active Directory, cloud platforms, SaaS applications, and non-human identities. Microsoft reported more than 7,000 password attacks per second in 2024, while compromised credentials remain among the most common—and slowest […]
The post https://cybersecuritynews.com/best-identity-threat-detection-and-response-solutions/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/best-identity-threat-detection-and-response-solutions/

2026-05-29 06:39:30 UTC

Malicious RVTools Installer Abuses Sectigo Certificate to Bypass SmartScreen Warnings
A trusted tool for VMware administrators has been weaponized. Attackers built a fake version of RVTools, a widely used utility for managing virtual infrastructure, and disguised it with a real digital certificate to slip past Windows security warnings without raising a flag. RVTools is a staple in enterprise environments. IT administrators rely on it daily […]
The post https://cybersecuritynews.com/malicious-rvtools-installer-abuses-sectigo-certificate/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/malicious-rvtools-installer-abuses-sectigo-certificate/

2026-05-28 08:37:42 UTC

Veeam Backup & Replication Tool Vulnerability Enables Privilege Escalation Attacks
Veeam has addressed a high-severity vulnerability in its Backup & Replication platform that could enable attackers to escalate privileges and gain deeper access to enterprise systems. The issue impacts Veeam Backup & Replication version 13.0.1.2067 and all earlier version 13 builds, prompting urgent patching recommendations for affected organizations. The vulnerability, tracked as CVE-2026-32996, affects the […]
The post https://cybersecuritynews.com/veeam-backup-replication-tool-vulnerability/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/veeam-backup-replication-tool-vulnerability/

2026-05-11 04:23:34 UTC

ODINI Malware Exploits CPU Magnetic Emissions to Breach Faraday-Shielded Air-Gapped Computers
ODINI is a sophisticated proof-of-concept malware capable of extracting sensitive information from air-gapped computers protected by Faraday cages. By modulating the targeted computer’s CPU workload to generate low-frequency magnetic fields, this covert channel successfully transmits data through advanced physical isolation barriers. Developed by a team led by Mordechai Guri at Israel’s Ben-Gurion University, the ODINI […]
The post https://cybersecuritynews.com/odini-malware-air-gapped-computers/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/odini-malware-air-gapped-computers/

2026-04-06 09:04:09 UTC

Hackers Using Fake “Microsoft Teams” Domains to Attack Users Via Malicious Payload
Cybercriminals are launching a sophisticated new wave of attacks using fake Microsoft Teams domains. According to recent threat intelligence shared by SEAL Org, hackers are actively tricking corporate users into downloading malicious payloads by mimicking the widely used communication platform. As Microsoft Teams remains an essential tool for remote and hybrid work environments, threat actors are […]
The post https://cybersecuritynews.com/hackers-using-fake-microsoft-teams-domains-attack-via-malicious-payload/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-using-fake-microsoft-teams-domains-attack-via-malicious-payload/

2026-04-06 07:12:12 UTC

A new Remote Access Trojan (RAT) called ResokerRAT has been found targeting Windows systems by abusing Telegram’s widely used Bot API to receive commands and send stolen data back to attackers. Unlike traditional malware that relies on custom command-and-control servers, this threat routes all communications through a trusted messaging platform, making it far harder for […]
The post https://cybersecuritynews.com/new-resokerrat-uses-telegram-bot/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/new-resokerrat-uses-telegram-bot/

2026-04-06 06:38:13 UTC

METATRON – Open-Source AI Penetration Testing Assistant Brings Local LLM Analysis to Linux
A new open-source penetration testing framework called METATRON is gaining attention in the security research community for its fully offline, AI-driven approach to vulnerability assessment. Built for Parrot OS and other Debian-based Linux distributions, METATRON combines automated reconnaissance tooling with a locally hosted large language model (LLM), eliminating the need for cloud connectivity, API keys, […]
The post https://cybersecuritynews.com/metatron-ai-penetration-testing/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/metatron-ai-penetration-testing/

2026-04-06 05:45:36 UTC

36 Malicious npm Strapi Packages Used to Deploy Redis RCE and Persistent C2 Malware
A coordinated supply chain attack has been uncovered targeting developers who build applications on Strapi, a widely used open-source content management system. Thirty-six malicious npm packages disguised as legitimate Strapi plugins were published to the npm registry, carrying payloads designed to exploit Redis for remote code execution, steal credentials, and establish persistent command-and-control access on […]
The post https://cybersecuritynews.com/36-malicious-npm-strapi-packages/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/36-malicious-npm-strapi-packages/

2026-04-06 03:44:11 UTC

CISA Adds TrueConf Vulnerability to KEV Catalog Following Active Exploitation
The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical vulnerability affecting TrueConf software to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2026-3502, this security flaw is currently facing active exploitation in the wild. The discovery has prompted federal agencies and private organizations to take immediate defensive action to secure their networks. […]
The post https://cybersecuritynews.com/cisa-trueconf-vulnerability-kev-catalog/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/cisa-trueconf-vulnerability-kev-catalog/

2026-04-06 03:41:09 UTC

2,000+ FortiClient EMS Instances Exposed Online Amid Active RCE Vulnerability Exploits in the Wild
The Shadowserver Foundation has issued an urgent warning to FortiClient Enterprise Management Server (EMS) administrators after identifying over 2,000 publicly accessible instances globally, two of which are now confirmed to be actively exploited through critical unauthenticated remote code execution (RCE) vulnerabilities. Two vulnerabilities, CVE-2026-35616 and CVE-2026-21643, both classified as unauthenticated RCE flaws, were exploited in […]
The post https://cybersecuritynews.com/forticlient-ems-instances-exposed-online/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/forticlient-ems-instances-exposed-online/

2026-04-04 13:04:09 UTC

Critical Fortinet FortiClient EMS 0-Day Vulnerability Actively Exploited in the Wild
Fortinet has issued an emergency hotfix after security researchers disclosed a critical zero-day vulnerability in FortiClient EMS that is already being actively exploited by threat actors. Tracked as CVE-2026-35616 and carrying a CVSSv3 score of 9.1 (Critical), the flaw enables unauthenticated attackers to bypass API authentication and authorization controls entirely, allowing them to execute arbitrary […]
The post https://cybersecuritynews.com/fortinet-forticlient-ems-0-day/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/fortinet-forticlient-ems-0-day/

2026-04-04 11:52:18 UTC

New Progress ShareFile Bugs Let Attackers Take Over Servers Without Logging In
A dangerous attack chain in Progress ShareFile that can allow attackers to take over exposed on-premises servers without first logging in. The issues affect customer-managed ShareFile Storage Zones Controller 5.x deployments, and Progress says customers should upgrade to version 5.12.4 or move to any 6.x release, which is not impacted. According to Progress and WatchTower, […]
The post https://cybersecuritynews.com/progress-sharefile-vulnerability/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/progress-sharefile-vulnerability/

2026-04-04 09:32:58 UTC

Hackers Weaponize Claude Code Leak to Spread Vidar and GhostSocks Malware
The cybersecurity community is on high alert following a massive source code leak from Anthropic. On March 31, 2026, the company accidentally exposed the complete source code for Claude Code, its flagship terminal-based coding assistant. The leak occurred due to a packaging error in a public npm package, which inadvertently included a JavaScript source map […]
The post https://cybersecuritynews.com/claude-code-leak-to-spread-vidar-and-ghostsocks-malware/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/claude-code-leak-to-spread-vidar-and-ghostsocks-malware/

2026-04-04 09:07:39 UTC

Top Node.js Maintainers Targeted in Sophisticated Social Engineering Scheme
A highly coordinated social engineering campaign is actively targeting top open-source developers in the Node.js and npm ecosystem. Following the recent compromise of the popular package Axios, which sees over 100 million weekly downloads, several high-impact software maintainers have reported similar attacks. Security researchers believe this is a strategic shift by advanced threat actors aiming […]
The post https://cybersecuritynews.com/top-node-js-maintainers-targeted-social-engineering-scheme/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/top-node-js-maintainers-targeted-social-engineering-scheme/

2026-04-04 06:10:56 UTC

Top 10 Best User Access Management Tools in 2026
User Access Management tools centralize control over user permissions and access, providing a unified platform to enforce consistent security policies across diverse systems and applications. They enhance security by implementing role-based access controls, monitoring user activity, preventing unauthorized access, mitigating potential risks, and safeguarding sensitive information. These tools support compliance efforts with detailed audit trails […]
The post https://cybersecuritynews.com/user-access-management-tools/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/user-access-management-tools/

2026-04-04 06:05:12 UTC

Top 10 Best VPN For Chrome in 2026
In ever-changing technology and networks, privacy is becoming increasingly difficult to achieve. People are so used to using the Internet and IoT devices that the sensitive data they share on the web has become a prime target for hackers or malicious actors. As we all know, data is crucial. Protecting data is vital since even […]
The post https://cybersecuritynews.com/best-vpn-for-chrome/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/best-vpn-for-chrome/

2026-04-04 04:15:21 UTC

LinkedIn Hidden Code Secretly Searches Your Browser for Installed Extensions
Every time you open LinkedIn in a Chrome-based browser, hidden JavaScript silently scans your computer for installed software without your knowledge, without your consent, and without a single word in LinkedIn’s privacy policy. A revealing investigation conducted by the European advocacy group Fairlinked e.V., under the campaign name “BrowserGate,” has uncovered what researchers describe as […]
The post https://cybersecuritynews.com/linkedin-code-collects-data/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/linkedin-code-collects-data/

2026-04-04 03:20:56 UTC

Anthropic Officially Ends Claude Subscriptions for Third-Party Tools Like OpenClaw
Anthropic has officially pulled the plug on third-party AI agent access to the Claude subscription, marking a significant shift in how users can leverage its models outside the company’s native ecosystem. According to Anthropic Claude Code exec Boris Cherny, starting today, April 4, at 12 p.m. PT (8 p.m. BST), Claude Pro and Max subscribers […]
The post https://cybersecuritynews.com/claude-ends-openclaw-subscriptions/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/claude-ends-openclaw-subscriptions/

2026-04-03 22:00:57 UTC

High-Stakes Security: Protecting the Digital Infrastructure of the Gaming Industry
The Growing Profile of Casino Targets The gaming industry has become a primary target for sophisticated cybercriminal groups. This interest is driven not only by the high volume of daily financial transactions but also by the vast repositories of sensitive personal data managed by these organizations. As traditional brick-and-mortar establishments transition into digital ecosystems, the […]
The post https://cybersecuritynews.com/high-stakes-security-protecting-the-digital-infrastructure-of-the-gaming-industry/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/high-stakes-security-protecting-the-digital-infrastructure-of-the-gaming-industry/

2026-04-03 17:02:42 UTC

14,000+ F5 BIG-IP APM Exposed Online as Attackers Actively Exploiting RCE Vulnerability
A critical security flaw in F5’s BIG-IP Access Policy Manager (APM) is currently under active exploitation, leaving thousands of enterprise networks at risk. The vulnerability, officially tracked as CVE-2025-53521, has sparked urgent warnings across the cybersecurity community after its impact was upgraded from a standard Denial-of-Service (DoS) to a severe Remote Code Execution (RCE) flaw. […]
The post https://cybersecuritynews.com/14000-f5-big-ip-apm-exposed-online/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/14000-f5-big-ip-apm-exposed-online/

2026-04-03 14:43:09 UTC

Kimsuky Deploys Malicious LNK Files to Deliver Python-Based Backdoor in Multi-Stage Attack
A North Korean threat group known as Kimsuky has been caught running a cyberattack campaign that uses malicious Windows shortcut files, known as LNK files, to quietly install a Python-based backdoor on victim systems. The attack stays hidden across multiple stages, making it harder for security tools to detect before the final payload reaches the […]
The post https://cybersecuritynews.com/kimsuky-deploys-malicious-lnk-files/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/kimsuky-deploys-malicious-lnk-files/

2026-04-03 14:22:41 UTC

Axios Maintainer Confirms The npm Compromise Was via a Targeted Social Engineering Attack
Two malicious versions of the popular JavaScript HTTP library Axios were briefly published to the npm registry on March 31, 2026. Each version carried a hidden dependency that installed a remote access trojan (RAT) across macOS, Windows, and Linux systems. The attack did not exploit a flaw in the Axios code itself. Instead, it targeted […]
The post https://cybersecuritynews.com/axios-maintainer-confirms-the-npm-compromise/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/axios-maintainer-confirms-the-npm-compromise/

2026-04-03 14:09:26 UTC

Hackers Abuse Trusted Platforms to Steal Bank Credentials From Philippine Users
A coordinated phishing campaign has been quietly targeting banking customers across the Philippines since early 2024, and it remains active today. The attackers are not relying on crude tricks — they are hiding behind widely trusted internet platforms to steal banking credentials and one-time passwords, then using them to drain victims’ accounts within minutes. The […]
The post https://cybersecuritynews.com/hackers-abuse-trusted-platforms/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-abuse-trusted-platforms/

2026-04-03 10:28:10 UTC

Hackers Use Phorpiex Botnet to Spread Ransomware, Sextortion, and Crypto-Clipping Malware
A botnet that has been running since 2011 is back in the spotlight — not because it is new, but because it keeps reinventing itself. Phorpiex, also known as Trik, has grown from a basic spam tool into a full-scale criminal platform capable of delivering ransomware, sending sextortion emails to millions of victims, and silently […]
The post https://cybersecuritynews.com/hackers-use-phorpiex-botnet-to-spread-ransomware/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-use-phorpiex-botnet-to-spread-ransomware/

2026-04-03 10:19:34 UTC

Hackers Use Venom Stealer to Turn ClickFix Lures Into Full Data Exfiltration Pipelines
A new malware has been quietly spreading across cybercrime networks, and security researchers say it is far more capable than most tools of its kind. Called Venom Stealer, this malware-as-a-service platform does not just harvest credentials — it builds an entire automated attack chain that begins with a simple social engineering trick and ends with […]
The post https://cybersecuritynews.com/hackers-use-venom-stealer/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-use-venom-stealer/

2026-04-03 09:19:57 UTC

Microsoft Forcing Upgrades to Unmanaged Windows 11, Version 24H2
Microsoft has officially begun force-upgrading unmanaged Windows 11 version 24H2 devices to version 25H2, marking the final phase of a staged rollout that relies on machine learning to determine device readiness. The move, confirmed in an updated Windows Release Health Dashboard entry, affects all Home and Pro edition devices not managed by IT departments. Starting […]
The post https://cybersecuritynews.com/microsoft-windows-11-24h2/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/microsoft-windows-11-24h2/

2026-04-03 08:50:19 UTC

Multiple TP-Link Vulnerabilities Let Attackers Trigger DoS and Crash Routers
Multiple high-severity vulnerabilities exist in TP-Link’s Tapo C520WS smart security cameras. If exploited, these vulnerabilities may allow adjacent attackers to trigger Denial-of-Service (DoS) conditions, crash the device, or completely bypass authentication. TP-Link has released urgent firmware updates to address these critical security gaps. When a security camera or connected router goes offline due to a […]
The post https://cybersecuritynews.com/tp-link-vulnerabilities-trigger-dos/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/tp-link-vulnerabilities-trigger-dos/

2026-04-03 07:38:26 UTC

Hackers Compromised 700+ Next.js Hosts by Exploiting React2Shell Vulnerability
A massive automated credential theft campaign is actively targeting web applications worldwide. Cybersecurity researchers at Cisco Talos have uncovered an operation by a hacker group tracked as UAT-10608, which has already compromised over 700 servers. The attackers are exploiting a critical security flaw known as React2Shell to gain access and steal highly sensitive data. The […]
The post https://cybersecuritynews.com/700-next-js-hosts-exploited/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/700-next-js-hosts-exploited/

2026-04-03 07:25:19 UTC

CERT-EU Confirms Trivy Supply Chain Attack Led to European Commission AWS Breach
The European Commission’s primary web platform, “europa.eu,” recently suffered a severe data breach stemming from a supply-chain compromise involving the popular open-source vulnerability scanner, Trivy. On April 3, 2026, CERT-EU published an official advisory detailing how a threat actor known as TeamPCP exploited the compromised continuous integration and continuous delivery (CI/CD) tool to harvest Amazon […]
The post https://cybersecuritynews.com/european-commission-breach-trivy/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/european-commission-breach-trivy/

2026-04-03 06:42:35 UTC

North Korea-Linked Hackers Compromise Axios npm Package in Major Supply Chain Attack
A North Korea-linked threat group has successfully hijacked one of the most widely used JavaScript libraries on the internet, injecting malware into millions of potential development environments. On March 31, 2026, attackers gained access to the Axios Node Package Manager (npm) package using stolen maintainer credentials, turning a trusted tool into a weapon against unsuspecting […]
The post https://cybersecuritynews.com/north-korea-linked-hackers-compromise-axios-npm-package/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/north-korea-linked-hackers-compromise-axios-npm-package/

2026-04-03 05:30:02 UTC

20 Best Application Performance Monitoring Tools in 2026
Applications’ performance and availability are monitored, measured, and optimized as part of the practice known as application performance monitoring (APM). Using APM tools and methodologies, organizations may diagnose issues that impair the user experience, discover performance bottlenecks, and gain visibility into how their applications operate. Application performance management (APM) involves monitoring several performance measures, including […]
The post https://cybersecuritynews.com/application-performance-monitoring-tools/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/application-performance-monitoring-tools/

2026-04-03 05:20:38 UTC

Best VPN For Linux In 2026
Linux users are known for prioritizing privacy, control, and performance — and in 2026, choosing the best VPN for Linux has become more important than ever. While Linux offers stronger security compared to other operating systems, it still doesn’t protect against ISP tracking, geo-restrictions, public Wi-Fi threats, or advanced surveillance. A reliable Linux VPN encrypts your internet […]
The post https://cybersecuritynews.com/best-vpn-for-linux/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/best-vpn-for-linux/

2026-04-02 16:58:08 UTC

How Elite SOCs Cut Escalation Rates by Arming Tier 1 With Better Threat Intelligence
In a mature Security Operations Center, escalation is supposed to work like a scalpel, precise, intentional, and reserved for alerts that genuinely demand deeper expertise. But across many teams today, it has become something far less disciplined: a reflex, a pressure valve, a way to pass uncertainty up the chain. The consequences are predictable. Tier […]
The post https://cybersecuritynews.com/reduce-soc-escalation-rates-tier-1-alert-triage/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/reduce-soc-escalation-rates-tier-1-alert-triage/

2026-04-02 16:15:03 UTC

Hackers Clone CERT-UA Site to Trick Victims Into Installing Go-Based RAT
A threat group recently set up a convincing fake version of Ukraine’s official cybersecurity authority website to trick targets into downloading a dangerous remote access tool. The campaign, now tracked under the identifier UAC-0255, relied on a mix of phishing emails and a cloned government website to push malware onto the computers of government workers, […]
The post https://cybersecuritynews.com/hackers-clone-cert-ua-site/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-clone-cert-ua-site/

2026-04-02 16:12:28 UTC

New Akira Lookalike Ransomware Campaign Targeting Windows Users in South America
A new and dangerous ransomware campaign has surfaced across South America, targeting Windows users with a carefully crafted strain that closely imitates the well-known Akira ransomware. While the two may appear nearly identical on the surface, this new threat is built on an entirely different foundation — one that quietly borrows from another notorious ransomware […]
The post https://cybersecuritynews.com/new-akira-lookalike-ransomware-campaign/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/new-akira-lookalike-ransomware-campaign/

2026-04-02 15:42:35 UTC

Qilin Ransomware Uses Malicious DLL to Kill Almost Every Vendor’s EDR Solutions
Qilin ransomware group is deploying a sophisticated, multi-stage infection chain via a malicious msimg32.dll that can disable over 300 endpoint detection and response (EDR) drivers from virtually every major security vendor. As organizations increasingly rely on EDR solutions, which offer far greater behavioral visibility than legacy antivirus, threat actors have adapted by weaponizing EDR killers […]
The post https://cybersecuritynews.com/qilin-ransomware-kill-edr/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/qilin-ransomware-kill-edr/

2026-04-02 14:54:30 UTC

OpenSSH 10.3 Fixes Shell Injection and Multiple SSH Security Issues
The OpenSSH project released version 10.3 and 10.3p1 on April 2, 2026, addressing a shell injection vulnerability and introducing several security-hardening changes that administrators should review before upgrading. The most notable security fix targets a shell injection vulnerability in the -J (ProxyJump) command-line option. Prior to this release, user and host names passed via -J […]
The post https://cybersecuritynews.com/openssh-10-3-release/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/openssh-10-3-release/

2026-04-02 14:53:54 UTC

Hackers Abuse DOCX, RTF, JS, and Python in Stealthy Boeing RFQ Malware Campaign
A seemingly routine procurement email has become the entry point for a sophisticated six-stage malware attack targeting industrial suppliers and procurement teams. The campaign, tracked as NKFZ5966PURCHASE, disguises itself as a Boeing Request for Quotation (RFQ) from a person named “Joyce Malave,” luring victims into opening a malicious Word document. Once opened, the file silently […]
The post https://cybersecuritynews.com/hackers-abuse-docx-rtf-js-and-python-in-boeing-rfq/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-abuse-docx-rtf-js-and-python-in-boeing-rfq/

2026-04-02 14:31:00 UTC

CISA Warns of Chrome 0-Day Vulnerability Actively Exploited in Attacks
A critical warning has been issued over a newly discovered zero-day vulnerability in Google Chrome, raising serious concerns for users worldwide. This flaw is actively exploited in the wild, allowing attackers to bypass security protections and execute malicious code, and was added to the Known Exploited Vulnerabilities (KEV) catalog on April 1, 2026. The discovery […]
The post https://cybersecuritynews.com/chrome-0-day-flaw-exploited/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/chrome-0-day-flaw-exploited/

2026-04-02 13:50:07 UTC

NoVoice on Google Play with 22 Exploits Attacks Millions of Android Users
A dangerous Android rootkit named NoVoice has been hiding inside over 50 apps on Google Play, compromising more than 2.3 million devices worldwide. Tracked as Operation NoVoice, the malware uses 22 exploits to take full control of a device without raising any alerts, making it one of the most destructive Android threats uncovered in recent […]
The post https://cybersecuritynews.com/novoice-on-google-play/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/novoice-on-google-play/

2026-04-02 11:54:43 UTC

Apple Expands iOS 18.7.7 Update to More Devices to Shield Users from DarkSword Exploit
Apple has taken the rare step of expanding the availability of iOS 18.7.7 and iPadOS 18.7.7 to a broader set of devices on April 1, 2026, pushing critical backported security patches to millions of users still running iOS 18 who remain exposed to DarkSword, a sophisticated, web-delivered exploit chain capable of silently stealing vast amounts […]
The post https://cybersecuritynews.com/apple-expands-ios-18-7-7-update/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/apple-expands-ios-18-7-7-update/

2026-04-02 11:27:45 UTC

New ZAP PTK Add-On Maps Browser-Based Security Findings as Native Alert Into ZAP
The OWASP Zed Attack Proxy (ZAP) team has rolled out version 0.3.0 of the OWASP PenTest Kit (PTK) add-on, introducing a transformative workflow upgrade for application security testing. This new release bridges the critical gap between traditional proxy-level scanning and modern client-side execution by mapping in-browser security findings directly into native ZAP alerts. ZAP has […]
The post https://cybersecuritynews.com/zap-ptk-add-on/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/zap-ptk-add-on/

2026-04-02 10:13:06 UTC

Cisco Smart Software Manager Vulnerability Let Attackers Execute Arbitrary Commands
Cisco has issued an urgent security warning regarding a critical vulnerability in its Smart Software Manager On-Prem (SSM On-Prem) platform. Enterprise organizations widely use this tool to manage their Cisco software licenses locally. Tracked as CVE-2026-20160, the flaw carries a near-perfect CVSS severity score of 9.8 out of 10. If exploited, it allows an unauthenticated, […]
The post https://cybersecuritynews.com/cisco-smart-software-manager-vulnerability/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/cisco-smart-software-manager-vulnerability/

2026-04-02 10:06:55 UTC

Oracle Lays Off 30,000 Employees to Ramp Up Investment in AI Technologies
Oracle has executed a massive workforce reduction, eliminating between 20,000 and 30,000 employees globally to free up cash flow for its aggressive artificial intelligence infrastructure investments. The layoffs, representing roughly 18% of its workforce, were communicated abruptly via email, highlighting the company’s urgent shift in financial strategy amid mounting debt. On Tuesday morning, up to […]
The post https://cybersecuritynews.com/oracle-lays-off-30000-employees/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/oracle-lays-off-30000-employees/

2026-04-02 09:35:10 UTC

FBI Warns of Chinese Mobile Apps May Expose User Data to Cyberattacks
Millions of Americans use mobile apps daily without thinking much about where their data actually goes. The Federal Bureau of Investigation has stepped forward to address that. On March 31, 2026, the FBI released a Public Service Announcement outlining serious data security risks connected to mobile applications developed by foreign companies — particularly those based […]
The post https://cybersecuritynews.com/fbi-warns-of-chinese-mobile-apps/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/fbi-warns-of-chinese-mobile-apps/

2026-04-02 09:16:31 UTC

TA416 Expands Espionage Operations Across Europe With Web Bug Recon and Malware Delivery
TA416 has returned to Europe with a fresh wave of espionage emails aimed at government and diplomatic staff. The campaign mixes quiet reconnaissance with malware delivery, showing how a patient threat actor can test who opens a message before sending a more dangerous follow-up. From mid-2025 into early 2026, the China-aligned group targeted diplomatic missions […]
The post https://cybersecuritynews.com/ta416-expands-espionage-operations-across-europe/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/ta416-expands-espionage-operations-across-europe/

2026-04-02 08:45:20 UTC

Microsoft Copilot Terms of Service Label Copilot is for Entertainment Purposes Only
Microsoft’s terms of service for its Copilot AI assistant include a notable disclaimer that has sparked renewed scrutiny from security and enterprise communities: the product is intended solely for entertainment purposes. According to the official Copilot terms of use, Microsoft explicitly states that Copilot can make mistakes, may not function as intended, and should not […]
The post https://cybersecuritynews.com/microsoft-copilot-terms-of-service/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/microsoft-copilot-terms-of-service/

2026-04-02 08:24:48 UTC

New WhatsApp Attack Chain Uses VBS Scripts, Cloud Downloads, and MSI Backdoors
A new malware campaign is actively using WhatsApp to deliver harmful files directly to Windows users, exploiting the widespread trust placed in everyday messaging apps. The threat actors send malicious Visual Basic Script (VBS) files through WhatsApp messages, knowing that users rarely question attachments from familiar platforms. Once a recipient runs one of these files, […]
The post https://cybersecuritynews.com/new-whatsapp-attack-chain-uses-vbs-scripts/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/new-whatsapp-attack-chain-uses-vbs-scripts/

2026-04-02 07:26:41 UTC

Critical Cisco IMC Vulnerability Let Attackers Bypass Authentication
Cisco has recently disclosed a critical security flaw affecting its Integrated Management Controller (IMC), prompting the release of urgent software updates. The vulnerability, officially tracked as CVE-2026-20093, has been assigned a critical Base CVSS score of 9.8, indicating the highest level of severity. This security weakness is located in the password change functionality of the […]
The post https://cybersecuritynews.com/cisco-imc-vulnerability-2/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/cisco-imc-vulnerability-2/

2026-04-02 07:06:06 UTC

Remcos RAT Infection Chain Hides Behind Obfuscated Scripts and Trusted Windows Binaries
Cybercriminals are getting better at hiding their tracks, and a recently uncovered Remcos RAT campaign is proof of that. This attack does not rely on a single malicious file dropped onto a system. Instead, it uses a carefully built, multi-stage chain that starts with a simple phishing email and ends with a full, in-memory system […]
The post https://cybersecuritynews.com/remcos-rat-infection-chain-hides-behind-obfuscated/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/remcos-rat-infection-chain-hides-behind-obfuscated/

2026-04-02 06:46:14 UTC

Symantec DLP Agent Vulnerability Let Attackers Escalate Privileges
A high-severity security flaw has been identified in the Symantec Data Loss Prevention (DLP) Agent for Windows. Tracked as CVE-2026-3991, this vulnerability allows a low-privileged local attacker to escalate their system privileges to the highest level. Security researcher Manuel Feifel discovered the flaw, and Broadcom has recently released patches to address the issue. The vulnerability […]
The post https://cybersecuritynews.com/symantec-dlp-agent-vulnerability/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/symantec-dlp-agent-vulnerability/

2026-04-02 06:28:12 UTC

Starbucks Breach – Attacks Allegedly Claim 10GB of Stolen Source Code
The threat group ShadowByt3s has claimed responsibility for a new cyberattack on Starbucks, allegedly stealing 10GB of proprietary source code and operational firmware. The data was reportedly scraped from a misconfigured Amazon S3 bucket named “sbux-assets” as part of a broader campaign targeting cloud vulnerabilities. A threat actor operating under the moniker “BlackVortex1” posted on […]
The post https://cybersecuritynews.com/starbucks-breach/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/starbucks-breach/

2026-04-02 05:39:50 UTC

10 Best VPN For Privacy In 2026
When it comes to privacy-focused VPNs, several providers stand out in 2026. NordVPN, based in Panama, offers robust security features including Double VPN, Onion over VPN, and an independently audited no-logs policy. Proton VPN, founded by CERN scientists and based in Switzerland, is known for its strong commitment to privacy and its Secure Core servers […]
The post https://cybersecuritynews.com/best-vpn-for-privacy/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/best-vpn-for-privacy/

2026-04-02 05:30:02 UTC

Top 20 Best Digital Forensic Tools in 2026
Digital forensic tools are specialized software designed to analyze, recover, and investigate data from digital devices. They help uncover crucial evidence in cybercrime investigations and legal proceedings. These tools can extract data from various sources, including computers, smartphones, and storage devices, ensuring comprehensive digital footprints and activities analysis. They offer features like data carving, metadata […]
The post https://cybersecuritynews.com/best-digital-forensic-tools/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/best-digital-forensic-tools/

2026-04-02 02:31:41 UTC

Vim Modeline Bypass Vulnerability Let Attackers Execute Arbitrary OS Commands
A newly discovered high-severity vulnerability in the popular Vim text editor exposes users to arbitrary command execution on the operating system. Tracked as CVE-2026-34982, the flaw relies on a modeline sandbox bypass that triggers when a victim opens a specially crafted file. Security researchers “dfwjj x” and Avishay Matayev identified a vulnerability chain that affects […]
The post https://cybersecuritynews.com/vim-modeline-bypass-vulnerability/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/vim-modeline-bypass-vulnerability/

2026-04-02 02:29:40 UTC

Public PoC Exploit Released for Nginx-UI Backup Restore Vulnerability
A critical security flaw has been disclosed in the Nginx-UI backup restore mechanism, tracked as CVE-2026-33026. This vulnerability allows threat actors to tamper with encrypted backup archives and inject malicious configurations during the restoration process. With a public Proof-of-Concept (PoC) exploit now available, unpatched deployments are at immediate risk of full system compromise. Cryptographic Flaw […]
The post https://cybersecuritynews.com/nginx-ui-backup-restore-vulnerability/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/nginx-ui-backup-restore-vulnerability/

2026-04-02 02:05:20 UTC

Microsoft to Remove EXIF Data for Images Shared on Teams
In a significant move to enhance corporate privacy and operational security, Microsoft has announced an important update for its Teams platform. As part of the March 2026 feature rollout, Microsoft Teams will now automatically remove EXIF metadata from all images shared across chats and channels. This privacy-by-default measure aims to protect users from unintentionally leaking […]
The post https://cybersecuritynews.com/microsoft-remove-exif-data-teams/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/microsoft-remove-exif-data-teams/

2026-04-01 17:13:13 UTC

Magecart Hackers Uses 100+ Domains to Hijack eStores Checkouts and Steal Card Data
A sophisticated and long-running Magecart campaign has been quietly operating for over 24 months, infecting e-commerce websites across at least 12 countries using more than 100 malicious domains to steal payment card data in real time and banks, not merchants, are bearing the heaviest financial blow. Security researchers at ANY.RUN has uncovered a large-scale Magecart […]
The post https://cybersecuritynews.com/magecart-hijack-estore-checkouts/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/magecart-hijack-estore-checkouts/

2026-04-01 13:06:14 UTC

Google Cloud’s Vertex AI platform Vulnerability Allow Attackers to Access Sensitive Data
Artificial intelligence agents are rapidly becoming integral to enterprise workflows, but they also introduce new attack surfaces. Security researchers recently uncovered a significant vulnerability within Google Cloud Platform’s Vertex AI Agent Engine. By exploiting default permission scoping, attackers could weaponize deployed AI agents into “double agents” that secretly exfiltrate data and compromise cloud infrastructure. Exploiting […]
The post https://cybersecuritynews.com/google-clouds-vertex-ai-platform-vulnerability/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/google-clouds-vertex-ai-platform-vulnerability/

2026-04-01 13:01:53 UTC

Hackers Actively Exploiting Critical WebLogic RCE Vulnerabilities in Attacks
A recent cybersecurity study reveals that threat actors are moving faster than ever to weaponize new software flaws. According to data collected from a high-interaction honeypot, hackers are actively exploiting a newly disclosed, maximum-severity vulnerability in Oracle WebLogic Server. The critical flaw, tracked as CVE-2026-21962, carries a CVSS score of 10.0. It allows unauthenticated attackers […]
The post https://cybersecuritynews.com/hackers-exploiting-weblogic-rce-vulnerabilities/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-exploiting-weblogic-rce-vulnerabilities/

2026-04-01 12:58:01 UTC

Russian Hackers Using Remote Access Toolkit “CTRL” for RDP Hijacking
A newly disclosed Russian-linked remote access toolkit called “CTRL” is being used to hijack Remote Desktop Protocol sessions and steal credentials from Windows systems. According to Censys ARC, the malware is a custom .NET framework that combines phishing, keylogging, reverse tunneling, and persistence into one attack chain. Censys ARC said the toolkit was discovered during […]
The post https://cybersecuritynews.com/ctrl-for-rdp-hijacking/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/ctrl-for-rdp-hijacking/

2026-04-01 12:53:43 UTC

New Chrome Zero-Day Vulnerability Actively Exploited in Attacks — Patch Now
Google has released an emergency security update for its Chrome browser, patching a zero-day vulnerability that is already being actively exploited in the wild. The Stable channel has been updated to version 146.0.7680.177/178 for Windows and Mac, and 146.0.7680.177 for Linux, with the rollout expected to reach all users over the coming days and weeks. […]
The post https://cybersecuritynews.com/chrome-zero-day-vulnerability-exploited/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/chrome-zero-day-vulnerability-exploited/

2026-04-01 12:32:24 UTC

HSBC India Asks Customers to use All-Uppercase Passwords
Beginning April 6, 2026, HSBC India will require its internet banking customers to enter their passwords in uppercase letters only. The mandate, communicated via official customer emails, has sparked widespread concern among technical experts regarding the bank’s credential storage practices and overall security posture. The Uppercase Migration According to the bank’s recent communications, customers must […]
The post https://cybersecuritynews.com/hsbc-india-uppercase-passwords/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hsbc-india-uppercase-passwords/

2026-04-01 12:21:06 UTC

Hackers Use EtherRAT and EtherHiding to Hide Malware Infrastructure on Ethereum
A sophisticated backdoor called EtherRAT is actively targeting organizations across multiple sectors by hiding its command infrastructure inside the Ethereum blockchain — a move that makes it uniquely hard to track and shut down. The malware runs on Node.js and gives attackers full remote control over compromised machines, enabling them to execute commands, steal cryptocurrency […]
The post https://cybersecuritynews.com/hackers-use-etherrat-and-etherhiding/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-use-etherrat-and-etherhiding/

2026-04-01 11:36:07 UTC

Hackers Push CrystalX Malware-as-a-Service Through Telegram With Stealer and RAT Features
A new and dangerous piece of malware has surfaced and is being marketed openly to cybercriminals through private Telegram channels. Named CrystalX, this Malware-as-a-Service (MaaS) platform combines a remote access trojan (RAT), credential stealer, keylogger, clipboard hijacker, spyware, and an unusual set of prankware tools into one capable package. Discovered in March 2026, the malware […]
The post https://cybersecuritynews.com/hackers-push-crystalx-malware-as-a-service/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-push-crystalx-malware-as-a-service/

2026-04-01 10:36:43 UTC

Cybersecurity Firm TAC Security Hits 10,000 Clients, Enters Top 5 in Global VM & AppSec
New York, New York, April 1st, 2026, CyberNewswire TAC Infosec, a global leader in cybersecurity (NSE: TAC), with presence across 100+ countries, announced a historic milestone by crossing 10,000 clients – 6,500+ of TAC Security and 3,500+ of CyberScope, since April 2024, delivering on its commitment to shareholders to achieve this by 2026. While building […]
The post https://cybersecuritynews.com/tac-security-10000-clients-top-5/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/tac-security-10000-clients-top-5/

2026-04-01 09:59:48 UTC

Windows 11 Emergency Update to Fix Installation Loop Issues
Microsoft just released an emergency out-of-band update to resolve a persistent installation failure affecting Windows 11 users. Released on March 31, 2026, update KB5086672 specifically targets systems running Windows 11 versions 25H2 and 24H2. This patch addresses a critical setup bug introduced in late March that prevented users from successfully applying recent system improvements and […]
The post https://cybersecuritynews.com/windows-11-emergency-update/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/windows-11-emergency-update/

2026-04-01 09:00:01 UTC

North Korean Hackers Compromise Widely Used Axios Package to Infect Windows, macOS, and Linux Systems
A major software supply chain attack has struck the JavaScript ecosystem after threat actors slipped a malicious dependency into the widely used axios NPM package. The poisoned releases, axios 1.14.1 and 0.30.4, pulled in plain-crypto-js and quietly delivered the WAVESHAPER.V2 backdoor to Windows, macOS, and Linux systems during installation. The incident is serious because axios […]
The post https://cybersecuritynews.com/north-korean-hackers-compromise-widely-used-axios-package/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/north-korean-hackers-compromise-widely-used-axios-package/

2026-04-01 08:48:26 UTC

Hackers Backdoor Telnyx Python SDK on PyPI to Steal Credentials Across Windows, macOS, and Linux
A threat actor group known as TeamPCP has been caught backdooring the Telnyx Python SDK on PyPI — a popular cloud communications library with over 700,000 downloads in February alone. On March 27, 2026, two malicious versions of the package, 4.87.1 and 4.87.2, were quietly published to the Python Package Index without any matching commits […]
The post https://cybersecuritynews.com/hackers-backdoor-telnyx-python-sdk-on-pypi/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-backdoor-telnyx-python-sdk-on-pypi/

2026-04-01 07:55:34 UTC

New npm Supply Chain Attack Uses undicy-http to Deploy Screen-Streaming RAT and Browser Injector
A malicious npm package named undicy-http has surfaced inside the Node.js developer ecosystem, quietly compromising machines of developers who mistakenly install it. The package impersonates undici, the official HTTP client library bundled with Node.js that handles millions of weekly downloads. Despite sharing a near-identical name, undicy-http contains zero HTTP client functionality. Instead, it launches a two-stage attack capable of stealing […]
The post https://cybersecuritynews.com/new-npm-supply-chain-attack-uses-undicy-http/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/new-npm-supply-chain-attack-uses-undicy-http/

2026-04-01 07:21:04 UTC

PNG Vulnerabilities Allow Attackers to Trigger Process Crashes, Leak Sensitive Information
Two high-severity vulnerabilities have been discovered in libpng, the widely used reference library for reading and writing PNG images. These flaws allow attackers to trigger process crashes, leak sensitive information, and potentially execute arbitrary code by convincing a system to process a crafted PNG file. The vulnerabilities affect any software that parses malformed images, making […]
The post https://cybersecuritynews.com/png-vulnerabilities/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/png-vulnerabilities/

2026-04-01 06:46:51 UTC

XLoader Malware Upgrades Obfuscation Tactics and Hides C2 Traffic Behind Decoy Servers
A well-known information-stealing malware called XLoader has received significant upgrades in its latest versions, making it considerably harder to detect and analyze than before. Originally derived from a malware family known as FormBook, which first surfaced in 2016, XLoader was rebranded and relaunched in early 2020, and since then, its developers have consistently pushed new […]
The post https://cybersecuritynews.com/xloader-malware-upgrades-obfuscation-tactics/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/xloader-malware-upgrades-obfuscation-tactics/

2026-04-01 04:31:16 UTC

Mercor AI Confirms Data Breach Following Lapsus$ Claims of 4TB Data Theft
Mercor AI has officially confirmed a severe data breach following claims by the notorious Lapsus$ hacking group that they stole 4 terabytes of sensitive company data. The incident, stemming from a recent supply chain attack on the open-source LiteLLM project, has exposed proprietary source code, internal databases, and massive amounts of user-verification data. The hacking […]
The post https://cybersecuritynews.com/mercor-ai-data-breach/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/mercor-ai-data-breach/

2026-04-01 04:04:58 UTC

Google Now Allows You to Change your @gmail.com Address in few Simple Steps
For over two decades, the permanence of a Google Account username has been a strict rule of the digital landscape. Many users found it frustrating to create new accounts and transfer data after outgrowing their childhood email addresses or changing their names. However, Google has recently updated its support documentation to announce that it will […]
The post https://cybersecuritynews.com/google-change-gmail-address/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/google-change-gmail-address/

2026-03-31 13:02:27 UTC

Hackers Weaponize Legitimate Windows Tools to Disable Antivirus Before Ransomware Attacks
Ransomware attacks have gone far beyond simple malicious code. Today, attackers operate with the precision of a well-planned business, using trusted Windows tools to quietly tear down defenses before ransomware even enters the picture. This shift has made modern ransomware campaigns harder to detect and significantly more damaging. The tools at the center of this […]
The post https://cybersecuritynews.com/hackers-weaponize-legitimate-windows-tools/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-weaponize-legitimate-windows-tools/

2026-03-31 12:39:05 UTC

A new remote access trojan known as ResokerRAT has come to light, using Telegram’s bot API as its core communication channel to silently monitor and control infected Windows machines. What makes this threat stand out is that it does not rely on a traditional command-and-control server. Instead, it misuses a widely trusted messaging platform to […]
The post https://cybersecuritynews.com/hackers-deploy-telegram-based-resokerrat/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-deploy-telegram-based-resokerrat/

2026-03-31 11:29:13 UTC

Anthropic’s Claude Code Source Code Reportedly Leaked Via Their npm Registry
Anthropic’s proprietary Claude Code CLI tool has had its full TypeScript source code inadvertently exposed through a misconfigured npm package, after a security researcher discovered a leaked .map file referencing the unobfuscated codebase stored on Anthropic’s own cloud infrastructure. On March 31, 2026, researcher Chaofan Shou made the disclosure public, posting: “Claude code source code […]
The post https://cybersecuritynews.com/claude-code-source-code-leaked/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/claude-code-source-code-leaked/

2026-03-31 10:40:56 UTC

CareCloud Data Breach – Hackers Accessed IT Infrastructure and Stole Patient Data
A prominent healthcare technology provider has formally disclosed a significant cybersecurity incident involving unauthorized access to its IT infrastructure. An unauthorized actor compromised one of the company’s electronic health record (EHR) systems, raising concerns over possible exposure of sensitive patient data. The security breach initially unfolded on March 16, 2026. The intrusion caused a temporary […]
The post https://cybersecuritynews.com/carecloud-data-breach/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/carecloud-data-breach/

2026-03-31 09:03:54 UTC

Apple New macOS Tahoe Feature Warns Users on ClickFix Attacks
Apple has introduced a new security mechanism in the macOS Tahoe 26.4 release candidate to protect users against social engineering campaigns known as ClickFix attacks. Discovered by users testing the latest OS build and highlighted in a popular Reddit post on r/MacOSBeta, the undocumented feature actively blocks the execution of potentially malicious commands pasted into […]
The post https://cybersecuritynews.com/clickfix-protection-macos-tahoe-26-4/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/clickfix-protection-macos-tahoe-26-4/

2026-03-31 08:58:33 UTC

CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in Attacks
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical vulnerability affecting Citrix NetScaler products. Identified as CVE-2026-3055, this security flaw has been officially added to CISA’s Known Exploited Vulnerabilities (KEV) catalog following confirmed evidence of active exploitation in the wild. Network defenders and system administrators are urged to take […]
The post https://cybersecuritynews.com/citrix-netscaler-vulnerability-exploited/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/citrix-netscaler-vulnerability-exploited/

2026-03-31 08:37:40 UTC

Cybercriminals Abuse IRS and Tax Filing Lures to Push Malware in New Campaigns
Tax season brings a reliable wave of phishing attacks, but 2026 has already shown a bigger and more organized push than in previous years. Cybercriminals are actively impersonating the Internal Revenue Service (IRS), national tax authorities, and company HR departments to trick people into installing malware or handing over login credentials. Over a hundred campaigns […]
The post https://cybersecuritynews.com/cybercriminals-abuse-irs-and-tax-filing-lures/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/cybercriminals-abuse-irs-and-tax-filing-lures/

2026-03-31 07:41:27 UTC

Hackers Deploy RoadK1ll Pivoting Malware to Turn Compromised Hosts Into Network Relays
A new piece of malware called RoadK1ll has been found silently converting compromised machines into controllable network relay points. Unlike most malware that arrives loaded with commands and attack tools, RoadK1ll is deliberately lean, built around one goal: giving attackers a reliable and silent path deeper into a network after initial compromise. That narrow focus […]
The post https://cybersecuritynews.com/hackers-deploy-roadk1ll-pivoting-malware/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/hackers-deploy-roadk1ll-pivoting-malware/

2026-03-31 04:09:17 UTC

Notepad++ v8.9.3 Released Addressing cURL Security Vulnerability and Crash Issues
Notepad++ has officially released version 8.9.3, delivering critical security patches, structural performance enhancements, and resolutions for persistent crash issues. This update finalizes the text editor’s transition to a highly optimized XML parser, addressing multiple recent regressions while fortifying the application’s auto-update mechanism against documented vulnerabilities. Notepad++ v8.9.3 Release The most notable security implementation in version […]
The post https://cybersecuritynews.com/notepad-v8-9-3-released/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/notepad-v8-9-3-released/

2026-03-31 03:39:45 UTC

Axios NPM Packages Compromised to Inject Malicious Codes in an Active Supply Chain Attack
A sophisticated supply chain attack has targeted Axios, one of the most heavily adopted HTTP clients within the JavaScript ecosystem, by introducing a malicious transitive dependency into the official npm registry. Serving as a critical component across frontend frameworks, backend microservices, and enterprise applications, Axios records approximately 83 million weekly downloads on npm. The compromise […]
The post https://cybersecuritynews.com/axios-npm-packages-compromised/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/axios-npm-packages-compromised/

2026-03-31 03:24:06 UTC

Claude AI Discovers Zero-Day RCE Vulnerabilities in Vim and Emacs
Anthropic’s Claude AI successfully discovered zero-day Remote Code Execution (RCE) flaws in both Vim and GNU Emacs. The discoveries highlight a massive paradigm shift in bug hunting, demonstrating that AI models can uncover critical vulnerabilities in legacy software with simple natural-language prompts. The Vim RCE: Compromise Upon File Open The research initiative began with a […]
The post https://cybersecuritynews.com/claude-ai-0-day-rce-vim/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/claude-ai-0-day-rce-vim/

2026-03-30 18:08:15 UTC

12 Best AWS Monitoring Tools in 2026
Amazon Web Services (AWS) is a cloud computing platform for businesses of all sizes and types. AWS’s architecture is robust and scalable, but dependability, performance, and security must be monitored. These aims guide AWS’s monitoring tools and services, which help you understand your cloud infrastructure and applications, analyze data, identify outliers, and maintain smooth operations. […]
The post https://cybersecuritynews.com/best-aws-monitoring-tools/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/best-aws-monitoring-tools/

2026-03-30 17:30:34 UTC

Exposed Server Reveals TheGentlemen Ransomware Toolkit, Victim Credentials, and Ngrok Tokens
A misconfigured server hosted on a Russian bulletproof hosting provider has exposed the complete operational toolkit of a TheGentlemen ransomware affiliate, including harvested victim credentials and plaintext authentication tokens used to establish hidden remote access tunnels. TheGentlemen ransomware group operates as a Ransomware-as-a-Service, or RaaS, operation where affiliates carry out attacks using shared tools and […]
The post https://cybersecuritynews.com/exposed-server-reveals-thegentlemen-ransomware-toolkit/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/exposed-server-reveals-thegentlemen-ransomware-toolkit/

2026-03-30 16:52:39 UTC

North Korean IT Worker Allegedly Used Stolen Identity and AI Resume in Job Application Scam
A suspected North Korean operative tried to sneak into a remote job at a cybersecurity firm by using a stolen identity, a fake AI-generated resume, and a VoIP phone number. The case, uncovered in June 2025, shows how North Korea’s state-sponsored IT worker scheme has grown more sophisticated and harder to spot without proper screening. […]
The post https://cybersecuritynews.com/north-korean-it-worker-allegedly-used-stolen-identity/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/north-korean-it-worker-allegedly-used-stolen-identity/

2026-03-30 16:30:44 UTC

CrySome RAT Emerges as Advanced .NET Malware With AV Killer and HVNC Capabilities
A new and dangerous piece of malware has surfaced in the threat landscape, and it is built to stay hidden, stay running, and stay in control of any system it infects. CrySome RAT is written in C# and targets the .NET ecosystem, giving attackers complete remote control over compromised Windows machines. From stealing passwords and […]
The post https://cybersecuritynews.com/crysome-rat-emerges-as-advanced-net-malware/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/crysome-rat-emerges-as-advanced-net-malware/

2026-03-30 16:01:26 UTC

New ClickFix Variant Uses Rundll32 and WebDAV to Evade PowerShell Detection
A new and more dangerous version of the ClickFix attack technique has been found actively targeting Windows users. Unlike older versions that used PowerShell or mshta to run malicious commands, this new variant takes a different path. It uses rundll32.exe and WebDAV, two built-in Windows components, to quietly deliver and execute harmful payloads without triggering […]
The post https://cybersecuritynews.com/new-clickfix-variant-uses-rundll32/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/new-clickfix-variant-uses-rundll32/

2026-03-30 14:28:09 UTC

New Homoglyph Attack Techniques Help Cybercriminals Spoof Trusted Domains
Cybercriminals have found a clever way to trick people by swapping real letters in website addresses with characters that look almost the same. These are called homoglyph attacks, and they are becoming a growing problem across the internet. A single character swap — like replacing a Latin “o” with a Greek omicron — can fool […]
The post https://cybersecuritynews.com/new-homoglyph-attack-techniques/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/new-homoglyph-attack-techniques/

2026-03-30 13:58:51 UTC

Open VSX’s New Scanner Vulnerability Allows Malicious Extension Goes Live
A serious security flaw was recently found in Open VSX, the extension marketplace used by popular code editors like Cursor and Windsurf, as well as the broader VS Code fork ecosystem. The vulnerability was found inside the platform’s newly introduced pre-publish scanning pipeline, a security layer built to check every extension before it becomes available […]
The post https://cybersecuritynews.com/open-vsxs-new-scanner-vulnerability/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/open-vsxs-new-scanner-vulnerability/

2026-03-30 13:11:55 UTC

BlankGrabber Stealer Uses Fake Certificate Loader to Hide Malware Delivery Chain
A Python-based information stealer known as BlankGrabber has been caught using a deceptive certificate loader trick to hide a multi-stage malware delivery chain. First identified in 2023, this threat has grown more complex over time and keeps targeting everyday users through widely used online platforms. BlankGrabber is designed to steal as much sensitive data as […]
The post https://cybersecuritynews.com/blankgrabber-stealer-uses-fake-certificate-loader/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/blankgrabber-stealer-uses-fake-certificate-loader/

2026-03-30 12:42:10 UTC

Stored XSS Bug in Jira Work Management Could Lead to Full Organization Takeover
A popular collaboration tool within the Atlassian ecosystem is widely used by organizations to track projects, manage approvals, and manage daily tasks. Recently, security researchers at Snapsec uncovered a critical Stored Cross-Site Scripting (XSS) vulnerability within the platform. By exploiting a seemingly low-risk configuration field, the team demonstrated how a low-privileged user could achieve a full […]
The post https://cybersecuritynews.com/stored-xss-bug-in-jira-work-management/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/stored-xss-bug-in-jira-work-management/

2026-03-30 12:29:26 UTC

CanisterWorm Malware Attacking Docker/K8s/Redis to Gain Access and Steal Secrets
A financially motivated cybercrime group has been quietly compromising cloud environments since late 2025, and its activities are now drawing serious concern across the security community. The group, known as TeamPCP, operates a self-propagating worm called CanisterWorm that hunts for poorly secured Docker APIs, Kubernetes clusters, Redis servers, and systems vulnerable to the React2Shell flaw. […]
The post https://cybersecuritynews.com/canisterworm-malware-attacking-docker/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/canisterworm-malware-attacking-docker/

2026-03-19 08:49:01 UTC

Iran-Linked Botnet Exposed After Open Directory Leak Reveals 15-Node Relay Network
A threat actor with ties to Iran has had their entire working infrastructure exposed after carelessly leaving an open directory on their own staging server, handing researchers a rare look into a live botnet operation. The leak revealed a 15-node relay network, a mass SSH deployment framework, DDoS tooling compiled on victim machines, and a […]
The post https://cybersecuritynews.com/iran-linked-botnet-exposed-after-open-directory-leak/ appeared first on https://cybersecuritynews.com.
https://cybersecuritynews.com/iran-linked-botnet-exposed-after-open-directory-leak/

2026-03-13 07:26:57 UTC

Chrome Zero-Day Vulnerabilities Actively Exploited in the Wild to Execute Malicious Code
Google has released an urgent security update for its Chrome browser after confirming that two high-severity zero-day vulnerabilities are being actively exploited in the wild. The stable channel has been updated to version 146.0.7680.75/76 for Windows and macOS, and 146.0.7680.75 for Linux, with the rollout expected to reach users over the coming days and weeks. […]
The post https://cybersecuritynews.com/chrome-zero-day-vulnerabilities-actively-exploited/
.
https://cybersecuritynews.com/chrome-zero-day-vulnerabilities-actively-exploited/

2026-03-13 03:21:00 UTC

OpenSSH GSSAPI Vulnerability Allow Attacker to Crash SSH Child Processes
A significant vulnerability in the GSSAPI Key Exchange patch was applied by numerous Linux distributions on top of their OpenSSH packages. The flaw, tracked as CVE-2026-3497, was uncovered by security researcher Jeremy Brown. It allows an attacker to crash SSH child processes reliably and potentially violates privilege separation boundaries, all with a single crafted network […]
The post https://cybersecuritynews.com/openssh-gssapi-vulnerability/
.
https://cybersecuritynews.com/openssh-gssapi-vulnerability/

2026-03-13 02:14:01 UTC

Meta Launches New Anti-Scam Tools on WhatsApp, Facebook and Messenger
Meta has launched a suite of advanced anti-scam tools across WhatsApp, Facebook, and Messenger to combat the growing industrialization of online fraud. These new defenses combine artificial intelligence, behavioral alerts, and global law enforcement partnerships to protect users proactively. To protect users from evolving social engineering tactics, Meta introduced specific warning mechanisms across its ecosystem. […]
The post https://cybersecuritynews.com/meta-new-anti-scam-tools/
.
https://cybersecuritynews.com/meta-new-anti-scam-tools/