Nostr notes by Cyber Security News (RSS Feed)

AWS Cost Explorer Bug Shows Trillion-Dollar Billing Estimates AWS ...

2026-07-17T10:15:35Z

AWS Cost Explorer Bug Shows Trillion-Dollar Billing Estimates

AWS customers worldwide were startled after the AWS Billing and Cost Management Console and Cost Explorer began displaying extraordinarily high projected cloud costs. Some organizations reported estimated monthly bills reaching trillions of dollars, triggering budget alerts and prompting concerns over potential unauthorized AWS usage. AWS confirmed the issue through its Health Dashboard and AWS Support […]

The post https://cybersecuritynews.com/aws-cost-explorer-bug/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/aws-cost-explorer-bug/

Top 10 Best Identity Threat Detection and Response (ITDR) ...

2026-07-17T08:45:50Z

Top 10 Best Identity Threat Detection and Response (ITDR) Solutions in 2026

Identity has become the primary battleground of enterprise cybersecurity. Attackers increasingly bypass traditional defenses by stealing credentials, hijacking sessions, abusing privileged accounts, and exploiting misconfigurations across Active Directory, cloud platforms, SaaS applications, and non-human identities. Microsoft reported more than 7,000 password attacks per second in 2024, while compromised credentials remain among the most common—and slowest […]

The post https://cybersecuritynews.com/best-identity-threat-detection-and-response-solutions/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-identity-threat-detection-and-response-solutions/

Malicious RVTools Installer Abuses Sectigo Certificate to Bypass ...

2026-05-29T06:39:30Z

Malicious RVTools Installer Abuses Sectigo Certificate to Bypass SmartScreen Warnings

A trusted tool for VMware administrators has been weaponized. Attackers built a fake version of RVTools, a widely used utility for managing virtual infrastructure, and disguised it with a real digital certificate to slip past Windows security warnings without raising a flag. RVTools is a staple in enterprise environments. IT administrators rely on it daily […]

The post https://cybersecuritynews.com/malicious-rvtools-installer-abuses-sectigo-certificate/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/malicious-rvtools-installer-abuses-sectigo-certificate/

Veeam Backup & Replication Tool Vulnerability Enables ...

2026-05-28T08:37:42Z

Veeam Backup & Replication Tool Vulnerability Enables Privilege Escalation Attacks

Veeam has addressed a high-severity vulnerability in its Backup & Replication platform that could enable attackers to escalate privileges and gain deeper access to enterprise systems. The issue impacts Veeam Backup & Replication version 13.0.1.2067 and all earlier version 13 builds, prompting urgent patching recommendations for affected organizations. The vulnerability, tracked as CVE-2026-32996, affects the […]

The post https://cybersecuritynews.com/veeam-backup-replication-tool-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/veeam-backup-replication-tool-vulnerability/

ODINI Malware Exploits CPU Magnetic Emissions to Breach ...

2026-05-11T04:23:34Z

ODINI Malware Exploits CPU Magnetic Emissions to Breach Faraday-Shielded Air-Gapped Computers

ODINI is a sophisticated proof-of-concept malware capable of extracting sensitive information from air-gapped computers protected by Faraday cages. By modulating the targeted computer’s CPU workload to generate low-frequency magnetic fields, this covert channel successfully transmits data through advanced physical isolation barriers. Developed by a team led by Mordechai Guri at Israel’s Ben-Gurion University, the ODINI […]

The post https://cybersecuritynews.com/odini-malware-air-gapped-computers/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/odini-malware-air-gapped-computers/

Hackers Using Fake “Microsoft Teams” Domains to Attack Users ...

2026-04-06T09:04:09Z

Hackers Using Fake “Microsoft Teams” Domains to Attack Users Via Malicious Payload

Cybercriminals are launching a sophisticated new wave of attacks using fake Microsoft Teams domains. According to recent threat intelligence shared by SEAL Org, hackers are actively tricking corporate users into downloading malicious payloads by mimicking the widely used communication platform. As Microsoft Teams remains an essential tool for remote and hybrid work environments, threat actors are […]

The post https://cybersecuritynews.com/hackers-using-fake-microsoft-teams-domains-attack-via-malicious-payload/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-using-fake-microsoft-teams-domains-attack-via-malicious-payload/

A new Remote Access Trojan (RAT) called ResokerRAT has been found ...

2026-04-06T07:12:12Z

A new Remote Access Trojan (RAT) called ResokerRAT has been found targeting Windows systems by abusing Telegram’s widely used Bot API to receive commands and send stolen data back to attackers. Unlike traditional malware that relies on custom command-and-control servers, this threat routes all communications through a trusted messaging platform, making it far harder for […]

The post https://cybersecuritynews.com/new-resokerrat-uses-telegram-bot/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/new-resokerrat-uses-telegram-bot/

METATRON – Open-Source AI Penetration Testing Assistant Brings ...

2026-04-06T06:38:13Z

METATRON – Open-Source AI Penetration Testing Assistant Brings Local LLM Analysis to Linux

A new open-source penetration testing framework called METATRON is gaining attention in the security research community for its fully offline, AI-driven approach to vulnerability assessment. Built for Parrot OS and other Debian-based Linux distributions, METATRON combines automated reconnaissance tooling with a locally hosted large language model (LLM), eliminating the need for cloud connectivity, API keys, […]

The post https://cybersecuritynews.com/metatron-ai-penetration-testing/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/metatron-ai-penetration-testing/

36 Malicious npm Strapi Packages Used to Deploy Redis RCE and ...

2026-04-06T05:45:36Z

36 Malicious npm Strapi Packages Used to Deploy Redis RCE and Persistent C2 Malware

A coordinated supply chain attack has been uncovered targeting developers who build applications on Strapi, a widely used open-source content management system. Thirty-six malicious npm packages disguised as legitimate Strapi plugins were published to the npm registry, carrying payloads designed to exploit Redis for remote code execution, steal credentials, and establish persistent command-and-control access on […]

The post https://cybersecuritynews.com/36-malicious-npm-strapi-packages/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/36-malicious-npm-strapi-packages/

CISA Adds TrueConf Vulnerability to KEV Catalog Following Active ...

2026-04-06T03:44:11Z

CISA Adds TrueConf Vulnerability to KEV Catalog Following Active Exploitation

The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical vulnerability affecting TrueConf software to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2026-3502, this security flaw is currently facing active exploitation in the wild. The discovery has prompted federal agencies and private organizations to take immediate defensive action to secure their networks. […]

The post https://cybersecuritynews.com/cisa-trueconf-vulnerability-kev-catalog/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/cisa-trueconf-vulnerability-kev-catalog/

2,000+ FortiClient EMS Instances Exposed Online Amid Active RCE ...

2026-04-06T03:41:09Z

2,000+ FortiClient EMS Instances Exposed Online Amid Active RCE Vulnerability Exploits in the Wild

The Shadowserver Foundation has issued an urgent warning to FortiClient Enterprise Management Server (EMS) administrators after identifying over 2,000 publicly accessible instances globally, two of which are now confirmed to be actively exploited through critical unauthenticated remote code execution (RCE) vulnerabilities. Two vulnerabilities, CVE-2026-35616 and CVE-2026-21643, both classified as unauthenticated RCE flaws, were exploited in […]

The post https://cybersecuritynews.com/forticlient-ems-instances-exposed-online/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/forticlient-ems-instances-exposed-online/

Critical Fortinet FortiClient EMS 0-Day Vulnerability Actively ...

2026-04-04T13:04:09Z

Critical Fortinet FortiClient EMS 0-Day Vulnerability Actively Exploited in the Wild

Fortinet has issued an emergency hotfix after security researchers disclosed a critical zero-day vulnerability in FortiClient EMS that is already being actively exploited by threat actors. Tracked as CVE-2026-35616 and carrying a CVSSv3 score of 9.1 (Critical), the flaw enables unauthenticated attackers to bypass API authentication and authorization controls entirely, allowing them to execute arbitrary […]

The post https://cybersecuritynews.com/fortinet-forticlient-ems-0-day/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/fortinet-forticlient-ems-0-day/

New Progress ShareFile Bugs Let Attackers Take Over Servers ...

2026-04-04T11:52:18Z

New Progress ShareFile Bugs Let Attackers Take Over Servers Without Logging In

A dangerous attack chain in Progress ShareFile that can allow attackers to take over exposed on-premises servers without first logging in. The issues affect customer-managed ShareFile Storage Zones Controller 5.x deployments, and Progress says customers should upgrade to version 5.12.4 or move to any 6.x release, which is not impacted. According to Progress and WatchTower, […]

The post https://cybersecuritynews.com/progress-sharefile-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/progress-sharefile-vulnerability/

Hackers Weaponize Claude Code Leak to Spread Vidar and GhostSocks ...

2026-04-04T09:32:58Z

Hackers Weaponize Claude Code Leak to Spread Vidar and GhostSocks Malware

The cybersecurity community is on high alert following a massive source code leak from Anthropic. On March 31, 2026, the company accidentally exposed the complete source code for Claude Code, its flagship terminal-based coding assistant. The leak occurred due to a packaging error in a public npm package, which inadvertently included a JavaScript source map […]

The post https://cybersecuritynews.com/claude-code-leak-to-spread-vidar-and-ghostsocks-malware/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/claude-code-leak-to-spread-vidar-and-ghostsocks-malware/

Top Node.js Maintainers Targeted in Sophisticated Social ...

2026-04-04T09:07:39Z

Top Node.js Maintainers Targeted in Sophisticated Social Engineering Scheme

A highly coordinated social engineering campaign is actively targeting top open-source developers in the Node.js and npm ecosystem. Following the recent compromise of the popular package Axios, which sees over 100 million weekly downloads, several high-impact software maintainers have reported similar attacks. Security researchers believe this is a strategic shift by advanced threat actors aiming […]

The post https://cybersecuritynews.com/top-node-js-maintainers-targeted-social-engineering-scheme/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/top-node-js-maintainers-targeted-social-engineering-scheme/

Top 10 Best User Access Management Tools in 2026 User Access ...

2026-04-04T06:10:56Z

Top 10 Best User Access Management Tools in 2026

User Access Management tools centralize control over user permissions and access, providing a unified platform to enforce consistent security policies across diverse systems and applications. They enhance security by implementing role-based access controls, monitoring user activity, preventing unauthorized access, mitigating potential risks, and safeguarding sensitive information. These tools support compliance efforts with detailed audit trails […]

The post https://cybersecuritynews.com/user-access-management-tools/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/user-access-management-tools/

Top 10 Best VPN For Chrome in 2026 In ever-changing technology ...

2026-04-04T06:05:12Z

Top 10 Best VPN For Chrome in 2026

In ever-changing technology and networks, privacy is becoming increasingly difficult to achieve. People are so used to using the Internet and IoT devices that the sensitive data they share on the web has become a prime target for hackers or malicious actors. As we all know, data is crucial. Protecting data is vital since even […]

The post https://cybersecuritynews.com/best-vpn-for-chrome/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-vpn-for-chrome/

LinkedIn Hidden Code Secretly Searches Your Browser for Installed ...

2026-04-04T04:15:21Z

LinkedIn Hidden Code Secretly Searches Your Browser for Installed Extensions

Every time you open LinkedIn in a Chrome-based browser, hidden JavaScript silently scans your computer for installed software without your knowledge, without your consent, and without a single word in LinkedIn’s privacy policy. A revealing investigation conducted by the European advocacy group Fairlinked e.V., under the campaign name “BrowserGate,” has uncovered what researchers describe as […]

The post https://cybersecuritynews.com/linkedin-code-collects-data/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/linkedin-code-collects-data/

Anthropic Officially Ends Claude Subscriptions for Third-Party ...

2026-04-04T03:20:56Z

Anthropic Officially Ends Claude Subscriptions for Third-Party Tools Like OpenClaw

Anthropic has officially pulled the plug on third-party AI agent access to the Claude subscription, marking a significant shift in how users can leverage its models outside the company’s native ecosystem. According to Anthropic Claude Code exec Boris Cherny, starting today, April 4, at 12 p.m. PT (8 p.m. BST), Claude Pro and Max subscribers […]

The post https://cybersecuritynews.com/claude-ends-openclaw-subscriptions/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/claude-ends-openclaw-subscriptions/

High-Stakes Security: Protecting the Digital Infrastructure of ...

2026-04-03T22:00:57Z

High-Stakes Security: Protecting the Digital Infrastructure of the Gaming Industry

The Growing Profile of Casino Targets The gaming industry has become a primary target for sophisticated cybercriminal groups. This interest is driven not only by the high volume of daily financial transactions but also by the vast repositories of sensitive personal data managed by these organizations. As traditional brick-and-mortar establishments transition into digital ecosystems, the […]

The post https://cybersecuritynews.com/high-stakes-security-protecting-the-digital-infrastructure-of-the-gaming-industry/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/high-stakes-security-protecting-the-digital-infrastructure-of-the-gaming-industry/

14,000+ F5 BIG-IP APM Exposed Online as Attackers Actively ...

2026-04-03T17:02:42Z

14,000+ F5 BIG-IP APM Exposed Online as Attackers Actively Exploiting RCE Vulnerability

A critical security flaw in F5’s BIG-IP Access Policy Manager (APM) is currently under active exploitation, leaving thousands of enterprise networks at risk. The vulnerability, officially tracked as CVE-2025-53521, has sparked urgent warnings across the cybersecurity community after its impact was upgraded from a standard Denial-of-Service (DoS) to a severe Remote Code Execution (RCE) flaw. […]

The post https://cybersecuritynews.com/14000-f5-big-ip-apm-exposed-online/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/14000-f5-big-ip-apm-exposed-online/

Kimsuky Deploys Malicious LNK Files to Deliver Python-Based ...

2026-04-03T14:43:09Z

Kimsuky Deploys Malicious LNK Files to Deliver Python-Based Backdoor in Multi-Stage Attack

A North Korean threat group known as Kimsuky has been caught running a cyberattack campaign that uses malicious Windows shortcut files, known as LNK files, to quietly install a Python-based backdoor on victim systems. The attack stays hidden across multiple stages, making it harder for security tools to detect before the final payload reaches the […]

The post https://cybersecuritynews.com/kimsuky-deploys-malicious-lnk-files/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/kimsuky-deploys-malicious-lnk-files/

Axios Maintainer Confirms The npm Compromise Was via a Targeted ...

2026-04-03T14:22:41Z

Axios Maintainer Confirms The npm Compromise Was via a Targeted Social Engineering Attack

Two malicious versions of the popular JavaScript HTTP library Axios were briefly published to the npm registry on March 31, 2026. Each version carried a hidden dependency that installed a remote access trojan (RAT) across macOS, Windows, and Linux systems. The attack did not exploit a flaw in the Axios code itself. Instead, it targeted […]

The post https://cybersecuritynews.com/axios-maintainer-confirms-the-npm-compromise/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/axios-maintainer-confirms-the-npm-compromise/

Hackers Abuse Trusted Platforms to Steal Bank Credentials From ...

2026-04-03T14:09:26Z

Hackers Abuse Trusted Platforms to Steal Bank Credentials From Philippine Users

A coordinated phishing campaign has been quietly targeting banking customers across the Philippines since early 2024, and it remains active today. The attackers are not relying on crude tricks — they are hiding behind widely trusted internet platforms to steal banking credentials and one-time passwords, then using them to drain victims’ accounts within minutes. The […]

The post https://cybersecuritynews.com/hackers-abuse-trusted-platforms/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-abuse-trusted-platforms/

Hackers Use Phorpiex Botnet to Spread Ransomware, Sextortion, and ...

2026-04-03T10:28:10Z

Hackers Use Phorpiex Botnet to Spread Ransomware, Sextortion, and Crypto-Clipping Malware

A botnet that has been running since 2011 is back in the spotlight — not because it is new, but because it keeps reinventing itself. Phorpiex, also known as Trik, has grown from a basic spam tool into a full-scale criminal platform capable of delivering ransomware, sending sextortion emails to millions of victims, and silently […]

The post https://cybersecuritynews.com/hackers-use-phorpiex-botnet-to-spread-ransomware/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-use-phorpiex-botnet-to-spread-ransomware/

Hackers Use Venom Stealer to Turn ClickFix Lures Into Full Data ...

2026-04-03T10:19:34Z

Hackers Use Venom Stealer to Turn ClickFix Lures Into Full Data Exfiltration Pipelines

A new malware has been quietly spreading across cybercrime networks, and security researchers say it is far more capable than most tools of its kind. Called Venom Stealer, this malware-as-a-service platform does not just harvest credentials — it builds an entire automated attack chain that begins with a simple social engineering trick and ends with […]

The post https://cybersecuritynews.com/hackers-use-venom-stealer/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-use-venom-stealer/

Microsoft Forcing Upgrades to Unmanaged Windows 11, Version 24H2 ...

2026-04-03T09:19:57Z

Microsoft Forcing Upgrades to Unmanaged Windows 11, Version 24H2

Microsoft has officially begun force-upgrading unmanaged Windows 11 version 24H2 devices to version 25H2, marking the final phase of a staged rollout that relies on machine learning to determine device readiness. The move, confirmed in an updated Windows Release Health Dashboard entry, affects all Home and Pro edition devices not managed by IT departments. Starting […]

The post https://cybersecuritynews.com/microsoft-windows-11-24h2/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/microsoft-windows-11-24h2/

Multiple TP-Link Vulnerabilities Let Attackers Trigger DoS and ...

2026-04-03T08:50:19Z

Multiple TP-Link Vulnerabilities Let Attackers Trigger DoS and Crash Routers

Multiple high-severity vulnerabilities exist in TP-Link’s Tapo C520WS smart security cameras. If exploited, these vulnerabilities may allow adjacent attackers to trigger Denial-of-Service (DoS) conditions, crash the device, or completely bypass authentication. TP-Link has released urgent firmware updates to address these critical security gaps. When a security camera or connected router goes offline due to a […]

The post https://cybersecuritynews.com/tp-link-vulnerabilities-trigger-dos/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/tp-link-vulnerabilities-trigger-dos/

Hackers Compromised 700+ Next.js Hosts by Exploiting React2Shell ...

2026-04-03T07:38:26Z

Hackers Compromised 700+ Next.js Hosts by Exploiting React2Shell Vulnerability

A massive automated credential theft campaign is actively targeting web applications worldwide. Cybersecurity researchers at Cisco Talos have uncovered an operation by a hacker group tracked as UAT-10608, which has already compromised over 700 servers. The attackers are exploiting a critical security flaw known as React2Shell to gain access and steal highly sensitive data. The […]

The post https://cybersecuritynews.com/700-next-js-hosts-exploited/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/700-next-js-hosts-exploited/

CERT-EU Confirms Trivy Supply Chain Attack Led to European ...

2026-04-03T07:25:19Z

CERT-EU Confirms Trivy Supply Chain Attack Led to European Commission AWS Breach

The European Commission’s primary web platform, “europa.eu,” recently suffered a severe data breach stemming from a supply-chain compromise involving the popular open-source vulnerability scanner, Trivy. On April 3, 2026, CERT-EU published an official advisory detailing how a threat actor known as TeamPCP exploited the compromised continuous integration and continuous delivery (CI/CD) tool to harvest Amazon […]

The post https://cybersecuritynews.com/european-commission-breach-trivy/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/european-commission-breach-trivy/

North Korea-Linked Hackers Compromise Axios npm Package in Major ...

2026-04-03T06:42:35Z

North Korea-Linked Hackers Compromise Axios npm Package in Major Supply Chain Attack

A North Korea-linked threat group has successfully hijacked one of the most widely used JavaScript libraries on the internet, injecting malware into millions of potential development environments. On March 31, 2026, attackers gained access to the Axios Node Package Manager (npm) package using stolen maintainer credentials, turning a trusted tool into a weapon against unsuspecting […]

The post https://cybersecuritynews.com/north-korea-linked-hackers-compromise-axios-npm-package/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/north-korea-linked-hackers-compromise-axios-npm-package/

20 Best Application Performance Monitoring Tools in 2026 ...

2026-04-03T05:30:02Z

20 Best Application Performance Monitoring Tools in 2026

Applications’ performance and availability are monitored, measured, and optimized as part of the practice known as application performance monitoring (APM). Using APM tools and methodologies, organizations may diagnose issues that impair the user experience, discover performance bottlenecks, and gain visibility into how their applications operate. Application performance management (APM) involves monitoring several performance measures, including […]

The post https://cybersecuritynews.com/application-performance-monitoring-tools/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/application-performance-monitoring-tools/

Best VPN For Linux In 2026 Linux users are known for prioritizing ...

2026-04-03T05:20:38Z

Best VPN For Linux In 2026

Linux users are known for prioritizing privacy, control, and performance — and in 2026, choosing the best VPN for Linux has become more important than ever. While Linux offers stronger security compared to other operating systems, it still doesn’t protect against ISP tracking, geo-restrictions, public Wi-Fi threats, or advanced surveillance. A reliable Linux VPN encrypts your internet […]

The post https://cybersecuritynews.com/best-vpn-for-linux/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-vpn-for-linux/

How Elite SOCs Cut Escalation Rates by Arming Tier 1 With Better ...

2026-04-02T16:58:08Z

How Elite SOCs Cut Escalation Rates by Arming Tier 1 With Better Threat Intelligence

In a mature Security Operations Center, escalation is supposed to work like a scalpel, precise, intentional, and reserved for alerts that genuinely demand deeper expertise. But across many teams today, it has become something far less disciplined: a reflex, a pressure valve, a way to pass uncertainty up the chain. The consequences are predictable. Tier […]

The post https://cybersecuritynews.com/reduce-soc-escalation-rates-tier-1-alert-triage/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/reduce-soc-escalation-rates-tier-1-alert-triage/

Hackers Clone CERT-UA Site to Trick Victims Into Installing ...

2026-04-02T16:15:03Z

Hackers Clone CERT-UA Site to Trick Victims Into Installing Go-Based RAT

A threat group recently set up a convincing fake version of Ukraine’s official cybersecurity authority website to trick targets into downloading a dangerous remote access tool. The campaign, now tracked under the identifier UAC-0255, relied on a mix of phishing emails and a cloned government website to push malware onto the computers of government workers, […]

The post https://cybersecuritynews.com/hackers-clone-cert-ua-site/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-clone-cert-ua-site/

New Akira Lookalike Ransomware Campaign Targeting Windows Users ...

2026-04-02T16:12:28Z

New Akira Lookalike Ransomware Campaign Targeting Windows Users in South America

A new and dangerous ransomware campaign has surfaced across South America, targeting Windows users with a carefully crafted strain that closely imitates the well-known Akira ransomware. While the two may appear nearly identical on the surface, this new threat is built on an entirely different foundation — one that quietly borrows from another notorious ransomware […]

The post https://cybersecuritynews.com/new-akira-lookalike-ransomware-campaign/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/new-akira-lookalike-ransomware-campaign/

Qilin Ransomware Uses Malicious DLL to Kill Almost Every ...

2026-04-02T15:42:35Z

Qilin Ransomware Uses Malicious DLL to Kill Almost Every Vendor’s EDR Solutions

Qilin ransomware group is deploying a sophisticated, multi-stage infection chain via a malicious msimg32.dll that can disable over 300 endpoint detection and response (EDR) drivers from virtually every major security vendor. As organizations increasingly rely on EDR solutions, which offer far greater behavioral visibility than legacy antivirus, threat actors have adapted by weaponizing EDR killers […]

The post https://cybersecuritynews.com/qilin-ransomware-kill-edr/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/qilin-ransomware-kill-edr/

OpenSSH 10.3 Fixes Shell Injection and Multiple SSH Security ...

2026-04-02T14:54:30Z

OpenSSH 10.3 Fixes Shell Injection and Multiple SSH Security Issues

The OpenSSH project released version 10.3 and 10.3p1 on April 2, 2026, addressing a shell injection vulnerability and introducing several security-hardening changes that administrators should review before upgrading. The most notable security fix targets a shell injection vulnerability in the -J (ProxyJump) command-line option. Prior to this release, user and host names passed via -J […]

The post https://cybersecuritynews.com/openssh-10-3-release/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/openssh-10-3-release/

Hackers Abuse DOCX, RTF, JS, and Python in Stealthy Boeing RFQ ...

2026-04-02T14:53:54Z

Hackers Abuse DOCX, RTF, JS, and Python in Stealthy Boeing RFQ Malware Campaign

A seemingly routine procurement email has become the entry point for a sophisticated six-stage malware attack targeting industrial suppliers and procurement teams. The campaign, tracked as NKFZ5966PURCHASE, disguises itself as a Boeing Request for Quotation (RFQ) from a person named “Joyce Malave,” luring victims into opening a malicious Word document. Once opened, the file silently […]

The post https://cybersecuritynews.com/hackers-abuse-docx-rtf-js-and-python-in-boeing-rfq/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-abuse-docx-rtf-js-and-python-in-boeing-rfq/

CISA Warns of Chrome 0-Day Vulnerability Actively Exploited in ...

2026-04-02T14:31:00Z

CISA Warns of Chrome 0-Day Vulnerability Actively Exploited in Attacks

A critical warning has been issued over a newly discovered zero-day vulnerability in Google Chrome, raising serious concerns for users worldwide. This flaw is actively exploited in the wild, allowing attackers to bypass security protections and execute malicious code, and was added to the Known Exploited Vulnerabilities (KEV) catalog on April 1, 2026. The discovery […]

The post https://cybersecuritynews.com/chrome-0-day-flaw-exploited/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/chrome-0-day-flaw-exploited/

NoVoice on Google Play with 22 Exploits Attacks Millions of ...

2026-04-02T13:50:07Z

NoVoice on Google Play with 22 Exploits Attacks Millions of Android Users

A dangerous Android rootkit named NoVoice has been hiding inside over 50 apps on Google Play, compromising more than 2.3 million devices worldwide. Tracked as Operation NoVoice, the malware uses 22 exploits to take full control of a device without raising any alerts, making it one of the most destructive Android threats uncovered in recent […]

The post https://cybersecuritynews.com/novoice-on-google-play/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/novoice-on-google-play/

Apple Expands iOS 18.7.7 Update to More Devices to Shield Users ...

2026-04-02T11:54:43Z

Apple Expands iOS 18.7.7 Update to More Devices to Shield Users from DarkSword Exploit

Apple has taken the rare step of expanding the availability of iOS 18.7.7 and iPadOS 18.7.7 to a broader set of devices on April 1, 2026, pushing critical backported security patches to millions of users still running iOS 18 who remain exposed to DarkSword, a sophisticated, web-delivered exploit chain capable of silently stealing vast amounts […]

The post https://cybersecuritynews.com/apple-expands-ios-18-7-7-update/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/apple-expands-ios-18-7-7-update/

New ZAP PTK Add-On Maps Browser-Based Security Findings as Native ...

2026-04-02T11:27:45Z

New ZAP PTK Add-On Maps Browser-Based Security Findings as Native Alert Into ZAP

The OWASP Zed Attack Proxy (ZAP) team has rolled out version 0.3.0 of the OWASP PenTest Kit (PTK) add-on, introducing a transformative workflow upgrade for application security testing. This new release bridges the critical gap between traditional proxy-level scanning and modern client-side execution by mapping in-browser security findings directly into native ZAP alerts. ZAP has […]

The post https://cybersecuritynews.com/zap-ptk-add-on/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/zap-ptk-add-on/

Cisco Smart Software Manager Vulnerability Let Attackers Execute ...

2026-04-02T10:13:06Z

Cisco Smart Software Manager Vulnerability Let Attackers Execute Arbitrary Commands

Cisco has issued an urgent security warning regarding a critical vulnerability in its Smart Software Manager On-Prem (SSM On-Prem) platform. Enterprise organizations widely use this tool to manage their Cisco software licenses locally. Tracked as CVE-2026-20160, the flaw carries a near-perfect CVSS severity score of 9.8 out of 10. If exploited, it allows an unauthenticated, […]

The post https://cybersecuritynews.com/cisco-smart-software-manager-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/cisco-smart-software-manager-vulnerability/

Oracle Lays Off 30,000 Employees to Ramp Up Investment in AI ...

2026-04-02T10:06:55Z

Oracle Lays Off 30,000 Employees to Ramp Up Investment in AI Technologies

Oracle has executed a massive workforce reduction, eliminating between 20,000 and 30,000 employees globally to free up cash flow for its aggressive artificial intelligence infrastructure investments. The layoffs, representing roughly 18% of its workforce, were communicated abruptly via email, highlighting the company’s urgent shift in financial strategy amid mounting debt. On Tuesday morning, up to […]

The post https://cybersecuritynews.com/oracle-lays-off-30000-employees/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/oracle-lays-off-30000-employees/

FBI Warns of Chinese Mobile Apps May Expose User Data to ...

2026-04-02T09:35:10Z

FBI Warns of Chinese Mobile Apps May Expose User Data to Cyberattacks

Millions of Americans use mobile apps daily without thinking much about where their data actually goes. The Federal Bureau of Investigation has stepped forward to address that. On March 31, 2026, the FBI released a Public Service Announcement outlining serious data security risks connected to mobile applications developed by foreign companies — particularly those based […]

The post https://cybersecuritynews.com/fbi-warns-of-chinese-mobile-apps/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/fbi-warns-of-chinese-mobile-apps/

TA416 Expands Espionage Operations Across Europe With Web Bug ...

2026-04-02T09:16:31Z

TA416 Expands Espionage Operations Across Europe With Web Bug Recon and Malware Delivery

TA416 has returned to Europe with a fresh wave of espionage emails aimed at government and diplomatic staff. The campaign mixes quiet reconnaissance with malware delivery, showing how a patient threat actor can test who opens a message before sending a more dangerous follow-up. From mid-2025 into early 2026, the China-aligned group targeted diplomatic missions […]

The post https://cybersecuritynews.com/ta416-expands-espionage-operations-across-europe/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/ta416-expands-espionage-operations-across-europe/

Microsoft Copilot Terms of Service Label Copilot is for ...

2026-04-02T08:45:20Z

Microsoft Copilot Terms of Service Label Copilot is for Entertainment Purposes Only

Microsoft’s terms of service for its Copilot AI assistant include a notable disclaimer that has sparked renewed scrutiny from security and enterprise communities: the product is intended solely for entertainment purposes. According to the official Copilot terms of use, Microsoft explicitly states that Copilot can make mistakes, may not function as intended, and should not […]

The post https://cybersecuritynews.com/microsoft-copilot-terms-of-service/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/microsoft-copilot-terms-of-service/

New WhatsApp Attack Chain Uses VBS Scripts, Cloud Downloads, and ...

2026-04-02T08:24:48Z

New WhatsApp Attack Chain Uses VBS Scripts, Cloud Downloads, and MSI Backdoors

A new malware campaign is actively using WhatsApp to deliver harmful files directly to Windows users, exploiting the widespread trust placed in everyday messaging apps. The threat actors send malicious Visual Basic Script (VBS) files through WhatsApp messages, knowing that users rarely question attachments from familiar platforms. Once a recipient runs one of these files, […]

The post https://cybersecuritynews.com/new-whatsapp-attack-chain-uses-vbs-scripts/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/new-whatsapp-attack-chain-uses-vbs-scripts/

Critical Cisco IMC Vulnerability Let Attackers Bypass ...

2026-04-02T07:26:41Z

Critical Cisco IMC Vulnerability Let Attackers Bypass Authentication

Cisco has recently disclosed a critical security flaw affecting its Integrated Management Controller (IMC), prompting the release of urgent software updates. The vulnerability, officially tracked as CVE-2026-20093, has been assigned a critical Base CVSS score of 9.8, indicating the highest level of severity. This security weakness is located in the password change functionality of the […]

The post https://cybersecuritynews.com/cisco-imc-vulnerability-2/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/cisco-imc-vulnerability-2/

Remcos RAT Infection Chain Hides Behind Obfuscated Scripts and ...

2026-04-02T07:06:06Z

Remcos RAT Infection Chain Hides Behind Obfuscated Scripts and Trusted Windows Binaries

Cybercriminals are getting better at hiding their tracks, and a recently uncovered Remcos RAT campaign is proof of that. This attack does not rely on a single malicious file dropped onto a system. Instead, it uses a carefully built, multi-stage chain that starts with a simple phishing email and ends with a full, in-memory system […]

The post https://cybersecuritynews.com/remcos-rat-infection-chain-hides-behind-obfuscated/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/remcos-rat-infection-chain-hides-behind-obfuscated/

Symantec DLP Agent Vulnerability Let Attackers Escalate ...

2026-04-02T06:46:14Z

Symantec DLP Agent Vulnerability Let Attackers Escalate Privileges

A high-severity security flaw has been identified in the Symantec Data Loss Prevention (DLP) Agent for Windows. Tracked as CVE-2026-3991, this vulnerability allows a low-privileged local attacker to escalate their system privileges to the highest level. Security researcher Manuel Feifel discovered the flaw, and Broadcom has recently released patches to address the issue. The vulnerability […]

The post https://cybersecuritynews.com/symantec-dlp-agent-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/symantec-dlp-agent-vulnerability/

Starbucks Breach – Attacks Allegedly Claim 10GB of Stolen ...

2026-04-02T06:28:12Z

Starbucks Breach – Attacks Allegedly Claim 10GB of Stolen Source Code

The threat group ShadowByt3s has claimed responsibility for a new cyberattack on Starbucks, allegedly stealing 10GB of proprietary source code and operational firmware. The data was reportedly scraped from a misconfigured Amazon S3 bucket named “sbux-assets” as part of a broader campaign targeting cloud vulnerabilities. A threat actor operating under the moniker “BlackVortex1” posted on […]

The post https://cybersecuritynews.com/starbucks-breach/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/starbucks-breach/

10 Best VPN For Privacy In 2026 When it comes to privacy-focused ...

2026-04-02T05:39:50Z

10 Best VPN For Privacy In 2026

When it comes to privacy-focused VPNs, several providers stand out in 2026. NordVPN, based in Panama, offers robust security features including Double VPN, Onion over VPN, and an independently audited no-logs policy. Proton VPN, founded by CERN scientists and based in Switzerland, is known for its strong commitment to privacy and its Secure Core servers […]

The post https://cybersecuritynews.com/best-vpn-for-privacy/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-vpn-for-privacy/

Top 20 Best Digital Forensic Tools in 2026 Digital forensic tools ...

2026-04-02T05:30:02Z

Top 20 Best Digital Forensic Tools in 2026

Digital forensic tools are specialized software designed to analyze, recover, and investigate data from digital devices. They help uncover crucial evidence in cybercrime investigations and legal proceedings. These tools can extract data from various sources, including computers, smartphones, and storage devices, ensuring comprehensive digital footprints and activities analysis. They offer features like data carving, metadata […]

The post https://cybersecuritynews.com/best-digital-forensic-tools/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-digital-forensic-tools/

Vim Modeline Bypass Vulnerability Let Attackers Execute Arbitrary ...

2026-04-02T02:31:41Z

Vim Modeline Bypass Vulnerability Let Attackers Execute Arbitrary OS Commands

A newly discovered high-severity vulnerability in the popular Vim text editor exposes users to arbitrary command execution on the operating system. Tracked as CVE-2026-34982, the flaw relies on a modeline sandbox bypass that triggers when a victim opens a specially crafted file. Security researchers “dfwjj x” and Avishay Matayev identified a vulnerability chain that affects […]

The post https://cybersecuritynews.com/vim-modeline-bypass-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/vim-modeline-bypass-vulnerability/

Public PoC Exploit Released for Nginx-UI Backup Restore ...

2026-04-02T02:29:40Z

Public PoC Exploit Released for Nginx-UI Backup Restore Vulnerability

A critical security flaw has been disclosed in the Nginx-UI backup restore mechanism, tracked as CVE-2026-33026. This vulnerability allows threat actors to tamper with encrypted backup archives and inject malicious configurations during the restoration process. With a public Proof-of-Concept (PoC) exploit now available, unpatched deployments are at immediate risk of full system compromise. Cryptographic Flaw […]

The post https://cybersecuritynews.com/nginx-ui-backup-restore-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/nginx-ui-backup-restore-vulnerability/

Microsoft to Remove EXIF Data for Images Shared on Teams In a ...

2026-04-02T02:05:20Z

Microsoft to Remove EXIF Data for Images Shared on Teams

In a significant move to enhance corporate privacy and operational security, Microsoft has announced an important update for its Teams platform. As part of the March 2026 feature rollout, Microsoft Teams will now automatically remove EXIF metadata from all images shared across chats and channels. This privacy-by-default measure aims to protect users from unintentionally leaking […]

The post https://cybersecuritynews.com/microsoft-remove-exif-data-teams/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/microsoft-remove-exif-data-teams/

Magecart Hackers Uses 100+ Domains to Hijack eStores Checkouts ...

2026-04-01T17:13:13Z

Magecart Hackers Uses 100+ Domains to Hijack eStores Checkouts and Steal Card Data

A sophisticated and long-running Magecart campaign has been quietly operating for over 24 months, infecting e-commerce websites across at least 12 countries using more than 100 malicious domains to steal payment card data in real time and banks, not merchants, are bearing the heaviest financial blow. Security researchers at ANY.RUN has uncovered a large-scale Magecart […]

The post https://cybersecuritynews.com/magecart-hijack-estore-checkouts/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/magecart-hijack-estore-checkouts/

Google Cloud’s Vertex AI platform Vulnerability Allow Attackers ...

2026-04-01T13:06:14Z

Google Cloud’s Vertex AI platform Vulnerability Allow Attackers to Access Sensitive Data

Artificial intelligence agents are rapidly becoming integral to enterprise workflows, but they also introduce new attack surfaces. Security researchers recently uncovered a significant vulnerability within Google Cloud Platform’s Vertex AI Agent Engine. By exploiting default permission scoping, attackers could weaponize deployed AI agents into “double agents” that secretly exfiltrate data and compromise cloud infrastructure. Exploiting […]

The post https://cybersecuritynews.com/google-clouds-vertex-ai-platform-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/google-clouds-vertex-ai-platform-vulnerability/

Hackers Actively Exploiting Critical WebLogic RCE Vulnerabilities ...

2026-04-01T13:01:53Z

Hackers Actively Exploiting Critical WebLogic RCE Vulnerabilities in Attacks

A recent cybersecurity study reveals that threat actors are moving faster than ever to weaponize new software flaws. According to data collected from a high-interaction honeypot, hackers are actively exploiting a newly disclosed, maximum-severity vulnerability in Oracle WebLogic Server. The critical flaw, tracked as CVE-2026-21962, carries a CVSS score of 10.0. It allows unauthenticated attackers […]

The post https://cybersecuritynews.com/hackers-exploiting-weblogic-rce-vulnerabilities/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-exploiting-weblogic-rce-vulnerabilities/

Russian Hackers Using Remote Access Toolkit “CTRL” for RDP ...

2026-04-01T12:58:01Z

Russian Hackers Using Remote Access Toolkit “CTRL” for RDP Hijacking

A newly disclosed Russian-linked remote access toolkit called “CTRL” is being used to hijack Remote Desktop Protocol sessions and steal credentials from Windows systems. According to Censys ARC, the malware is a custom .NET framework that combines phishing, keylogging, reverse tunneling, and persistence into one attack chain. Censys ARC said the toolkit was discovered during […]

The post https://cybersecuritynews.com/ctrl-for-rdp-hijacking/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/ctrl-for-rdp-hijacking/

New Chrome Zero-Day Vulnerability Actively Exploited in Attacks ...

2026-04-01T12:53:43Z

New Chrome Zero-Day Vulnerability Actively Exploited in Attacks — Patch Now

Google has released an emergency security update for its Chrome browser, patching a zero-day vulnerability that is already being actively exploited in the wild. The Stable channel has been updated to version 146.0.7680.177/178 for Windows and Mac, and 146.0.7680.177 for Linux, with the rollout expected to reach all users over the coming days and weeks. […]

The post https://cybersecuritynews.com/chrome-zero-day-vulnerability-exploited/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/chrome-zero-day-vulnerability-exploited/

HSBC India Asks Customers to use All-Uppercase Passwords ...

2026-04-01T12:32:24Z

HSBC India Asks Customers to use All-Uppercase Passwords

Beginning April 6, 2026, HSBC India will require its internet banking customers to enter their passwords in uppercase letters only. The mandate, communicated via official customer emails, has sparked widespread concern among technical experts regarding the bank’s credential storage practices and overall security posture. The Uppercase Migration According to the bank’s recent communications, customers must […]

The post https://cybersecuritynews.com/hsbc-india-uppercase-passwords/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hsbc-india-uppercase-passwords/

Hackers Use EtherRAT and EtherHiding to Hide Malware ...

2026-04-01T12:21:06Z

Hackers Use EtherRAT and EtherHiding to Hide Malware Infrastructure on Ethereum

A sophisticated backdoor called EtherRAT is actively targeting organizations across multiple sectors by hiding its command infrastructure inside the Ethereum blockchain — a move that makes it uniquely hard to track and shut down. The malware runs on Node.js and gives attackers full remote control over compromised machines, enabling them to execute commands, steal cryptocurrency […]

The post https://cybersecuritynews.com/hackers-use-etherrat-and-etherhiding/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-use-etherrat-and-etherhiding/

Hackers Push CrystalX Malware-as-a-Service Through Telegram With ...

2026-04-01T11:36:07Z

Hackers Push CrystalX Malware-as-a-Service Through Telegram With Stealer and RAT Features

A new and dangerous piece of malware has surfaced and is being marketed openly to cybercriminals through private Telegram channels. Named CrystalX, this Malware-as-a-Service (MaaS) platform combines a remote access trojan (RAT), credential stealer, keylogger, clipboard hijacker, spyware, and an unusual set of prankware tools into one capable package. Discovered in March 2026, the malware […]

The post https://cybersecuritynews.com/hackers-push-crystalx-malware-as-a-service/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-push-crystalx-malware-as-a-service/

Cybersecurity Firm TAC Security Hits 10,000 Clients, Enters Top 5 ...

2026-04-01T10:36:43Z

Cybersecurity Firm TAC Security Hits 10,000 Clients, Enters Top 5 in Global VM & AppSec

New York, New York, April 1st, 2026, CyberNewswire TAC Infosec, a global leader in cybersecurity (NSE: TAC), with presence across 100+ countries, announced a historic milestone by crossing 10,000 clients – 6,500+ of TAC Security and 3,500+ of CyberScope, since April 2024, delivering on its commitment to shareholders to achieve this by 2026. While building […]

The post https://cybersecuritynews.com/tac-security-10000-clients-top-5/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/tac-security-10000-clients-top-5/

Windows 11 Emergency Update to Fix Installation Loop Issues ...

2026-04-01T09:59:48Z

Windows 11 Emergency Update to Fix Installation Loop Issues

Microsoft just released an emergency out-of-band update to resolve a persistent installation failure affecting Windows 11 users. Released on March 31, 2026, update KB5086672 specifically targets systems running Windows 11 versions 25H2 and 24H2. This patch addresses a critical setup bug introduced in late March that prevented users from successfully applying recent system improvements and […]

The post https://cybersecuritynews.com/windows-11-emergency-update/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/windows-11-emergency-update/

North Korean Hackers Compromise Widely Used Axios Package to ...

2026-04-01T09:00:01Z

North Korean Hackers Compromise Widely Used Axios Package to Infect Windows, macOS, and Linux Systems

A major software supply chain attack has struck the JavaScript ecosystem after threat actors slipped a malicious dependency into the widely used axios NPM package. The poisoned releases, axios 1.14.1 and 0.30.4, pulled in plain-crypto-js and quietly delivered the WAVESHAPER.V2 backdoor to Windows, macOS, and Linux systems during installation. The incident is serious because axios […]

The post https://cybersecuritynews.com/north-korean-hackers-compromise-widely-used-axios-package/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/north-korean-hackers-compromise-widely-used-axios-package/

Hackers Backdoor Telnyx Python SDK on PyPI to Steal Credentials ...

2026-04-01T08:48:26Z

Hackers Backdoor Telnyx Python SDK on PyPI to Steal Credentials Across Windows, macOS, and Linux

A threat actor group known as TeamPCP has been caught backdooring the Telnyx Python SDK on PyPI — a popular cloud communications library with over 700,000 downloads in February alone. On March 27, 2026, two malicious versions of the package, 4.87.1 and 4.87.2, were quietly published to the Python Package Index without any matching commits […]

The post https://cybersecuritynews.com/hackers-backdoor-telnyx-python-sdk-on-pypi/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-backdoor-telnyx-python-sdk-on-pypi/

New npm Supply Chain Attack Uses undicy-http to Deploy ...

2026-04-01T07:55:34Z

New npm Supply Chain Attack Uses undicy-http to Deploy Screen-Streaming RAT and Browser Injector

A malicious npm package named undicy-http has surfaced inside the Node.js developer ecosystem, quietly compromising machines of developers who mistakenly install it. The package impersonates undici, the official HTTP client library bundled with Node.js that handles millions of weekly downloads. Despite sharing a near-identical name, undicy-http contains zero HTTP client functionality. Instead, it launches a two-stage attack capable of stealing […]

The post https://cybersecuritynews.com/new-npm-supply-chain-attack-uses-undicy-http/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/new-npm-supply-chain-attack-uses-undicy-http/

PNG Vulnerabilities Allow Attackers to Trigger Process Crashes, ...

2026-04-01T07:21:04Z

PNG Vulnerabilities Allow Attackers to Trigger Process Crashes, Leak Sensitive Information

Two high-severity vulnerabilities have been discovered in libpng, the widely used reference library for reading and writing PNG images. These flaws allow attackers to trigger process crashes, leak sensitive information, and potentially execute arbitrary code by convincing a system to process a crafted PNG file. The vulnerabilities affect any software that parses malformed images, making […]

The post https://cybersecuritynews.com/png-vulnerabilities/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/png-vulnerabilities/

XLoader Malware Upgrades Obfuscation Tactics and Hides C2 Traffic ...

2026-04-01T06:46:51Z

XLoader Malware Upgrades Obfuscation Tactics and Hides C2 Traffic Behind Decoy Servers

A well-known information-stealing malware called XLoader has received significant upgrades in its latest versions, making it considerably harder to detect and analyze than before. Originally derived from a malware family known as FormBook, which first surfaced in 2016, XLoader was rebranded and relaunched in early 2020, and since then, its developers have consistently pushed new […]

The post https://cybersecuritynews.com/xloader-malware-upgrades-obfuscation-tactics/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/xloader-malware-upgrades-obfuscation-tactics/

Mercor AI Confirms Data Breach Following Lapsus$ Claims of 4TB ...

2026-04-01T04:31:16Z

Mercor AI Confirms Data Breach Following Lapsus$ Claims of 4TB Data Theft

Mercor AI has officially confirmed a severe data breach following claims by the notorious Lapsus$ hacking group that they stole 4 terabytes of sensitive company data. The incident, stemming from a recent supply chain attack on the open-source LiteLLM project, has exposed proprietary source code, internal databases, and massive amounts of user-verification data. The hacking […]

The post https://cybersecuritynews.com/mercor-ai-data-breach/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/mercor-ai-data-breach/

Google Now Allows You to Change your @gmail.com Address in few ...

2026-04-01T04:04:58Z

Google Now Allows You to Change your @gmail.com Address in few Simple Steps

For over two decades, the permanence of a Google Account username has been a strict rule of the digital landscape. Many users found it frustrating to create new accounts and transfer data after outgrowing their childhood email addresses or changing their names. However, Google has recently updated its support documentation to announce that it will […]

The post https://cybersecuritynews.com/google-change-gmail-address/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/google-change-gmail-address/

Hackers Weaponize Legitimate Windows Tools to Disable Antivirus ...

2026-03-31T13:02:27Z

Hackers Weaponize Legitimate Windows Tools to Disable Antivirus Before Ransomware Attacks

Ransomware attacks have gone far beyond simple malicious code. Today, attackers operate with the precision of a well-planned business, using trusted Windows tools to quietly tear down defenses before ransomware even enters the picture. This shift has made modern ransomware campaigns harder to detect and significantly more damaging. The tools at the center of this […]

The post https://cybersecuritynews.com/hackers-weaponize-legitimate-windows-tools/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-weaponize-legitimate-windows-tools/

A new remote access trojan known as ResokerRAT has come to light, ...

2026-03-31T12:39:05Z

A new remote access trojan known as ResokerRAT has come to light, using Telegram’s bot API as its core communication channel to silently monitor and control infected Windows machines. What makes this threat stand out is that it does not rely on a traditional command-and-control server. Instead, it misuses a widely trusted messaging platform to […]

The post https://cybersecuritynews.com/hackers-deploy-telegram-based-resokerrat/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-deploy-telegram-based-resokerrat/

Anthropic’s Claude Code Source Code Reportedly Leaked Via Their ...

2026-03-31T11:29:13Z

Anthropic’s Claude Code Source Code Reportedly Leaked Via Their npm Registry

Anthropic’s proprietary Claude Code CLI tool has had its full TypeScript source code inadvertently exposed through a misconfigured npm package, after a security researcher discovered a leaked .map file referencing the unobfuscated codebase stored on Anthropic’s own cloud infrastructure. On March 31, 2026, researcher Chaofan Shou made the disclosure public, posting: “Claude code source code […]

The post https://cybersecuritynews.com/claude-code-source-code-leaked/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/claude-code-source-code-leaked/

CareCloud Data Breach – Hackers Accessed IT Infrastructure and ...

2026-03-31T10:40:56Z

CareCloud Data Breach – Hackers Accessed IT Infrastructure and Stole Patient Data

A prominent healthcare technology provider has formally disclosed a significant cybersecurity incident involving unauthorized access to its IT infrastructure. An unauthorized actor compromised one of the company’s electronic health record (EHR) systems, raising concerns over possible exposure of sensitive patient data. The security breach initially unfolded on March 16, 2026. The intrusion caused a temporary […]

The post https://cybersecuritynews.com/carecloud-data-breach/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/carecloud-data-breach/

Apple New macOS Tahoe Feature Warns Users on ClickFix Attacks ...

2026-03-31T09:03:54Z

Apple New macOS Tahoe Feature Warns Users on ClickFix Attacks

Apple has introduced a new security mechanism in the macOS Tahoe 26.4 release candidate to protect users against social engineering campaigns known as ClickFix attacks. Discovered by users testing the latest OS build and highlighted in a popular Reddit post on r/MacOSBeta, the undocumented feature actively blocks the execution of potentially malicious commands pasted into […]

The post https://cybersecuritynews.com/clickfix-protection-macos-tahoe-26-4/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/clickfix-protection-macos-tahoe-26-4/

CISA Warns of Citrix NetScaler Vulnerability Actively Exploited ...

2026-03-31T08:58:33Z

CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical vulnerability affecting Citrix NetScaler products. Identified as CVE-2026-3055, this security flaw has been officially added to CISA’s Known Exploited Vulnerabilities (KEV) catalog following confirmed evidence of active exploitation in the wild. Network defenders and system administrators are urged to take […]

The post https://cybersecuritynews.com/citrix-netscaler-vulnerability-exploited/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/citrix-netscaler-vulnerability-exploited/

Cybercriminals Abuse IRS and Tax Filing Lures to Push Malware in ...

2026-03-31T08:37:40Z

Cybercriminals Abuse IRS and Tax Filing Lures to Push Malware in New Campaigns

Tax season brings a reliable wave of phishing attacks, but 2026 has already shown a bigger and more organized push than in previous years. Cybercriminals are actively impersonating the Internal Revenue Service (IRS), national tax authorities, and company HR departments to trick people into installing malware or handing over login credentials. Over a hundred campaigns […]

The post https://cybersecuritynews.com/cybercriminals-abuse-irs-and-tax-filing-lures/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/cybercriminals-abuse-irs-and-tax-filing-lures/

Hackers Deploy RoadK1ll Pivoting Malware to Turn Compromised ...

2026-03-31T07:41:27Z

Hackers Deploy RoadK1ll Pivoting Malware to Turn Compromised Hosts Into Network Relays

A new piece of malware called RoadK1ll has been found silently converting compromised machines into controllable network relay points. Unlike most malware that arrives loaded with commands and attack tools, RoadK1ll is deliberately lean, built around one goal: giving attackers a reliable and silent path deeper into a network after initial compromise. That narrow focus […]

The post https://cybersecuritynews.com/hackers-deploy-roadk1ll-pivoting-malware/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-deploy-roadk1ll-pivoting-malware/

Notepad++ v8.9.3 Released Addressing cURL Security Vulnerability ...

2026-03-31T04:09:17Z

Notepad++ v8.9.3 Released Addressing cURL Security Vulnerability and Crash Issues

Notepad++ has officially released version 8.9.3, delivering critical security patches, structural performance enhancements, and resolutions for persistent crash issues. This update finalizes the text editor’s transition to a highly optimized XML parser, addressing multiple recent regressions while fortifying the application’s auto-update mechanism against documented vulnerabilities. Notepad++ v8.9.3 Release The most notable security implementation in version […]

The post https://cybersecuritynews.com/notepad-v8-9-3-released/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/notepad-v8-9-3-released/

Axios NPM Packages Compromised to Inject Malicious Codes in an ...

2026-03-31T03:39:45Z

Axios NPM Packages Compromised to Inject Malicious Codes in an Active Supply Chain Attack

A sophisticated supply chain attack has targeted Axios, one of the most heavily adopted HTTP clients within the JavaScript ecosystem, by introducing a malicious transitive dependency into the official npm registry. Serving as a critical component across frontend frameworks, backend microservices, and enterprise applications, Axios records approximately 83 million weekly downloads on npm. The compromise […]

The post https://cybersecuritynews.com/axios-npm-packages-compromised/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/axios-npm-packages-compromised/

Claude AI Discovers Zero-Day RCE Vulnerabilities in Vim and Emacs ...

2026-03-31T03:24:06Z

Claude AI Discovers Zero-Day RCE Vulnerabilities in Vim and Emacs

Anthropic’s Claude AI successfully discovered zero-day Remote Code Execution (RCE) flaws in both Vim and GNU Emacs. The discoveries highlight a massive paradigm shift in bug hunting, demonstrating that AI models can uncover critical vulnerabilities in legacy software with simple natural-language prompts. The Vim RCE: Compromise Upon File Open The research initiative began with a […]

The post https://cybersecuritynews.com/claude-ai-0-day-rce-vim/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/claude-ai-0-day-rce-vim/

12 Best AWS Monitoring Tools in 2026 Amazon Web Services (AWS) is ...

2026-03-30T18:08:15Z

12 Best AWS Monitoring Tools in 2026

Amazon Web Services (AWS) is a cloud computing platform for businesses of all sizes and types. AWS’s architecture is robust and scalable, but dependability, performance, and security must be monitored. These aims guide AWS’s monitoring tools and services, which help you understand your cloud infrastructure and applications, analyze data, identify outliers, and maintain smooth operations. […]

The post https://cybersecuritynews.com/best-aws-monitoring-tools/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-aws-monitoring-tools/

Exposed Server Reveals TheGentlemen Ransomware Toolkit, Victim ...

2026-03-30T17:30:34Z

Exposed Server Reveals TheGentlemen Ransomware Toolkit, Victim Credentials, and Ngrok Tokens

A misconfigured server hosted on a Russian bulletproof hosting provider has exposed the complete operational toolkit of a TheGentlemen ransomware affiliate, including harvested victim credentials and plaintext authentication tokens used to establish hidden remote access tunnels. TheGentlemen ransomware group operates as a Ransomware-as-a-Service, or RaaS, operation where affiliates carry out attacks using shared tools and […]

The post https://cybersecuritynews.com/exposed-server-reveals-thegentlemen-ransomware-toolkit/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/exposed-server-reveals-thegentlemen-ransomware-toolkit/

North Korean IT Worker Allegedly Used Stolen Identity and AI ...

2026-03-30T16:52:39Z

North Korean IT Worker Allegedly Used Stolen Identity and AI Resume in Job Application Scam

A suspected North Korean operative tried to sneak into a remote job at a cybersecurity firm by using a stolen identity, a fake AI-generated resume, and a VoIP phone number. The case, uncovered in June 2025, shows how North Korea’s state-sponsored IT worker scheme has grown more sophisticated and harder to spot without proper screening. […]

The post https://cybersecuritynews.com/north-korean-it-worker-allegedly-used-stolen-identity/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/north-korean-it-worker-allegedly-used-stolen-identity/

CrySome RAT Emerges as Advanced .NET Malware With AV Killer and ...

2026-03-30T16:30:44Z

CrySome RAT Emerges as Advanced .NET Malware With AV Killer and HVNC Capabilities

A new and dangerous piece of malware has surfaced in the threat landscape, and it is built to stay hidden, stay running, and stay in control of any system it infects. CrySome RAT is written in C# and targets the .NET ecosystem, giving attackers complete remote control over compromised Windows machines. From stealing passwords and […]

The post https://cybersecuritynews.com/crysome-rat-emerges-as-advanced-net-malware/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/crysome-rat-emerges-as-advanced-net-malware/

New ClickFix Variant Uses Rundll32 and WebDAV to Evade PowerShell ...

2026-03-30T16:01:26Z

New ClickFix Variant Uses Rundll32 and WebDAV to Evade PowerShell Detection

A new and more dangerous version of the ClickFix attack technique has been found actively targeting Windows users. Unlike older versions that used PowerShell or mshta to run malicious commands, this new variant takes a different path. It uses rundll32.exe and WebDAV, two built-in Windows components, to quietly deliver and execute harmful payloads without triggering […]

The post https://cybersecuritynews.com/new-clickfix-variant-uses-rundll32/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/new-clickfix-variant-uses-rundll32/

New Homoglyph Attack Techniques Help Cybercriminals Spoof Trusted ...

2026-03-30T14:28:09Z

New Homoglyph Attack Techniques Help Cybercriminals Spoof Trusted Domains

Cybercriminals have found a clever way to trick people by swapping real letters in website addresses with characters that look almost the same. These are called homoglyph attacks, and they are becoming a growing problem across the internet. A single character swap — like replacing a Latin “o” with a Greek omicron — can fool […]

The post https://cybersecuritynews.com/new-homoglyph-attack-techniques/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/new-homoglyph-attack-techniques/

Open VSX’s New Scanner Vulnerability Allows Malicious Extension ...

2026-03-30T13:58:51Z

Open VSX’s New Scanner Vulnerability Allows Malicious Extension Goes Live

A serious security flaw was recently found in Open VSX, the extension marketplace used by popular code editors like Cursor and Windsurf, as well as the broader VS Code fork ecosystem. The vulnerability was found inside the platform’s newly introduced pre-publish scanning pipeline, a security layer built to check every extension before it becomes available […]

The post https://cybersecuritynews.com/open-vsxs-new-scanner-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/open-vsxs-new-scanner-vulnerability/

BlankGrabber Stealer Uses Fake Certificate Loader to Hide Malware ...

2026-03-30T13:11:55Z

BlankGrabber Stealer Uses Fake Certificate Loader to Hide Malware Delivery Chain

A Python-based information stealer known as BlankGrabber has been caught using a deceptive certificate loader trick to hide a multi-stage malware delivery chain. First identified in 2023, this threat has grown more complex over time and keeps targeting everyday users through widely used online platforms. BlankGrabber is designed to steal as much sensitive data as […]

The post https://cybersecuritynews.com/blankgrabber-stealer-uses-fake-certificate-loader/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/blankgrabber-stealer-uses-fake-certificate-loader/

Stored XSS Bug in Jira Work Management Could Lead to Full ...

2026-03-30T12:42:10Z

Stored XSS Bug in Jira Work Management Could Lead to Full Organization Takeover

A popular collaboration tool within the Atlassian ecosystem is widely used by organizations to track projects, manage approvals, and manage daily tasks. Recently, security researchers at Snapsec uncovered a critical Stored Cross-Site Scripting (XSS) vulnerability within the platform. By exploiting a seemingly low-risk configuration field, the team demonstrated how a low-privileged user could achieve a full […]

The post https://cybersecuritynews.com/stored-xss-bug-in-jira-work-management/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/stored-xss-bug-in-jira-work-management/

CanisterWorm Malware Attacking Docker/K8s/Redis to Gain Access ...

2026-03-30T12:29:26Z

CanisterWorm Malware Attacking Docker/K8s/Redis to Gain Access and Steal Secrets

A financially motivated cybercrime group has been quietly compromising cloud environments since late 2025, and its activities are now drawing serious concern across the security community. The group, known as TeamPCP, operates a self-propagating worm called CanisterWorm that hunts for poorly secured Docker APIs, Kubernetes clusters, Redis servers, and systems vulnerable to the React2Shell flaw. […]

The post https://cybersecuritynews.com/canisterworm-malware-attacking-docker/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/canisterworm-malware-attacking-docker/

Iran-Linked Botnet Exposed After Open Directory Leak Reveals ...

2026-03-19T08:49:01Z

Iran-Linked Botnet Exposed After Open Directory Leak Reveals 15-Node Relay Network

A threat actor with ties to Iran has had their entire working infrastructure exposed after carelessly leaving an open directory on their own staging server, handing researchers a rare look into a live botnet operation. The leak revealed a 15-node relay network, a mass SSH deployment framework, DDoS tooling compiled on victim machines, and a […]

The post https://cybersecuritynews.com/iran-linked-botnet-exposed-after-open-directory-leak/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/iran-linked-botnet-exposed-after-open-directory-leak/

Chrome Zero-Day Vulnerabilities Actively Exploited in the Wild to ...

2026-03-13T07:26:57Z

Chrome Zero-Day Vulnerabilities Actively Exploited in the Wild to Execute Malicious Code

Google has released an urgent security update for its Chrome browser after confirming that two high-severity zero-day vulnerabilities are being actively exploited in the wild. The stable channel has been updated to version 146.0.7680.75/76 for Windows and macOS, and 146.0.7680.75 for Linux, with the rollout expected to reach users over the coming days and weeks. […]
The post https://cybersecuritynews.com/chrome-zero-day-vulnerabilities-actively-exploited/
.

https://cybersecuritynews.com/chrome-zero-day-vulnerabilities-actively-exploited/

OpenSSH GSSAPI Vulnerability Allow Attacker to Crash SSH Child ...

2026-03-13T03:21:00Z

OpenSSH GSSAPI Vulnerability Allow Attacker to Crash SSH Child Processes

A significant vulnerability in the GSSAPI Key Exchange patch was applied by numerous Linux distributions on top of their OpenSSH packages. The flaw, tracked as CVE-2026-3497, was uncovered by security researcher Jeremy Brown. It allows an attacker to crash SSH child processes reliably and potentially violates privilege separation boundaries, all with a single crafted network […]
The post https://cybersecuritynews.com/openssh-gssapi-vulnerability/
.

https://cybersecuritynews.com/openssh-gssapi-vulnerability/

Meta Launches New Anti-Scam Tools on WhatsApp, Facebook and ...

2026-03-13T02:14:01Z

Meta Launches New Anti-Scam Tools on WhatsApp, Facebook and Messenger

Meta has launched a suite of advanced anti-scam tools across WhatsApp, Facebook, and Messenger to combat the growing industrialization of online fraud. These new defenses combine artificial intelligence, behavioral alerts, and global law enforcement partnerships to protect users proactively. To protect users from evolving social engineering tactics, Meta introduced specific warning mechanisms across its ecosystem. […]
The post https://cybersecuritynews.com/meta-new-anti-scam-tools/
.

https://cybersecuritynews.com/meta-new-anti-scam-tools/