Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,449 articles

OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication

OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (…

NEWSHackreadabout 18 hours ago

SPECTER Attack Uses USB Power Signals to Leak Data From Air-Gapped PCs

Researchers demonstrated SPECTER, a technique that leaks data from compromised air-gapped PCs through USB power controls, phone ch…

NEWShighBleeping Computerabout 20 hours ago

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to by…

NEWSThe Registerabout 21 hours ago

Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds

Designed to carry out 100,000 steps without human approval

NEWShighWired Securityabout 22 hours ago

The PHP Meltdown Shows How AI Makes Bugs More Exploitable

Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assist…

NEWSThe Hacker Newsabout 23 hours ago

Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026…

NEWSThe Hacker Newsabout 23 hours ago

Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads

Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemi…

NEWSThe Hacker News1 day ago

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did…

NEWSCVE-2026-111497The Hacker News1 day ago

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the…

NEWScriticalCVE-2026-110447The Hacker News1 day ago

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Bu…

NEWSBleeping Computer1 day ago

Abandoned Popcorn Time app exposed millions of device to RCE attacks

Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client…

NEWScriticalThe Register1 day ago

There's a third PHP2Shell bug, but it won't get an emergency fix

Bad things (and software bugs?) come in threes

NEWSThe Register1 day ago

Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack

Monitoring was only partial and was easily bypassed

NEWSHackread1 day ago

GoDaddy Revokes 404,607 SSL Certificates After Policy Errors

GoDaddy revoked 404,607 SSL/TLS certificates after finding certificate-policy errors, with affected sites including some Gibraltar…

NEWShighBleeping Computer1 day ago

Microsoft Teams to get AI-powered, context-aware phishing detection

Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. [...]

NEWSThe Hacker News1 day ago

BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bo…

NEWScriticalThe Hacker News1 day ago

Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws

Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the lan…

NEWSThe Hacker News1 day ago

Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC…

NEWSHackread1 day ago

Overlord RAT Uses Fake Legal Notices to Infect Windows PCs in New Campaign

WatchGuard details Overlord RAT attacks using fake Brazilian legal notices, plus Lampion malware and a separate remote access…

NEWSBleeping Computer1 day ago

Microsoft: Windows Server 2016 reaches end of support in January

Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. [...]

NEWScriticalBleeping Computer1 day ago

Quest Diagnostics confirms data breach exposed patient records

American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gaine…

NEWSCyberScoop1 day ago

Senators say targeted ads are a security risk. Ad groups say the critics are off base.

Citizen Lab’s AdFection findings have senators pushing for industry improvements, while IAB Europe and Google defend their vetting…

NEWSSecurity Magazine1 day ago

U.S. Banks Detect Unauthorized AI Agents Accessing Accounts

Unauthorized third-party AI agents are accessing banks in the United States, with some attempting to act independent of user instr…

NEWShighBleeping Computer2 days ago

PHP shares mitigation for new RCE vulnerability with no patch

The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-d…

NEWSSecurityWeek2 days ago

In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware

Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, Shi…

NEWSHackread2 days ago

When It Makes Sense to Replace a Legacy Virtualization Stack

Virtualization platforms often remain in place long after their original purpose because migration carries operational risk. Yet a…

NEWSBleeping Computer2 days ago

You gave your AI agent access, but who is giving it orders?

AI agents can be manipulated through malicious emails, websites, and plugins into executing commands, stealing data, or deleting f…

NEWSSecurity Magazine2 days ago

Cyber Breach Hits Quest Diagnostics, Patient Records May Be Affected

Quest Diagnostics, a diagnostic information services provider, revealed it experienced a cyber breach.

NEWShighThe Hacker News2 days ago

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as…

NEWSBleeping Computer2 days ago

HPE patches eight max severity RCE and auth bypass AOS flaws

Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), in…