Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

2,131 articles

Hackers abuse ViPNet software to target Russian govt agencies

An advanced threat actor is abusing the update mechanism for the ViPNet private networking product suite to target Russian organiz…

NEWShighThe Hacker News7 days ago

UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware

Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into…

NEWScriticalThe Hacker News7 days ago

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Acces…

NEWShighBleeping Computer7 days ago

Update now: 7-Zip fixes RCE flaw exploitable with malicious archives

7-Zip version 26.02 was released to fix a remote code execution vulnerability that could allow attackers to execute malicious code…

NEWShighBleeping Computer8 days ago

WordPress Core "wp2shell" RCE flaws get public exploits, patch now

Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core, mak…

NEWSBleeping Computer8 days ago

Microsoft warns of surge in ACR Stealer attacks on customers

Microsoft has observed a surge in attacks using the ACR Stealer malware to steal browser-stored passwords, authentication tokens,…

NEWSBleeping Computer8 days ago

The Future of Age Verification: Your Face Never Leaves Your Device

As age verification laws expand worldwide, organizations face growing pressure to protect users' privacy while meeting regulatory…

NEWSWired Security8 days ago

Your Period Tracker Is (Probably) Spying on You

Plus: Russian cyberspies turn to infrastructure hacking, DHS repeatedly fails to realize it’d been hacked, a breach exposes an AI…

NEWShighWired Security8 days ago

Prompt Injection Attacks Are Thwarting AI Hacking Agents

“Context bombing” tricks malicious AI agents into shutting down before they can do harm.

NEWSThe Hacker News8 days ago

New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

An anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable…

NEWSBleeping Computer8 days ago

Abbott Laboratories probes two cyber incidents amid extortion claims

Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy…

NEWSThe Hacker News8 days ago

OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On the glibc…

NEWSThe Hacker News8 days ago

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem…

NEWSBleeping Computer9 days ago

HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload

A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on OpenSSL serve…

NEWSThe Hacker News9 days ago

New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens

A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 uniq…

NEWSThe Hacker News9 days ago

GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft

Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster dubbed Cylindrica…

NEWSThe Register9 days ago

AI spam filters are getting suckered by old-school text salting

Turns out decades-old email tricks still work against some LLM-powered email filters

NEWSCyberScoop9 days ago

State officials, election experts pan Trump speech: ‘This is what desperation looks like’

The president’s speech re-hashed debunked conspiracies around U.S. elections. Critics say the administration’s 18-month investigat…

NEWSInfosecurity Magazine9 days ago

Government Agencies Falling Victim to Ransomware Daily, Warns Study

Government organizations are targeted by attackers who know agencies cannot afford disruption to public services

NEWScriticalBleeping Computer9 days ago

Ernst & Young discloses data breach after support system hack

Ernst & Young is notifying customers of a data breach caused by the compromise of a third-party support ticket system used by its…

NEWScriticalInfosecurity Magazine9 days ago

23andMe Faces New Security Mandates in $18m Data Breach Settlement

23andMe has agreed to an $18m settlement with 42 US attorneys general over its 2023 data breach, including enhanced data protectio…

NEWShighSecurityWeek9 days ago

In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint

Noteworthy stories that might have slipped under the radar: OpenClaw AI agents exploited via WhatsApp, ransomware hits naval defen…

NEWSCyberScoop9 days ago

Leading members of Scattered Spider sentenced in UK to 66 months in jail

Thalha Jubair and Owen Flowers led and directed many attacks attributed to the hacker subset of The Com. U.S. authorities previous…

NEWSBleeping Computer9 days ago

Inside the Search for "Clean" Residential Proxies for Carding

Residential proxies are no longer the silver bullet they once were for carding. Flare explains why cybercriminals increasingly see…

NEWShighHackread9 days ago

“TTF Trap” Phishing Emails Use Fake Font Files to Deliver Windows Malware

An email that appears to contain a shipping document, payment request, or business proposal can infect a Windows…

NEWShighThe Hacker News9 days ago

Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image fil…

NEWSSecurityWeek9 days ago

Podcast: Broken Governance, Agentic AI, and the MindStone Agent Exclusive

(Video) Artificial intelligence is transforming cybersecurity, but are governance, compliance, and security practices evolving fas…

NEWScriticalThe Register9 days ago

Attackers target critical FortiSandbox flaws as CISA issues patch order

Command injection vulns land on exploited list after researchers spot abuse attempts

NEWSThe Hacker News9 days ago

E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants

The European Commission on Thursday ordered Google to give rival AI assistants the same reach into Android that Gemini already has…

NEWSSecurityWeek9 days ago

Beacon Security Raises $13 Million for Security Data Platform

The startup helps organizations detect, hunt, and protect their assets across environments at machine speed. The post Beacon Secur…