Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,451 articles

ConnectWise Suspends Cloud Services in Response to Cyberattack

The services remain unavailable as the company continues remediation and security validation. The post ConnectWise Suspends Cloud…

NEWSThe Hacker News6 days ago

GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into…

NEWSBleeping Computer6 days ago

Microsoft fixes classic Outlook bug that hid Copilot buttons

Microsoft has fixed a known issue that removed the Copilot Chat and Copilot buttons in the classic Outlook desktop mail client for…

NEWShighSecurityWeek6 days ago

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

Threat actors have been observed delivering cryptocurrency miners and proxy software. The post Plex2Shell Exploit Chain Weaponized…

NEWSHackread6 days ago

Fake Calendar Invites Target 40,000 Firms in Microsoft Credential Theft

More than 40,000 organisations have received fake calendar invitations designed to steal Microsoft account credentials, according…

NEWSSecurityWeek6 days ago

One Compromised Login Exposed Millions of California Students’ Records

Intruders used compromised credentials to access an ETS SFTP server, copying records of California students back to 2006. The post…

NEWSThe Hacker News6 days ago

From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software

In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updat…

NEWShighSecurityWeek6 days ago

Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack

The persistent, stealthy FortiGate implant was deployed against a telecommunications organization. The post Exploited Fortinet Bug…

NEWSInfosecurity Magazine6 days ago

ConnectWise Shuts Off Cloud Services After ‘Unauthorized Access’ to Microsoft 365 Tenants

Cloud Backup, SaaS Security, and Cloud Management services offline as IT service provider investigates possibility that unknown at…

NEWShighHackread6 days ago

OpenAI Model Hacked Crypto Wallet and Spent Funds to Deploy Smart Contracts

OpenAI disclosed that an internal AI model hacked a crypto wallet and spent Sepolia test ETH without permission…

NEWShighThe Hacker News6 days ago

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious…

NEWSCyberScoop6 days ago

Spyware found on devices belonging to prominent Serbian critics as elections loom

The confirmed and suspected targets include a university rector backing Serbia's protests and a prosecutor who investigated a Trum…

NEWSInfosecurity Magazine6 days ago

US Cybersecurity Job Postings Fall 26%, Hitting Four Year Low

CyberSN observed a particularly big dip in cybersecurity leadership positions such as CISO and Cybersecurity Director in 2026 comp…

NEWSSecurityWeek6 days ago

MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks

Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics. The post MITRE ATT&CK v20…

NEWSBleeping Computer6 days ago

Microsoft: October Windows Server updates break Exchange sign-in, mail flow

Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some…

NEWSSecurityWeek6 days ago

Anthropic Acquires Confidential AI Startup Opaque Systems

Opaque Systems has developed technology that lets AI systems use sensitive data while keeping it protected by the underlying hardw…

NEWSThe Hacker News6 days ago

Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers

A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without…

NEWSThe Hacker News6 days ago

OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys

An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys t…

NEWSThe Register7 days ago

ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU

Huntress alleges takeover of M365 accounts

NEWScriticalCVE-2026-999999.3 CRITICALThe Register7 days ago

Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking

Party like it’s CVE-2026-99999 – a 9.3-rated nasty called PwnEscape

NEWShighBleeping Computer7 days ago

Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root

Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root…

NEWSSecurityWeek7 days ago

US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars

CyberSN’s Cybersecurity Jobs Report provides visibility into the US cybersecurity job market. It’s a mixed bag. The post US Cybers…

NEWSThe Hacker News7 days ago

ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an in…

NEWShighBleeping Computer8 days ago

Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack

ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed appli…

NEWScriticalBleeping Computer8 days ago

Drupal patches critical RCE flaws, warns exploits may emerge soon

Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any suppor…

NEWSWired Security8 days ago

Encryption Is Getting Squeezed From All Sides

Canada’s planned surveillance law is the latest grim step in a series of threats to encryption that are spreading around the world…

NEWSThe Register8 days ago

Cybercrims go beyond stealing data to attack physical building systems

'Hold my beer, have fun getting into your offices'

NEWSThe Hacker News8 days ago

MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack…

NEWSSecurityWeek8 days ago

Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets. The…

NEWShighThe Hacker News8 days ago

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compro…