Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,718 articles

Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’

Dropped on Patch Tuesday, the exploit allows any user to spawn a shell with System privileges. The post Nightmare Eclipse Drops Wi…

NEWSInfosecurity Magazine3 months ago

ICO Reprimands Criminal Records Office After 2023 Breach

The ICO has issued a formal reprimand to ACRO after patching and security monitoring failures led to a breach

NEWSThe Register3 months ago

Passwords stored in public Google Doc then showed up in search results

Developer spotted hostname and credential string lurking in autocomplete

NEWShighCVE-2026-550409.1 CRITICALThe Hacker News3 months ago

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Threat actors have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-conce…

NEWSThe Register3 months ago

Chinese Loongson processors have leaky caches, researchers find

Attackers could extract data, even working from inside a guest VM

NEWSBleeping Computer3 months ago

"City-Forum" data-theft attacks target Salesforce, ServiceNow portals

An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and…

NEWShighBleeping Computer3 months ago

Android malware combo takes out loans and relays victims' credit cards

A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal liv…

NEWSThe Register3 months ago

'Near-autonomous' AI agents attack Taiwan's nuclear safety agency

Some say the world will end in fire, some say an agentic swarm

NEWScriticalCVE-2026-713629.1 CRITICALBleeping Computer3 months ago

Hackers exploit critical Adobe Commerce flaw to hijack customer accounts

Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detec…

NEWSThe Register3 months ago

Spectre rears its ugly head again as researchers show some RISC-V chips are susceptible

Eight years on, we're still paying to hide the future glimpsed during speculative execution

NEWSBleeping Computer3 months ago

Hundreds of fake Chrome VPN extensions route traffic through a proxy

More than 737 browser extensions published on the Chrome Web Store impersonated well-known VPN and proxy services while routing us…

NEWScriticalThe Register3 months ago

Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows

Exploit Wednesday's back, baby

NEWScriticalThe Hacker News3 months ago

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security…

NEWSCyberScoop3 months ago

Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan

Israeli cyber firm Dream said the framework adapted mid-operation, corrected its mistakes and expanded as it went along. The post…

NEWSBleeping Computer3 months ago

Plug and Pwn attack uses fake USB devices for Windows SYSTEM access

Security researchers have disclosed new "Plug and Pwn" attacks that abuse the Windows Plug and Play feature to trigger Windows int…

NEWScriticalCVE-2026-688207.0 HIGHBleeping Computer3 months ago

Lazarus hackers exploited Windows zero-day to target defense firms

North Korean hackers have been exploiting a Windows zero-day vulnerability (CVE-2026-68820) to target defense-sector companies as…

NEWShighSecurityWeek3 months ago

SharePoint Vulnerability Exploited Shortly After PoC Release

The vulnerability was patched by Microsoft in July and CISA warned that it could end up being exploited in the wild. The post Shar…

NEWSThe Register3 months ago

Uber Freight keeps on trucking after extortion crew breaks in

Helix claims nearly a million files, while the logistics biz says operations never hit the brakes

NEWShighInfosecurity Magazine3 months ago

WindRelay Malware Pairs With SpyNote RAT in Live-Call Scam

New WindRelay NFC malware paired with SpyNote RAT let a fraudster clone a card mid-call

NEWShighBleeping Computer3 months ago

FBI: Hackers target online accounts to steal nude photos

The FBI warns that cybercriminals are targeting adults' and children's social media and other online accounts to steal sexually ex…

NEWSThe Hacker News3 months ago

737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One

A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to block…

NEWSBleeping Computer3 months ago

The Threat Hiding in Your Hiring Process: How Fake Remote Workers Get In

Fake remote workers can exploit gaps between hiring checks, device delivery, and account access to enter organizations under false…

NEWSThe Register3 months ago

Exposed: Woeful security at UK criminal records office that led to sensitive data leak

Nobody patched the CMS or read the alerts, and ACRO still cannot tell whether info was exfiltrated

NEWScriticalInfosecurity Magazine3 months ago

Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day

Lazarus malware used post-quantum key exchange to protect delivery of a Windows zero-day exploit

NEWSSecurityWeek3 months ago

Mindgard Raises $30 Million to Protect AI Systems

The cybersecurity startup will use the fresh investment to scale its product, engineering, sales, and marketing teams. The post Mi…

NEWScriticalInfosecurity Magazine3 months ago

Gunra Ransomware Exploits Fortinet Flaws to Target Critical Infrastructure

Gunra actors are using stealth to exfiltrate vast volumes of data from Microsoft services, US and Korean agencies have warned

NEWSThe Register3 months ago

Akira ransomware scum blocked victim's security tools – and broke their own encryptor

Gives a whole new meaning to Safe Mode

NEWSSecurityWeek3 months ago

WhatsApp Unveils New Scam Alert Feature

Signal has also made a security announcement: an automatic key verification feature to complement its safety number system. The po…

NEWSSecurityWeek3 months ago

Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset

Researchers observed the novel campaign exploiting unauthenticated guest access to quietly enumerate and exfiltrate exposed data f…

NEWSInfosecurity Magazine3 months ago

NIST Seeks Public Input on AI-Ready NVD Modernization

The US National Institute for Standards and Technology wants to modernize its National Vulnerability Database to embrace AI-powere…