Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,720 articles

BdThemes plugins supply-chain hack creates rogue WordPress admins

A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modifie…

NEWShighThe Register3 months ago

DEF CON hackers add new muscle to water utility protection

Franklin project adds new security providers, employs digital twins and AI

NEWSCyberScoop3 months ago

OpenAI says Daybreak will expand to offer specialized cyber services

The company rolled out “Red” and “Blue” programs for defenders, introduced a new model and announced partnerships with 16 major cy…

NEWShighCyberScoop3 months ago

NATO and an AI startup can now name and track software vulnerabilities

NATO’s cyber defense arm and a startup that uses artificial intelligence to find software flaws can now issue the ID numbers the i…

NEWSBleeping Computer3 months ago

OpenAI releases ChatGPT 5.6 Cyber, but it's only for approved users

OpenAI has developed a new model called "GPT 5.6 Cyber," designed for vulnerability research, penetration testing, incident respon…

NEWSCyberScoop3 months ago

U.S., South Korean government agencies caution to be on lookout for Gunra ransomware gang

The ransomware-as-a-service outfit has gone after a range of critical infrastructure sectors across the globe. The post U.S., Sout…

NEWSBleeping Computer3 months ago

New StormEncryptor ransomware used by former Medusa affiliate

A financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware…

NEWSThe Register3 months ago

North Korean spies are running local LLMs to cause AI mischief

Kimsuky's phishing attacks get an AI boost

NEWShighThe Register3 months ago

Gym rat asks AI agent to book him a class, it hacks a waitlist API to bump him up the list

What wouldst thou ask of the monkey's paw?

NEWShighThe Hacker News3 months ago

China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw

Microsoft has disclosed that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumen…

NEWShighInfosecurity Magazine3 months ago

Researchers Uncover RovoBlast Vulnerability in Atlassian AI Assistant

Atlassian fixed a flaw letting one crafted link make its Rovo AI assistant exfiltrate company data

NEWSCyberScoop3 months ago

UK man tied to The Com sentenced for abusing 117 victims

Justin Swaddle, who was a minor when he committed the crimes, coerced children across multiple countries into self-harm and sexual…

NEWScriticalThe Hacker News3 months ago

⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors

A lot of security problems still begin with someone doing a completely normal thing. Cloning a repo. Answering a call. Leaving a b…

NEWShighBleeping Computer3 months ago

CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

CISA has confirmed that ransomware gangs have begun exploiting two recently patched SonicWall SMA1000 vulnerabilities, including a…

NEWSSecurityWeek3 months ago

OpenAI’s Upcoming Astra Model Raises Autonomous Cyberattack Concerns

The current GPT-5.6-Sol has been assigned a ‘high’ cybersecurity threshold, but Astra could reach the maximum ‘critical’ threshold…

NEWSInfosecurity Magazine3 months ago

WordPress Plugins Compromised Without a Single File Change

Poisoned JSON feed let attackers backdoor WordPress sites without changing any plugin files

NEWSCyberScoop3 months ago

Why transparent AI agents matter more than you think

The difference between a prompt injection attack you'll catch and one you won't might just be whether your AI agent can explain it…

NEWSSecurityWeek3 months ago

Stealthium Targets Security Blind Spots in AI Accelerators and Neo-Clouds

The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powe…

NEWShighSecurityWeek3 months ago

Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC

Remote, unauthenticated attackers could exploit the bugs to cause a denial-of-service (DoS) condition. The post Cisco Warns of Hig…

NEWSBleeping Computer3 months ago

When Credentials Are No Longer Enough: Device Trust in the AI Era

AI is making phishing, credential theft, and social engineering faster and more efficient, while traditional trust signals such as…

NEWSThe Register3 months ago

Attackers pick Levi's pockets in social engineering attack

Crims talked their way onto three employee PCs before trousering corporate data

NEWSThe Register3 months ago

Wetherspoons bars smart glasses from filming customers

Pub chain says turn off the cameras, reminds punters not to blare sound from phone vids either

NEWShighThe Hacker News3 months ago

Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development

North Korea's state hackers are no longer content to type prompts into public chatbots. One of the country's main espionage groups…

NEWSSecurityWeek3 months ago

‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad

An AI agent executes instructions that an attacker has planted in the log or alert that records a blocked request word for word. T…

NEWSBleeping Computer3 months ago

Member of The Com sent to prison for blackmail, sextortion

A member of "The Com," a loose-knit online cybercrime collective that targets children and teenagers, has been sentenced to two ye…

NEWShighThe Hacker News3 months ago

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they r…

NEWShighThe Register3 months ago

Cyber vulnerability sweep picks up Royal Navy drones sending data to China

No, no nasties to see here, guv...

NEWSBleeping Computer3 months ago

LexisNexis shuts down services after suspicious activity on servers

LexisNexis took its Diligence, Metabase API, and Newsdesk services offline as part of its response to unusual activity on servers…

NEWSThe Hacker News3 months ago

Shipping 10–50× More Code? Watch This Webinar on Securing AI-Speed Development

AI is helping development teams produce far more code, far faster. But security teams still have to review vulnerabilities, manage…

NEWScriticalBleeping Computer3 months ago

Valve notifies Steam hardware customers of a data breach

Video game publisher and digital distribution giant Valve is notifying Steam hardware customers in Europe that hackers stole their…