Attack &amp; News

NEWSBleeping Computer3 months ago

Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks

Calling all defenders

Unlimited Technology Systems breach impacts 3.8 million people

Healthcare software company Unlimited Technology Systems reported that more than 3.8 million people were impacted by a data breach…

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cr…

ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-…

NEWSCyberScoop3 months ago

UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

A recent wave of cyber attacks targeting financial services, private equity, and professional services is attributed to a data ext…

More than half of AI-generated patches are broken

Research finds your AI generated security patch is more likely to fail than fully fix a vulnerability. It might even introduce bra…

NEWScriticalThe Register3 months ago

Ransomware attacks spike as world distracted by AI

What, you didn't think the top gangs were busy watching agents escape their sandboxes too, did you?

NEWShighBleeping Computer3 months ago

Levi Strauss & Co. says hackers stole corporate data in cyberattack

Levi Strauss & Co. (Levi's) says that hackers used social engineering on three of its employees to gain access to and steal corpor…

NEWShighSecurityWeek3 months ago

N-able God mode flaw: Vendor confirms attackers reached customer networks as second hotfix lands

Attackers turned admin access into a route downstream, while N-able tells N-central customers to patch – again

In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street

Noteworthy stories that might have slipped under the radar: ban on Chinese data center tech, QuickFox VPN supply chain attack, IEH…

NEWSCyberScoop3 months ago

Coast Guard says it is monitoring cyberattack that disrupted North Carolina’s ports

The cyberattack hit gate systems at all three North Carolina ports, as officials continue investigating the breach and its effects…

NEWSBleeping Computer3 months ago

MIT boffins' TONTOU attack slips through Spectre defenses on Intel and AMD CPUs

Timer interrupts reopen branch predictor poisoning window, with a working Zen 2 exploit to prove it

Real emails, hijacked payments: Two H1 2026 attack chains

Gen's H1 2026 Threat Report examines two separate attack chains. One used compromised business inboxes and browser manipulation in…

NEWSBleeping Computer3 months ago

Scot NHS trust probes access to medical records of 9-year-old girl after man arrested on suspicion of murder

Investigation into whether staff improperly accessed Minnie Merriman’s file after she was named for the first time this week

North Carolina Ports confirms cyberattack disrupting operations

The North Carolina Ports Authority has confirmed that a cyberattack disrupted IT systems and slowed operations at Port of Wilmingt…

NEWSCVE-2026-64638The Hacker News3 months ago

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version…

NEWShighThe Register3 months ago

Growing Up The Hard Way

Open Source had a great childhood. For two decades it got to be a kid. It ran around barefoot, gave everything away, trusted stra…

Attacker phished way into US defense supplier's Microsoft 365 account

Intruder gained access to engineering files and potentially export-controlled technical data

18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers

A use-after-free bug in Linux's SCTP networking code can be turned into full root on a host, and Tencent researchers say they used…

NEWSInfosecurity Magazine3 months ago

Vishing Extortion Group UNC6671 Rebrands After Making Millions

Initially calling itself BlackFile, the group has expanded operations to the Redact, Pink, Helix, and Falcon brands. The post Vish…

Healthcare and Victim Support Charities Affected by Beacon Cyber Incident

Beacon has informed around 1500 customer charities that its CRM databases were accessed and likely exfiltrated by an unauthorized…

NEWShighThe Hacker News3 months ago

Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

Cybersecurity researchers have called attention to an active "widespread email-driven phishing campaign" that employs adversary-in…

NEWScriticalThe Hacker News3 months ago

AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle, generated and pr…

'Asimov was right' about rules for robots, says ex-US Cyber Director

Humans will get the AI models they deserve

NEWSInfosecurity Magazine3 months ago

Truck Brake Controller’s Safety Recall Doubled as Hidden Security Fix

NMFTA research shows a Bendix EC80 brake controller safety recall also patched remote code execution and DoS vulnerabilities. The…

Google Links Redact Extortion Group to BlackFile Rebrand

BlackFile has rebranded as Redact after an alleged affiliate hijack, with Google linking the group to ongoing vishing and extortio…

New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NA…

Black Hat USA 2026 – Summary of Vendor Announcements (Part 4)

Companies are showcasing their products and services this week at the 2026 edition of the Black Hat conference in Las Vegas. The p…