Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

3,763 articles

NEWSThe Register3 months ago

Every employee’s password was stored in a single Excel file

The CEO thought this was the best way to deal with some email issues

NEWShighCVE-2026-428978.1 HIGHSecurityWeek3 months ago

Microsoft Patches Exploited Exchange Server Vulnerability

The company warned about zero-day attacks exploiting the Exchange Server vulnerability CVE-2026-42897 on May 14. The post Microso…

NEWSThe Hacker News3 months ago

GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks

GitHub has announced what it said are "breaking changes" coming to npm version 12, one of which turns off install scripts by defau…

NEWShighBleeping Computer3 months ago

Max severity Ivanti Sentry vulnerability now exploited in attacks

Attackers are now targeting a recently patched maximum-severity flaw in Ivanti Sentry, enabling them to execute code with root pri…

NEWSThe Register3 months ago

Chinese agents caught rebuilding botnets and stirring the pot on AI datacenter debate

PRC eyes are watching you

NEWShighCVE-2026-50278.8 HIGHBleeping Computer3 months ago

Path traversal flaw in AI dev platform Langflow exploited in attacks

Attackers are actively exploiting CVE-2026-5027, a high-severity path traversal vulnerability in the AI development platform Langf…

NEWSWired Security3 months ago

CISA Tells US Agencies to Fix Security Bugs in as Little as 3 Days Thanks to AI Threats

“Defenders cannot afford to take weeks to patch,” one Cybersecurity and Infrastructure Security Agency official warned on Wednesda…

NEWSHackread3 months ago

FBI Seizes China-Linked Fake Consulting Sites Targeting US Clearance Holders

The Justice Department and FBI seized 13 fake consulting websites that officials say targeted US clearance holders with paid resea…

NEWSWired Security3 months ago

Trump Risks Key Surveillance Authority Over ‘Unqualified’ Spy-Chief Pick

US lawmakers are alarmed that Bill Pulte, a housing official with no intelligence experience, is poised to take charge of one of t…

NEWSBleeping Computer3 months ago

The ‘Miasma’ worm source code briefly leaked on GitHub

The Miasma credential-stealing attack framework, which has recently targeted open-source ecosystems through supply-chain attacks,…

NEWSCyberScoop3 months ago

OpenAI: ‘Likely’ Chinese influence operation tried to use ChatGPT to stir debate on data centers

The company says there’s little evidence it influenced any real policy discussion. The post OpenAI: ‘Likely’ Chinese influence op…

NEWSBleeping Computer3 months ago

GitHub announces npm security changes to tackle supply-chain attacks

GitHub has announced that npm v12, expected next month, will introduce several security-focused changes aimed at blocking supply-c…

NEWScriticalThe Register3 months ago

Angry bug hunter with Microsoft beef drops new Windows 0-day

Revenge is a dish best served code

NEWShighBleeping Computer3 months ago

Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks

Oracle PeopleSoft servers are being targeted in ongoing data theft attacks by the ShinyHunters extortion gang, which claims to hav…

NEWSHackread3 months ago

How to Turn Images into Animated Videos with AI: A Wondershare Filmora Guide

This article was created in collaboration with Wondershare.

NEWSHackread3 months ago

Scammers Use TikTok and Instagram Reels to Spread Vidar Infostealer

ReversingLabs reveals how hackers exploit social media engagement metrics to deliver Vidar infostealer malware to thousands of uns…

NEWShighSecurity Magazine3 months ago

Global Interest in AI Exploited as Social Engineering Lure

AI has become a tool for many cybercriminals seeking to advance and accelerate their attacks, but AI’s capabilities aren’t the onl…

NEWSThe Hacker News3 months ago

China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance

Cybersecurity researchers have warned of a "resurgence and expansion" of JDY, a covert network associated with China-nexus state-s…

NEWShighCyberScoop3 months ago

CISA directive orders agencies to prioritize vulnerability patching in a new way

A vulnerability that meets all four criteria would need to be fixed within three days, for instance. The post CISA directive order…

NEWSInfosecurity Magazine3 months ago

Fake Software Tutorials on TikTok Spread Vidar Stealer

Threat actors push fake free-software tutorials on TikTok and Instagram to spread Vidar stealer

NEWShighInfosecurity Magazine3 months ago

Cybersecurity Software Fails to Detect Fifth of Brower-Based Phishing Attacks

Menlo Security research warns that as enterprise applications become increasingly browser based, traditional cybersecurity tools l…

NEWSInfosecurity Magazine3 months ago

New SilabRAT Trojan Hijacks Sessions to Steal Crypto

MaaS trojan SilabRAT uses HVNC and browser cloning to hijack sessions and steal crypto

NEWSHackread3 months ago

ServiceNow Discloses Security Incident Exposing Customer Data

ServiceNow applied a security update after an API access issue exposed customer data, with affected firms notified through direct…

NEWScriticalCVE-2026-250899.8 CRITICALThe Hacker News3 months ago

Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities

Fortinet, Ivanti, and SAP have released security updates to address multiple critical security vulnerabilities that could result i…

NEWShighCVE-2026-50278.8 HIGHThe Hacker News3 months ago

Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE

A high-severity unpatched security flaw in Langflow, an open-source low-code platform to build artificial intelligence (AI) applic…

NEWSBleeping Computer3 months ago

China-linked JDY botnet expands targeting of U.S. military networks

The JDY botnet, a malware network previously associated with Chinese threat actors like Volt Typhoon, has significantly expanded i…

NEWShighCVE-2026-202457.8 HIGHThe Hacker News3 months ago

CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added three new vulnerabilities to its Known Exploited…

NEWSBleeping Computer3 months ago

The 5 Best Practices for Secure Identity Verification

Attackers are increasingly bypassing weak authentication through phishing, MFA fatigue, and service desk social engineering. Speco…

NEWSKrebs on Security3 months ago

Who Runs the Ransomware Group ‘The Gentlemen?’

A cybercrime group known as The Gentlemen has emerged as the second most active ransomware gang by victim count, rapidly attractin…

NEWSSecurityWeek3 months ago

Infostealers Turn Millions of Devices Into Credential Theft Machines

As attackers increasingly favor stolen credentials over exploits, infostealers have become a primary source of access for ransomwa…