Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

2,131 articles

NEWSInfosecurity Magazine10 days ago

SANS Warns of AI Governance Gap as Use by Security Teams Surges

SANS Institute says governance programs are still nascent even as AI failures and threats grow

NEWSThe Hacker News10 days ago

Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide

Pull the certificate off the flash of a Shark RV2320EDUS robot vacuum, and you can run root commands on other people's Shark vacuu…

NEWShighSecurityWeek10 days ago

F5 Patches Multiple NGINX, BIG-IP Vulnerabilities

Attackers could exploit the bugs to modify configurations, terminate or restart processes, cross security boundaries, leak memory,…

NEWShighInfosecurity Magazine10 days ago

US Launches Gold Eagle to Coordinate AI-Driven Vulnerability Management

The White House announced Gold Eagle to help accelerate the discovery, prioritization and patching of flaws found by AI

NEWSSecurityWeek10 days ago

China’s Top Cybersecurity Firms Hit by Mounting Military Procurement Bans

Chinese cybersecurity firms are facing action from the country’s military, but it’s not due to product or technical failures. The…

NEWSThe Hacker News10 days ago

OpenAI’s GPT-Red Automates Prompt Injection Testing to Harden GPT-5.6 Sol

OpenAI has disclosed details of GPT-Red, an internal automated red-teaming model that scales prompt injection vulnerability discov…

NEWSSecurityWeek10 days ago

Old UEFI Shims Expose Systems to Secure Boot Bypass

Signed by Microsoft, the vulnerable UEFI shim bootloaders could be abused on any system, regardless of the OS. The post Old UEFI S…

NEWScriticalCVE-2026-53412The Hacker News10 days ago

Zoom Patches Critical Windows Flaw That Could Enable Account Takeover

Zoom has released security updates for a critical security flaw impacting Zoom Workplace for Windows that could facilitate account…

NEWSThe Register10 days ago

Law firm insisted on one password to rule them all

Using the admin password, you could be anyone and see anything

NEWScriticalSecurityWeek10 days ago

Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day

The researcher stripped the proof-of-concept (PoC) exploit to prevent immediate exploitation of the vulnerability. The post Nightm…

NEWScriticalThe Register10 days ago

Tech support scam caused massive data breach at Australian airline Qantas

It’s possible to leak PII describing 5.7 million people without breaching privacy rules

NEWShighSecurityWeek10 days ago

Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities

The cybersecurity companies patched critical and high-severity vulnerabilities in some of their products. The post Trend Micro, Ta…

NEWScriticalThe Register10 days ago

Cyberattack threatens utterly critical infrastructure in Japan: KFC

The Colonel stops taking online orders and may close stores after logistics partner’s systems go down

NEWSBleeping Computer11 days ago

Dutch police bust investment fraud ring stealing over €100 million

The Dutch Police announced the arrest of multiple individuals suspected of being part of an international investment fraud scheme…

NEWSWired Security11 days ago

Here’s the Truth About Whether Meta’s NameTag Face Recognition Tech ‘Exists’

Since WIRED reported on Meta’s NameTag face recognition system, company executives have made confusing and conflicting remarks abo…

NEWSCyberScoop11 days ago

Security researchers find stalkers abusing Chrome’s sync feature

Certo Software warns that the capability, designed for convenience, can easily be used to spy on online activity. The post Securit…

NEWScriticalBleeping Computer11 days ago

Zoom warns of critical account takeover vulnerability

Zoom is warning of a critical vulnerability in its desktop client and software development kit for Windows that could be exploited…

NEWScriticalCyberScoop11 days ago

SonicWall customers under threat as attackers exploit 2 zero-days

Researchers said the vulnerabilities, which attackers are chaining together, were first exploited three weeks before the vendor di…

NEWSThe Hacker News11 days ago

TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development

Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things (IoT) botnet framework dubbed TuxBo…

NEWShighBleeping Computer11 days ago

Google Gemini CLI abused as a hacking agent, malware botnet operator

A Russian-speaking threat actor known as "bandcampro" used Google's open-source Gemini CLI AI tool as a hacking agent and to opera…

NEWSCyberScoop11 days ago

Dems press DNI nominee Jay Clayton on election security questions, but leave dismayed

Clayton maintained he was not an “election denier” but wouldn’t directly answer a number of questions about the 2020 race, his pre…

NEWSHackread11 days ago

Fake Céline Dion Paris Tickets Sold on Facebook and Ticketmaster Clones

Group-IB says scammers are targeting Céline Dion fans through Facebook, duplicate digital tickets and fake websites impersonating…

NEWShighBleeping Computer11 days ago

AsyncAPI npm packages infected with credential-stealing malware

Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that delive…

NEWShighThe Hacker News11 days ago

OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps

A malware framework called OkoBot has been running on Windows machines since April 2025, and one of its modules is built to con ha…

NEWSCyberScoop11 days ago

Forget the model. When it comes to cybersecurity, it’s all about the harness

Industry has quickly developed tools meant to guide and direct frontier LLMs in cybersecurity. Attackers aren’t far behind. The po…

NEWShighThe Register11 days ago

CISA sounds alarm over trio of exploited SharePoint flaws

Three bugs are under active attack, and two more critical holes could add to the pain

NEWShighInfosecurity Magazine11 days ago

Phishing Campaign Abuses eCards to Deploy RMM Tools

Six-month phishing campaign used seasonal eCard lures to plant legitimate RMM tools on victims

NEWShighSecurityWeek11 days ago

Unpatched Cursor Vulnerability Exposes Users to Code Execution

An attacker can create a malicious repository containing a git.exe in the project root, and Cursor executes it automatically. The…

NEWShighSecurityWeek11 days ago

CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities

Three vulnerabilities are actively exploited in attacks, including two that have been targeted as zero-days. The post CISA Urges I…

NEWScriticalBleeping Computer11 days ago

We built a vulnerability vending machine: AI tokens in, zero-days out

Intruder built an AI-powered "vulnerability vending machine" that combines code slicing with LLMs to automatically discover comple…

Attack & News

SANS Warns of AI Governance Gap as Use by Security Teams Surges

Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide

F5 Patches Multiple NGINX, BIG-IP Vulnerabilities

US Launches Gold Eagle to Coordinate AI-Driven Vulnerability Management

China’s Top Cybersecurity Firms Hit by Mounting Military Procurement Bans

OpenAI’s GPT-Red Automates Prompt Injection Testing to Harden GPT-5.6 Sol

Old UEFI Shims Expose Systems to Secure Boot Bypass

Zoom Patches Critical Windows Flaw That Could Enable Account Takeover

Law firm insisted on one password to rule them all

Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day

Tech support scam caused massive data breach at Australian airline Qantas

Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities

Cyberattack threatens utterly critical infrastructure in Japan: KFC

Dutch police bust investment fraud ring stealing over €100 million

Here’s the Truth About Whether Meta’s NameTag Face Recognition Tech ‘Exists’

Security researchers find stalkers abusing Chrome’s sync feature

Zoom warns of critical account takeover vulnerability

SonicWall customers under threat as attackers exploit 2 zero-days

TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development

Google Gemini CLI abused as a hacking agent, malware botnet operator

Dems press DNI nominee Jay Clayton on election security questions, but leave dismayed

Fake Céline Dion Paris Tickets Sold on Facebook and Ticketmaster Clones

​ ​AsyncAPI npm packages infected with credential-stealing malware

OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps

Forget the model. When it comes to cybersecurity, it’s all about the harness

CISA sounds alarm over trio of exploited SharePoint flaws

Phishing Campaign Abuses eCards to Deploy RMM Tools

Unpatched Cursor Vulnerability Exposes Users to Code Execution

CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities

We built a vulnerability vending machine: AI tokens in, zero-days out

AsyncAPI npm packages infected with credential-stealing malware