Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,431 articles

NEWSThe Register4 months ago

Cloudflare teams up with big browsers to help websites tell bots from people

Makers of Chrome, Edge, Firefox back bot-fraud defense called Private Access Control Tokens

NEWSBleeping Computer4 months ago

FortiBleed campaign used custom FortiGate sniffer to steal credentials

Security firm SOCRadar says the large-scale FortiBleed campaign targeting Fortinet FortiGate devices used custom sniffers to harve…

NEWSCyberScoop4 months ago

Trump administration to order agencies to speed up post-quantum migration, boost industry

President Trump signed two executive orders Monday accelerating the federal government’s transition to post-quantum encryption and…

NEWShighThe Register4 months ago

Security shops among the 'hundreds' of Klue hack victims

As yet another extortion crew Icarus exploits Salesforce-linked integrations

NEWShighThe Hacker News4 months ago

ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack

Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack after unknown threat actors managed to tamp…

NEWSHackread4 months ago

Beats Studio Buds Flaw Could Let Nearby Attackers Eavesdrop on Users

Apple has released a security update to patch a Beats Studio Buds flaw that let nearby hackers listen to conversations through the…

NEWSBleeping Computer4 months ago

Microsoft says Windows 11 26H2 is coming soon, details upgrade process

Microsoft has confirmed that Windows 11 version 26H2 will be the next feature update and that devices running Windows 11 24H2 and…

NEWSBleeping Computer4 months ago

Microsoft fixes AutoGen Studio flaw that enabled code execution

A vulnerability chain dubbed AutoJack in Microsoft's AutoGen Studio interface for prototyping AI agents could let attackers manipu…

NEWSWired Security4 months ago

OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic’s Mythos

Amid concerns about AI models’ cybersecurity capabilities, OpenAI revealed an improved version of GPT-5.5-Cyber and its “Patch the…

NEWSThe Hacker News4 months ago

Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants

Cybersecurity researchers have disclosed details of four vulnerabilities in Dify, an open-source agentic workflow platform with mo…

NEWSCyberScoop4 months ago

Intel agencies: Frontier AI models will reshape cybersecurity faster than expected

The joint warning from Five Eyes countries mirrors what many cybersecurity and AI experts have been saying for the past year. The…

NEWScriticalHackread4 months ago

Texas Parks and Wildlife Data Breach Affects Over 3M License Customers

Around 3 million Texas licence holders face a data breach after hackers targeted a third-party vendor, exposing driver's licences…

NEWSInfosecurity Magazine4 months ago

GentleKiller Framework Disables Victims' Security Software

ESET details GentleKiller, the EDR-killer framework the Gentlemen ransomware gang gives affiliates

NEWSThe Hacker News4 months ago

29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests

A heap over-read in the Squid web proxy can leak another user's cleartext HTTP request, including any credentials or session token…

NEWScriticalThe Register4 months ago

Canadian utility fesses up to data breach, but key details remain off-grid

London Hydro says names, addresses, account details may have been exposed, but much about the intrusion is unknown

NEWSHackread4 months ago

Threat Hunting Beyond Alerts: Finding the Activity Detection Misses

Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.

NEWSBleeping Computer4 months ago

A Glimpse into the “Search Your Target” Market for Stolen Credentials

Attackers no longer need to sift through massive credential dumps. They can pay others to do it for them. Flare explores how an em…

NEWSInfosecurity Magazine4 months ago

Unpatchable BootROM Flaw Impacts Apple A12, A13 Chips

Apple BootROM exploit exposes unpatchable USB flaw on A12 and A13 devices

NEWSSecurityWeek4 months ago

Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data

Squidbleed, discovered with the aid of Claude Mythos Preview, has been described as a Heartbleed-style vulnerability. The post De…

NEWSThe Hacker News4 months ago

New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer

Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported…

NEWScriticalThe Register4 months ago

Brazil probes emergency warning system after nationwide rogue alert

Severe weather event alert platform buzzed devices across the country with the word 'misanthropy'

NEWSHackread4 months ago

Scammers Use Fake GitHub Stars, VirusTotal Reviews to Spread Crypto Clipper

A multi-platform malware campaign abuses fake trust signals to infect Windows and Mac users with a crypto clipper packed with 15,5…

NEWSThe Hacker News4 months ago

Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries

Google has set September 30, 2026, as the day it begins enforcing Android developer verification in the first four countries, and…

NEWSThe Hacker News4 months ago

Stop Your Legacy Infrastructure from Hijacking Your AI Agents

Earlier this month, I spoke at the Gartner Security & Risk Management Summit about a blind spot most security programs are still n…

NEWShighSecurityWeek4 months ago

Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data

Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data. The post Attackers Expl…

NEWSInfosecurity Magazine4 months ago

Microsoft Attributes Mastra AI Supply Chain Attack to North Korea

North Korean threat actor Sapphire Sleet has been linked to a supply chain attack targeting Mastra, according to Microsoft securit…

NEWShighThe Register4 months ago

Health board apologizes for phishing staff with with bogus vacation day

IT thought a fake offer of extra time off for hard-pressed Canadian medical workers was the way to go

NEWShighSecurityWeek4 months ago

North Korean Hackers Blamed for Mastra NPM Supply Chain Attack

A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions. The…

NEWSHackread4 months ago

Salesforce Disables Klue Integration After OAuth Token Theft Hits Customer Data

Icarus extortion group used a legacy Klue Battlecards credential to bypass security and steal bulk Salesforce records from affecte…

NEWSThe Hacker News4 months ago

⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More

It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomwa…