Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,414 articles

Hackers Use Fake Claude Code Guide and AI PDFs to Spread AsyncRAT Malware

Hackers are using fake Claude Code guide and AI PDFs to spread AsyncRAT malware via Windows attack using PowerShell and Defender…

NEWSSecurityWeek4 months ago

CISA Directs Federal Agencies to Prioritize Security Patches Based on Risk

The new BOD 26-04 requires agencies to review and update vulnerability management policies with a focus on KEV catalog entries. Th…

NEWSSecurityWeek4 months ago

OnyxC2 Stealer Offers Cybercriminals Enterprise-Grade Theft for $250 a Month

Researchers say the OnyxC2 malware targets more than 200 applications and extensions while evading detection through encrypted pay…

NEWScriticalBleeping Computer4 months ago

Coupang hit with record $409 million data breach fine in Korea

The Personal Information Protection Commission (PIPC), South Korea's data protection regulator, has fined e-commerce giant Coupa…

NEWSHackread4 months ago

The Hidden Security Risks of Poor Software Testing

Poor Software Testing can expose hidden flaws, vulnerable dependencies and weak controls, increasing breach risks, downtime and co…

NEWScriticalBleeping Computer4 months ago

CISA tells govt agencies to patch critical exploited flaws in 3 days

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced a new Binding Operational Directive, 26-04, that priori…

NEWSInfosecurity Magazine4 months ago

Most Cybersecurity Teams Struggle to Find Time for Training on New Cyber Threats

Organizations are aware of the challenges that new technologies like AI bring: but cybersecurity staff struggle to make time for t…

NEWSWired Security4 months ago

Signal Alums Reveal ‘Encrypted Spaces,’ a System for Making Private Collaboration Apps

The new open-source project could serve as the basis for a future of apps with features as complex as Slack, Discord, or Google Do…

NEWShighSecurityWeek4 months ago

Hackers Exploit Langflow Vulnerability for Remote Code Execution

Disclosed in March, the security defect enables unauthenticated attackers to write files to arbitrary locations on the system. The…

NEWShighSecurityWeek4 months ago

Siemens Says Desigo CC Files Flagged as Malware by Security Engines

A PowerShell script included in patch files appears to be triggering false positives by multiple security engines. The post Siemen…

NEWShighThe Hacker News4 months ago

AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS.

For thirty years, vulnerability management ran on a buffer: the months between when a vulnerability was found and when someone cou…

NEWShighInfosecurity Magazine4 months ago

Interpol Dismantles SniperDz Phishing-as-a-Service Platform

New revelations by Group-IB expose the full scale of the decade-old SniperDz phishing operation

NEWSSecurityWeek4 months ago

FBI Seizes 13 Websites That Officials Say Were Used by China to Target and Recruit US Workers

The 13 websites purported to be affiliated with consulting companies that advertised job openings for current and former holders o…

NEWShighSecurityWeek4 months ago

Splunk, Palo Alto Networks Patch Severe Vulnerabilities

The security defects could allow attackers to create or modify arbitrary files and access and modify protected resources. The post…

NEWSInfosecurity Magazine4 months ago

Extortion-Only Attacks Increase, With Data Theft Dominating Ransomware Claims

Extortion-only attacks are increasing as data theft drives most ransomware claims, with many organizations unable to stop stolen d…

NEWScriticalSecurityWeek4 months ago

‘GreatXML’ Zero-Day Exploit Bypasses BitLocker

The PoC exploits Microsoft Defender’s offline scan to spawn a SYSTEM shell when rebooting in Recovery Mode. The post ‘GreatXML’ Ze…

NEWSThe Hacker News4 months ago

OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack

The Vietnam-aligned threat actor known as OceanLotus has been attributed to two distinct campaigns that targeted domestic entities…

NEWSInfosecurity Magazine4 months ago

New “Agentjacking” Attacks Could Hijack AI Coding Agents

Tenet Security researchers reveal how new “agentjacking” attacks could trick coding agents into executing arbitrary code

NEWSBleeping Computer4 months ago

Microsoft fixes BitLocker recovery bug on Windows Server 2025

Microsoft has resolved a known issue causing some Windows Server 2025 devices to boot into BitLocker recovery after installing the…

NEWShighSecurityWeek4 months ago

University of Nottingham Confirms Breach After Hackers Leak Data

The ShinyHunters hacker group has taken credit for the attack, leaking more than 450,000 email addresses and other information. Th…

NEWScriticalBleeping Computer4 months ago

Nottingham University data breach affects over 450,000 students

The University of Nottingham confirmed on Wednesday that a hacking group gained access to its student records system in a breach a…

NEWSThe Register4 months ago

Every employee’s password was stored in a single Excel file

The CEO thought this was the best way to deal with some email issues

NEWShighCVE-2026-428978.1 HIGHSecurityWeek4 months ago

Microsoft Patches Exploited Exchange Server Vulnerability

The company warned about zero-day attacks exploiting the Exchange Server vulnerability CVE-2026-42897 on May 14. The post Microso…

NEWSThe Hacker News4 months ago

GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks

GitHub has announced what it said are "breaking changes" coming to npm version 12, one of which turns off install scripts by defau…

NEWShighBleeping Computer4 months ago

Max severity Ivanti Sentry vulnerability now exploited in attacks

Attackers are now targeting a recently patched maximum-severity flaw in Ivanti Sentry, enabling them to execute code with root pri…

NEWSThe Register4 months ago

Chinese agents caught rebuilding botnets and stirring the pot on AI datacenter debate

PRC eyes are watching you

NEWShighCVE-2026-50278.8 HIGHBleeping Computer4 months ago

Path traversal flaw in AI dev platform Langflow exploited in attacks

Attackers are actively exploiting CVE-2026-5027, a high-severity path traversal vulnerability in the AI development platform Langf…

NEWSWired Security4 months ago

CISA Tells US Agencies to Fix Security Bugs in as Little as 3 Days Thanks to AI Threats

“Defenders cannot afford to take weeks to patch,” one Cybersecurity and Infrastructure Security Agency official warned on Wednesda…

NEWSHackread4 months ago

FBI Seizes China-Linked Fake Consulting Sites Targeting US Clearance Holders

The Justice Department and FBI seized 13 fake consulting websites that officials say targeted US clearance holders with paid resea…

NEWSWired Security4 months ago

Trump Risks Key Surveillance Authority Over ‘Unqualified’ Spy-Chief Pick

US lawmakers are alarmed that Bill Pulte, a housing official with no intelligence experience, is poised to take charge of one of t…