Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

2,132 articles

UNK_MassTraction Exploits Roundcube Flaws Against US, Canadian Universities

China-linked UNK_MassTraction targets US and Canadian universities through Roundcube flaws, stealing sessions and opening access t…

NEWSThe Hacker News19 days ago

GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures

New research shows that a signed Git commit's hash is not the one-of-a-kind name that much of the software world assumes it to be.…

NEWSThe Hacker News19 days ago

The Verification Step Is the New ATO Battleground in 2026

For years, account takeover (ATO) followed a predictable script. Attackers bought stolen credentials in bulk, ran them through aut…

NEWScriticalBleeping Computer19 days ago

Telco giant KDDI says data breach affects over 12 million people

Japanese telecommunications giant KDDI says that millions of people had their email addresses and passwords exposed after attacker…

NEWSThe Hacker News19 days ago

GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in Code

An AI coding assistant that refuses to answer a dangerous request in its chat box can answer it anyway if the same request is brok…

NEWSInfosecurity Magazine19 days ago

New Malicious Campaign Delivers Vidar Infostealer and Monero Crypto Miner

Cyber threat actors are infecting victims with the Vidar stealer and the XMRig cryptocurrency miner in a new malicious campaign

NEWShighSecurityWeek19 days ago

CISA Urges Immediate Patching of Exploited ColdFusion, Langflow, Joomla Flaws

Two newly disclosed critical vulnerabilities in Adobe ColdFusion and Langflow join two Joomla extension flaws in CISA's Known Expl…

NEWScriticalSecurityWeek19 days ago

Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection

Researchers show how attackers can use a crafted public GitHub Issue to trick AI-powered workflows into exposing data from private…

NEWShighWired Security19 days ago

OnlyFans Models Are Accidentally Making Hacked Government Websites Disappear

Scammers are hijacking government websites to upload ads for “leaked” OnlyFans content. Thousands of copyright complaints from adu…

NEWShighWired Security19 days ago

What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out

Burst water mains. Evacuated hospitals. In a closed-door simulation, insurers played out their response to a mass disruption by Ch…

NEWSBleeping Computer19 days ago

CISA orders feds to prioritize patching Langflow auth bypass flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) gave federal agencies until Friday to patch an actively exploited…

NEWShighThe Hacker News19 days ago

China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware

A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box (ORB) netw…

NEWSCyberScoop19 days ago

Found fast, fixed slow: The gap the AI clearinghouse must close

The government's new AI clearinghouse risks becoming a committee that discovers more problems than it solves — unless it's designe…

NEWShighBleeping Computer19 days ago

Ubiquiti warns of new max severity UniFi OS vulnerability

Ubiquiti has released security updates to patch seven critical vulnerabilities in UniFi OS, including a maximum-severity flaw that…

NEWSInfosecurity Magazine19 days ago

NCSC Touts National Scale, AI-Powered “Cyber Shield” for Defense

The National Cyber Security Centre wants to work with AI partners to build a new “Cyber Shield” to defend the UK

NEWSBleeping Computer19 days ago

CISA orders feds to patch max severity ColdFusion flaw by Friday

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered government agencies to patch an actively exploited ma…

NEWSCVE-2026-434997.8 HIGHThe Hacker News19 days ago

15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros

Researchers at Nebula Security have disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw that lets any logged-in…

NEWScriticalCVE-2026-4828210.0 CRITICALThe Hacker News19 days ago

CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulne…

NEWSHackread19 days ago

Why Unity Remains the Most Popular Engine for Mobile Games

Learn why Unity is still a trusted engine for mobile games, from faster prototyping and Android and iOS support to tools that help…

NEWShighBleeping Computer19 days ago

Accenture confirms breach after hacker offers stolen data for sale

IT services giant Accenture has confirmed it suffered a security breach after a threat actor claimed to have stolen 35 GB of sourc…

NEWShighCyberScoop19 days ago

Spain arrests suspected hacker linked to Russian hacktivist campaign

Authorities didn’t name the man or file formal charges, but accuse him of participating in attacks linked to Cyber Army of Russia…

NEWSThe Register19 days ago

Windows is watching: Anti-piracy tool fingers Scattered Spider suspect

Along with other telemetry, Windows GDID makes online activity more traceable

NEWSCyberScoop19 days ago

Deepfake CSAM lawsuit against xAI, Grok expands

Two new alleged victims detailed how Grok was used by friends and family to generate sexual images of them as minors. The suit als…

NEWSThe Register19 days ago

GitHub AI agent leaks private repos when asked nicely

Per usual, there's no fix - or even any documentation - for GitLost

NEWShighBleeping Computer19 days ago

Chinese hackers develop LONGLEASH malware to expand ORB network

Chinese hackers tracked as 'UAT-7810' are actively evolving their malware to expand their Operational Relay Box (ORB) network by c…

NEWSSecurity Magazine19 days ago

KDDI Corporation Breach Impacts 12.2M Customer Emails

A prominent Japanese telecommunications organization revealed a data breach may have impacted 12.2 million customer emails.

NEWSSecurityWeek19 days ago

County Government Reportedly Paid $1 Million to Cyber Extortion Group

The alleged victim, believed to be a small Ohio county, reportedly paid the extortion group to prevent the public release of sensi…

NEWShighBleeping Computer19 days ago

Hidden backdoor in Tenda router firmware grants admin access

A hidden authentication backdoor has been found in multiple Tenda router firmware versions, potentially allowing an attacker to ga…

NEWScriticalCVE-2026-208969.8 CRITICALSecurityWeek19 days ago

Critical Gitea Flaw Under Active Exploitation, Researchers Warn

Attackers are exploiting the critical Gitea vulnerability CVE-2026-20896 to bypass authentication with a single HTTP header and ac…

NEWShighThe Register19 days ago

CAI cloud worm gives competitors' malware the boot, then steals secrets and mines for coin

Dog-eat-dog world for credential-stealing attackers