Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

2,167 articles

Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials

The Security Service of Ukraine (SSU) said it, together with the U.S. Federal Bureau of Investigation (FBI), uncovered a long-runn…

NEWShighBleeping Computerabout 1 month ago

Clean GitHub repo tricks AI coding agents into running malware

An agentic coding tool tasked with running a seemingly benign GitHub repository could execute a malicious payload that is invisibl…

NEWSThe Hacker Newsabout 1 month ago

OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards

OpenAI on Friday released three versions of GPT-5.6, called Sol, Terra, and Luna, as a limited preview to a small number of compan…

NEWSSecurityWeekabout 1 month ago

Chinese Framework Powers 200,000 Scam Sites

Threat actors are selling investment scam templates created using the legitimate DCloud Uni-App toolkit. The post Chinese Framewor…

NEWSWired Securityabout 1 month ago

Security News This Week: LastPass Users Had Their Data Stolen—Again

Plus: Former national security advisor John Bolton pleads guilty in classified-materials case, Microsoft helps take down major inf…

NEWSThe Registerabout 1 month ago

It's looking like a hot, messy summer for security teams as AI finds countless previously hidden vulns

Time to start praying to the goddess of wisdom and war

NEWShighBleeping Computerabout 1 month ago

FBI: Russian hackers now target Signal backup recovery keys

The FBI and CISA are warning that a phishing campaign targeting Signal users tied to Russian intelligence services has evolved to…

NEWSHackreadabout 1 month ago

8 Top SAST Tools for Polyglot Monorepos and Platform Engineering in 2026

Compare 8 top SAST tools for polyglot monorepos, covering incremental scans, ownership, custom rules and platform engineering at s…

NEWSThe Registerabout 1 month ago

Even the Secret Service won't use company-issued phones

Personal cell phones on protective missions, no threat detection on government-issued devices among the litany of sins

NEWShighBleeping Computerabout 1 month ago

CISA sets urgent deadline to fix Cisco flaw exploited in attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is giving federal agencies until Sunday to patch a vulnerability…

NEWShighThe Hacker Newsabout 1 month ago

FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys

The FBI and CISA have updated their March warning about Russian intelligence phishing Signal accounts, and the operators have adde…

NEWShighHackreadabout 1 month ago

Woodgnat Hackers Use Mistic RAT to Broker Access for Ransomware Gangs

Woodgnat Hackers use Backdoor.Mistic, a stealthy RAT, to let brokers compromise networks and sell entry points to ransomware group…

NEWSCyberScoopabout 1 month ago

ATF cancels controversial commercial geolocation contract

The agency told CyberScoop the tool was a pilot that didn’t meet their needs. Members of Congress say it was accessed for hundreds…

NEWShighThe Hacker Newsabout 1 month ago

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader…

NEWSBleeping Computerabout 1 month ago

Polymarket customers lose $3 million in supply-chain attack

Polymarket says it will fully reimburse customers who lost an estimated $3 million after hackers injected a malicious script into…

NEWSBleeping Computerabout 1 month ago

Cybersecurity firms targeted by fraudulent OpenAI organization invites

Threat actors are creating OpenAI tenants that impersonate legitimate companies and inviting employees to join them, in what appea…

NEWSWired Securityabout 1 month ago

The Pentagon Is Looking Into the Dialog Data Exposure for Unmasking National Security Officials

Exposed records from the private group included the personal information of a senior White House intelligence official and an acti…

NEWShighThe Hacker Newsabout 1 month ago

Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign

A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new custom backdoor called TinyRCT as part of cyber…

NEWSThe Registerabout 1 month ago

Amazon Q flaw let booby-trapped Git repos execute code, swipe cloud creds

Researchers warn many AI coding assistants now execute commands from project configurations

NEWScriticalSecurity Magazineabout 1 month ago

Security Leaders Discuss Texas Hunting, Fishing License Data Breach

The Texas Parks and Wildlife Department reported that the personal information of more than three million Texas hunting and fishin…

NEWSSecurityWeekabout 1 month ago

Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories

AWS has patched the vulnerability and published its own advisory to inform customers about the potential impact. The post Amazon…

NEWShighSecurityWeekabout 1 month ago

More Klue Breach Victims Identified as Hackers Get Hacked

Roughly two dozen companies have notified their customers of the Klue-Salesforce incident impact. The post More Klue Breach Victim…

NEWSSecurityWeekabout 1 month ago

In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs

Other noteworthy stories that might have slipped under the radar: Russia used Cellebrite to hack activist’s phone, Five Eyes issue…

NEWSBleeping Computerabout 1 month ago

Your First GRC Agent: A Red Teamer's Walkthrough

AI won't replace GRC analysts, but it can eliminate much of the repetitive work they do. Anecdotes walks through building an agent…

NEWSCVE-2026-129577.8 HIGHThe Hacker Newsabout 1 month ago

Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. The…

NEWShighCVE-2026-46331The Hacker Newsabout 1 month ago

New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries

A flaw in the Linux kernel's traffic-control subsystem can let a local unprivileged user gain root on affected systems. CVE-2026-…

NEWSHackreadabout 1 month ago

macOS Flaw Allowed Standard Users to Disable CrowdStrike and Kandji Security Tools

A macOS XPC flaw let regular users disable CrowdStrike and Kandji tools, exposing security gaps that vendors patched after XM Cybe…

NEWSSecurityWeekabout 1 month ago

Nebulock Raises $25 Million for AI-Native Contextual Security

The cybersecurity startup provides threat hunting, proactive detection, and behavioral security analytics. The post Nebulock Raise…

NEWShighThe Hacker Newsabout 1 month ago

CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical remote code execution vulnerability…

NEWSThe Registerabout 1 month ago

Miasma campaign poisons 20-plus npm packages, hunts for developer secrets

Microsoft says latest attack targets Leo Platform and RStreams packages, harvesting creds and going after more maintainers