Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

2,150 articles

Microsoft says Windows 11 26H2 is coming soon, details upgrade process

Microsoft has confirmed that Windows 11 version 26H2 will be the next feature update and that devices running Windows 11 24H2 and…

NEWSBleeping Computerabout 1 month ago

Microsoft fixes AutoGen Studio flaw that enabled code execution

A vulnerability chain dubbed AutoJack in Microsoft's AutoGen Studio interface for prototyping AI agents could let attackers manipu…

NEWSWired Securityabout 1 month ago

OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic’s Mythos

Amid concerns about AI models’ cybersecurity capabilities, OpenAI revealed an improved version of GPT-5.5-Cyber and its “Patch the…

NEWSThe Hacker Newsabout 1 month ago

Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants

Cybersecurity researchers have disclosed details of four vulnerabilities in Dify, an open-source agentic workflow platform with mo…

NEWSCyberScoopabout 1 month ago

Intel agencies: Frontier AI models will reshape cybersecurity faster than expected

The joint warning from Five Eyes countries mirrors what many cybersecurity and AI experts have been saying for the past year. The…

NEWScriticalHackreadabout 1 month ago

Texas Parks and Wildlife Data Breach Affects Over 3M License Customers

Around 3 million Texas licence holders face a data breach after hackers targeted a third-party vendor, exposing driver's licences…

NEWSInfosecurity Magazineabout 1 month ago

GentleKiller Framework Disables Victims' Security Software

ESET details GentleKiller, the EDR-killer framework the Gentlemen ransomware gang gives affiliates

NEWSThe Hacker Newsabout 1 month ago

29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests

A heap over-read in the Squid web proxy can leak another user's cleartext HTTP request, including any credentials or session token…

NEWScriticalThe Registerabout 1 month ago

Canadian utility fesses up to data breach, but key details remain off-grid

London Hydro says names, addresses, account details may have been exposed, but much about the intrusion is unknown

NEWSHackreadabout 1 month ago

Threat Hunting Beyond Alerts: Finding the Activity Detection Misses

Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.

NEWSBleeping Computerabout 1 month ago

A Glimpse into the “Search Your Target” Market for Stolen Credentials

Attackers no longer need to sift through massive credential dumps. They can pay others to do it for them. Flare explores how an em…

NEWSInfosecurity Magazineabout 1 month ago

Unpatchable BootROM Flaw Impacts Apple A12, A13 Chips

Apple BootROM exploit exposes unpatchable USB flaw on A12 and A13 devices

NEWSSecurityWeekabout 1 month ago

Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data

Squidbleed, discovered with the aid of Claude Mythos Preview, has been described as a Heartbleed-style vulnerability. The post De…

NEWSThe Hacker Newsabout 1 month ago

New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer

Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported…

NEWScriticalThe Registerabout 1 month ago

Brazil probes emergency warning system after nationwide rogue alert

Severe weather event alert platform buzzed devices across the country with the word 'misanthropy'

NEWSHackreadabout 1 month ago

Scammers Use Fake GitHub Stars, VirusTotal Reviews to Spread Crypto Clipper

A multi-platform malware campaign abuses fake trust signals to infect Windows and Mac users with a crypto clipper packed with 15,5…

NEWSThe Hacker Newsabout 1 month ago

Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries

Google has set September 30, 2026, as the day it begins enforcing Android developer verification in the first four countries, and…

NEWSThe Hacker Newsabout 1 month ago

Stop Your Legacy Infrastructure from Hijacking Your AI Agents

Earlier this month, I spoke at the Gartner Security & Risk Management Summit about a blind spot most security programs are still n…

NEWShighSecurityWeekabout 1 month ago

Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data

Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data. The post Attackers Expl…

NEWSInfosecurity Magazineabout 1 month ago

Microsoft Attributes Mastra AI Supply Chain Attack to North Korea

North Korean threat actor Sapphire Sleet has been linked to a supply chain attack targeting Mastra, according to Microsoft securit…

NEWShighThe Registerabout 1 month ago

Health board apologizes for phishing staff with with bogus vacation day

IT thought a fake offer of extra time off for hard-pressed Canadian medical workers was the way to go

NEWShighSecurityWeekabout 1 month ago

North Korean Hackers Blamed for Mastra NPM Supply Chain Attack

A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions. The…

NEWSHackreadabout 1 month ago

Salesforce Disables Klue Integration After OAuth Token Theft Hits Customer Data

Icarus extortion group used a legacy Klue Battlecards credential to bypass security and steal bulk Salesforce records from affecte…

NEWSThe Hacker Newsabout 1 month ago

⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More

It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomwa…

NEWSSecurityWeekabout 1 month ago

What the Latest ShinyHunters Breaches Reveal About Modern Cyberattacks

Groups like ShinyHunters are demonstrating that attackers do not necessarily need malware or zero-day exploits to cause massive da…

NEWShighInfosecurity Magazineabout 1 month ago

Klue Breach Enables Hackers to Compromise Cybersecurity Firms via OAuth Tokens

At least five cybersecurity firms confirmed they have been affected by a breach of business intelligence platform Klue via Salesfo…

NEWShighSecurityWeekabout 1 month ago

New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones

The vulnerability exploited by the Usbliter8 exploit cannot be patched and a PoC exploit has been released by researchers. The pos…

NEWShighThe Registerabout 1 month ago

Gizmodo readers hit with ClickFix malware prompts after account compromise

Infosec buffs say Windows users could have been infected with a nasty trojan, while Mac users got off lightly

NEWSSecurityWeekabout 1 month ago

Fortinet Responds to FortiBleed Campaign

A database of over 86,000 confirmed working credentials was created during the credential-harvesting campaign. The post Fortinet R…

NEWSWired Securityabout 1 month ago

World Cup Scams Are Getting Harder to Spot

From fake tickets to cloned websites, AI is magnifying World Cup scams. Can fans distinguish between what’s real and what’s not?