Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

3,752 articles

NEWScriticalCVE-2026-59346The Hacker News4 days ago

Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code

Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug…

NEWShighBleeping Computer4 days ago

Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain

A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stor…

NEWSThe Hacker News4 days ago

Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted

Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach…

NEWShighCVE-2026-324759.0 CRITICALSecurityWeek4 days ago

Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites

Tracked as CVE-2026-32475 (CVSS score of 9.8), the bug described as an arbitrary file upload issue in the function that handles fo…

NEWSBleeping Computer4 days ago

OpenAI admits it didn't disclose rogue AI wiki hijacking incident

OpenAI admits it did not disclose an incident where autonomous AI agents hijacked a German wiki, created 18,000 posts, shared answ…

NEWShighWired Security4 days ago

OpenAI Agents Hacked Another Website

Plus: Tens of millions of US and Canadian drivers’ licenses go up for sale on the dark web, the US military finally tries to tackl…

NEWSThe Hacker News4 days ago

Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel

A group of AI safety researchers says a fleet of autonomous agents that identified themselves as OpenAI systems left about 18,000…

NEWShighCVE-2026-815789.8 CRITICALThe Hacker News4 days ago

Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education…

NEWSCyberScoop5 days ago

European parliament members call for slowdown of Serbia’s EU entry over spyware use

The letter follows revelations about Serbian student activists being infected with Pegasus and NoviSpy, and coincides with other p…

NEWSThe Register5 days ago

ASCII smuggling isn't just an AI security risk

Phishers find a new use for invisible Unicode tag characters

NEWScriticalBleeping Computer5 days ago

IDScan sued over alleged data breach affecting 153 million drivers

Multiple lawsuits have been filed against identity verification company IDScan after hackers allegedly breached the service and of…

NEWShighSecurityWeek5 days ago

In Other News: Microsoft’s Cloud Patches, Hacked Dropbox Accounts, Guardio’s $1.1B Valuation

Noteworthy stories that might have slipped under the radar: Microsoft rolled out patches for cloud services, hackers compromised 5…

NEWScriticalCVE-2026-737499.8 CRITICALSecurityWeek5 days ago

HPE Patches Critical RCE Vulnerabilities in AOS-CX

Nearly two dozen issues, tracked collectively as CVE-2026-73749 (CVSS score of 9.8), were addressed with the updates. The post HPE…

NEWScriticalSecurityWeek5 days ago

OpenAI Pledges $1 Billion to Bring Frontier AI to Critical Infrastructure Defenders

The Daybreak initiative will provide subsidized AI cyber capabilities, training and technical assistance, though OpenAI has disclo…

NEWSThe Register5 days ago

Rogue OpenAI agents used dead German web site to communicate in May, months before Hugging Face incident

Two cases of agents escaping to solve unsolvable problems paints an uncomfortable question: Is the entire internet in OpenAI's exp…

NEWShighThe Hacker News5 days ago

Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Microsoft is alerting of a "high-volume phishing campaign" that's using invisible Unicode tag characters to bypass email filters.…

NEWScriticalCVE-2026-19490Bleeping Computer5 days ago

Critical Citrix NetScaler auth bypass now leveraged in attacks

Attackers have begun targeting a critical-severity Citrix NetScaler auth bypass flaw (CVE-2026-19490) in the wild, according to vu…

NEWSCVE-2026-64717.2 HIGHThe Hacker News5 days ago

PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

PostgreSQL has released updates to address a security flaw that allows an account with the REPLICATION attribute to run arbitrary…

NEWShighThe Hacker News5 days ago

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South K…

NEWSBleeping Computer5 days ago

Microsoft says some users can’t open the Teams desktop client

Microsoft is working to resolve a known issue that causes delays or blocks some users from opening the Microsoft Teams desktop cli…

NEWSBleeping Computer5 days ago

39 New Methods That Compromise Passkey Authentication

Passkeys eliminate many password-based attacks, but researchers have documented 39 methods for compromising authentication built a…

NEWShighCVE-2026-95869.8 CRITICALSecurityWeek5 days ago

Sangoma Switchvox Vulnerabilities Exploited in the Wild

Tracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution. The post…

NEWScriticalBleeping Computer5 days ago

New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges

An anonymous security researcher who uses the "Nightmare Eclipse" handle released a CrowdStrike Falcon zero-day exploit named "Fal…

NEWSBleeping Computer5 days ago

Exchange Online outage causes email delays, 'Server busy' errors

Microsoft is working to resolve an ongoing Exchange Online outage that is delaying email sent to and received from external domain…

NEWShighCVE-2026-64717.2 HIGHSecurityWeek5 days ago

12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover

Dubbed PostGREShell, CVE-2026-6471 turns low-level replication access into code execution, permanent superuser privileges and a pe…

NEWSSecurity Magazine5 days ago

California to Regulate AI Chatbot Toys Marketed at Children

California could regulate AI chatbots for children, pending Governor Gavin Newsom's approval.

NEWSSecurityWeek5 days ago

Catch Raises $5 Million for AI Executive Assistant With Guardrails

Catch promises the capabilities of a trusted executive assistant, with built-in controls governing what data and systems it can ac…

NEWScriticalBleeping Computer5 days ago

Google warns of new Chrome zero-day flaw exploited in attacks

Google has updated the Chrome browser to address an actively exploited high-severity zero-day flaw in the V8 engine and 11 other v…

NEWScriticalSecurityWeek5 days ago

VMware Workstation and Fusion Updates Patch Critical Vulnerability

The flaws could allow attackers with administrative access to a virtual machine to execute code on the host system. The post VMwar…

NEWScriticalSecurityWeek5 days ago

Google Patches 6th Chrome Zero-Day of 2026

Google’s Chrome 152 security update resolves 12 vulnerabilities, including a high-severity type confusion flaw in the V8 engine. T…