Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,630 articles

NEWSCVE-2026-934857.1 HIGHThe Hacker Newsabout 1 month ago

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in adm…

NEWShighCVE-2026-72738.8 HIGHThe Hacker Newsabout 1 month ago

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS190…

NEWSSecurityWeekabout 1 month ago

US Proposes AI Incident Alert System in Talks With China, Bessent Says

Trump has resisted calls to slow down AI development, saying that would help China catch up to U.S. companies. The post US Propose…

NEWSHackreadabout 1 month ago

Using Paybis as a Crypto On-Ramp in 2026: Fees, Wallets and Checks

Paybis offers crypto on-ramp and off-ramp services with cards, bank transfers and wallets. Learn about its fees, verification, sec…

NEWSThe Registerabout 1 month ago

Anthropic-linked CVEs pile up, attackers mostly shrug

Of 225 flaws found by Glasswing and tracked by VulnCheck researcher, just one has confirmed exploitation in the wild

NEWScriticalBleeping Computerabout 1 month ago

BigCommerce alerts merchants of data breach linked to Ribon apps

Ecommerce platform BigCommerce has alerted multiple merchants to data breaches after attackers compromised credentials for third-p…

NEWShighBleeping Computerabout 1 month ago

CISA alerts of active exploitation of three Linux kernel flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnera…

NEWShighThe Registerabout 1 month ago

Meta Muse AI app flaw lets local malware redirect dictation traffic

Ad biz promises users control while bug could expose voice prompts

NEWSThe Registerabout 1 month ago

Treasury chief says AI bosses, not their bots, will carry the can for criminal acts

'Humans are responsible, not the AI,' argues Scott Bessent as he calls out OpenAI agents' hack of Hugging Face

NEWSHackreadabout 1 month ago

Alexey Tulia at Tech Race Summit: how AI agents are changing engineering leadership

Alexey Tulia, Executive Leader at Coinspaid Dev, discussed the changing role of engineers and CTOs during the AI…

NEWShighBleeping Computerabout 1 month ago

WordPress Click2Shell flaw lets hackers execute PHP on the server

Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnera…

NEWSBleeping Computerabout 1 month ago

Microsoft to retire Microsoft 365 Companion apps in December

Microsoft will retire the Calendar, People, and Files Microsoft 365 companion apps on December 16 and has asked admins to remove t…

NEWSThe Hacker Newsabout 1 month ago

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other secu…

NEWSSecurityWeekabout 1 month ago

Google Hit With $463 Million Fine for EU Location Data Rule Breach

Google has been fined 403 million euros ($463 million) for breaching the European Union’s strict privacy rules because it mishandl…

NEWSThe Hacker Newsabout 1 month ago

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more t…

NEWSHackreadabout 1 month ago

Clop Ransomware Responds to ShinyHunters Amid Eight-Figure Demands

Clop responds to ShinyHunters after its leak site takeover as the group demands an eight-figure payment, interest and a public apo…

NEWSThe Hacker Newsabout 1 month ago

Google Fined €403 Million Over GDPR Violations Tied to Location Data

Google has been fined €403 million for breaking the EU's data protection law, the GDPR, in the way three of its features handled p…

NEWSCyberScoopabout 1 month ago

Dems seek top-to-bottom assessment of CISA workforce

After the exit of around 1,000 CISA workers, legislation from three top House Democrats orders a force structure assessment like t…

NEWSHackreadabout 1 month ago

Can Shiba Inu Reach $1 in 2026? The Math Behind the SHIB Dream

Shiba Inu's $1 dream faces a mathematical reality check as SHIB's huge circulating supply would require an extraordinary $589 tril…

NEWSSecurityWeekabout 1 month ago

Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer

The attackers impersonate at least 40 companies and disable 145 security products to deploy infostealer malware. The post Fake Las…

NEWSBleeping Computerabout 1 month ago

Google fined €403 million over location data privacy violations

Ireland's Data Protection Commission (DPC) has fined Google €403 million ($463M) for multiple GDPR violations related to processin…

NEWSInfosecurity Magazineabout 1 month ago

Google Hit with €403m GDPR Fine Over Location Data Practices

The Irish DPC found that Google users were unaware that their location was being used to influence them with ads

NEWSBleeping Computerabout 1 month ago

Microsoft fixes broken Excel copy and paste for all Office users

Microsoft has fixed a known issue that causes copy-and-paste failures for Excel users after installing the September 2026 security…

NEWSInfosecurity Magazineabout 1 month ago

New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code

Sekoia said Exvicy, a new ClickFix MaaS framework, reused code from rival service ErrTraffic

NEWSSecurityWeekabout 1 month ago

CISO Conversations: Noopur Davis – The Accidental Global CISO at Comcast

Noopur Davis never planned a career in cybersecurity. She was a developer at Intergraph, and for many years that was all she wante…

NEWScriticalThe Hacker Newsabout 1 month ago

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks

A browser. A plugin. A package. A login screen. Normal stuff. That is basically the problem this week. The trouble keeps showing…

NEWShighThe Hacker Newsabout 1 month ago

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed…

NEWSBleeping Computerabout 1 month ago

FBI's CJIS v6.1: What Security Teams Need to Know.

The FBI's CJIS Security Policy v6.1 strengthens requirements around encryption and vulnerability scanning while continuing the shi…

NEWSSecurityWeekabout 1 month ago

Dragos Completes NetRise and runZero Acquisitions Following Accenture Deal

The transaction is part of the $4.1 billion deal in which Accenture acquired a majority stake in Dragos in an OT cybersecurity pus…

NEWSInfosecurity Magazineabout 1 month ago

Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign

CloudSEK linked GHAPPIER to a compromised npm package with valid trusted-publishing provenance