Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,638 articles

An Undercover Google Analyst Infiltrated a Notorious Supply Chain Hacking Gang

TeamPCP pulled off the worst-ever software supply chain hacking spree and breached thousands of companies. Now Google’s threat int…

NEWShighCyberScoopabout 1 month ago

International security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data

The U.S., Japan, Germany and Australia said WaterPlum operators pose as prospective employers and have infected more than 30,000 d…

NEWShighThe Hacker Newsabout 1 month ago

Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2

The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set…

NEWSBleeping Computerabout 1 month ago

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously u…

NEWScriticalSecurityWeekabout 1 month ago

In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw

Noteworthy stories that might have slipped under the radar: Mandiant's 2026 AI risk report, PhantomRaven malware used by bug bount…

NEWSBleeping Computerabout 1 month ago

Secure enterprise sharing with access reviews for Microsoft 365

Microsoft 365 makes sharing files easy, but access can remain long after its original purpose has ended, leaving organizations wit…

NEWSBleeping Computerabout 1 month ago

Microsoft Teams will let admins block custom file extensions

Microsoft Teams will soon let administrators tweak the list of file extensions commonly associated with security threats to meet t…

NEWSInfosecurity Magazineabout 1 month ago

New Settra Ransomware Variant Deployed in Attacks on Retail and Manufacturing

Huntress researchers highlighted a new ransomware variant, named Settra, and the post-compromise techniques used in two recent att…

NEWSBleeping Computerabout 1 month ago

Webinar: Which Google Workspace security controls actually matter?

Fast-growing companies face countless recommendations for securing Google Workspace, but not every control provides the same value…

NEWSWired Securityabout 1 month ago

Meta’s Copyright System Is Being Weaponized Against Albanian Protesters

After three months of daily anti-government protests—dubbed the Flamingo Revolution—the sudden mass suspension of Instagram accoun…

NEWSCVE-2026-8588910.0 CRITICALThe Hacker Newsabout 1 month ago

Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation

Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry that could be exploited to achieve privilege…

NEWShighSecurityWeekabout 1 month ago

AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code

Hacktron researchers earned a bug bounty after demonstrating access to OpenAI employee accounts. The post AI-Built Exploit and Si…

NEWSBleeping Computerabout 1 month ago

Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts

Microsoft has resolved a known issue that causes incorrect alerts warning that Defender Antivirus was turned off after installing…

NEWScriticalSecurityWeekabout 1 month ago

23 Million User Records Compromised in Gyazo Data Breach

Gyazo maker Helpfeel said the attacker exploited a vulnerability in its image upload server to gain unauthorized access. The post…

NEWSThe Hacker Newsabout 1 month ago

An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It.

In July 2025, someone registered a domain that used to belong to a content delivery network. The CDN had been wound down years ea…

NEWSThe Hacker Newsabout 1 month ago

Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs…

NEWShighSecurityWeekabout 1 month ago

Microsoft Patches 18 Vulnerabilities in AI, Cloud Products

Microsoft fixed vulnerabilities across Azure and AI-branded products, with privilege escalation flaws accounting for the majority.…

NEWSThe Hacker Newsabout 1 month ago

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented J…

NEWSSecurityWeekabout 1 month ago

NightmareStresser DDoS Service Disrupted in International Operation

Active since at least 2022, NightmareStresser was one of the longest-running DDoS-for-hire services in the world. The post Nightma…

NEWShighInfosecurity Magazineabout 1 month ago

CISA Upgrades Vulnerability Reporting Platform with More Automation

The US cybersecurity agency is moving to a new vulnerability coordination platform called VINCE-NT

NEWShighSecurityWeekabout 1 month ago

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts. The post Brevo Supply Chain Atta…

NEWShighBleeping Computerabout 1 month ago

New Check Point flaw lets hackers execute code with root privileges

Check Point Software has released security updates to address a critical vulnerability that can let attackers execute code with ro…

NEWSThe Hacker Newsabout 1 month ago

Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer

A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information st…

NEWScriticalCVE-2026-581389.8 CRITICALSecurityWeekabout 1 month ago

Critical Orkes Conductor Vulnerability Exploited in Attacks

CVE-2026-58138 is an unauthenticated remote code execution vulnerability that attackers can exploit via inline workflow definition…

NEWSInfosecurity Magazineabout 1 month ago

Manufacturing Accounts for 22% of all Ransomware Victims

Black Kite has found that manufacturing remained the most targeted sector for ransomware attacks, and saw a big jump in incidents…

NEWSBleeping Computerabout 1 month ago

Microsoft fixes broken copy and paste for Excel 2016 users

Microsoft has fixed a known issue that causes copy-and-paste failures for some Excel users after installing the September 2026 KB5…

NEWSSecurityWeekabout 1 month ago

MIND Secures $72 Million for AI-Powered DLP

The company will use the funding to accelerate platform development and expand its presence in key enterprise markets. The post MI…

NEWShighSecurityWeekabout 1 month ago

Check Point, Kaspersky, Tanium Patch Product Vulnerabilities

Check Point Security Management and Log Servers are affected by a critical vulnerability that can allow remote code execution with…

NEWShighThe Hacker Newsabout 1 month ago

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat ac…

NEWSThe Registerabout 1 month ago

USA’s Venezuela takeover comes with bonus exposure to Chinese AI surveillance tech

Think tank points out that companies banned by Washington will help run the regime that Uncle Sam now controls