Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,654 articles

Microsoft shares workaround for Windows domain login issues

Microsoft shared a temporary fix on Wednesday for a known issue that prevents Windows 11 users from logging in with valid domain c…

NEWSThe Hacker Newsabout 1 month ago

BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS

The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 Sept…

NEWSSecurityWeekabout 1 month ago

CISA Releases Guidance on Deploying Cyber Decoys

Complementing Zero Trust models, decoys enable organizations to detect, observe, and block malicious activity in their environment…

NEWSSecurityWeekabout 1 month ago

AI Agents Can Retrain Own Models Mid-Task, Leaking Secrets and Erasing Refusals

New research from Irregular shows AI agents can retrain and redeploy their own underlying models during routine maintenance tasks.…

NEWSThe Hacker Newsabout 1 month ago

Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records

A security breach at Gyazo, Helpfeel's image-sharing service, exposed about 23.62 million user records, including email addresses…

NEWScriticalBleeping Computerabout 1 month ago

Cisco warns of max severity ISE zero-day exploited in attacks

Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are active…

NEWScriticalCVE-2026-7646010.0 CRITICALThe Hacker Newsabout 1 month ago

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exp…

NEWScriticalSecurityWeekabout 1 month ago

Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day

Remote, unauthenticated attackers can exploit the vulnerability to bypass authentication via crafted requests. The post Active Exp…

NEWSThe Hacker Newsabout 1 month ago

U.S. Seizes NightmareStresser Domains Linked to Hundreds of Thousands of DDoS Attacks

The U.S. Department of Justice (DoJ) on Tuesday announced the court-authorized seizure of internet domains associated with a distr…

NEWSBleeping Computerabout 1 month ago

Anthropic wants Claude to analyze your bank account and financial data

Anthropic is testing a new personal finance feature called "Claude Money" that will allow you to connect your bank accounts direct…

NEWSThe Registerabout 1 month ago

AI agents can modify themselves without humans telling them to do so

This is a test - it is only a test

NEWSBleeping Computerabout 1 month ago

Windows 11 KB5124008 update breaks domain trust for some users

Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on some en…

NEWShighThe Registerabout 1 month ago

CISA decides weekly vulnerability bulletin isn't necessary anymore

Agency's shift from static CVSS scores to risk-based prioritization sends the old format packing September 28

NEWShighBleeping Computerabout 1 month ago

Iranian hackers use CHOSEN BRICK Windows malware to spy on targets

Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target…

NEWSCyberScoopabout 1 month ago

CISA promotes a fresh way to deter cyberattackers: Lie to them

It’s the first guidance from the Cybersecurity and Infrastructure Security Agency on deploying decoys, like honeypots, to detect a…

NEWShighBleeping Computerabout 1 month ago

Malware bypasses browser checks to force install Chrome, Edge extensions

A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge exte…

NEWSKrebs on Securityabout 1 month ago

Data Broker Radaris Loses Domains in Privacy Fight

The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast…

NEWSThe Registerabout 1 month ago

Google Pixel phones pwned in zero-click attacks

CISA gives federal agencies just 3 days to patch

NEWScriticalBleeping Computerabout 1 month ago

Spain's data agency gets first report of AI-powered data breach

The Spanish Data Protection Agency (AEPD) was notified of an attack allegedly carried out with an AI agent powered by a known larg…

NEWScriticalSecurityWeekabout 1 month ago

First Agentic AI Data Breach Reported to Spanish Regulator

Spanish regulators say an AI agent chained together a successful login, vulnerability discovery, and access to personal data in a…

NEWShighCVE-2026-890269.8 CRITICALThe Hacker Newsabout 1 month ago

Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has…

NEWShighThe Hacker Newsabout 1 month ago

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Gho…

NEWScriticalInfosecurity Magazineabout 1 month ago

PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug

Attackers are exploiting a critical flaw in a third-party WooCommerce plugin to upload PHP webshells

NEWSCyberScoopabout 1 month ago

Coast Guard, FBI board US-bound foreign ships in order to probe for cyberattacks

The agencies issued a joint statement saying the “joint security boardings” came in response to “indications that the networks of…

NEWSThe Hacker Newsabout 1 month ago

One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude

Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants bu…

NEWSSecurityWeekabout 1 month ago

Virtual Event Today: Attack Surface Management Summit

Join SecurityWeek today for a virtual summit exploring the strategies and tools organizations need to discover, prioritize, and de…

NEWShighSecurityWeekabout 1 month ago

EU Chief Warns of AI-Powered Hacking, Moves to Rein In Social Media

Ursula von der Leyen warns that advanced AI could unleash hacking on an unprecedented scale as Europe prepares new protections aga…

NEWSCyberScoopabout 1 month ago

Treasury’s Scott Bessent says no liability exemptions for AI labs

The secretary told House Financial Services Committee lawmakers that the “best way to guarantee safety” is for AI creators to be h…

NEWScriticalBleeping Computerabout 1 month ago

The true cost of a ransomware attack, with and without BCDR

The ransom itself can be only a fraction of the total cost of a ransomware attack, with downtime, recovery, remediation, and legal…

NEWSInfosecurity Magazineabout 1 month ago

CISA and NIST Issue Guidance to Protect Cloud Identity Tokens

CISA and NIST issued final guidance to help protect cloud identity tokens and assertions