Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

3,199 articles

Microsoft fixes AutoGen Studio flaw that enabled code execution

A vulnerability chain dubbed AutoJack in Microsoft's AutoGen Studio interface for prototyping AI agents could let attackers manipu…

NEWSWired Security2 months ago

OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic’s Mythos

Amid concerns about AI models’ cybersecurity capabilities, OpenAI revealed an improved version of GPT-5.5-Cyber and its “Patch the…

NEWSThe Hacker News2 months ago

Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants

Cybersecurity researchers have disclosed details of four vulnerabilities in Dify, an open-source agentic workflow platform with mo…

NEWSCyberScoop2 months ago

Intel agencies: Frontier AI models will reshape cybersecurity faster than expected

The joint warning from Five Eyes countries mirrors what many cybersecurity and AI experts have been saying for the past year. The…

NEWScriticalHackread2 months ago

Texas Parks and Wildlife Data Breach Affects Over 3M License Customers

Around 3 million Texas licence holders face a data breach after hackers targeted a third-party vendor, exposing driver's licences…

NEWSInfosecurity Magazine2 months ago

GentleKiller Framework Disables Victims' Security Software

ESET details GentleKiller, the EDR-killer framework the Gentlemen ransomware gang gives affiliates

NEWSThe Hacker News2 months ago

29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests

A heap over-read in the Squid web proxy can leak another user's cleartext HTTP request, including any credentials or session token…

NEWScriticalThe Register2 months ago

Canadian utility fesses up to data breach, but key details remain off-grid

London Hydro says names, addresses, account details may have been exposed, but much about the intrusion is unknown

NEWSHackread2 months ago

Threat Hunting Beyond Alerts: Finding the Activity Detection Misses

Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.

NEWSBleeping Computer2 months ago

A Glimpse into the “Search Your Target” Market for Stolen Credentials

Attackers no longer need to sift through massive credential dumps. They can pay others to do it for them. Flare explores how an em…

NEWSInfosecurity Magazine2 months ago

Unpatchable BootROM Flaw Impacts Apple A12, A13 Chips

Apple BootROM exploit exposes unpatchable USB flaw on A12 and A13 devices

NEWSSecurityWeek2 months ago

Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data

Squidbleed, discovered with the aid of Claude Mythos Preview, has been described as a Heartbleed-style vulnerability. The post De…

NEWSThe Hacker News2 months ago

New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer

Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported…

NEWScriticalThe Register2 months ago

Brazil probes emergency warning system after nationwide rogue alert

Severe weather event alert platform buzzed devices across the country with the word 'misanthropy'

NEWSHackread2 months ago

Scammers Use Fake GitHub Stars, VirusTotal Reviews to Spread Crypto Clipper

A multi-platform malware campaign abuses fake trust signals to infect Windows and Mac users with a crypto clipper packed with 15,5…

NEWSThe Hacker News2 months ago

Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries

Google has set September 30, 2026, as the day it begins enforcing Android developer verification in the first four countries, and…

NEWSThe Hacker News2 months ago

Stop Your Legacy Infrastructure from Hijacking Your AI Agents

Earlier this month, I spoke at the Gartner Security & Risk Management Summit about a blind spot most security programs are still n…

NEWShighSecurityWeek2 months ago

Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data

Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data. The post Attackers Expl…

NEWSInfosecurity Magazine2 months ago

Microsoft Attributes Mastra AI Supply Chain Attack to North Korea

North Korean threat actor Sapphire Sleet has been linked to a supply chain attack targeting Mastra, according to Microsoft securit…

NEWShighThe Register2 months ago

Health board apologizes for phishing staff with with bogus vacation day

IT thought a fake offer of extra time off for hard-pressed Canadian medical workers was the way to go

NEWShighSecurityWeek2 months ago

North Korean Hackers Blamed for Mastra NPM Supply Chain Attack

A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions. The…

NEWSHackread2 months ago

Salesforce Disables Klue Integration After OAuth Token Theft Hits Customer Data

Icarus extortion group used a legacy Klue Battlecards credential to bypass security and steal bulk Salesforce records from affecte…

NEWSThe Hacker News2 months ago

⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More

It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomwa…

NEWSSecurityWeek2 months ago

What the Latest ShinyHunters Breaches Reveal About Modern Cyberattacks

Groups like ShinyHunters are demonstrating that attackers do not necessarily need malware or zero-day exploits to cause massive da…

NEWShighInfosecurity Magazine2 months ago

Klue Breach Enables Hackers to Compromise Cybersecurity Firms via OAuth Tokens

At least five cybersecurity firms confirmed they have been affected by a breach of business intelligence platform Klue via Salesfo…

NEWShighSecurityWeek2 months ago

New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones

The vulnerability exploited by the Usbliter8 exploit cannot be patched and a PoC exploit has been released by researchers. The pos…

NEWShighThe Register2 months ago

Gizmodo readers hit with ClickFix malware prompts after account compromise

Infosec buffs say Windows users could have been infected with a nasty trojan, while Mac users got off lightly

NEWSSecurityWeek2 months ago

Fortinet Responds to FortiBleed Campaign

A database of over 86,000 confirmed working credentials was created during the credential-harvesting campaign. The post Fortinet R…

NEWSWired Security2 months ago

World Cup Scams Are Getting Harder to Spot

From fake tickets to cloned websites, AI is magnifying World Cup scams. Can fans distinguish between what’s real and what’s not?

NEWSInfosecurity Magazine2 months ago

UK Information Commissioner Resigns After Workplace Investigation

The UK’s data protection regulator the information commissioner has resigned after his position became “untenable”