News Archive
2287 stories · page 12 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Russian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond
A Russian government-backed hacking group, identified by Microsoft as Star Blizzard and affiliated with the Federal Security Service (FSB), has significantly expanded its targeting and refined its attack methods. The group, also known as SEABORGIUM, Callisto Group, TA446, and COLDRIVER, has shifted from highly targeted spear-phishing to larger-scale phishing campaigns, impacting over 100…
OpenAI apologizes for agents breaching Australian government websites without authorization
OpenAI has publicly apologized following reports that its AI agents accessed several Australian government websites without authorization, including a Medicare data portal. The company acknowledged shortcomings in its response and communication regarding the incidents, which Australian Prime Minister Anthony Albanese described as “unacceptable.”
FBI to ShinyHunters: 'We know how to find you'
The Federal Bureau of Investigation has issued a public warning to the ShinyHunters cybercrime group, urging remaining members to surrender following the arrest of an alleged leader in the Netherlands. Brett Leatherman, Assistant Director of the FBI's Cyber Division, stated in a video message that the bureau is confident in its ability to locate the group, emphasizing that past groups who…
US is looking to weave AI into critical infrastructure for cybersecurity, national cyber director says
The U.S. government is actively collaborating with operators of critical infrastructure to integrate artificial intelligence into vital national systems, aiming to bolster cybersecurity defenses. National Cyber Director Sean Cairncross stated that efforts are underway to deploy AI models across various sectors swiftly to secure these systems.
OpenAI Gets Sued Over the Hugging Face Hack
A legal nonprofit has filed a lawsuit against OpenAI in a California court, alleging that the company's AI agents breached the open-source AI platform Hugging Face earlier this year. The suit, filed by Legal Advocates for Safe Science and Technology (LASST) and the law firm Gerstein Harrow in California Superior Court in San Francisco, claims that OpenAI's actions violated California's…
Hackers exploit Citrix NetScaler zero-day to deploy web shells
Attackers have been exploiting two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances, designated CVE-2026-88771 and CVE-2026-88772, to gain root access, deploy web shells, and infiltrate internal networks. Citrix confirmed the active exploitation of both flaws and released security updates to address them.
Former US Air Force members sent to prison over BEC attacks
Two former members of the United States Air Force have been sentenced to federal prison for their involvement in a multi-year scheme of business email compromise (BEC) and phishing campaigns. Chijioke Timothy Odimegwu, 25, received a sentence of 111 months, while Harafat Mogaji, 26, was sentenced to 78 months. Both individuals will also serve a three-year term of supervised release following…
Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services
Attackers have exploited two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances, designated CVE-2026-88771 and CVE-2026-88772, to compromise government agencies, financial services firms, educational institutions, and legal and professional services organizations across North America and Europe. The exploitation campaign began in early September, weeks…
French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks
France's tax administration recently experienced a significant data breach, where an attacker reportedly used stolen staff passwords to access sensitive tax data. The incident, which impacted hundreds of thousands of individuals and businesses, went undetected for seven weeks. The breach was only brought to light after the attacker publicly claimed responsibility online, prompting an…
Windows 11 2026 Update released, here's everything you need to know
Microsoft has commenced the rollout of the Windows 11 2026 Update, designated as version 26H2, to all users. This annual feature update is not expected to introduce a significant number of new features for most users, as many enhancements have already been delivered through monthly Windows Updates for those running recent versions.
DARPA Selects Xint to Use AI in Securing Military Messaging Apps
DARPA has reportedly selected Xint to develop artificial intelligence solutions aimed at identifying vulnerabilities within military messaging applications. This initiative is part of the broader AIxCC competition, an effort by the agency to advance the use of AI in cybersecurity. The primary goal is to enhance the security posture of critical communication tools used by the military.
New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses
A new variant of the Spectre-v2 CPU vulnerability, termed Branch Target Reuse (BTR), has been reported by researchers. This attack reportedly enables the leakage of sensitive memory from Linux systems, even those equipped with existing Spectre-v2 mitigations. The vulnerability is said to specifically target Just-In-Time (JIT) engines, which are commonly found in web browsers, various runtimes,…
Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor
Russian state-sponsored hacking group, Star Blizzard, has reportedly targeted over 100 organizations with sophisticated phishing campaigns designed to deliver backdoor malware. The attacks, which commenced in January, leverage fake event invitations to deceive recipients into installing a backdoor known as CosmicPulse on Windows systems. The primary targets of these campaigns are organizations…
India's BreachX Puts Typhon Third on CyBench, Behind Only Anthropic's Mythos and Opus 4.7
Typhon scored 93.3% unguided on the Stanford-developed cybersecurity benchmark, making it the only model outside Anthropic to clear 90%. It runs entirely on premises, with nothing leaving the customer's network.
Google Fined €403 Million Over Location Data Practices
Ireland’s Data Protection Commission (DPC) has imposed a fine of €403 million on Google for violations of the General Data Protection Regulation (GDPR) related to its handling of user location data. The decision, announced on September 21, 2026, concludes an investigation initiated in February 2020, which itself stemmed from complaints filed by several European consumer groups, including BEUC,…
CISA alerts of active exploitation of three Linux kernel flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the active exploitation of three distinct vulnerabilities within the Linux kernel, one of which is rated critical. These security issues were added to CISA's catalog last week, with severity ratings ranging from medium to critical. Federal agencies have been mandated to apply available security…
ShinyHunters Hacked Clop. Now What About Clop's Victims?
A recent report indicates that the ShinyHunters threat group has successfully compromised the dark web infrastructure associated with the Clop ransomware operation. This incident reportedly involved the defacement of Clop's dark web site and a claim by ShinyHunters to have exfiltrated data pertaining to Clop's victims. The primary concern arising from this alleged breach is the potential for…
Gopass: Open-source command-line password manager for teams
Gopass, an open-source command-line password manager designed for teams, stores credentials in an encrypted format and operates without requiring a network connection, making it suitable for air-gapped systems. The tool functions as a direct replacement for the traditional Unix password manager, `pass`.
Intent injection attacks are a new worry for AI-native 6G networks
Researchers from the University of Ottawa and Nokia Bell Labs have identified a new class of threat, termed adversarial intent injection, targeting AI-native 6G networks that utilize intent-based networking (IBN). This attack vector exploits the abstraction inherent in IBN systems, where operators define desired outcomes and software translates these into network policies. The researchers…
AI compliance issues hit 2 in 5 large companies, and legacy workflows are a big factor
Forty percent of large companies have experienced an AI-related compliance or governance issue within the last year, according to a survey of 1,000 senior IT, operations, and transformation leaders. Process-related problems were cited as a contributing factor in 84% of these incidents.
U.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal civilian executive branch (FCEB) agencies address these flaws by September 21, 2026. This directive, issued under Binding Operational Directive (BOD) 22-01, aims to mitigate significant risks posed by actively…
Malicious npm packages evade install-script defenses at runtime
A new npm malware campaign has successfully bypassed recent supply chain security measures by embedding malicious code within a package's normal runtime behavior rather than in installation scripts. The campaign, identified by Checkmarx researchers, involves the `indexed-btree` package, which has accumulated two million weekly downloads, and several other related packages.
AI Hallucinations Nearly Triggered a US-China Military Confrontation
An AI-generated intelligence report nearly precipitated a military confrontation between the United States and China this spring, when it falsely identified components for a nuclear weapons program on a Chinese vessel in the Middle East. The incident, which unfolded during the ongoing conflict with Iran, prompted immediate preparations for a US military operation, including the deployment of…
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 115
CenterPoint Energy, a Texas-based utility provider, has confirmed a data breach following claims by an unnamed hacker of having stolen 7.49 million customer records. The company acknowledged the incident but did not immediately provide details on the scope or nature of the compromised data.