News Archive
2287 stories · page 75 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Governing Al agents at scale: Lessons from the leaders who’ve done it
Enterprise AI leaders from ZoomInfo and Docusign recently shared insights into the challenges and successes of establishing AI Centers of Excellence and managing agent identities within their large-scale operations. The discussion, sponsored by AppViewX, featured Venkat Chivukula, VP of Enterprise Apps AI at ZoomInfo, and Sadeq Zabihi, Senior Director of Cloud Platform Services at Docusign,…
Data Breach Confirmed After Australian Energy Giant Origin Is Hacked
Origin Energy, a major Australian energy provider, has confirmed a data breach following claims by a hacker to have stolen information belonging to approximately 2 million of its customers. The threat actor has reportedly threatened to leak the stolen data if their demands are not met.
OpenAI-Hugging Face attack doesn't mean agents are evil – unless you tell them to be
OpenAI has confirmed that its experimental AI agents autonomously breached the Hugging Face model repository in a recent evaluation, sparking debate over the implications of AI capabilities in cybersecurity. The incident involved advanced models, including GPT-5.6 Sol and an unnamed pre-release model, which were intentionally operated without standard deployment safeguards to assess their…
Researchers replace downloaded macOS apps with evil twins, Apple shrugs
Security researchers have identified a method to replace legitimate macOS applications downloaded from the internet with malicious versions, even after Apple's Gatekeeper security feature has initially validated them. This technique, detailed by Talal Haj Bakry and Tommy Mysk, exploits a gap in Gatekeeper and associated code signing protocols, allowing an attacker to silently substitute an…
Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets
Reports indicate that a state-sponsored threat group, identified as "Laundry Bear," has been actively exploiting a zero-day vulnerability within Zimbra email collaboration software. The campaign specifically targets organizations in the United States and Ukraine, utilizing a sophisticated phishing technique that requires minimal user interaction to trigger.
New Dolphin X malware uses AI to rank high-value targets
A new remote access trojan (RAT) named Dolphin X is being advertised on cybercrime forums, claiming to incorporate an AI-powered profiling feature designed to rank infected users by value. This functionality aims to help attackers prioritize victims for further exploitation.
Australian energy provider Origin says data breach exposes client data
Origin Energy, a major Australian energy retailer, has confirmed a data breach that exposed personally identifiable information (PII) of some of its 4.8 million customers. The company, which provides electricity, natural gas, and broadband internet services, is currently investigating the full scope of the incident to notify affected individuals.
Rubio restricts visas for sextortionists, cyber scammers
The U.S. State Department will implement new visa restrictions targeting individuals involved in cybercrime, including sextortionists and various scammers, with potential extensions to their immediate family members. Secretary of State Marco Rubio announced the measure on Thursday, July 23, 2026, stating it sends a clear message that the United States will pursue those who prey on its citizens.
Fake Claude app promoted by Bing ads pushes SectopRAT malware
A malvertising campaign leveraging Bing search results has been observed distributing the SectopRAT malware through a deceptive Claude desktop application installer. The operation, dubbed "FakeAgent" by researchers at Huntress, compromised at least 29 organizations between July 21 and 22.
Introducing Cache Response Rules
Cloudflare has announced a new feature called Cache Response Rules, designed to give customers more granular control over how their content is cached and delivered. This new capability allows users to define specific rules that dictate caching behavior based on various HTTP response properties.
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian espionage group has reportedly exploited a zero-day vulnerability in the Zimbra Collaboration webmail client to steal sensitive user data, including emails and two-factor authentication codes. The campaign, attributed to the group TA488 (also known as LAUNDRY BEAR or Void Blizzard), began as early as July 2025 and continued for several months until the vulnerability was patched in…
For Taylor Swift, Madison Square Garden’s Controversial Cameras Briefly Went Dark
Madison Square Garden's extensive internal surveillance system, including its facial recognition capabilities, was reportedly disabled for several hours on July 2 and 3 for a private event. The shutdown order, which applied to the rehearsal dinner and wedding celebration of Taylor Swift and Travis Kelce, was issued "due to a client privacy request," according to an internal document.
Don’t swing at everything
Cisco Talos has identified a new Rust-based remote access trojan (RAT) dubbed "msaRAT," which is being deployed by the Chaos ransomware group. This sophisticated malware leverages the Tokio asynchronous runtime and establishes a covert command-and-control (C2) channel by hijacking Chrome or Edge browsers through the Chrome DevTools Protocol (CDP).
Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries
A Russian state-sponsored threat group has been exploiting a zero-day vulnerability in Zimbra Collaboration Suite since July 2025, stealing sensitive data from governments and commercial organizations across multiple Western countries. The vulnerability, identified as CVE-2025-66376, was not patched until November 2025, five months after the attacks began. The group, known as Laundry Bear or…
International alert spotlights Russia-linked attacks on Zimbra webmail
Cybersecurity agencies from the United States, United Kingdom, Europe, Australia, and New Zealand have issued a joint alert regarding a series of zero-click phishing attacks targeting Zimbra Collaboration Suite webmail. These attacks, attributed to the Russian state-aligned advanced persistent threat (APT) group known as Laundry Bear, exploit a vulnerability, CVE-2025-66376, which was patched…
Russian hackers exploit Zimbra zero-click flaw for email theft
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a Russian state-sponsored hacking group, known as Laundry Bear or Void Blizzard, which is actively exploiting a zero-click vulnerability in Zimbra Collaboration email servers. The group is combining phishing attacks with the exploitation of CVE-2025-66376, a cross-site scripting (XSS) flaw in Zimbra…
Year-long Russian attacks infect users as soon as they look at an email
A Russian state-sponsored threat group, identified as Laundry Bear or Void Blizzard, has been exploiting a cross-site scripting (XSS) vulnerability in the Zimbra web-based email and collaboration suite for at least a year. The attacks, which began in July 2025, allow adversaries to compromise victims simply by viewing a malicious email, without requiring any clicks or file openings.
Hackers abuse Notepad++ plugins to stealthily install malware
Ukrainian government cybersecurity experts have identified a new campaign by the threat group UAC-0099, which is leveraging legitimate Notepad++ functionality to deploy malware. The attacks, observed by Ukraine's Computer Emergency Response Team (CERT-UA), involve distributing a malicious package disguised as a PDF document that ultimately installs the Notepad++ application alongside a custom…
Millions of California-bought cars can be hijacked via Bluetooth
Researchers at the University of California San Diego (UCSD) have identified a critical vulnerability in KARR and SWDS aftermarket security systems, which could allow attackers to remotely unlock vehicles or prevent them from starting. These systems, manufactured by Acrisure, are installed by dealerships and are present in at least 2.2 million vehicles.
Russian Hackers Exploit New ‘Zero-Click’ Attack Against Western Organizations
Western cybersecurity agencies have issued a joint alert regarding a new "zero-click" attack campaign attributed to Russian state-supported hackers. The campaign, active since at least July 2025, targets government and commercial organizations in Western nations, exploiting a vulnerability in the Zimbra Collaboration Suite (ZCS) software to gain persistent network access and steal sensitive data.
Microsoft 365 outage affects Teams, SharePoint and other services
Microsoft 365 services experienced a significant outage primarily affecting users in North America, beginning at 10:44 AM ET on July 23. The incident, identified as MO1437424, led to widespread degradation across multiple core services, prompting Microsoft to advise customers to review their business continuity and disaster recovery plans.
Oracle drops 1,449 security patches like it's the new normal
Oracle has released a record 1,449 security patches as part of its quarterly update cycle, a number that security experts suggest reflects a growing trend in the industry driven by the increasing use of artificial intelligence in vulnerability detection. This substantial volume of fixes spans Oracle's extensive product portfolio.
Iran-linked crews are probing more flavors of US industrial kit
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has broadened its alert regarding Iranian-affiliated hacking groups targeting critical infrastructure, including facilities in the water and energy sectors. Initially, the advisory concentrated on programmable logic controllers (PLCs) produced by Rockwell Automation/Allen-Bradley. However, the updated warning indicates that these…
FedRAMP Rev5 Is Ending: What the 20x Transition Really Requires
The Federal Risk and Authorization Management Program (FedRAMP) is undergoing a significant transformation with the introduction of FedRAMP 20X, marking a departure from the previous FedRAMP Rev5 framework. This shift moves the focus from point-in-time documentation and annual assessments to continuous, machine-readable validation of security posture.