News Archive
2287 stories · page 83 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
HalluSquatting Attack Exploits AI Coding Assistants to Deliver Malware
A novel attack vector, dubbed "HalluSquatting," has been identified that exploits the inherent "hallucination" tendency of AI coding assistants to recommend non-existent project names. Threat actors can register these fabricated project names, effectively squatting on them, and then manipulate the AI into suggesting these malicious versions to developers. This technique ultimately leads…
Operationalizing Day Minus Seven: The Cloud-Native ROC
The cybersecurity landscape is rapidly changing with the advent of advanced AI models, leading to an era dubbed 'Day Minus Seven.' In this new paradigm, AI can discover, chain, and exploit vulnerabilities at speeds that outpace traditional security workflows. The primary challenge for security teams is no longer identifying vulnerabilities but rather discerning which exposures are genuine,…
China-Linked APT Expands Proxy Network With New Malware
A China-linked advanced persistent threat (APT) group, identified as UAT-7810, has been observed expanding its network of compromised devices, known as Operational Relay Box (ORB) networks, and equipping it with new custom malware. Researchers at Cisco Talos assessed with high confidence that UAT-7810 is a China-nexus group. These ORB networks consist of hijacked routers and other devices that…
Armored Likho Hits Government, Energy Sectors With BusySnake Stealer
A newly identified threat actor, referred to as Armored Likho, is actively targeting organizations within the government and energy sectors across Russia, Kazakhstan, and Brazil. Researchers have observed a sophisticated phishing campaign orchestrated by this group, which leverages a custom-developed information-stealing malware.
Attackers using Langflow flaw for credential harvesting (CVE-2026-55255)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in the Langflow AI framework to its Known Exploited Vulnerabilities catalog. This flaw, identified as CVE-2026-55255, has been observed being actively exploited in the wild by threat actors.
3 Ways AI Powers Service Desk Attacks and How to Prevent Them
Artificial intelligence is becoming a significant tool for attackers targeting service desks, as highlighted by IBM's 2025 Cost of a Data Breach Report, which found AI used in 16% of breaches. These attacks often leverage AI for sophisticated phishing and deepfake impersonation, aiming to bypass technical security controls by manipulating service desk agents. The onboarding process is…
Bug in top AI coding agents shows that Unix-era security headaches never really die
Security researchers have identified a significant vulnerability, termed "GhostApproval," affecting multiple widely-used AI coding assistants. This flaw allows malicious actors to trick these agents into accessing and modifying files beyond their intended sandbox environment, leading to potential remote code execution on a developer's machine. The vulnerability was discovered by Google-owned…
Censys Internet Map links real-time DNS data to internet infrastructure
Censys has enhanced its Internet Map by integrating real-time Domain Name System (DNS) data, allowing security teams to connect domain names directly to the underlying internet infrastructure. This development aims to streamline security workflows by consolidating information previously scattered across multiple datasets and interfaces into a single platform.
Blackpoint AI SOC Agent autonomously contains identity-based attacks
Blackpoint Cyber has launched its AI SOC Agent, a new feature designed for autonomous response to identity-based threats. This capability, now generally available, aims to detect and contain attacks targeting Microsoft 365 and Google Workspace accounts with minimal human intervention. The system operates on an AI and human hybrid model, with the AI component acting on threats it identifies…
First Recon AI Security Runtime helps enterprises govern AI with audit-ready evidence
First Recon AI has publicly launched its AI Security Runtime, a platform designed to govern and secure the use of artificial intelligence within enterprises. The system aims to provide organizations with the ability to manage AI interactions, enforce policies, and generate auditable records of AI activity.
FalconStor Cloud Clean Room enables validated recovery without dedicated infrastructure
FalconStor has introduced FalconStor Cloud Clean Room, a new platform designed to allow organizations to conduct validated recovery tests in a secure, on-demand environment. This solution aims to address the persistent challenge of ensuring data recoverability without the significant cost and complexity of maintaining dedicated recovery infrastructure.
Introducing Meerkat: an experiment in global consensus
Cloudflare has developed an experimental consensus service named Meerkat, designed to manage critical control-plane state across its global network of over 330 data centers. This new system aims to provide strong consistency and high availability, even under challenging internet conditions.
Security Teams Are Ready To Become More Preemptive. What’s Holding Them Back?
Security teams are increasingly ambitious and ready to adopt more proactive security measures, but practical challenges are hindering their progress. A survey conducted at Rapid7's Global Security Summit highlighted that while the direction is clear – moving towards more connected, resilient, and preemptive security operations – most organizations are still in the early stages of this…
DNSFilter makes its DNS threat protection available to OEM partners
DNSFilter has launched a new Original Equipment Manufacturing (OEM) program, allowing other companies to integrate its DNS threat protection, domain analysis, and privacy solutions into their own products. The program is now publicly available and has already been adopted by some partners.
Felons, Fraudsters Flog Offensive Cybersecurity Startup
IRIS C2, a cybersecurity startup actively seeking zero-day exploits with promises of substantial payouts, is reportedly led by individuals with a history of felony convictions and fraudulent operations. The company, which operates under the guise of IRIS C2 and is linked to Calvexa Group LLC, advertises on platforms like X (formerly Twitter) and its own website, irisc2[.]com, offering between…
Threat Actors Uses Agentic AI to Rapidly Compromise Cloud Target
A threat actor utilized agentic artificial intelligence to compromise an Amazon Web Services (AWS) cloud environment within 72 hours, a task that would typically take weeks, according to a report by the security vendor Sygnia. The attack, aimed at extortion, leveraged familiar cloud infrastructure exploitation techniques but at an accelerated pace due to AI assistance.
Your next car could be watching your face
New car buyers in the European Union will soon find their vehicles equipped with mandatory driver-monitoring technology, a measure designed to enhance road safety. This requirement, effective July 7, 2026, mandates systems like Driver Drowsiness and Attention Warning (DDAW) and Advanced Driver Distraction Warning (ADDW) in all new vehicles sold within the bloc. The United States is also moving…
MassTraction Exploits Roundcube Flaws at US, Canadian Universities
A threat group identified as UNK_MassTraction, suspected of operating on behalf of China, has been observed exploiting vulnerabilities within the Roundcube webmail application. The primary targets of these attacks are research mail servers located at academic institutions in both the United States and Canada. The group's reported method involves the theft of user sessions to achieve…
Telco giant KDDI says data breach affects over 12 million people
Japanese telecommunications company KDDI has reported a significant data breach impacting an email platform used by five internet service providers (ISPs) in the country, potentially exposing the personal information of over 12 million individuals. The breach, discovered on June 17, led to unauthorized access to email addresses and passwords of current and former customers, as well as those…
Telegram-Hosted RedWing Malware Lets Anyone Rent Android Spyware Tools
Researchers have discovered RedWing, an Android spyware operation being sold as a subscription service via Telegram, with suspected ties to Russian threat actors. This sophisticated Malware-as-a-Service (MaaS) product lowers the barrier to entry for novice attackers, providing documentation, tutorial videos, and a bot that customizes and builds malicious applications on demand. The entire…
Cybersecurity and the Gap Between Skill and Ability
National security agencies from the Five Eyes alliance have issued a joint warning about the escalating cyber risks posed by AI, particularly its capacity for autonomous hacking. The advisory reiterates long-standing cybersecurity best practices but emphasizes their increased urgency due to rapid AI advancements.
New Malicious Campaign Delivers Vidar Infostealer and Monero Crypto Miner
A new cyber-attack campaign is targeting consumers and small to medium-sized businesses globally, aiming to steal cryptocurrency data and mine Monero. The campaign, first observed in April 2026 by Unit 42, the research division of Palo Alto Networks, employs a dual monetization strategy.
OnlyFans Models Are Accidentally Making Hacked Government Websites Disappear
Adult content creators, primarily those on platforms like OnlyFans, are unintentionally contributing to the removal of compromised government and university websites from search engine results. This phenomenon arises from the creators' efforts to combat the widespread piracy of their content.
CISA orders feds to prioritize patching Langflow auth bypass flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies prioritize patching a critical authentication bypass vulnerability affecting the Langflow visual framework. The directive, issued as Binding Operational Directive (BOD) 26-04, requires agencies to secure their systems by Friday.