News Archive
2287 stories · page 84 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
A Chinese-linked threat actor identified as UAT-7810 is reportedly expanding its network of compromised devices, known as the Operational Relay Box (ORB) network, by deploying new custom malware. Cisco Talos researchers have observed this actor compromising internet-facing networking devices to achieve this expansion.
Found fast, fixed slow: The gap the AI clearinghouse must close
A recently established AI cybersecurity clearinghouse, mandated by an executive order, is tasked with coordinating the discovery and patching of software vulnerabilities within critical infrastructure. The initiative aims to address the growing gap between the rapid pace of AI-driven vulnerability identification and the slower, more complex process of remediation.
U.S. CISA adds Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities affecting Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder to its Known Exploited Vulnerabilities (KEV) catalog. This directive mandates that federal agencies patch these vulnerabilities by July 10, 2026, to mitigate risks from active exploitation. Private…
Ubiquiti warns of new max severity UniFi OS vulnerability
Ubiquiti has issued security updates to address seven critical vulnerabilities affecting its UniFi OS, including a maximum-severity flaw that could allow for command injection attacks. The most severe issue, tracked as CVE-2026-50746, impacts the UniFi Connect Application, specifically versions 3.4.16 and earlier.
NCSC Touts National Scale, AI-Powered “Cyber Shield” for Defense
The UK's National Cyber Security Centre (NCSC) has announced plans for "Cyber Shield," an ambitious national cyber-defense initiative designed to counter the growing threat posed by AI-powered cyberattacks. The project, first discussed in May, aims to build a large-scale, AI-driven capability to protect the UK's critical technology systems.
Understanding Program Memory Stack with Stack Simulator
A new resource is available to help individuals understand the fundamental computer science concept of the program memory stack. This explanation details how local variables and function return addresses are managed within a program's execution.
State IDs for AI Agents: Will Estonia Set a Precedent?
Estonia is considering how its citizens might utilize artificial intelligence agents to interact with government services, a move that raises novel questions about digital identity and authentication for non-human actors. The Baltic nation is actively exploring mechanisms to enable AI agents to act on behalf of individuals when accessing public sector functionalities.
CISA Deploys Anthropic’s Mythos AI to Hunt Vulnerabilities in U.S. Government Code
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is utilizing Anthropic's advanced artificial intelligence model, Mythos, to proactively identify vulnerabilities within federal government code. This initiative aims to detect and address security weaknesses before they can be exploited by malicious actors, including foreign intelligence services and cybercriminal organizations.
CISA orders feds to patch max severity ColdFusion flaw by Friday
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies patch a critical vulnerability in Adobe ColdFusion by Friday. This directive, issued under Binding Operational Directive 26-04, targets a flaw designated CVE-2026-48282, which is actively being exploited by malicious actors.
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
A Linux kernel vulnerability, present for 15 years and now publicly disclosed as CVE-2026-43499, has been identified by Nebula Security. This flaw, dubbed GhostLock, allows any authenticated user on an unpatched system to escalate their privileges to root and to break out of containerized environments.
CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its catalog of Known Exploited Vulnerabilities (KEV). These newly identified weaknesses, which affect products from Adobe, Joomla, and Langflow, are reportedly being actively exploited in the wild.
The Threat Isn’t the Frontier Model
The primary danger to cybersecurity defenses from artificial intelligence is not the advanced "frontier" models, but rather the increasing ease with which adversaries can deploy smaller, more efficient AI models on modest hardware. This trend, driven by advancements in model quantization, is expected to accelerate in the coming months, enabling opportunistic attackers to scale their operations.
ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit
A Mexican banking fraud campaign, identified as REF6045, is being actively managed by human operators who monitor infected systems and direct malicious activities. The initial infection vector involves deceptive CAPTCHA pages that trick users into executing a command, which then installs the SCMBANKER PowerShell toolkit. This toolkit, with components dating back to at least October 2025,…
Accenture confirms breach after hacker offers stolen data for sale
Global IT services firm Accenture has confirmed a security breach after a threat actor claimed to have stolen 35 gigabytes of data, including source code. The company stated that the matter has been addressed and does not impact its operations or service delivery.
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
A recent campaign identified by researchers has been observed distributing the Vidar information stealer and the XMRig cryptocurrency miner. The operation, which saw a significant spike in activity in April 2026, primarily targets consumers and small to medium-sized businesses in the U.S. and European Union. Attackers lure victims through malvertising, directing them to download fake cracked…
Spain arrests suspected hacker linked to Russian hacktivist campaign
Spanish authorities have arrested a man suspected of involvement in pro-Russian hacktivist campaigns, including activities linked to Cyber Army of Russia Reborn and NoName. The arrest, which occurred in March but was announced on a Monday, was the result of an investigation initiated by a tip from the FBI in August 2025.
Critical Gitea Docker Bug Under Active Exploitation Exposes Repositories and Secrets
Attackers are actively exploiting a critical vulnerability in Gitea's official Docker images, enabling them to bypass authentication and gain access to sensitive repositories and secrets. The flaw, identified as CVE-2026-20896, carries a high severity score of 9.8.
Big Brand Jobs Scam Targets Marketing Pros' Google Accounts
A sophisticated phishing campaign is actively targeting marketing professionals with deceptive job offers, aiming to compromise their Google account credentials. The attackers are impersonating well-known brands to lend credibility to their fraudulent recruitment efforts.
Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft
Security researchers at Varonis have disclosed a vulnerability in Google's Dialogflow CX platform that could have allowed attackers to steal sensitive data from AI-powered chatbots. The flaw, which Varonis has named the "Rogue Agent" flaw, has since been addressed by Google with a deployed fix.
Chinese hackers develop LONGLEASH malware to expand ORB network
Chinese threat actors, identified as UAT-7810, are actively developing and deploying new malware to enhance their Operational Relay Box (ORB) network. This network, previously documented as a secure relay infrastructure for other China-aligned advanced persistent threat groups, is being expanded by compromising internet-facing networking devices, with a particular focus on unpatched Ruckus…
OMB M-26-14: Why federal agencies must fix asset visibility first
The Office of Management and Budget (OMB) has released Memorandum M-26-14, a significant update to federal agency cybersecurity requirements, focusing on enhanced logging and network visibility. This new directive supersedes M-21-31, shifting away from broad data retention mandates towards a more structured, risk-based approach.
Uncommon NIMLOC DNS Record Type Observed
The SANS Internet Storm Center is drawing attention to an unusual DNS record type, NIMLOC, that has recently been detected within network traffic logs. The purpose and origin of these records are not immediately clear, prompting investigation by security professionals.
SharpHound Recon Attack – How AI enhanced the threat hunt
At Cisco Live AMER 2026, a novel approach to security operations was implemented by integrating an AI-driven security agent with always-on, full packet capture technology. This setup aimed to automate threat hunting and analysis, protecting conference attendees and infrastructure.
Machine Speed, Human Judgement: How AI Changed the SOC in 2026
The operations of Security Operations Centers (SOCs) have undergone a fundamental transformation, largely driven by the integration of artificial intelligence into investigative workflows. This shift enables analysts to operate with machine-like speed while focusing their expertise on critical decision-making.