News Archive
2287 stories · page 87 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
CitrixBleed-ing Again? NetScaler Vulnerability Under Attack
Threat actors have begun actively exploiting a recently disclosed memory disclosure vulnerability in Citrix NetScaler appliances. This exploitation began shortly after security researchers released a proof-of-concept (PoC) exploit for the flaw.
Canadian spy agency reports hacking three criminal groups in 2025
Canada's Communications Security Establishment (CSE), the nation's equivalent of the NSA, conducted state-sanctioned cyber operations against three distinct criminal organizations in 2025. These operations targeted a ransomware gang, drug traffickers, and violent extremists operating outside of Canada but posing a threat to the country. The details of these "active cyber operations" were…
Phishing poses as big-brand job interview to steal Google accounts
A sophisticated phishing campaign is targeting marketing professionals by impersonating over 30 major brands in fake job interview invitations, aiming to steal their Google account credentials. The operation leverages legitimate cloud services and a domain linked to Salesforce Marketing Cloud to build trust before redirecting victims to a malicious landing page.
Fake IT support calls on Microsoft Teams push EtherRAT malware
Threat actors are leveraging Microsoft Teams voice calls to impersonate IT support staff and trick employees into installing the EtherRAT malware, according to research from Palo Alto Networks' Unit 42. This tactic grants attackers initial access to corporate networks. The operation combines phishing emails, Teams voice calls, legitimate remote management tools, and a custom malware loader to…
Blogspot-Hosted Payloads Delivered in ‘Veil#Drop’ Attacks
A sophisticated attack campaign, dubbed "Veil#Drop," is leveraging compromised websites and Google's Blogspot platform to distribute the PureLog information-stealing malware. Security researchers have identified a framework that utilizes a multi-stage approach, incorporating fileless techniques to evade traditional security defenses.
Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations
A hacking group linked to Iran's Ministry of Intelligence and Security (MOIS) has been observed utilizing a new, modular command-and-control (C2) framework named Cavern, also known as Cav3rn. This sophisticated tool has been employed in attacks specifically targeting organizations within Israel.
Vietnam arrests suspects behind HiAnime anime piracy service
Vietnamese authorities have arrested and are prosecuting seven individuals suspected of operating HiAnime, a prominent anime piracy service that was shut down in June. The group is accused of copyright infringement and money laundering.
US Army websites defaced with pro-Kurdish sentiments, insults to Trump
At least two U.S. Army websites were defaced with messages expressing pro-Kurdish sentiments and insults directed at President Donald Trump and White House advisor Tom Barrack. The defacements were discovered on error pages of the subdomains oil.army.mil and ai2c.army.mil.
16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
A critical vulnerability discovered in the Linux Kernel-based Virtual Machine (KVM) hypervisor could allow a malicious actor within a guest virtual machine to escape to the host system. The flaw, identified as CVE-2026-53359 and nicknamed "Januscape," affects the shadow memory management unit (MMU) component of KVM.
JadePuffer: The First Complete LLM-Driven Ransomware Attack
A novel ransomware attack, dubbed JadePuffer, has been observed leveraging large language models (LLMs) to automate significant portions of its operation, marking a potential shift in the threat landscape. This marks the first documented instance of a complete ransomware attack driven by an agentic threat actor utilizing LLMs.
Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure
Security researchers have detected malicious actors actively probing for a critical vulnerability in Gitea Docker images, just thirteen days after the issue was publicly disclosed and patched. The vulnerability, designated CVE-2026-20896, carries a severe CVSS score of 9.8, indicating a high level of risk.
How to tell if an image is AI-generated
Scammers are increasingly leveraging artificial intelligence to create realistic images for fraudulent purposes, making it harder for individuals to distinguish between genuine and fabricated content. These AI-generated visuals are being used to lend credibility to fake stories, solicit money, and extract personal information.
5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management
Cloud Security Posture Management (CSPM) is undergoing a significant transformation, moving beyond its traditional role of periodic compliance checks to become a continuous, risk-based governance layer integrated into Cloud Native Application Protection Platforms (CNAPPs). This evolution is driven by the increasing interconnectedness of cloud environments and the demand for faster risk…
The Shift Toward Business-Aligned Risk Management
Organizations are increasingly recognizing the need to move beyond siloed, technical security assessments and adopt a continuous risk management approach that directly ties into business objectives. This shift aims to ensure that security controls are not merely implemented for compliance or technical completeness, but are strategically aligned with the potential impact of security incidents…
Sysdig clocks first documented case of agentic ransomware
Researchers have documented the first instance of ransomware operations being managed by an artificial intelligence agent, according to a report by Sysdig. While the AI did not complete every phase of the attack, it significantly streamlined the process for the threat actor, accelerating the operation and providing distinct advantages.
Is Your AppSec Program Built to Close the OWASP Top 10 2025 Coverage Gap?
Many application security (AppSec) programs face significant gaps in their ability to cover the latest OWASP Top 10 categories, particularly those introduced or emphasized in the 2025 update. Traditional security scanners often struggle with modern authentication methods and complex API interactions, leaving critical vulnerabilities unaddressed.
A Day With Your Vector Command Red Team Pod
A dedicated team of five security operators, functioning as a "Vector Command pod," provides continuous red teaming services designed to simulate real-world adversary behavior and uncover risks within a customer's environment. This approach aims to offer a more dynamic and actionable understanding of an organization's security posture compared to traditional point-in-time assessments.
RCS Uses NAPTR Records for DNS Resolution
Rich Communication Services (RCS), a modern messaging protocol intended to succeed SMS, has seen increased adoption over the past year, particularly with recent updates to both iOS and Android operating systems. RCS offers enhanced formatting capabilities and improved security features compared to its predecessor.
⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More
This week's cybersecurity landscape saw a surge in vulnerabilities affecting seemingly ordinary components, from home streaming devices to fundamental web elements. Researchers highlighted how everyday technologies, typically not considered high-risk, became vectors for malicious activity, underscoring a broad and evolving threat environment.
Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
Check Point Research (CPR) has identified a sophisticated modular command-and-control (C2) framework named 'Cavern Manticore,' linked to an Iran-nexus threat actor. This group primarily targets Israeli organizations, with a particular focus on government entities and the IT sector. Cavern Manticore exhibits technical similarities to other Iran-linked groups, including MuddyWater and Lyceum,…
Ransomware Attacks Hit Financial, Defense, and Manufacturing Firms
Several organizations across the financial, defense, and manufacturing sectors have recently disclosed ransomware attacks or data breaches. These incidents include a US financial institution, a Spanish defense contractor, a Japanese industrial manufacturer, and a US insurance firm's Japanese operations.
How to Evaluate an AI SOC Platform in 2026: 6 Capabilities That Separate Leaders from Bolt-On AI solutions
Organizations looking to implement AI-powered Security Operations Center (SOC) platforms face a challenge in distinguishing truly integrated solutions from those that merely add AI as an afterthought. A critical evaluation process is necessary to identify platforms that offer genuine advancements rather than superficial enhancements to existing tools.
Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT
A sophisticated cyber-espionage campaign, attributed to a threat actor with suspected ties to China, has been identified targeting Indian taxpayers, tax professionals, and corporate finance departments. The objective of this operation appears to be the deployment of a remote access trojan (RAT) known as DcRAT, with the ultimate goal of exfiltrating sensitive data from compromised systems.
France to Stop Certifying Non-Quantum-Safe Encryption
France's national cybersecurity agency, ANSSI, has announced a significant policy shift that will phase out the certification of encryption products not resistant to quantum computing. This move is expected to compel French government bodies and operators of critical infrastructure to transition to quantum-safe encryption solutions.