Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not…
IT Security News Hourly Summary 2026-07-02 21h : 8 posts
8 posts were published in the last hour 18:34 : Europe Confirms Record €4.1B Penalty Against Google for Android Practices 18:34 : Claude Cowork’s Sandbox Vulnerability Allows Attackers to Run Arbitrary Commands as Root 18:34 : Ousaban Malware Uses Phishing…
Europe Confirms Record €4.1B Penalty Against Google for Android Practices
EU’s top court upheld a €4.1B fine against Google, ruling it abused Android’s market dominance through restrictive licensing practices. The Court of Justice of the European Union issued its ruling on July 2, 2026, and Google lost. The court dismissed…
Claude Cowork’s Sandbox Vulnerability Allows Attackers to Run Arbitrary Commands as Root
A vulnerability chain in Anthropic’s Claude Cowork allows an attacker with local code execution to escalate privileges and run arbitrary commands as root inside the product’s isolated Linux sandbox, bypassing every layer of defense Anthropic built into the environment. Claude…
Ousaban Malware Uses Phishing PDFs and VBS Downloader to Target Iberian Banking Users
A newly documented campaign is quietly hijacking online banking sessions across Spain and Portugal, and it starts with something as ordinary as a broken PDF file. The malware behind it, known as Ousaban, has resurfaced with a fresh set of…
AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python Scripts for Malware Delivery
AsyncRAT is back in the headlines, and the attackers behind it have found a clever way to hide in plain sight. Instead of relying on suspicious servers, they use Dropbox links and TryCloudflare tunnels, both trusted services that most security…
Microsoft 365 Phishing Panel Uses OAuth Device Code Flow to Capture Tokens and Persist Access
A newly uncovered phishing panel called ARToken is giving cybercriminals an easy way to steal Microsoft 365 login sessions without ever touching a password. The tool works by abusing a legitimate Microsoft sign in feature meant for devices without a…
AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for Stealthy Remote Access
A stealthy campaign is turning trusted remote access software into a weapon against everyday users and businesses. Attackers have hidden the AsyncRAT trojan inside fake software installers, letting it slip past basic security checks. The campaign relies on DLL sideloading…
Catan and Mouse
What do board games and cybersecurity have in common? Pattern recognition. Strategy. Adaptation. In this week’s Threat Source Bill explores why curiosity may be a defender’s most valuable skill. This article has been indexed from Cisco Talos Blog Read the…
Smooth AI criminal drives ‘first’ end-to-end agentic ransomware attack
Don’t count on the LLM to return your data – even if you pay up This article has been indexed from www.theregister.com – Articles Read the original article: Smooth AI criminal drives ‘first’ end-to-end agentic ransomware attack
Real-Time Observability: Introducing Akamai Cloud Pulse Alerts
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from Blog Read the original article: Real-Time Observability: Introducing Akamai Cloud Pulse Alerts
FortiBleed Credential Theft Connected to INC and Lynx Ransomware
FortiBleed, the Fortinet credential theft campaign, is now connected to INC Ransom and Lynx, with a Nextcloud zero-day vulnerability also under investigation. This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and More Read the original…
How to Install Kali Linux on VirtualBox (Step by Step 2026)
By HOC Team | Last updated: June 2026 | Read time: ~20 min Kali Linux is the most… The post How to Install Kali Linux on VirtualBox (Step by Step 2026) appeared first on Hackers Online Club. This article has…
CitrixBleed Vulnerability Exploited by Hackers Within 24 Hours of Public Disclosure
A newly disclosed CitrixBleed-class vulnerability in Citrix NetScaler appliances came under active exploitation less than a day after public disclosure, with decoy infrastructure operator Lupovis confirming a coordinated scanning-and-exploitation campaign across three separate sensor deployments. Within 24 hours of Citrix…
Researchers Warn of Unpatched Argo CD Flaw That Enables Cluster Takeover
Organizations using Argo CD to automate application deployments on Kubernetes are being urged to review their network configurations after security researchers disclosed an unpatched vulnerability that could allow attackers to execute arbitrary code on the platform’s repo-server component and…
Accenture Buys Cybersecurity Firms Dragos, runZero, NetRise for $4.18 Billion
In a landmark move to fortify its cybersecurity capabilities, Accenture has announced a $4.18 billion deal to acquire a majority stake in industrial cybersecurity leader Dragos, alongside full ownership of asset intelligence firm runZero and device security specialist NetRise.…
U.S. CISA adds a Microsoft SharePoint Server flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint Server flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft SharePoint Server flaw, tracked as CVE-2026-45659 (CVSS score v3.1 of 8.8), to…
ChatGPT File Download Flow Vulnerability Could Be Abused to Access System Files
A proof-of-concept vulnerability chain in ChatGPT that combined a guardrail bypass with a path traversal flaw, potentially allowing attackers to access restricted system files such as /etc/passwd through the platform’s file download mechanism. According to Security researcher zer0dac, OpenAI has…
DHS Confirms Breach of Information-Sharing Network Platform HSIN
The Department of Homeland Security has confirmed that hackers breached the Homeland Security Information Network (HSIN), a sensitive but unclassified platform relied upon by federal, state, local, tribal, territorial, international, and private-sector partners to coordinate emergency response and share threat…
Fake Google and Cloudflare verification pages spread multiple malware families
We uncovered ClickFix attacks using fake Google and Cloudflare pages to deliver everything from infostealers to a newly discovered malware loader. This article has been indexed from Malwarebytes Read the original article: Fake Google and Cloudflare verification pages spread multiple…
Apple’s Hide My Email doesn’t hide it very well
A year ago a researcher found a vulnerability in Apple’s Hide My Email feature and now he’s tired of waiting for a fix. This article has been indexed from Malwarebytes Read the original article: Apple’s Hide My Email doesn’t hide…
Improving security posture across the Microsoft partner ecosystem
Read how Microsoft strengthens partner ecosystem security with CSP vetting, least privilege access, monitoring, and risk management best practices. The post Improving security posture across the Microsoft partner ecosystem appeared first on Microsoft Security Blog. This article has been indexed…
Ctrl+Alt+Oops: FortiBleed criminal’s logins stitch two gangs together
Researchers scoured logs, finding opsec fail for at least one person who was working with INC and Lynx simultaneously This article has been indexed from www.theregister.com – Articles Read the original article: Ctrl+Alt+Oops: FortiBleed criminal’s logins stitch two gangs together
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories
This week’s security news is mostly about weak spots. Browsers, bots, sandboxes, AI systems, and email flows all show the same problem in different ways. Everything looks normal until someone tests a small gap and finds a way through. This…