A critical bug in open-source EDK II firmware lets a remote attacker run code on a machine before the operating system starts. The flaw is tracked as…
Category: Cyber Security News
Microsoft Whistleblower Alleges Foreign Engineer Was Approved to Access U.S. Government Cloud Logs
A claimed Microsoft whistleblower has raised concerns about government cloud security after screenshots appeared to show approval for an engineer,…
Discord to Make Discoverable Public Server Messages Searchable on Google
Discord will make selected messages from Discoverable Servers searchable through Google and other search engines, opening some community discussions to…
Researchers Exploit OpenAI API Flaw to Extract Hidden GPT-5.6 Reasoning Traces
Researchers at Xint found an OpenAI API flaw that exposed hidden reasoning in GPT-5.6 models by routing prompts through a conversation-compaction feature.…
Before Your SOC Investigates: What 16K+ Security Teams Already Know
What if some of the threats reaching your organization’s environment had already been identified elsewhere, before your security team even started…
Critical GoAhead TLS Flaws Could Expose Hundreds of Millions of Devices to Attacks
Three new security flaws affect GoAhead, a small web server that device makers build into routers, printers, gateways, and industrial controllers. The…
CISA Offers Two Free Tools to Detect Security Misconfigurations in Microsoft 365 and Google Workspace
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) offers two free tools to help organizations find security misconfigurations in Microsoft…
Hackers Use Fake FedEx Invoices to Deploy Sirius Backdoor and Evade Windows Security
Hackers are sending fake FedEx tax invoices to trick users into installing a stealthy backdoor on Windows. The malware, called Sirius Backdoor, hides…
Hackers Abuse Signed ChatGPT and Claude Binaries to Deploy Malware Through Fake GitHub Downloads
A malware campaign known as Yoba targets users by leveraging the popularity of AI tools like ChatGPT and Claude to trick them into installing infected…
Israeli Ad Tech Firm Accused on Using Online Ads to Track Starlink Users
Israeli advertising company Discover-Tech is accused of using online ads to track people connected to SpaceX’s Starlink satellite internet service.…
Alibaba’s Qwen AI Said It Wouldn’t Execute Commands, Then Tried to Send Data to China
Alibaba’s Qwen3.8-Flash-Next attempted an unexpected upload to an Alibaba Cloud storage bucket in Beijing during a closed security test, according to…
University of Copenhagen Data Breach Exposes 525,000 People’s Personal Data, Including Phone Numbers
The University of Copenhagen has confirmed a data breach that exposed personal information belonging to about 525,000 people after hackers accessed a…
Hackers Hijack AI Pentesting Agents to Install Backdoors and Steal API Keys
Hackers are now targeting the AI tools that security teams use to test their own networks. A new investigation describes automated campaigns that break…
Apple Released Patches for Exploited CoreGraphics 0-day Vulnerability for Older iPhones
Apple released iOS 18.7.11 and iPadOS 18.7.11 to patch a CoreGraphics zero-day vulnerability that attackers may have used in targeted attacks. Released on…
Hacker Uses AI to Breach 90 South Korean Organizations and Steal 8.2 Million Records
South Korean police have arrested a 32-year-old man accused of leading an AI-assisted hacking operation that stole personal records and internal files…
Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to Gain Elevated Privileges
HashiCorp has released fixes for a Consul-k8s authorization bypass that could allow an attacker to gain elevated Consul privileges from another Kubernetes…
Apple iOS 27.2 Released With Fixes for 163 Vulnerabilities, Including Fix for Critical WebKit RCE
Apple released iOS 27.2 and iPadOS 27.2 on October 26, 2026, with fixes for 163 security flaws. The update covers iPhone 11 and later and a wide set of…
Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens
Hackers compromised Microsoft 365 accounts at 79 organizations by reusing stolen login tokens, recording at least 497 successful sign-ins between July 14…
Top 10 Best Confidential Computing Platforms in 2026 [Ranked & Scored]
Encryption always had a hole: data must decrypt to compute, and whoever owns the machine cloud admin, hypervisor, intruder with root could watch.…
Hackers Impersonate IT Support on Microsoft Teams to Gain Remote Access to Employees’ PCs
Hackers are impersonating IT support staff on Microsoft Teams to persuade employees to grant remote access to their Windows computers. The activity…