A critical privilege escalation vulnerability has been discovered in the IPVanish VPN application for macOS. This flaw allows any unprivileged local user to execute arbitrary code as root without requiring user interaction. The security failure completely bypasses macOS security features,…
Category: Cyber Security News
Malicious Packages Disguised as Laravel Utilities Deploy PHP RAT and Enables Remote Access
A supply chain attack targeting the PHP developer community has surfaced through Packagist, the official package repository for PHP and Laravel projects. Threat actor nhattuanbl published several packages that disguised a fully functional remote access trojan (RAT) inside what looked like standard…
CISA Warns of VMware Aria Operations Vulnerability Exploited in Attacks
A critical vulnerability affecting VMware Aria Operations has been added to the Known Exploited Vulnerabilities (KEV) catalog. Broadcom recently issued a security advisory detailing a flaw that allows unauthenticated attackers to execute arbitrary commands. Organizations are urged to implement mitigations…
Windows 11 23H2 to 25H2 Upgrade Allegedly Breaking Internet Connectivity
A persistent bug in Windows 11 in-place upgrades is reportedly wiping critical 802.1X wired authentication configurations, leaving enterprise workstations completely offline until manual intervention is performed. System administrators across Reddit’s r/sysadmin community are raising alarms as the issue originally observed…
Coruna Exploit Kit With 23 Exploits Hacked Thousands of iPhones
Google’s Threat Intelligence Group (GTIG) has uncovered Coruna, a sophisticated iOS exploit kit containing 23 exploits across five full exploit chains that compromised thousands of iPhones running iOS 13.0 through 17.2.1 throughout 2025. The Coruna exploit kit is an advanced,…
SloppyLemming Espionage Campaign Uses BurrowShell Backdoor and Rust RAT to Hit Pakistan and Bangladesh Targets
A suspected India-aligned threat group known as SloppyLemming has been conducting a sustained espionage campaign against government agencies, defense organizations, nuclear oversight bodies, and critical infrastructure operators in Pakistan and Bangladesh. Active since 2021 and also tracked as Outrider Tiger…
Zerobot Malware Exploiting Tenda Command Injection Vulnerabilities to Deploy Malware
A Mirai-based botnet campaign known as Zerobot has resurfaced with renewed force, this time targeting critical flaws in Tenda AC1206 routers and the n8n workflow automation platform. The campaign, now operating on its ninth known iteration — dubbed zerobotv9 —…
Microsoft Warns of New Phishing Attack Exploiting OAuth in Entra ID to Evade Detection
A new active phishing attack that exploits OAuth’s legitimate redirection behavior, allowing it to bypass traditional email and browser defenses without stealing any tokens. According to Microsoft Defender researchers, the campaigns primarily target government and public-sector organizations, using trusted identity…
LexisNexis Data Breach — Threat Actor Allegedly Claims 2.04 GB Stolen
A threat actor operating under the alias FulcrumSec has publicly claimed responsibility for a fresh breach of LexisNexis Legal & Professional, the legal information division of RELX Group, alleging the exfiltration of 2.04 GB of structured data from the company’s…
Malvertising Threat Actor ‘D‑Shortiez’ Abuses WebKit Back‑Button Hijack in Forced‑Redirect Browser Campaign
A threat actor tracked as D-Shortiez has been running a persistent malvertising campaign that turns a WebKit browser behavior into a trap, forcing iOS Safari users into scam pages with no easy way out. The campaign is not entirely new…
Epic Fury/Roaring Lion Sparks Escalating Cyber Conflict as Iran Goes Offline, Hacktivists Step Up Retaliation
On February 28, 2026, the United States and Israel launched a coordinated offensive — code-named Operation Epic Fury by the U.S. and Operation Roaring Lion by Israel — setting off a wide-ranging cyber conflict that spread across the Middle East…
Hackers Leverage Telegram for Initial Access to Corporate VPN, RDP, and Cloud Environments
Telegram, once widely recognized as a privacy-focused messaging application, has quietly transformed into one of the most powerful operational platforms used by cybercriminals today. What dark web forums once offered — anonymity, exclusive access, and a marketplace for stolen data…
Langflow’s AI CSV Agent Vulnerability Allows Remote Code Execution Attacks
A critical vulnerability in a popular AI application platform allows attackers to remotely execute harmful code through its CSV data-processing agent. The vulnerability, tracked as CVE-2026-27966, was recently disclosed and given a critical severity score of 10.0 out of 10.…
Google Unveils Merkle Tree Certificates to Shield HTTPS Against Quantum Threats
Google has announced a major initiative to protect HTTPS connections from the emerging threats posed by quantum computing. Working with the Internet Engineering Task Force (IETF) and its “PKI, Logs, And Tree Signatures” (PLANTS) working group, Chrome is spearheading the…
Malvertising Campaign Delivers AMOS ‘malext’ macOS Infostealer via Fake Text‑Sharing Lures
A new malvertising campaign is actively targeting macOS users worldwide, delivering a new variant of the AMOS infostealer called “malext.” Attackers are purchasing Google Search ads that push victims toward fake help articles on free text-sharing websites, where a deceptive…
How to Cut MTTR by Improving Threat Visibility in Your SOC
In boardrooms and security operations centers alike, one metric has risen from a niche KPI to a defining measure of organizational resilience: Mean Time to Respond (MTTR). But why has this particular number captured so much attention, and does it…
Hackerbot-Claw Bot Attacks Microsoft and DataDog via GitHub Actions CI/CD Misconfiguration
Between February 21 and February 28, 2026, an autonomous bot named hackerbot-claw launched a week-long attack campaign against major open source repositories. It targeted GitHub Actions CI/CD pipelines belonging to Microsoft, DataDog, the Cloud Native Computing Foundation, and several other…
New Claude Memory Feature Allow Users to Transfer Data from ChatGPT and Other AI Providers
Anthropic has introduced a new memory import tool for Claude that allows users to seamlessly transfer their stored preferences, habits, and context from other AI platforms, including ChatGPT, Google Gemini, and Microsoft Copilot, directly into Claude’s memory system, eliminating the…
Threat Actors Deploy ‘AuraStealer’ Infostealer with 48 C2 Domains and Active Campaigns
A new information-stealing malware called AuraStealer has been making its presence felt across the cybersecurity landscape since mid-2025. Developed and actively maintained by a group of Russian-speaking individuals, the malware first appeared on underground hacker forums in July 2025, shortly…
Android Security Update – Patch for 129 Vulnerabilities and Actively Exploited Zero-Day
Google has released its highly anticipated March 2026 Android Security Bulletin, delivering critical fixes for 129 security vulnerabilities across the Android ecosystem. This massive update represents one of the highest numbers of patches issued in a single month in recent…