AT&T will pay $177 million to settle lawsuits over two major customer data breaches disclosed in 2024, after a federal judge granted final approval on…
Category: Cyber Security News
Microsoft Teams to Warn Users About Malicious Links Hidden in QR Codes
Microsoft is extending Teams security to detect malicious links hidden inside QR codes and warn users after a message has been delivered. The update adds…
AnyDesk Linux Flaw Lets Remote Attackers Execute Code as Root Without Authentication
A working proof-of-concept for a serious AnyDesk Linux vulnerability that can let remote attackers run commands as root without authentication or user…
CastleStealer Malware Uses Browser Protection Bypass and Remote Shell to Expand Attacker Access
CastleStealer, an emerging C#-based information stealer, has added browser protection bypass and remote shell features that give its operators a wider…
New Agentic AI Red Team Checklist Adds 222 Tests Across 20 Attack Categories
A free agentic AI red-team checklist offers 222 tests across 20 attack categories to assess autonomous AI systems beyond prompt injection, covering…
New GhostAction Attack Compromises Hundreds of GitHub Repos to Steal Secrets
A new GhostAction campaign has compromised 346 GitHub repositories after threat actors used two hijacked maintainer accounts to add a fake “security…
Cisco Talos Warns Autonomous AI Agents Could Turn Pentests Into Stealthy Red Team Attacks
Autonomous AI agents could move beyond noisy vulnerability scans and become quiet, persistent attackers, Cisco Talos has warned. The concern is not simply…
Warden Stealer Spreads Through ClickFix, Malvertising, Cracked Software and Game Cheats
A fast-growing Windows information stealer called Warden Stealer is being spread through ClickFix lures, malicious advertisements, cracked software…
Hackers Abuse Trusted Terraform Workflows to Infect Developer Systems With Cross-Platform Malware
A newly identified supply-chain campaign is abusing Terraform provider workflows to infect developer systems with malware built for macOS, Linux, and…
Top 10 Best IaC Security Tools in 2026 [Ranked & Scored]
The misconfiguration that breaches you in production was mergeable in review IaC security exists to catch it there. Evaluating the market alongside modern…
Microsoft Says PKI, HSMs and Security Appliances Must Prepare for Post-Quantum Authentication
Microsoft is urging organizations to prepare their certificate systems for post-quantum authentication, warning that public key infrastructure (PKI),…
Let’s Encrypt Cuts TLS Certificate Lifetimes From 90 to 64 Days Starting February 2027
Let’s Encrypt will cut its default TLS certificate lifetime from 90 days to 64 days on February 10, 2027, giving website operators less time between…
VirusTotal Adds Scanning for Public IPv4 Space to Expose C2 Servers and Malware Infrastructure
VirusTotal has added daily scanning of the public IPv4 space, giving security teams a new way to find command-and-control (C2) servers and track malware…
Top 10 Best Container Image Scanning Tools in 2026 [Ranked & Scored]
Every image scan returns hundreds of CVEs; the question is which ten your containers actually execute and which base image would zero the list entirely.…
Top 10 Best Bug Bounty Platforms in 2026 [Ranked & Scored]
Researchers are testing your perimeter tonight whether you invited them or not bounty platforms decide whether that energy reaches your inbox or the dark…
New Anthropic OSS Scanner Tool to Scan Open-source Repositories for Vulnerabilities
Anthropic has introduced OSS Scanner, a free service that checks critical open-source repositories for security vulnerabilities and sends findings…
MATCHBOIL Malware Uses Cloudflare-Hidden C2 Servers to Deliver Backdoor Payloads
MATCHBOIL, a C# malware downloader linked to UAC-0099, uses command-and-control (C2) servers hidden behind Cloudflare to deliver backdoor payloads. Its…
PoC Released for Telegram Desktop Flaw Enabling One-Click File Account Takeover
A public proof of concept has exposed a flaw in Telegram Desktop that could let attackers steal local files and take over accounts after a user clicks a…
React Server Components Flaw Lets Attackers Freeze Next.js Servers With a Single POST Request
A high-severity denial-of-service flaw (CVE-2026-23870) in React Server Components can allow a remote attacker to freeze vulnerable Next.js servers by…
Malicious PDF Reader With 10,000+ Installs on Google Play Delivers Anatsa Banking Trojan
A malicious Android PDF reader distributed through Google Play has recorded more than 10,000 installs while serving as an installer for the Anatsa banking…