Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more. The post The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2) appeared first on Unit 42. This article has been…
Android Is Fighting Phone Scams With a New Feature to Prove Who’s Calling
Available for Android 12 and later, the anti-scam feature is baked into Google Dialer, which sends a silent “confirmation signal” to ensure whoever’s calling you is who they appear to be. This article has been indexed from Security Latest Read…
These convincing copyright notices are designed to steal Google logins
Scammers use fake takedown requests, countdown timers, and spoofed sign-in screens to steal Google logins from Chrome developers. This article has been indexed from Malwarebytes Read the original article: These convincing copyright notices are designed to steal Google logins
Cisco sings Mythos’ praises – but doesn’t say how many bugs the model uncovered
Meanwhile, Anthropic adds 150 partners to Project Glasswing This article has been indexed from www.theregister.com – Articles Read the original article: Cisco sings Mythos’ praises – but doesn’t say how many bugs the model uncovered
Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The vulnerability, CVE-2024-21182 (CVSS score: 7.5), allows an…
Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine
The Russian hacking group known as Gamaredon has been attributed to the continued exploitation of a WinRAR vulnerability to deliver multiple malware families aimed at data theft and propagation. Per Sekoia, the activity involves the weaponization of CVE-2025-8088, a path…
Android Is Fighting Phone Scams With a New Feature to Prove Who’s Calling
Available for Android 12 and later, the anti-scam feature is baked into Google Dialer, which sends a silent “confirmation signal” to ensure whoever’s calling you is who they appear to be. This article has been indexed from Security Latest Read…
CISA and Partners Urge Hardening Automatic Tank Gauge Systems
CISA and Partners Urge Hardening Automatic Tank Gauge Systems Overview The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), the Department of Energy (DOE), the Environmental Protection Agency (EPA), the Transportation…
Russia Says Foreign Spyware Found on High-Ranking Officials’ Mobile Phones
Russia’s Federal Security Service (FSB) has claimed it disrupted a large-scale cyber-espionage operation involving the deployment of advanced spyware on mobile devices used by high-ranking government officials. The agency stated that the campaign was orchestrated by unidentified foreign intelligence services…
Red Hat Confirms Supply Chain Compromise of @redhat-cloud-services npm Packages
Red Hat has officially confirmed a supply chain compromise affecting multiple packages published under the @redhat-cloud-services npm namespace, disclosed publicly on June 1, 2026. A compromised GitHub account was used to inject malicious code into frontend libraries maintained within a…
Attackers Abuse AWS, Google Cloud, Cloudflare, and Microsoft Services to Hide Malicious Traffic
Cybercriminals are increasingly weaponizing trusted cloud infrastructure, including Amazon Web Services, Google Cloud, Microsoft Azure, Cloudflare, and GitHub, to camouflage malicious traffic, evade detection, and sustain long-lived Command and Control (C2) operations. A recent threat intelligence investigation using ANY.RUN’s Threat…
Microsoft Build 2026: Securing code, agents, and models across the development lifecycle
Discover how Microsoft enables fast, secure AI development with MDASH and new security capabilities. The post Microsoft Build 2026: Securing code, agents, and models across the development lifecycle appeared first on Microsoft Security Blog. This article has been indexed from…
Fake ChatGPT Desktop App Ads Used to Push Password-Stealing Malware
Fake ChatGPT desktop app ads pushed password-stealing malware by abusing trusted AI links, hiding from scanners, and tricking users into downloads. This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and More Read the original article:…
Trump signs EO seeking early government access to powerful AI models
The directive represents an about-face for an administration that previously repudiated government AI reviews. This article has been indexed from Cybersecurity Dive – Latest News Read the original article: Trump signs EO seeking early government access to powerful AI models
Claude Code GitHub Actions Flaw Created Supply Chain Attack Risk
Claude Code GitHub Actions flaws could enable repository compromise, credential theft, and supply chain attacks. The post Claude Code GitHub Actions Flaw Created Supply Chain Attack Risk appeared first on eSecurity Planet. This article has been indexed from eSecurity Planet…
Instagram Account Hijacks Expose the Security Risks of AI-Powered Support
Attackers exploited Meta’s AI support chatbot to reset Instagram passwords and hijack accounts without accessing victims’ email inboxes. Attackers abused Meta’s AI-powered support chatbot to reset Instagram passwords and hijack accounts without accessing victims’ email inboxes. The issue affected several…
Attackers Actively Exploiting Critical Vulnerability in Burst Statistics Plugin
On May 13th, 2026, we publicly disclosed a critical Authentication Bypass vulnerability in Burst Statistics, a WordPress plugin with 200,000 active installations. This vulnerability can be leveraged by unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator…
Two New Reports Offer Competing Explanations for Cybersecurity’s Growing Crisis
As AI shortens the path from vulnerability disclosure to exploitation, researchers disagree on whether the problem is inadequate security tools or inadequate operational control. The post Two New Reports Offer Competing Explanations for Cybersecurity’s Growing Crisis appeared first on SecurityWeek.…
Dozens of Red Hat npm packages targeted in supply chain attack
Researchers said a variant of the Mini Shai-Hulud is involved in the compromise. This article has been indexed from Cybersecurity Dive – Latest News Read the original article: Dozens of Red Hat npm packages targeted in supply chain attack
Google Patches Android Zero-Day Under Active Exploitation
Google has patched CVE-2025-48595, an actively exploited Android zero-day that enables privilege escalation on affected devices. The post Google Patches Android Zero-Day Under Active Exploitation appeared first on eSecurity Planet. This article has been indexed from eSecurity Planet Read the…
U.S. CISA adds Oracle WebLogic flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle WebLogic flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Palo Alto Networks PAN-OS flaw, tracked as CVE-2024-21182 (CVSS score of 7.5), to its Known…
Secure multi-tenant AI agents with Amazon Bedrock AgentCore resource-based policies
Software as a service (SaaS) providers building AI-powered applications on Amazon Bedrock AgentCore often need to serve multiple tenants with distinct security requirements from a shared infrastructure. Some tenants require cross-account access from their own Amazon Web Services (AWS) accounts,…
IT Security News Hourly Summary 2026-06-02 18h : 13 posts
13 posts were published in the last hour 16:3 : How to prepare security controls for future AI regulations 16:3 : Password manager Dashlane says hackers stole some customers’ password vaults 16:3 : Dozens of Red Hat npm packages targeted…
How to prepare security controls for future AI regulations
<p>The global AI regulatory landscape is fragmented and volatile. As a result, cybersecurity leaders must reconcile competing compliance requirements and safeguard organizational AI without creating roadblocks to the overall AI strategy’s success.</p> <p>While the EU AI Act imposes a comprehensive,…