A significant vulnerability in the GSSAPI Key Exchange patch was applied by numerous Linux distributions on top of their OpenSSH packages. The flaw, tracked as CVE-2026-3497, was uncovered by security researcher Jeremy Brown. It allows an attacker to crash SSH…
Tag: Cyber Security News
Critical CrackArmor Vulnerabilities Expose 12.6 Million Linux Servers to Complete Root Takeover
Nine critical vulnerabilities have been discovered in AppArmor, which is a widely used mandatory access control framework for Linux. These vulnerabilities, collectively referred to as “CrackArmor,” enable unprivileged local users to escalate their privileges to root, break container isolation, and…
Meta Launches New Anti-Scam Tools on WhatsApp, Facebook and Messenger
Meta has launched a suite of advanced anti-scam tools across WhatsApp, Facebook, and Messenger to combat the growing industrialization of online fraud. These new defenses combine artificial intelligence, behavioral alerts, and global law enforcement partnerships to protect users proactively. To…
Attackers Hijack Microsoft 365 Accounts Through OAuth Device Code Abuse Without Stealing Passwords
Analysts at ANY.RUN has identified a sharp spike in phishing campaigns exploiting Microsoft’s OAuth Device Authorization Grant flow, with more than 180 malicious URLs detected within a single week. Unlike conventional credential harvesting, this technique routes victims through legitimate Microsoft…
Critical MediaTek Vulnerability Lets Attackers Steal Android Phone PINs in 45 Seconds
A critical vulnerability in the MediaTek Dimensity 7300 chipset allows a physical attacker to extract device PINs, decrypt on-device storage, and steal cryptocurrency wallet seed phrases in approximately 45 seconds, raising serious alarms for the roughly 25% of Android users…
Microsoft Copilot Email and Teams Summarization Vulnerability Enables Phishing Attacks
AI assistants have rapidly transformed daily operations, streamlining tasks for teams managing overloaded inboxes, client communications, and incident response. Tools like Microsoft Copilot integrate directly into daily workflows, summarizing emails and meetings while pulling context from across the Microsoft 365…
Ericsson US Discloses Data Breach – Hackers Stolen Employees and Customers Data
The U.S. subsidiary of a Swedish telecommunications multinational has disclosed a data breach exposing the personal information of employees and customers. The incident did not occur on Ericsson’s internal network, but rather targeted one of the company’s third-party service providers.…
Paloalto Cortex XDR Broker Vulnerability Attackers to Obtain and Modify Sensitive Information
A security advisory has been issued for a newly discovered vulnerability affecting the Cortex XDR Broker Virtual Machine (VM). This flaw could allow a highly privileged, authenticated attacker to access and alter sensitive system information. Fortunately, the issue was discovered…
SolarWinds Web Help Desk Deserialization Vulnerability Enables Command Execution
Cybersecurity authorities have flagged a severe security flaw in SolarWinds Web Help Desk that requires immediate attention from system administrators. Tracked as CVE-2025-26399, this vulnerability allows malicious actors to execute unauthorized commands directly on the host machine. Because of its…
Splunk RCE Vulnerability Allows Attackers to Execute Arbitrary Shell Commands
A critical security advisory has been released, warning users of a high-severity vulnerability affecting both Enterprise and Cloud platforms. Tracked as CVE-2026-20163, this flaw carries a CVSS score of 8.0. It enables attackers to perform Remote Command Execution (RCE) on…
Cisco IOS XR Software Vulnerability Allow Attacker to Execute Commands as Root
Cisco has issued a high-severity security advisory warning organizations about two critical privilege-escalation vulnerabilities in its IOS XR Software. If exploited, these flaws could allow an authenticated, local attacker to execute arbitrary commands as root or gain full administrative control…
Hackers Leveraging Cloudflare Anti-Bot Features to Steal Microsoft 365 Credentials
A sophisticated Microsoft 365 credential harvesting campaign that weaponizes Cloudflare’s own protective features to evade detection and silently steal user login data. The campaign demonstrates a growing and troubling trend: threat actors turning the very tools designed to defend websites…
GitLab Security Update – Patch for XSS and API DoS Vulnerabilities
GitLab has released urgent security updates for its Community Edition (CE) and Enterprise Edition (EE) to address a wide range of vulnerabilities. The newly released versions 18.9.2, 18.8.6, and 18.7.6 fix a total of 15 security issues, including critical Cross-Site…
Critical Microsoft Office Vulnerability Enables Remote Code Execution Attacks
On March 10, 2026, Microsoft released security updates to address a critical vulnerability in its widely used Office suite. Tracked as CVE-2026-26110, this security flaw allows an unauthorized attacker to execute malicious code on a victim’s device. With a high…
Chrome Security Update – Patch for 29 Vulnerabilities that Allow Remote Code Execution
Google has officially released Chrome version 146 to the stable channel, delivering crucial security updates for Windows, Mac, and Linux users. Rolling out over the coming days, Chrome 146.0.7680.71 for Linux and 146.0.7680.71/72 for Windows and Mac addresses 29 security…
Chrome Security Update – Patch for 29 Vulnerabilities that Allows Remote Code Execution
Google has officially released Chrome version 146 to the stable channel, delivering crucial security updates for Windows, Mac, and Linux users. Rolling out over the coming days, Chrome 146.0.7680.71 for Linux and 146.0.7680.71/72 for Windows and Mac addresses 29 security…
Google Completes Acquisition of Wiz in Historic $32 Billion Deal
Google has officially closed its $32 billion all-cash acquisition of Wiz, the Israeli cloud and AI security platform, marking the largest deal in Google’s history and a landmark moment for the global cybersecurity industry. The Wiz team will join Google…
Iran’s Internet Blackout Surpasses 10 Days as Traffic Flatlines Below 1% of Normal Levels
Iran’s internet blackout has now surpassed ten consecutive days, with Cloudflare Radar data confirming that HTTP traffic from the country remains well below 1% of pre-shutdown levels, effectively severing approximately 90 million Iranians from the global internet. The near-total blackout…
Stryker Cyber Attack – Hackers Claim System Breach and Device Wipe
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers used wiper malware to permanently erase data from its network. The breach severely impacted operations at its Cork headquarters and compromised devices worldwide,…
Microsoft Active Directory Domain Services Vulnerability Let Attackers Escalate Privileges
An “Important” security update released on March 10, 2026, addresses a high-severity flaw in Active Directory Domain Services (AD DS).Tracked as CVE-2026-25177, this vulnerability has a CVSS score of 8.8. It allows authorized network attackers to elevate their privileges to…