A large-scale phishing campaign is actively targeting organizations across the United States, using fake event invitations to deceive employees into handing over their corporate login credentials. The operation is wide in reach and strikes some of the most sensitive sectors…
Tag: Cyber Security News
Qilin Ransomware Enumerates RDP Authentication History on a Compromised Server
Qilin ransomware is one of the most active and damaging threats in the cyber landscape today. The group has steadily evolved its tactics since it first appeared in 2022, and its latest technique of enumerating Remote Desktop Protocol (RDP) authentication…
WordPress Plugin Hacked Since 2020 to Inject Malicious Code Silently
A massive supply chain attack has been uncovered in the Quick Page/Post Redirect Plugin, a popular WordPress plugin with over 70,000 active installations. Security researcher Austin Ginder discovered a dormant backdoor introduced five years ago that silently injects arbitrary code…
Jenkins Patches High-Severity Plugin Flaws Including Path Traversal and Stored XSS
Jenkins project published a security advisory detailing patches for seven plugin vulnerabilities, including high-severity path traversal and Stored Cross-Site Scripting (XSS) flaws. Administrators must urgently update these plugins to secure their Continuous Integration and Continuous Deployment (CI/CD) pipelines against potential…
Google Gemini CLI Vulnerabilities Allow Attackers to Execute Commands on Host Systems
A critical remote code execution vulnerability in the Google Gemini CLI and its associated GitHub Action. Assigned a maximum severity score of CVSS 10.0, the flaw allowed unprivileged external attackers to execute commands directly on host systems. This vulnerability effectively…
CVE MCP Server Turns Claude Into a Fully Capable Security Analyst With 27 Tools Across 21 APIs
A new open-source project called CVE MCP Server is redefining how security teams triage vulnerabilities, transforming Anthropic’s Claude AI into a fully capable security analyst by giving it direct, correlated access to 27 intelligence tools spanning 21 external APIs all…
OpenAI Releases 5-Point Action Plan to Strengthen AI-Powered Cyber Defense
OpenAI has published a comprehensive cybersecurity action plan titled “Cybersecurity in the Intelligence Age: An Action Plan for Democratizing AI-Powered Cyber Defense,” outlining a five-pillar strategy to equip trusted defenders with advanced AI capabilities while preventing adversarial misuse. Artificial intelligence…
ProFTPD’s SQL Injection Vulnerability Enables Remote Code Execution Attacks
A critical SQL injection vulnerability in ProFTPD, one of the Internet’s most widely deployed FTP servers. Tracked as CVE-2026-42167, this flaw carries a CVSS severity score of 8.1 and affects the mod_sql extension. Depending on how the server is configured, attackers can exploit…
CISA Warns of ConnectWise ScreenConnect Vulnerability Exploited in Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a severe vulnerability in ConnectWise ScreenConnect. On April 28, 2026, CISA officially added this flaw, tracked as CVE-2024-1708, to its Known Exploited Vulnerabilities (KEV) catalog. This…
Novel KarstoRAT RAT Enables Webcam Monitoring, Audio Recording, and Remote Payload Execution
A newly identified remote access trojan called KarstoRAT has been found in sandbox analyses and malware repositories since early 2026. The malware gives attackers a broad set of remote-control capabilities over compromised Windows machines, including webcam capture, audio recording, keylogging,…
Qinglong Task Scheduler RCE Vulnerabilities Exploited in the Wild
In early 2026, two critical authentication bypass vulnerabilities in the popular open-source Qinglong task scheduler were actively exploited by hackers. According to Snyk security reports, unauthenticated attackers breached publicly accessible panels, achieving remote code execution to install a hidden, resource-draining…
Claude-Generated Commit Adds PromptMink Malware to Crypto Trading Agent
A new threat has quietly taken root in the software development world, using an AI coding assistant as an unknowing participant in a supply chain attack. A malicious npm package campaign called PromptMink surfaced after being introduced into an open-source…
cPanel 0-Day Authentication Bypass Vulnerability Actively Exploited in the Wild — PoC Released
A critical authentication bypass vulnerability in cPanel & WHM has been confirmed to be actively exploited in the wild, sending shockwaves through the global web hosting industry. The flaw, tracked as CVE-2026-41940, allows unauthenticated attackers to bypass login mechanisms entirely,…
Europol Busts €50 Million Online Fraud Network Running Corporate-Style Scam Call Centres
A major international law enforcement operation has brought down a large-scale online fraud network that stole more than EUR 50 million from victims across Europe and beyond. Austrian and Albanian authorities, backed by Europol and Eurojust, carried out a coordinated…
SonicWall SonicOS Vulnerabilities Allow Attackers to Bypass Access Controls and Crash Firewall
SonicWall has released a security advisory addressing three vulnerabilities in its SonicOS software. Discovered by the Advanced Research Team at CrowdStrike, these flaws could allow attackers to bypass access controls, reach restricted services, or cause a denial-of-service condition by crashing…
New EtherRAT Variant Uses Trojanized Tftpd64 Installer to Bridge Web2 Malware and Web3 Theft
A new and more dangerous type of malware is quietly targeting Windows users by hiding inside a trusted software installer. Cybercriminals have combined traditional malware tactics with cryptocurrency theft, creating a threat that is harder to detect and far more…
Cursor AI Extension Access Developer Tokens Leads to Full Credential Compromise
A high-severity access-control vulnerability (CVSS 8.2) in Cursor, a widely used AI-powered coding environment. The flaw uncovered by LayerX has allowed any installed extension to access a developer’s API keys and session tokens secretly. This results in total credential compromise…
Linux Kernel 0-Day “Copy Fail” Roots Every Major Distribution Since 2017
A critical zero-day vulnerability in the Linux kernel has been publicly disclosed, enabling any unprivileged local user to obtain root access on virtually every major Linux distribution shipped since 2017. Dubbed “Copy Fail” and tracked as CVE-2026-31431, the flaw was…
Lazarus Hackers Attacking macOS Users With ‘Mach-O Man’ Malware Kit
North Korea’s state-sponsored Lazarus Group has unleashed a newly identified, modular macOS malware kit dubbed “Mach-O Man” a sophisticated, four-stage attack chain targeting fintech executives, crypto developers, and high-value enterprise users through fake meeting invitations and social engineering lures. Analyzed…
SAP npm Packages Compromised to Harvest Developer and CI/CD Secrets
A new supply chain attack dubbed “mini Shai Hulud” has compromised four SAP-related npm packages by injecting malicious preinstall scripts that silently execute during dependency installation, targeting developer environments and CI/CD pipelines to steal credentials across GitHub, npm, and major…