A Cursor AI coding agent powered by Anthropic’s Claude Opus 4.6 deleted the entire production database and all volume-level backups of PocketOS, a SaaS platform serving car rental businesses nationwide, in a single unauthorized API call on Friday, April 25,…
Tag: Cyber Security News
Critical Gemini CLI Vulnerability Enables Remote Code Execution Attacks
Google has fixed a critical security flaw in the Gemini CLI that could allow attackers to execute remote code in certain automated workflows. The issue affects the npm package @google/gemini-cli and the google-github-actions/run-gemini-cli GitHub Action, especially when they are used in headless environments such…
ClickUp’s Hardcoded API Key Exposes 959 Emails from Fortune 500 Giants
A publicly accessible JavaScript file on ClickUp’s homepage has been silently leaking nearly a thousand corporate and government email addresses, including employees from Fortinet, Home Depot, Tenable, Mayo Clinic, and U.S. state government workers, through a hardcoded third-party API key…
Notepad++ Vulnerability Allows Attackers to Crash Application, Leak Memory Data
A security vulnerability has been identified in Notepad++, one of the most widely used open-source text editors among developers and IT professionals. The vulnerability CVE-2026-3008, which could allow a remote attacker to crash the application or extract sensitive memory address…
New Malware Uses Obfuscation and Staged Payload Delivery to Evade Detection
A newly discovered malware campaign is targeting government employees in Pakistan using carefully crafted spear-phishing emails that combine obfuscation and staged payload delivery to stay hidden from security tools. The attack was directed at staff from the Punjab Safe Cities…
New Vidar Malware Campaign Uses Fake YouTube Software Downloads to Steal Corporate Credentials
A credential-stealing malware named Vidar has quietly emerged as one of the most active threats targeting corporate employees in early 2026. Threat actors are using fake software downloads promoted through YouTube videos to trick workers into installing it on their…
North Korean Hackers Attacking Drug Companies to Deploy Malware Via Weaponized Excel Files
North Korean state-sponsored hackers from the Kimsuky group have launched a targeted campaign against prescription pharmaceutical companies, using a cleverly disguised malware file named White Life Science ERP Specification. The attack uses a fake Excel document to trick employees into…
EU Proposes Requiring Google to Share User Search Data with Rival Search Engines
The European Commission has formally proposed measures requiring Google to share anonymized user search data with rival search engines and AI chatbots, marking a landmark enforcement step under the Digital Markets Act (DMA) aimed at dismantling the search giant’s competitive…
Researchers Warn macOS textutil and KeePassXC Can Become Attack Primitives in Automation
Security researchers have raised a warning about two widely trusted tools, macOS textutil and KeePassXC, showing that both can become dangerous when placed inside automated pipelines that process attacker-controlled input. The findings do not point to traditional software flaws. Instead,…
Hackers Using Fake Income Tax Department’s Notice to Deploy Malware
A new phishing campaign is actively targeting Indian taxpayers and businesses by impersonating the Income Tax Department of India. Threat actors have built convincing fake websites that look nearly identical to official government portals, using urgent language to pressure victims…
Microsoft Store App Vibing.exe Allegedly Harvested Screens, Audio, and Clipboard Content
A suspicious executable named Vibing.exe on the Microsoft Store has sparked major privacy and security alarms among cybersecurity researchers. Marketed as an interface to the “AI-native world” by the elusive Vibing-Team, the application reportedly harvests sensitive user data without explicit…
Microsoft Officially Shares Group Policy to Remove Windows 11 Copilot from Enterprise Devices
Microsoft has officially released a new Group Policy setting that allows IT administrators to silently uninstall the Microsoft Copilot app from managed Windows 11 devices, a move that signals a broader enterprise shift away from bundled AI bloat and toward…
Microsoft Outlook.com Issue Blocks Users From Accessing Emails
Microsoft has acknowledged a service degradation affecting Outlook.com, with users reporting difficulties accessing the platform as of Monday, April 27, 2026. The company’s official Microsoft 365 Status account on X confirmed the incident, noting the last status update at 10:15…
ClickFix Attack Replaces PowerShell With Cmdkey and Remote Regsvr32 Payload Delivery
A new and more capable version of the ClickFix attack has been spotted in the wild, and it works a little differently from what security teams have seen before. Instead of relying on PowerShell, attackers are now chaining native Windows…
‘fast16’ Malware with Sabotage Capabilities Attacking Ultra expensive Targets
The fast16 malware is a recently exposed sabotage‑capable threat designed to target extremely high‑value environments and ultra‑expensive systems with precision. It does not behave like common commodity malware that aims for broad infections, but instead focuses on select victims where…
Top 10 Best NDR (Network Detection and Response) Solutions in 2026
In the modern enterprise, the network is the ultimate source of ground truth. As organizations accelerate their digital transformation and adopt complex, cloud-native security architectures, the traditional perimeter has dissolved. Threat actors routinely bypass endpoint defenses using compromised credentials, living-off-the-land…
Attackers Can Backdoor CODESYS Applications by Chaining Vulnerabilities
Multiple vulnerabilities in the CODESYS Control runtime, one of the world’s most widely adopted software-based programmable logic controller (Soft PLC) platforms. According to Nozomi Networks Labs researchers, by chaining these security flaws, an authenticated attacker can replace a legitimate industrial…
Vidar Malware Hides Second-Stage Payloads in JPEG and TXT Files to Evade Detection
Vidar, one of the most active information-stealing malware families, has taken on a new shape in 2026. Researchers have found that its latest version now conceals second-stage payloads inside JPEG image files and TXT documents, making it much harder for…
Nessus Agent Vulnerability on Windows Enables Arbitrary Code Execution with SYSTEM Privileges
A newly disclosed security vulnerability in Tenable’s Nessus Agent for Windows could allow attackers to execute malicious code with the highest level of system privileges, raising serious concerns for enterprise security teams relying on the widely-deployed vulnerability assessment platform. The…
pentest-ai-agents – 28 Claude Code Subagents for Penetration Testing
A new open-source toolkit called pentest-ai-agents is redefining how security professionals leverage AI in penetration testing workflows, transforming Anthropic’s Claude Code into a fully specialized offensive security research assistant powered by 28 domain-specific subagents. Released by security researcher 0xSteph on…