A critical vulnerability in Gitea, identified as CVE-2026-60004, could enable attackers to execute arbitrary shell commands on vulnerable servers. This…
Tag: Cyber Security News
WordPress Plugin Backdoor Sends Site and Administrator Details to Attacker C2
A critical supply chain backdoor in the Advanced Responsive Video Embedder WordPress plugin, which can give unauthenticated attackers complete…
Hackers Are Hiding Commands in Emails to Trick the AI Systems Protecting You
Attackers are beginning to hide malicious instructions inside ordinary emails, documents, calendar invites, and online advertisements. The goal is not…
Malicious npm Packages Deploy Cross-Platform RAT Targeting Alibaba Developers
A cluster of malicious npm packages has been used to deliver a cross-platform remote access trojan against developers who use Alibaba-related tools. The…
First-Ever Fully Autonomous AI Cyberattack Exploits 0-Day Flaws to Infiltrate Hugging Face
Between July 9 and July 13, 2026, security researchers documented what is being called the first fully autonomous AI agent cyberattack to chain zero-day…
OpenAI Open-Sources Codex Security CLI for Finding, Validating, and Fixing Security Vulnerabilities
OpenAI has open-sourced Codex Security, a command-line tool and TypeScript SDK designed to help developers find, validate, and fix security…
Claude Mythos Preview Discovers Cryptographic Weaknesses That Human Experts Missed for Years
Anthropic researchers using Claude Mythos Preview have uncovered mathematical flaws in major cryptographic algorithms that human experts failed to spot…
JetBrains Urging Customers to Patch Critical TeamCity Flaw that Enables OS Command Execution
JetBrains has urgently released security updates for a critical vulnerability in TeamCity On-Premises that could allow remote attackers to bypass…
Chrome Extension Monitors AI Conversations Across ChatGPT, Claude, Gemini, and Other Platforms
A Chrome extension with roughly 100,000 installs is quietly harvesting every prompt and AI response typed across nine major artificial intelligence…
Nginx Buffer Overflow Vulnerability Allows Attackers to Execute Arbitrary Code – PoC Released
A high-severity heap buffer overflow in NGINX Plus and NGINX Open Source can let unauthenticated attackers crash worker processes and, under certain…
Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026)
Global phishing-as-a-service (PhaaS) activity surged to 7,295 tracked uploads during the week of July 20-26, 2026, driven overwhelmingly by OAuth…
Apple iOS 26.6 Fixes Flaws Enabling Kernel Code Execution, Root Access and Sandbox Escape
Apple has released iOS 26.6 and iPadOS 26.6 to address a significant number of security vulnerabilities, including flaws that could allow malicious…
An SOC Story of Why Fast Answers Beat Perfect Answers in Cyber Incident Response
A Formula 1 pit crew doesn’t wait until every sensor, camera, and engineer agrees that a tire needs changing. They have a few seconds to make a decision…
Fake Claude Code Install Guide Uses Google Ads to Deliver MacSync Infostealer
Fake Google Ads are being used to push a convincing Claude Code installation guide that delivers the MacSync infostealer to macOS users. The campaign…
Origin Confirms Data Breach – Hackers Accessed 900,000 Customers’ Data
Origin Energy, an Australian energy provider, has confirmed that unauthorized access to customer information has affected approximately 900,000 current…
An SOC Story Why Fast Answers Beat Perfect Answers in Cyber Incident Response
A Formula 1 pit crew doesn’t wait until every sensor, camera, and engineer agrees that a tire needs changing. They have a few seconds to make a decision…
Dismantled Kratos Phishing Kits Acting as Blueprint for Others to Attack Microsoft 365 Users
Kratos is a phishing service built to steal Microsoft 365 credentials at scale. It evolved from the Sneaky2FA kit and gave affiliates ready-made login…
Hackers Are Using Fake Crypto Wallet Screens to Steal Recovery Phrases and Browser Sessions
Criminals are using convincing cryptocurrency wallet screens and browser extensions to steal recovery phrases, login data, and active browser sessions.…
Hackers Exploiting FastJson RCE 0-Day in the Wild to Attack US-based Organizations
A critical vulnerability in FastJson, identified as CVE-2026-16723, is being exploited against organizations in the United States, putting Java…
Dysphoria Botnet Infects 200,000 IoT Devices and Hides C2 Behind Blockchain Domains
Dysphoria has emerged as a fast-moving IoT botnet that has infected an estimated 200,000 devices worldwide. The malware targets routers, cameras,…