The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about an actively exploited SQL injection vulnerability in WordPress Core that could allow attackers to compromise websites and potentially achieve remote code execution. This flaw, tracked as CVE-2026-63030,…
Tag: Cyber Security News
Oracle Patches 1,400+ Vulnerabilities, Critical Flaws Expose Enterprise Servers to Remote Attacks
Oracle has released its July 2026 Critical Patch Update (CPU), shipping 1,449 security patches that collectively remediate more than 1,200 vulnerabilities across databases, middleware, cloud services, and enterprise applications, in what is now the largest CPU in the company’s history.…
New NULLZEREPTOOL Uses Telegram to Launch 20 DDoS Methods With Rotating Proxies
NULLZEREPTOOL is a newly uncovered attack framework that turns a Telegram bot into a remote control panel for powerful distributed denial of service campaigns backed by rotating proxy infrastructure. The framework came to light when a single Pastebin post was…
Russian Hacker Jailbreaks Claude to Turn into an AI-Powered Penetration Testing Platform
A Russian-speaking threat actor known as “Trim” has reportedly transformed jailbroken frontier AI models into an automated penetration testing platform called AI Pentest Checker. This activity highlights how criminals can misuse legitimate AI services and common security tools to accelerate…
Hackers Abuse Compromised Outlook Accounts to Steal MFA-Protected Microsoft 365 Sessions
Attackers are quietly turning trusted Microsoft Outlook mailboxes into launchpads for stealing multi factor authenticated Microsoft 365 sessions, even when users think they are protected. Adversary in the middle phishing has evolved into a reliable tool for hijacking live cloud…
Spain Fines 23andMe €2.4 Million Over Security Failures Behind 6.9 Million-User Breach
Spain’s data protection authority has fined the genetic testing company 23andMe €2.4 million due to security failures linked to a data breach in 2023. This incident exposed highly sensitive information such as genetic, health, ethnicity, and family-related data belonging to…
Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Agents and Steal Data
A newly disclosed flaw in Microsoft’s official Azure DevOps MCP server shows how an invisible comment in a pull request can silently hijack a developer’s AI coding assistant and turn it into a data-exfiltration tool. Security researchers at Manifold Security…
Anonymous Researcher Dumps 204 0-Day Exploit Files Before Vendors Can Patch Them
An anonymous GitHub user has quietly assembled one of the most disruptive exploit collections of the year, dropping 204 zero‑day proof‑of‑concept files for dozens of open‑source projects before vendors had a chance to patch them. The archive, hosted under the…
GolangGhost Steals Chrome Secrets From macOS Keychain and Hijacks MetaMask Permissions
A new malware campaign is targeting cryptocurrency and Web3 professionals through fake job interviews. The operation delivers GolangGhost, a remote access trojan that can steal browser credentials, collect wallet data, and give attackers control of infected macOS systems. The attackers…
OpenAI’s GPT Agents Exploit Zero-Days and Hacked Hugging Face Servers
Hugging Face has disclosed a security incident that security researchers are calling a watershed moment for AI safety: an autonomous AI agent, built on OpenAI models, independently discovered and chained multiple vulnerabilities, including a zero-day, to breach Hugging Face’s production…
Google Chrome Update Fixes 12 Vulnerabilities That Could Enable Browser Attacks
Google has rolled out a new Stable channel update for Chrome, patching 12 security vulnerabilities, including nine rated “High” severity. The update brings Chrome to version 150.0.7871.181/.182 for Windows and Mac, and 150.0.7871.181 for Linux, with the rollout expected to…
Qilin Ransomware Claims 1,358 Victims as Global Attacks Reach New Record
Qilin ransomware has grown from a fast-moving criminal operation into one of the most visible threats in the global extortion landscape. The group encrypts systems and steals data, then pressures victims with the risk of public leaks. Its campaigns have…
Hackers Turn Fake Games Into Multi-Stage Infostealers That Steal Passwords and Crypto Wallets
Criminals are using fake game downloads to slip a sophisticated information stealer onto Windows computers. The campaign hides behind supposed games, mods, cracks, and other software, exploiting the trust and urgency around free or hard-to-find downloads. A downloaded archive can…
Trump’s AI Safety Chief Quits Just Three Months After Taking Charge
Chris Fall has resigned as the director of the Center for AI Standards and Innovation (CAISI), leaving the Trump administration’s AI safety organization without a permanent leader just three months after his appointment. CNBC confirmed the departure on Monday following…
Hackers Hijack 20+ Government Websites to Deliver Malware Through Trusted Links
An active malware campaign, dubbed PhantomEnigma, that abuses compromised Brazilian government infrastructure to distribute malicious payloads while evading detection. The operation has hijacked at least 20 official “.gov.br” municipal and police portals, using them as trusted delivery points for malware…
This $2,000-a-Month Crypter Can Kill EDR and Make Malware Disappear From Disk
A criminal service called Cruciferra is giving malware operators a way to slip past Windows defenses. Sold as a subscription crypter for as much as $2,000 a month, it wraps malicious programs so security tools struggle to inspect, block, and…
Gemini 3.5 Flash Cyber With Automated Faster Vulnerability Detection and Patch Capabilities
Google has launched Gemini 3.5 Flash Cyber, a specialized cybersecurity model fine-tuned to find, validate, and patch software vulnerabilities faster and more efficiently than mainline Gemini Flash models. The release marks a significant expansion of Google’s automated security research efforts,…
Now You Can teach a Skill to Claude by Just Recording your Screen
Anthropic has rolled out a new capability in Claude Cowork that lets users teach the AI assistant a repeatable skill simply by recording their screen while performing a task. The feature, called “Record a skill,” turns a screen capture into…
Top 10 Malware Used by Hackers Last Week to Launch Cyberattacks
Cybercriminals continued to lean on a familiar arsenal of malware last week, with information stealers and remote access trojans (RATs) dominating the threat landscape as the primary tools for initial access, credential theft, and long-term system control. Topping the list…
Critical SharePoint Remote Code Execution Vulnerability Actively Exploited in the Wild
A newly disclosed vulnerability, tracked as CVE-2026-50522, is rattling enterprise IT teams as it allows unauthenticated attackers to remotely execute code on on-premises Microsoft SharePoint servers. The flaw carries a critical CVSS score of 9.8 and stems from deserialization of…