Hackers are hiding dangerous malware inside what look like popular Minecraft mods and game clients, using YouTube videos and search engine tricks to pull unsuspecting players into their trap. The campaign, known as WeedHack, has been quietly running since January…
Tag: EN
Laravel CRLF Injection Vulnerability Enables an Attacker to Interfere with Outbound Email Processing
A high-severity CRLF injection vulnerability in the Laravel framework, tracked as CVE-2026-48019, could allow attackers to interfere with outbound email processing in affected applications. The issue impacts Laravel versions up to 13.9.0 and versions before 12.60.0, and has been patched…
Ivanti ITSM Vulnerability Lets Attackers Gain Admin Privilege
Ivanti has disclosed a high-severity vulnerability in its Ivanti Neurons for ITSM platform that could allow attackers with valid credentials to escalate privileges and gain full administrative access. The flaw, tracked as CVE-2026-9614, affects both cloud and on-premises deployments and…
Critical Apache ActiveMQ Vulnerability Allows Malicious Security Header Injections
A critical vulnerability in Apache ActiveMQ has been disclosed, allowing attackers to inject malicious HTTP security headers through improperly handled message properties, potentially leading to cross-site scripting and response manipulation attacks in affected deployments. Tracked as CVE-2026-42253, the issue impacts…
Simplify security management with CIS SecureSuite Platform
New operating systems prioritize usability, a reality which threat actors use to exploit security gaps. Every misconfiguration creates an opportunity for compromise, and lean teams struggle in their security management efforts to harden hundreds or thousands of endpoints. CIS SecureSuite…
One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens
Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code (VS Code) that makes it possible to steal a user’s GitHub token. “Just by clicking a link, it’s possible for an attacker to steal a GitHub token that…
Infosecurity Europe: Vulnerability Management Innovator Konvu Wins Cyber Startup Award
Inaugural Infosecurity Europe Cyber Startup Award Winner Impresses Panel with Ability Help Prioritize Vulnerabilities in AI era This article has been indexed from www.infosecurity-magazine.com Read the original article: Infosecurity Europe: Vulnerability Management Innovator Konvu Wins Cyber Startup Award
Gentlemen Ransomware Exploits Fortinet Flaws, AI, and Custom C2 Tools
A newly analyzed leak tied to The Gentlemen ransomware group reveals how modern ransomware operations are evolving in structure and tooling while relying on the same proven intrusion techniques seen over the past four years. The leak also highlights operator…
Hackers Target Global Stock Exchange in Espionage Operation
The attackers had access to a senior executive’s email account for 150 days and exfiltrated data for months. The post Hackers Target Global Stock Exchange in Espionage Operation appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read…
Security of 100 AI Agents Tested and Ranked – What You Need to Know
The AI Risk Quadrant evaluates AI agents based on three factors: how vulnerable they are to compromise, the potential impact of a breach, and the strength of their security defenses. The post Security of 100 AI Agents Tested and Ranked…
Kirki, Burst Statistics WordPress Plugin Flaws in Attackers’ Crosshairs
Threat actors are exploiting vulnerable Kirki and Burst Statistics deployments to elevate privileges and take over websites. The post Kirki, Burst Statistics WordPress Plugin Flaws in Attackers’ Crosshairs appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read…
Malware campaign targeting Minecraft users infects over 116,000 systems
A Malware-as-a-Service (MaaS) operation named WeedHack is targeting Minecraft users and allows threat actors to gain remote access to victims’ screens, webcams, and files through a web-based dashboard, McAfee researchers found. Minecraft, developed by Mojang Studios and released in 2011,…
Autonomous AI-driven worm can reason its way through corporate networks
Researchers at the University of Toronto, the Vector Institute, and the University of Cambridge have built and tested a proof-of-concept AI-driven worm that does not operate on a fixed list of exploits. Instead, it analyzes each target it encounters, reasons…
Google Patches Actively Exploited Android Privilege Escalation
Google has released its June 2026 Android security bulletin addressing 124 vulnerabilities, with one flaw already under active exploitation in what the company describes as limited, targeted attacks. This article has been indexed from CyberMaterial Read the original article: Google…
Stock Exchange Hit by Monthslong Email Campaign
A finance executive at an undisclosed stock exchange fell victim to a monthslong email compromise campaign in which attackers maintained near-continuous access to their inbox using legitimate Windows system tools. This article has been indexed from CyberMaterial Read the original…
ENISA NIS360 2026: EU Sectors Show Uneven Cybersecurity Program
The European Union Agency for Cybersecurity (ENISA) has released its 2026 NIS360 assessment showing that while cybersecurity maturity is improving across critical sectors covered by the NIS2 directive, progress remains dangerously uneven. This article has been indexed from CyberMaterial Read…
New US cyber force estimated at $11B startup cost
A federal commission has recommended establishing a dedicated U.S. This article has been indexed from CyberMaterial Read the original article: New US cyber force estimated at $11B startup cost
Bayer Reinvents Security Awareness Training for AI Threats
Bayer has fundamentally redesigned its security awareness program to address AI-powered social engineering attacks that bypass traditional detection methods. This article has been indexed from CyberMaterial Read the original article: Bayer Reinvents Security Awareness Training for AI Threats
Expiring Microsoft Secure Boot Keys May Block DBX Updates on Legacy Devices
Expiring Microsoft Secure Boot keys will not brick unmigrated systems on June 27, 2026. However, they will silently freeze DB/DBX updates and lock affected Windows and Linux fleets out of future boot‑level protections. On June 27, 2026, the Microsoft Corporation…
WordPress Plugin Flaw Opens Door to Privilege Escalation Attacks Across 500,000+ Sites
A critical security flaw in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin is exposing sites to account takeover and privilege escalation attacks, with roughly 150,000 estimated to be running vulnerable versions introduced in the 6.0…