Category: Cyber Security News

Qilin ransomware affiliates are actively exploiting the PAN-OS GlobalProtect authentication bypass flaw, CVE-2026-0257, to gain unauthorized VPN access and deploy domain-wide encryption against victim networks. Arctic Wolf says the intrusions are ongoing and may involve multiple Qilin affiliates using both encryption-only and double-extortion tactics. #Qilin #PAN-OS #GlobalProtect #CVE-2026-0257

ServiceNow’s patched CVE-2026-6875 remote code execution flaw in its AI platform is reportedly being exploited in the wild, with evidence linked to technical details released by Searchlight Cyber. ServiceNow says it has not seen signs of abuse on hosted instances and is urging both hosted and self-hosted customers to apply the…

Clover Health Investments disclosed a data breach after a social engineering attack compromised three non-managerial health plan employee accounts on July 4. The incident may have exposed customers’ personally identifiable information and protected health information, though the company says it contained the intrusion and is still determining the full scope. #CloverHealthInvestments…

A security researcher says Meta paid him a $78,000 bug bounty after he found a critical flaw that exposed customer support data tied to Meta’s backend support infrastructure and Meta Horizon Managed Solutions. The issue involved missing authorization, broken access control, and IDOR bugs that could have revealed support conversations, case…

The World Cup avoided major public cyber disruption, but the article stresses that strong preparation, coordination, and resilience were essential behind the scenes. It highlights risks from spoofed FIFA websites, vendor and platform weaknesses, and potential OT disruptions, showing that future major events need continuous threat intelligence and early planning. #FIFA #IC3

Ostium said an attacker stole $23.75 million from its liquidity provider vault after compromising off-chain price feed infrastructure and submitting fake price reports to generate artificial profits. The platform paused trading, confirmed trader collateral was not stolen, and said the stolen USDC was later swapped into Ethereum and partially sent to Tornado Cash. #Ostium #Arbitrum #USDC #PeckShieldAlert #TornadoCash

Two newly disclosed SonicWall SMA1000 vulnerabilities were exploited as zero-days for weeks, giving UTA0533 a path to install custom malware on VPN appliances. The attack chain used CVE-2026-15409 and CVE-2026-15410 to achieve root access and deploy KNUCKLEBALL, Sou5, ORANGETAIL, and ROOTRUN. #SonicWall #SMA1000 #CVE-2026-15409 #CVE-2026-15410 #UTA0533 #KNUCKLEBALL #Sou5 #ORANGETAIL #ROOTRUN

The Department of Justice seized more than 1,000 domains that illegally streamed World Cup matches, with operations led by HSI and the National Intellectual Property Rights Coordination Center. Officials warned that illicit streaming sites can expose users to embedded malicious software and other risks, while international actions also targeted sites in…

Estée Lauder is notifying customers after attackers exploited a flaw in Oracle E-Business Suite used for HR operations and accessed personal information belonging to certain individuals. The breach is linked to the Clop campaign targeting CVE-2025-61882, which also affected multiple major organizations and led Estée Lauder to offer identity monitoring. #EstéeLauder #OracleEBusinessSuite #CVE-2025-61882 #Clop

India’s NPCIL said documents leaked online and linked to the Kudankulam Nuclear Power Plant do not contain information affecting nuclear safety or security, and appear limited to non-nuclear Balance of Plant materials. The leak was claimed by World Leaks, while Reliance Group reported a partial breach involving data hosted on Yotta…

Flock Safety has dropped its planned acoustic gunshot and “human distress” detection feature after privacy concerns and community backlash, saying the product was only in a limited trial and was never broadly released. The controversy followed reporting by the Electronic Frontier Foundation and came as the Los Angeles Police Department moved…

Researchers uncovered nearly 7,600 malicious GitHub repositories in the FakeGit campaign, including more than 800 fake AI Skills and MCP servers used to distribute SmartLoader and later StealC. The new AgentBaiting technique can trick AI agents like Claude Code, Gemini, and ChatGPT into discovering and following malicious repositories on their own….

Chris Fall is stepping down as director of the Center for AI Standards and Innovation just months after taking the role, and NIST Director Dr. Arvind Raman will serve as acting director. The center has become an important federal hub for testing frontier AI systems from companies like OpenAI and Anthropic for cyber, biological, and national security risks. #CAISI #NIST #OpenAI #Anthropic #ChrisFall

Security researchers from Pillar Security demonstrated sandbox escapes in Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity by planting files that trusted tools outside the sandbox later executed or scanned. The findings showed multiple failure modes, including hook abuse, interpreter execution, Git metadata tricks, command allowlist bypasses, and Docker socket access, with several issues patched or acknowledged by vendors. #Cursor #OpenAICodex #GeminiCLI #Antigravity #PillarSecurity