Group-IB has uncovered HollowGraph, a .NET espionage implant that uses a hijacked Microsoft 365 calendar and Microsoft Graph API traffic to receive instructions and exfiltrate stolen files through far-future calendar events. The campaign also uses DNS to refresh Entra ID client-credential details, and Group-IB links the implant to Cavern with high…
Category: Cyber Security News
Rapid7 uncovered an exposed malware delivery infrastructure that revealed 1,048 files, including live campaign artifacts, test kits, and documentation showing an operator using generative AI to build and test phishing delivery at speed. One active campaign targeted Mexican users through a fake CURP lookup site, delivering an infostealer via a WebDAV-based…
HollowGraph abuses the calendar feature in compromised Microsoft 365 mailboxes as a covert command-and-control channel to receive instructions and exfiltrate stolen data. Group-IB says the malware is likely part of the Cavern framework and is being used in targeted espionage against organizations in Israel. #HollowGraph #Cavern #Microsoft365 #MicrosoftGraph #Lyceum
AI-powered cyberattacks are becoming a real threat in 2026, with models like Anthropic’s Mythos and Fable, OpenAI’s GPT-5.5, and Z.ai’s GLM-5.2 showing cybersecurity capabilities close to top human hackers. The article argues that temporary controls are not enough and that long-term defense must come from stronger government leadership, better infrastructure protection, and coordinated risk management. #Anthropic #Mythos #Fable #OpenAI #GPT-5.5 #Z.ai #GLM-5.2 #CISA #ProjectGlasswing #PatchthePlanet
Okta’s red team uncovered HollowByte, a denial-of-service flaw in OpenSSL that lets an attacker exhaust server memory with only an 11-byte payload before any security handshake completes. The issue affects many OpenSSL-based applications and was patched in OpenSSL 4.0.1 and backported to 3.6.3, 3.5.7, 3.4.6, and 3.0.21. #OpenSSL #HollowByte #Okta…
Volexity says two SonicWall SMA1000 zero-days, CVE-2026-15409 and CVE-2026-15410, were exploited for weeks before patches were released, with activity starting as early as June 22. The attackers, tracked as UTA0533, used KnuckleBall malware to deploy the OrangeTail webshell and Suo5 proxy, prompting CISA to add the flaws to its KEV catalog….
Neo, an American-Israeli cybersecurity startup, has emerged from stealth with $100 million in seed and Series A funding to help enterprises control and secure AI software. Its platform provides real-time governance, asset discovery, policy enforcement, and attribution for AI agents, AI-enabled apps, and traditional software across enterprise environments. #Neo #AndreessenHorowitz #BessemerVenturePartners…
AI in the SOC is advancing quickly, but many deployments fail when they move from polished demos into real production environments. The guide, developed with Prophet Security and former Gartner analysts, gives security leaders a practical framework to test whether AI SOC solutions are accurate, durable, and aligned with how their teams work. #ProphetSecurity #Gartner #OliverRochford #PrateekBhajanka
A heap-based buffer overflow in 7-Zip’s XZ archive handler, tracked as CVE-2026-14266, could allow code execution when a crafted XZ file is opened, and the issue was fixed in 7-Zip 26.02 on June 25. The flaw carries High severity, affects local file handling, and users should update because products that bundle…
Ernst & Young (EY) has notified clients that personal and financial information was exposed after attackers accessed a third-party service management platform used for tax-related support work. The breach involved client documents containing sensitive data such as names, Social Security numbers, account numbers, and credit/debit card numbers, but no threat actor…
Richard Bird has launched the Hacker in a Hoodie (HIH) Index, a website that tracks disclosed material breaches through SEC filings, company statements, and news reports. The project aims to give journalists, policymakers, and the public a source-graded way to verify breach details without relying on inflated or misleading loss estimates….
Attackers are actively exploiting CVE-2026-6875, a critical pre-auth sandbox-escape RCE in the ServiceNow AI Platform, using a different route than the published proof of concept. ServiceNow has patched hosted instances and released updates for self-hosted deployments, but Defused says exploitation began in the wild soon after the fix was issued. #ServiceNow #CVE-2026-6875 #Defused #SearchlightCyber
Microsoft released emergency updates to fix a Windows 11 issue that caused some Dell PCs to slow down, overheat, drain battery, or shut down after recent security updates. The problem was traced to an incompatibility between the Windows USB-C Connection Manager and the Intel Innovation Platform Framework Processor Participant driver, affecting devices that installed KB5101650 and KB5095093. #Microsoft #Dell #KB5101650 #KB5095093 #IntelInnovationPlatformFramework
Microsoft is fixing a known WSUS issue that has caused synchronization failures and timeouts for more than a week, affecting both client and server Windows platforms. The problem is blocking some organizations from deploying the latest Windows updates through WSUS and Configuration Manager, while Microsoft works on additional mitigations for previously affected servers. #Microsoft #WSUS #WindowsUpdate #ConfigurationManager
Hugging Face disclosed that attackers breached its production infrastructure using an autonomous AI agent system, stealing internal datasets and credentials before moving laterally across internal clusters. The company says it has revoked and rotated affected credentials, fixed the vulnerable paths, and found no evidence yet of tampering with public models or datasets. #HuggingFace