Category: Cyber Security News

A threat actor known as HelloNet is abusing the ViPNet update mechanism to target Russian organizations, including government agencies, by deploying malware that acts as a proxy, loader, and backdoor. Kaspersky says the campaign has affected multiple sectors and may involve a Chinese-speaking APT group, though the attribution remains low confidence. #HelloNet #ViPNet #HelloInjector #HelloProxy #HelloExecutor #HelloCleaner #HelloBackdoor #InfoTeCS

Hugging Face said it was hacked through an autonomous AI agent that abused a malicious dataset to gain access to its production infrastructure and internal credentials. The company contained the incident, rotated secrets, strengthened cluster defenses, and used Z.ai’s GLM 5.2 for forensics after other models blocked analysis of the attack…

Two newly patched WordPress flaws, tracked as CVE-2026-60137 and CVE-2026-63030, are being actively exploited in the wild soon after disclosure. Chaining WP2Shell enables unauthenticated remote code execution on affected WordPress sites, prompting forced updates and protective rules from WordPress and Cloudflare. #WP2Shell #CVE-2026-60137 #CVE-2026-63030 #WordPress #Cloudflare…

Google has released Chrome 150 to fix seven memory safety flaws, including critical use-after-free bugs in CameraCapture, GPU, and Network, plus high-severity issues in Cast, Ozone, and Aura. The update also patches a V8 out-of-bounds read/write bug reported by OpenAI Codex Security, and users should install it promptly even though no…

7-Zip 26.02 fixes a remote code execution flaw in its XZ decompression handling that could let attackers run arbitrary code through a specially crafted archive. Users should install the update manually from 7-zip.org, as there is no automatic updater, to reduce the risk of phishing-delivered attacks and future exploitation. #7Zip #LandonPeng #XZ

Microsoft has observed a surge in attacks using ACR Stealer, which targets browser passwords, authentication tokens, and sensitive business documents. The malware is delivered through ClickFix lures, WebDAV servers, and MSHTA, and is believed to be a rebranding of Amatera Stealer. #ACRStealer #AmateraStealer #ClickFix #WebDAV #MSHTA

Public proof-of-concept exploits have been released for the wp2shell vulnerabilities in WordPress Core, enabling pre-authentication remote code execution against affected installations. Administrators should patch immediately to WordPress 7.0.2 or 6.9.5, as in-the-wild exploitation has already been observed. #wp2shell #CVE-2026-63030 #CVE-2026-60137 #WordPress

Age assurance laws are expanding worldwide, pushing platforms to verify users while reducing the privacy risks of collecting biometric data. Incode’s On-Device Age Estimation keeps facial analysis on the user’s device and pairs it with fraud detection and privacy-preserving collaboration to avoid transmitting or storing the face. #Incode #OnDeviceAgeEstimation #Identiq #OnlineSafetyAct #DigitalECA #ACCS #KantaraIAL2

Ukrainian President Volodymyr Zelensky appointed intelligence and counterterrorism official Yevhenii Khmara as acting defense minister after a government reshuffle triggered protests and criticism across Ukraine. The move comes as parliament and lawmakers debate whether Khmara’s military background complies with Ukrainian law, while leadership changes also affect the Security Service of Ukraine…

A ransomware attack forced Coca-Cola’s Fairlife dairy unit to temporarily halt U.S. production after detecting an intrusion on Thursday. Coca-Cola said product quality and safety were not impacted, while the investigation continues and law enforcement has been notified. #CocaCola #Fairlife…

Checkmarx uncovered ViteVenom, a cluster of seven malicious npm packages targeting developers using the Vite frontend tooling ecosystem in a software supply chain attack. The campaign is linked to SuccessKey and ChainVeil, using a four-tier blockchain-based C2 setup across Tron, Aptos, and Binance Smart Chain to deliver a RAT for reverse…

A security researcher known as Nightmare Eclipse released LegacyHive, a Windows zero-day proof-of-concept that can escalate privileges on fully updated systems by abusing the Windows User Profile Service. The exploit was intentionally stripped down to require extra credentials, while Microsoft says it is investigating the claim and cybersecurity experts have confirmed the PoC works. #NightmareEclipse #LegacyHive #WindowsUserProfileService #MicrosoftDefenderForEndpoint

Abbott Laboratories is investigating two separate cybersecurity incidents involving its Cancer Diagnostics business and its LabCentral portal, with one linked to ShinyHunters and the other to ShadowByt3$. The company says the incidents have not affected operations, while both threat actors claim to have stolen internal documents and, in the ShinyHunters case, large amounts of personal and medical data. #Abbott #ExactSciences #ShinyHunters #ShadowByt3$ #LabCentral

Okta disclosed HollowByte, a denial-of-service flaw in OpenSSL that can force unpatched servers to hold up to 131 KB of memory per connection and keep that memory fragmented on glibc systems even after the connection drops. OpenSSL fixed it in June without a CVE or advisory, and the issue affects TLS…