Category: Cyber Security News

WordPress fixed a pre-auth remote code execution flaw in core that could be triggered by an anonymous HTTP request on default installs, affecting versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Administrators should verify their actual version and update immediately, since the issue has no CVE yet and can also be…

Two young men, Thalha Jubair and Owen Flowers, were sentenced to 66 months in jail for a 2024 cyberattack that disrupted Transport for London operations and drew major attention from U.K. and U.S. authorities. Investigators linked both to Scattered Spider and said Jubair was tied to extensive extortion activity, while officials described the case as a major disruption to the group’s criminal activity. #TransportforLondon #ThalhaJubair #OwenFlowers #ScatteredSpider #TheCom

Flare researchers analyzed 2,889 underground posts and found that carders now treat residential proxies as only one part of a larger identity-simulation stack, not a standalone way to bypass fraud controls. Criminals are increasingly focused on “clean” IPs, geolocation consistency, and finance-compatible access, while defenders should assess the full session context rather than trusting residential traffic alone. #Flare #NetNut #Popa

OpenSSL has silently fixed HollowByte, an unauthenticated denial-of-service flaw that can be triggered with only an 11-byte malicious payload and can leave servers memory-bloated until restart. Okta’s Red Team warns that organizations using OpenSSL in products like NGINX, Apache, Node.js, Python, Ruby, PHP, MySQL, and PostgreSQL should upgrade immediately to the patched releases. #OpenSSL #HollowByte #NGINX #Apache #Nodejs #Python #Ruby #PHP #MySQL #PostgreSQL

President Donald Trump’s primetime speech was widely criticized by election officials and experts as a repetition of long-debunked claims about rigged U.S. elections and foreign interference. Officials said the administration’s new allegations about noncitizen voting and compromised election systems lacked credible evidence and appeared to reflect political desperation. #DonaldTrump #China #DHS #SAVEdatabase #ElectionAssistanceCommission

Beacon Security has raised $13 million in a seed funding round led by Notable Capital, with participation from several other investors. The New York-based startup says its agentic security data platform helps organizations use AI agents and human analysts to detect, investigate, and respond to threats with greater context and real-time…

This SecurityWeek interview features Clint Bodungen discussing why traditional governance often fails practitioners, how cybersecurity has changed over two decades, and why people remain the biggest weakness. He also introduces the MindStone Agent and highlights a real-world ransomware response where autonomous AI agents helped coordinate incident response, forensics, recovery, and infrastructure…

This week’s cybersecurity roundup covers major incidents involving Odido, Lidl, ZEGO Textilveredelungszentrum, Nihon Kotsu, and Thyssenkrupp Marine Systems, along with new findings such as CrashStealer on macOS and an AI-related remote code execution flaw in WhatsApp. It also highlights Iranian tracking activity against US troops, a new Spirals ransomware case, and…

U.S. prosecutors charged Zhuoying Chen and Haojie Zhang with running a money-laundering network that moved at least $43 million from cyber investment fraud scams into bank accounts in China. The case is part of a broader wave of pig butchering and investment fraud investigations, including major actions tied to Daren Li, Prince Group, and the Scam Center Strike Force. #ZhuoyingChen #HaojieZhang #DarenLi #PrinceGroup #ScamCenterStrikeForce

Microsoft announced that Windows Server 2022 will reach end of mainstream support on October 13, 2026, after which it will move to extended support and keep receiving monthly security updates until October 14, 2031. The company is urging customers to plan upgrades to Windows Server 2025, the latest LTSC release, while also noting related support timeline changes for Windows Server hotpatching and other Windows products. #WindowsServer2022 #WindowsServer2025 #Microsoft

CISA has warned that threat actors are actively exploiting CVE-2026-58644, a critical Microsoft SharePoint RCE flaw that was fixed in July 2026 and later added to the KEV catalog. Microsoft also updated its advisory to confirm exploitation, while CISA urged federal agencies to patch related exploited issues in Fortinet FortiSandbox under…

Risk Ledger has raised £24 million in a Series B round led by Axiom Equity, bringing its total funding to £33.8 million. The company will use the capital to expand its network-first supply chain security platform, add AI-driven risk tooling, and enter the US market. #RiskLedger #AxiomEquity #MerciaVentures…

Nichirei, Japan’s frozen food giant, says it will gradually restore operations after a cyberattack on July 13 disrupted refrigerated warehouses, shipping, and related services. The company confirmed hackers targeted its servers and that some affected systems stored personal information, prompting a report to the Personal Information Protection Commission. #Nichirei #NichireiLogisticsGroup #NichireiFoods…

CISA has ordered U.S. federal agencies to urgently patch two actively exploited critical vulnerabilities in Fortinet FortiSandbox, tracked as CVE-2026-39808 and CVE-2026-25089. Fortinet and Defused reported that attackers are already abusing the flaws in the wild, allowing unauthenticated remote code execution through low-complexity command injection attacks. #Fortinet #FortiSandbox #CVE-2026-39808 #CVE-2026-25089 #CISA