Category: Cyber Security News

Microsoft plans to remove Outlook Web Access Light from a future Exchange Server update, shifting users to the full Outlook on the web experience. The change is aimed at reducing legacy surface area and simplifying engineering, with removal estimated for August 2026 and admin-level disable options available now. #Microsoft #ExchangeServer #OWALight #Outlookontheweb

Summer vacation schedules and reduced staffing create openings for attackers, who use the slower pace to hide suspicious activity, extend dwell time, and exploit phishing and Business Email Compromise attempts. Organizations can reduce these seasonal risks by using AI-driven automation, continuous monitoring, and automated response to keep security coverage strong year-round. #Kaseya #BusinessEmailCompromise #AI

Forg365 is a new phishing-as-a-service operation that targets Microsoft 365 accounts using device-code phishing, AiTM techniques, and AI-generated lure content. It also uses the ForgCookie browser extension to maintain persistent access to Microsoft services after compromise. #Forg365 #Microsoft365 #ForgCookie #ZeroBEC

The UK government is accelerating its cybersecurity strategy through the NCSC’s Cyber Shield initiative and the Cyber Resilience Pledge, both designed to strengthen national defense and improve resilience against fast-evolving AI-driven threats. Together, these measures signal a stronger policy direction for board accountability, supply chain security, early warning participation, and machine-speed…

QIZ Security raised $17 million in seed funding to expand its cryptographic posture and post-quantum cryptography management platform. The platform helps organizations discover, assess, and remediate encryption risks across on-premises, cloud, and hybrid environments before quantum threats become critical. #QIZSecurity #QIZ…

Microsoft has started rolling out patches for the Defender vulnerability RoguePlanet, tracked as CVE-2026-50656, about a month after a public zero-day exploit was released. The flaw used a race condition to escalate privileges to System, and while no exploitation has been reported, the researcher behind it has already uncovered additional Defender…

Nebula Security published technical details and exploit code for CVE-2026-43499, also known as GhostLock, a Linux kernel use-after-free flaw that has affected major distributions since 2011. The company showed that the bug can enable local root privilege escalation and even container escape in Google’s kernelCTF program, earning a $92,337 bounty. #CVE-2026-43499…

KDDI confirmed that a June 17 breach impacted more than 12 million people after attackers exploited a zero-day vulnerability in software used for the email infrastructure of five ISPs, including STNet, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE. The company said it removed the attackers, is enforcing password resets, and is working…

8Layers has raised a $1.1 million pre-seed extension round, bringing its total early-stage funding to $2.9 million. The Madrid-based startup will use the new capital to expand its digital identity protection platform across Europe, which combines ISPM, ITDR, and automated compliance for identities in cloud environments. #8Layers #Okta #MicrosoftEntraID #GoogleWorkspace #AWSIAM…

Google released Chrome 150 with fixes for 27 security vulnerabilities, including two critical use-after-free flaws in the Ozone and Views components. The update also addresses a wide range of other memory and validation issues, while most bugs were found internally by Google. #Chrome #Ozone #Views…

Wiz disclosed GhostApproval, an attack that tricks AI coding assistants into following deceptive symlinks and modifying files outside the intended workspace. The issue was tested against Claude Code, Amazon Q Developer, Cursor, Google Antigravity, Augment, and Windsurf, with some vendors already patching the flaw. #GhostApproval #ClaudeCode #AmazonQDeveloper #Cursor #GoogleAntigravity #Augment #Windsurf…

Taiwanese authorities charged two businessmen for helping China-linked operators use leased LINE accounts to impersonate journalists and target politicians, academics, and civil society groups. Investigators say the campaign also pushed malware disguised as encrypted communications software and aligns with earlier findings by the ICIJ and The Citizen Lab about a Beijing-linked…

Block, Inc. will pay $45 million to settle allegations from 46 states that Cash App misled users about its security and left them vulnerable to fraud. The agreement follows findings that the app lacked proper customer support and verification controls, enabling scammers to exploit users and fake support numbers….

Eight Greeks who were targeted with Predator spyware have sued Intellexa and 13 associated individuals, seeking about €7.6 million in damages for privacy violations and harm to their communications and personal data. The case follows the 2022 Predator scandal in Greece, which led to major resignations, prison sentences for Intellexa’s founder…