RedWing is a Telegram-rented Android bank-fraud service that helps criminals hijack phones, steal banking credentials, capture one-time codes, and control calls, screens, and devices in real time. Zimperium says it resembles the Oblivion rental malware and may be linked to Russian threat actors, while defenders are advised to focus on install-time…
Category: Cyber Security News
Threat actors are exploiting CVE-2026-20896 in Gitea’s reverse-proxy authentication to access internet-exposed instances with only a valid username and one HTTP header. The flaw affects Gitea Docker images before 1.26.3 and can lead to full compromise of repositories, secrets, and CI/CD assets. #Gitea #CVE-2026-20896…
A U.S. government entity reportedly paid the Kairos extortion group $1 million in Bitcoin after the attackers claimed to have stolen more than 2 terabytes of data from a May 2025 intrusion. The affected body appears to be Union County, Ohio, which later notified 45,487 people that sensitive personal and financial…
A hidden authentication backdoor in multiple Tenda router firmware versions can let an attacker gain full administrative access to the web management panel by supplying a special password. CERT/CC says CVE-2026-11405 affects several Tenda routers, no patch is available yet, and users are advised to disable remote web management and reduce LAN exposure. #Tenda #CVE-2026-11405 #CERTCC
Chinese hackers tracked as UAT-7810 are expanding their Operational Relay Box infrastructure by compromising internet-facing routers, especially unpatched Ruckus devices, to proxy traffic through legitimate-looking regional systems. Cisco Talos found new tools in the campaign, including LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST, alongside exploitation of multiple router vulnerabilities. #UAT-7810 #LONGLEASH #SHORTLEASH #DOGLEASH #JARLEASH #LEASHTEST #Ruckus #ASUSAiCloud #UAT-5918
Januscape is a 16-year-old Linux kernel vulnerability, tracked as CVE-2026-53359, that lets attackers escape a KVM virtual machine and execute code as root on the host. The flaw affects multi-tenant cloud environments and can be chained with Dirty Frag to achieve full compromise on unpatched systems. #Januscape #CVE-2026-53359 #KVM #DirtyFrag
Organizations are still facing persistent phishing, business email compromise, and account takeover attacks even after investing in secure email gateways, MFA, and identity protection. A BleepingComputer webinar with Abnormal AI and Novant Health will show how behavioral AI can help detect abnormal communication patterns, automate investigations, and improve response to Device Code phishing and trusted sender impersonation. #BleepingComputer #AbnormalAI #NovantHealth #DeviceCodePhishing
Cordyceps exposed a CI/CD weakness in GitHub Actions where individually valid workflows combined into exploitable privilege chains, leaving many “green” pipelines vulnerable despite passing scans. The article highlights real cases at Microsoft, Google, and Apache, and argues that AI-generated workflows are accelerating governance gaps that scanners alone cannot catch. #Cordyceps #Microsoft #AzureSentinel #Google #Apache #GitHubActions
Spain’s National Police arrested a man in Palencia suspected of supporting the pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest. Investigators say he helped a CARR-linked hacker evade capture, coordinated via encrypted apps, and was tied to operations associated with NoName057(16) and attacks on critical infrastructure. #CyberArmyofRussiaReborn #CARR #ZPentest #NoName05716 #APT44 #Sandworm
A Microsoft 365 device code phishing campaign observed in late June and early July 2026 used collaboration-themed lures and a compromised Croatian rental website to trick victims into authorizing attacker sessions through Microsoft’s legitimate device login flow. ZeroBEC and Cisco Talos linked the activity to reusable tooling and PhaaS ecosystems including…
Threat actors are exploiting CVE-2026-48282, a maximum-severity path traversal flaw in Adobe ColdFusion that can lead to arbitrary code execution. Adobe released emergency updates for ColdFusion 2025 and 2023, but exploitation reportedly began within two hours of public disclosure. #AdobeColdFusion #CVE-2026-48282 #KEVIntel #CanadianCentreforCyberSecurity…
CISA is reportedly using Anthropic’s Mythos AI model to scan federal code repositories for security vulnerabilities, with the goal of finding and fixing flaws before adversaries can exploit them. The effort has allegedly already uncovered many bugs, while Anthropic’s broader relationship with US agencies has also faced tension over model safeguards…
A newly disclosed Linux kernel flaw, tracked as CVE-2026-53359 and nicknamed Januscape, can let an attacker escape a KVM virtual machine and execute code on the host. The issue affects shadow MMU code, threatens multi-tenant public clouds, and was demonstrated by Hyunwoo Kim as a zero-day in Google kvmCTF. #CVE-2026-53359 #Januscape…
Tarah Wheeler, CISO at TPO Group, describes a cybersecurity career shaped by social science, writing, and broad hands-on experience across red team, SecOps, compliance, and policy work. She warns that the field lacks reliable ground truth and benchmarks, making it hard to separate facts from hype while leaders like NIST face…
An Iran-linked APT tracked as Cavern Manticore is targeting organizations in Israel with a modular C&C framework that uses .NET compilation formats as an anti-analysis layer. The group, likely tied to Iran’s MOIS and possibly the OilRig subgroup Lyceum, abuses SysAid updates, RMM tools, and remote desktop features to move laterally…