Category: Cyber Security News

OpenAI has released an improved GPT‑5.5‑Cyber model and updated Codex Security plugin to help trusted defenders find, validate, and patch vulnerabilities faster across large codebases. The company also launched the Patch the Planet initiative with Trail of Bits to support open-source projects and address the growing security burden created by AI-driven…

Kaspersky has identified a WhatsApp-based campaign that spreads malicious VBScript files through direct messages to install legitimate RMM software and gain remote access to victims’ systems. The operation targets users across multiple countries, often using deceptive business-document filenames and infrastructure overlaps linked to Gh0st RAT and ValleyRAT. #WhatsApp #VBScript #ManageEngineRMMCentral #Gh0stRAT…

Xsolis, Inc. disclosed a data breach that affected 1,396,519 people after a targeted phishing attack led to unauthorized access to systems and files containing sensitive health and personal information. The company said it is not aware of any actual or attempted misuse of the exposed data. #Xsolis #HHS…

Microsoft has confirmed that Windows 11 version 26H2 is the next feature update, and devices running 24H2 or 25H2 will be able to move to it using a small enablement package. The update shares the same servicing branch as 24H2 and 25H2, allowing a low-disruption upgrade path, while older versions such as 23H2 will require the full update. #Windows11 #Microsoft #26H2 #24H2 #25H2

A newly disclosed FFmpeg flaw called PixelSmash (CVE-2026-8461) can enable remote code execution on Jellyfin under certain conditions and cause denial-of-service in apps such as Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio. JFrog says the bug affects many FFmpeg-based projects through the MagicYUV decoder, with fixes available in FFmpeg 8.1.2 and additional mitigations already applied by some vendors. #PixelSmash #CVE-2026-8461 #FFmpeg #Jellyfin #Nextcloud #PhotoPrism #Kodi #Emby #OBSStudio #MagicYUV

JaredFromSubway, an Ethereum MEV bot, lost $15 million after an attacker tricked its detection logic with fake trading opportunities, fake pools, and malicious tokens. The attacker gained long-lived token approvals and then drained WETH, USDC, and USDT from the bot, while JaredFromSubway later offered escalating bounties and entered negotiations for recovery. #JaredFromSubway #Ethereum #MEV #WETH #USDC #USDT

A malware campaign is abusing compromised WhatsApp accounts to send obfuscated VBScript files disguised as business and financial documents across multiple countries. When opened, the files trigger an infection chain that installs ManageEngine Endpoint Central for remote access, with Kaspersky noting possible links to ValleyRAT and Gh0st RAT infrastructure. #WhatsApp #ManageEngineEndpointCentral #ValleyRAT #Gh0stRAT

A federal court ruled that the Trump administration’s SAVE voter database violated federal privacy laws, unlawfully combined sensitive data from multiple agencies, and must be dismantled. The judge found the system threatened Americans’ right to vote and highlighted concerns over wrongful voter cancellations based on unreliable citizenship data. #SAVE #PrivacyAct #SocialSecurityAct #AdministrativeProcedureAct #LeagueofWomenVoters #EPIC

The Trump administration is preparing executive actions to speed up the federal shift to post-quantum encryption and boost domestic quantum computing funding. One order would push civilian agencies to adopt quantum-resistant encryption sooner, while another would direct federal support toward the U.S. quantum industry. #TrumpAdministration #NationalInstituteofStandardsandTechnology #DepartmentofCommerce #IBM

SOCRadar says the FortiBleed campaign targeted more than 430,000 FortiGate firewalls and used a custom tool called FortigateSniffer to capture authentication traffic and steal credentials from compromised devices. The attackers allegedly abused FortiOS diagnostics, processed captured traffic with SNIFTRAN and a PCAP analysis toolkit, and used Hashcat on GPU clusters to crack hashes and extract secrets. #FortiBleed #FortigateSniffer #FortiGate #SNIFTRAN #Hashcat #FortiOS

Brazil suspended its Civil Defense Alert system after unauthorized messages triggered false emergency warnings across several states, including São Paulo, Rio de Janeiro, Paraná, Mato Grosso do Sul, and the Federal District. Authorities are investigating unauthorized access that sent 10 alerts, while a more secure version of the platform is being…

Researchers uncovered four vulnerabilities in Dify, codenamed DifyTap, that could let attackers read private AI chats, access internal APIs, and expose files across tenants without authentication. Most issues have been patched in Dify 1.14.2, while one path traversal flaw remains pending a fix. #Dify #DifyTap #CVE-2026-41947 #CVE-2026-41948 #CVE-2026-41949 #CVE-2026-41950 #PDFium #CVE-2024-5846…

ShapedPlugin’s official release pipeline was compromised, allowing attackers to push backdoored Pro versions of Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro through legitimate update channels. The malicious plugins installed a fake plugin, stole credentials and 2FA codes, exfiltrated wp-config.php and WooCommerce data, and used persistence…

Threat actors are turning infostealer-derived credential dumps into searchable underground services that let buyers request targeted results by company, domain, platform, geography, or account type. Flare’s analysis of 470 forum posts shows these sellers act as a processing layer between stolen logs and account takeover, with many claims of freshness and validity falling short in practice. #Flare #Infostealer #InitialAccessBroker