Category: Cyber Security News

International law enforcement agencies removed SocGholish infections from nearly 15,000 WordPress websites and shut down more than 100 servers and domains tied to the botnet. The Operation Endgame action targets infrastructure linked to Evil Corp and aims to disrupt the malware’s infection chain, which has been used to deliver additional payloads since at least 2017. #SocGholish #FakeUpdates #GhoLoader #EvilCorp #OperationEndgame

Microsoft 365 is not a complete data protection solution, and organizations remain responsible for backup, recovery, and long-term retention under the shared responsibility model. The article explains why third-party protection is needed for ransomware recovery, compliance, granular restores, phishing and insider threats, and scalable backup across Microsoft 365. #Microsoft365 #AcronisCyberPlatform #AndyKerr

Nintendo of America confirmed that threat actors stole survey data from its third-party TinyPulse service, while stressing that its own systems were not compromised and no customer or financial data was accessed. Shadowbyt3$ claimed responsibility for the theft, demanded a $2 million ransom, and alleged the leak included employee-related records and internal conversations. #Nintendo #NintendoofAmerica #TinyPulse #Shadowbyt3$

This roundup shows how attackers are abusing trusted platforms, browser extensions, AI chat features, OAuth flows, and developer tools to deliver malware, steal credentials, and stage phishing campaigns. It also highlights major security developments such as Windows Server 2025 DoH, a Cisco SD-WAN zero-day exploited by UAT-8616, and supply chain threats…

F5 has released patches for two critical NGINX Open Source vulnerabilities, CVE-2026-42530 and CVE-2026-42055, that could allow remote unauthenticated attackers to execute code under certain configurations. The company also advised mitigations such as disabling HTTP/3 or changing header-related settings, while noting no confirmed in-the-wild exploitation for these flaws. #NGINX #F5 #CVE-2026-42530…

Most internet-exposed REDCap servers are running outdated versions, leaving them vulnerable to targeting by state-sponsored groups like UNC6508. Google’s GTIG says UNC6508 has used compromised REDCap servers for cyberespionage and credential theft against major research organizations, while Censys found only a tiny fraction of instances are fully up to date. #REDCap…

Accenture plans to acquire a majority stake in Dragos for $3.25 billion and buy runZero and NetRise, betting big on industrial OT security for critical infrastructure in the AI era. The deal expands Dragos’ end-to-end platform for xOT defense as AI-driven threats increase the risk to power grids, pipelines, factories, and other operational environments. #Accenture #Dragos #runZero #NetRise #xOT

TeamPCP has compromised more than 1,000 open-source software packages in less than four months, exposing how fragile trust in software dependencies and CI/CD pipelines has become. The campaign has targeted widely used repositories and developer tools to steal credentials and spread malicious code, with impacts tied to packages and projects like Trivy, npm, PyPI, GitHub Actions, and Mini Shai-Hulud. #TeamPCP #Trivy #MiniShaiHulud #npm #PyPI #GitHubActions

Klue suffered an OAuth breach that allowed the Icarus threat actors to steal Salesforce CRM data from multiple organizations through compromised Battlecards integrations. The incident triggered extortion emails, Salesforce disabled the Klue Battlecards integration, and affected customers were urged to revoke tokens and review logs. #Klue #Salesforce #Icarus #Huntress #ReliaQuest

Microsoft reported a clipper malware campaign that has been active since at least February, using LNK files on USB drives and the Tor network to steal cryptocurrency wallet data and hide command-and-control traffic. The malware can replace clipboard wallet addresses, harvest seed phrases and private keys, take screenshots, and spread itself by infecting removable drives and disguising documents as malicious shortcuts. #Microsoft #LNK #Tor #BIP39 #Ethereum #Bitcoin #Tron #Monero

Enterprise AI tools can outlive the employees who created them, leaving orphaned agents and standing privileges that still hold access to sensitive data and source code. The webinar highlights how traditional security tools miss these hidden AI access risks and explains how to map AI activity back to a responsible human…

The article argues that cybersecurity failures are often driven less by individual vulnerabilities than by the fundamental design of interconnected TCP/IP networks, which make exposure and lateral movement difficult to prevent. It also previews future discussions on end-of-life systems, OT/IT convergence, and human factors, while noting that CVE-identified flaws will still…

Accenture is making a major OT cybersecurity push by taking a majority stake in Dragos and fully acquiring runZero and NetRise, forming a combined platform for industrial visibility, asset discovery, firmware intelligence, and threat detection. The deal, valued at about $4.1 billion, is designed to strengthen protection for critical infrastructure and…

Microsoft has fixed a known issue that caused the June 2026 KB5094122 security update to fail on some Windows Server 2016 systems that had not installed the previous KB5087537 update. The problem triggered 0x80070002 and FILE_NOT_FOUND errors, and affected devices should now install the update normally. #Microsoft #WindowsServer2016 #KB5094122 #KB5087537

F5 has issued out-of-band updates for multiple NGINX vulnerabilities, including critical flaws in ngx_http_v3_module and ngx_http_proxy_v2_module/ngx_http_grpc_module that could lead to denial of service or remote code execution on vulnerable systems. The company also patched high-severity issues in NGINX Gateway Fabric and provided mitigations for admins who cannot immediately apply the updates. #NGINX #F5 #CVE-2026-42530 #CVE-2026-42055 #CVE-2026-11311 #CVE-2026-50107