Category: Cyber Security News

A critical vulnerability in SimpleHelp remote management software, tracked as CVE-2026-48558, lets unauthenticated attackers create privileged Technician accounts when OIDC authentication is enabled. SimpleHelp has released fixes in versions 5.5.16 and 6.0RC2, and organizations using OIDC should update or restrict access immediately. #SimpleHelp #CVE-2026-48558 #OIDC

The U.S. Department of Justice seized CFAKE.com and SOCFAKE.com in what appears to be the first publicly announced domain seizure under the TAKE IT DOWN Act, after the sites allegedly hosted nonconsensual AI-generated nude images and videos. The case involved coordinated action by U.S., Italian, and French authorities, and led to an arrest in Nice, France, along with the seizure of cryptocurrency tied to the operation. #CFAKEcom #SOCFAKEcom #TAKEITDOWNAct

Google Threat Intelligence Group uncovered UNC6508, a previously unknown China-linked espionage group that infiltrated U.S. and Canadian organizations for years to steal sensitive data from medical, academic, military, and policy targets. The group used the INFINITERED backdoor, abused REDCap servers and domain compliance rules, and remained undetected in some cases from September 2023 until late 2025. #UNC6508 #INFINITERED #REDCap

Varonis Threat Labs uncovered SearchLeak, a one-click attack chain against Microsoft 365 Copilot Enterprise Search that could exfiltrate emails, calendar details, and indexed files through a trusted microsoft.com link. Microsoft assigned CVE-2026-42824 and mitigated the issue on the backend, while defenders are advised to monitor suspicious q-parameter payloads and unusual Bing…

Researchers at Obsidian Security disclosed a critical three-vulnerability chain in LiteLLM that can let a low-privilege user escalate to proxy admin and achieve server-side code execution. A successful compromise can expose provider keys, decrypted credentials, prompts, responses, and even let an attacker rewrite model outputs in transit. #LiteLLM #ObsidianSecurity #CVE-2026-47101 #CVE-2026-47102…

Researchers uncovered UNK_DeadDrop, a North Korea-linked phishing campaign using recruitment and code-review lures on GitHub to push malicious VS Code projects and Overlord malware against developers across nearly 100 organizations. Separately, malicious VS Code extensions and multiple npm/GitHub supply-chain campaigns were found delivering backdoors and stealers that target credentials, wallets, and…

Cisco has patched CVE-2026-20262 in Catalyst SD-WAN Manager after confirming it was exploited to escalate privileges to root. The flaw affects all deployment types and let authenticated attackers upload crafted files through an API to overwrite files and gain higher privileges; admins should review logs for index.jsp and .war upload attempts. #Cisco #CatalystSDWANManager #CVE-2026-20262

A supply-chain attack against Awesome Motive’s CDN compromised WordPress plugins OptinMonster, TrustPulse, and PushEngage, briefly serving malicious JavaScript to users. Attackers used a stolen CDN API key to inject code that could create rogue administrator accounts, install hidden backdoors, and give full remote access to infected sites. #OptinMonster #TrustPulse #PushEngage #AwesomeMotive #UpdraftPlus

The Trump administration’s export controls on Anthropic’s Fable 5 sparked a backlash from cybersecurity experts who argue the model’s reported jailbreaks do not prove dangerous offensive capabilities. Anthropic and researchers say Fable 5 remains valuable for defensive security work, while critics call the restrictions heavy-handed and misguided. #Anthropic #Fable5 #Mythos #WassenaarAgreement #ClaudeOpus #OpenAI #Daybreak #GPT55 #ClaudeSonnet #Kimi27

NewCore has emerged from stealth with $66 million in seed funding to secure human, machine, and agentic identities for the modern enterprise. Its identity platform uses Secure Split Key technology, hardware-bound verification, and continuous identity discovery to reduce exposure and eliminate attacks such as Golden SAML, token replay, and adversary-in-the-middle session…

Google Threat Intelligence Group says UNC6508, a Chinese government-linked cyberespionage group, has been targeting North American medical, academic, and military research organizations since at least 2023. The campaign used REDCap server targeting, deployed the InfiniteRed malware, and abused content compliance rules to steal emails and pursue intelligence tied to national security,…

Mackay Sugar was hit by a ransomware attack that disrupted operations at its Queensland mills and forced the company to restore systems in stages. The Gentlemen ransomware group claimed the company on its Tor site, but no data leak has been reported and it remains unclear whether ICS or OT systems…

ShinyHunters stole personal information from more than 137,000 school staff accounts in a Salesforce attack targeting Infinite Campus, an EdTech provider used by thousands of U.S. school districts. The leaked data included names, email addresses, phone numbers, physical addresses, usernames, and support tickets, making the breach similar in method to other major ShinyHunters campaigns. #ShinyHunters #InfiniteCampus #Salesforce

A critical vulnerability chain called SearchLeak in Microsoft 365 Copilot Enterprise could let attackers steal sensitive data from mailboxes, OneDrive, and SharePoint through a specially crafted URL. Microsoft fixed the flaw as CVE-2026-42824, while researchers showed how prompt injection, an HTML rendering race condition, and a Bing SSRF issue could be chained to exfiltrate emails, calendar details, and documents. #Microsoft365CopilotEnterprise #SearchLeak #CVE-2026-42824 #Bing #Varonis

Google Threat Intelligence Group says China-linked UNC6508 targeted exposed REDCap servers to deploy the custom InfiniteRed malware and quietly steal sensitive data from a North American medical institution. The campaign lasted more than a year and used novel email-based exfiltration through a legitimate compliance feature to send matching records to a Gmail account. #UNC6508 #InfiniteRed #REDCap