Category: Cyber Security News

JDY has resurfaced and expanded into a large covert botnet of more than 1,500 compromised SOHO and IoT devices used for targeted scanning, service fingerprinting, and continuous reconnaissance. Its operators leverage layered command infrastructure and newly disclosed edge-device vulnerabilities to feed intelligence to Chinese state-sponsored threat actors, including Volt Typhoon. #JDY…

OpenAI’s threat intelligence team identified two likely China-linked influence activity clusters that used ChatGPT to generate anti-data center and anti-tariff content aimed at inflaming U.S. debates. The campaigns posed as Americans on X and YouTube, used VPNs, and showed little evidence of achieving meaningful engagement. #OpenAI #ChatGPT #DataCenterBandwagon #DonaldTrump #XiJinping

Oracle PeopleSoft servers are being hit by ongoing data theft attacks linked to the ShinyHunters extortion gang, which claims to have stolen data from more than 100 organizations and 300 instances. Investigators found exposed tooling and indicators tied to the campaign, including scripts, staging files, and IP addresses, while Nottingham University has acknowledged a cybersecurity incident. #ShinyHunters #OraclePeopleSoft #NottinghamUniversity

GitHub says npm v12 will tighten npm install behavior by requiring explicit approval for dependency install scripts, Git-based dependencies, and remote URL sources that previously executed or resolved automatically. These changes are intended to block supply-chain abuse seen in campaigns affecting eslint-config-prettier, Toptal’s Picasso packages, data-stealing npm packages, and Shai-Hulud attacks. #npm #ShaiHulud #eslint-config-prettier #Picasso #node-gyp

CISA has directed federal agencies to prioritize patching based on four urgency criteria, including public exposure, exploit automation, system takeover potential, and active real-world exploitation. The new BOD 26-04 aims to speed remediation for the most critical vulnerabilities, with some fixes required in as little as three days and broader policy updates due over the next 180 days. #CISA #BOD26-04 #KEVCatalog

Microsoft has released security updates for an actively exploited Exchange Server XSS flaw, CVE-2026-42897, which can let attackers run arbitrary JavaScript in Outlook Web Access. CISA marked the issue as exploited in the wild and urged rapid patching for affected Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition systems. #Microsoft #ExchangeServer #CVE-2026-42897 #CISA

Credential theft rose sharply in 2025, driving more breaches as attackers used AI-assisted tactics to defeat weak identity checks and exploit inconsistent authentication practices. Organizations can reduce account takeover risk by hardening MFA, securing the service desk, using device trust, adopting passkeys, and protecting biometric data. #Specops #M&S #Clorox #FIDO2 #WebAuthn

JDY botnet has expanded from about 650 active bots to more than 1,500 compromised SOHO and IoT devices, with a strong focus on the United States and military-related targets. Black Lotus Labs says the network is used for reconnaissance and rapid scanning of newly disclosed vulnerabilities, including targets such as Cisco, Ubiquiti, Hikvision, Linksys, and Fortinet. #JDY #VoltTyphoon #CISA #Fortinet #Cisco #Ubiquiti #Hikvision #Linksys

Aryon Security has raised $29 million in Series A funding, bringing its total funding to $38 million, with Brightmind Partners leading the round. The Tel Aviv-based startup, founded by IDF cybersecurity veterans, provides technology-agnostic cloud security controls that scan for misconfigurations and enforce prevention before risks reach production. #AryonSecurity #BrightmindPartners #IDF…

Cyera has raised $600 million in fresh funding, boosting its valuation to $12 billion and bringing total funding to more than $2.3 billion. The company says the capital will help expand its AI-native data security platform, which helps organizations control what AI can access and do across their environments. #Cyera #EvolutionEquityPartners…

Infostealers are now a primary source of stolen credentials, giving attackers fast, stealthy access to targets with more than 11.1 million infected devices and 3.3 billion stolen records circulating in illicit markets. Flashpoint reports that stealers like Vidar, Lumma, Acreed, Rhadamanthys, and StealC are used to harvest credentials, tokens, and other…

Microsoft patched three Windows zero-days, including GreenPlasma and MiniPlasma, which can give local attackers SYSTEM privileges on fully patched systems. The update also fixes YellowKey, a Windows Recovery Environment flaw that can bypass BitLocker protection on affected Windows 11 and Windows Server systems. #GreenPlasma #MiniPlasma #YellowKey #Microsoft #WinRE #BitLocker

Microsoft warned that some devices upgraded to Windows 11 24H2 or 25H2 may fail to install the June 2026 cumulative updates, showing error 0x80073712 or 0x800f0993. Affected users can try a system restart, remove the problematic package with DISM, or perform an in-place upgrade if the issue persists. #Windows11 #KB5082200 #KB5079391 #KB5094127 #KB5093998 #KB5094126

ServiceNow says it patched a vulnerability that may have been exploited to give unauthenticated users greater access than intended, and it detected anomalous activity tied to the issue. The company has notified affected customers, including some with evidence of successful queries, and the issue may impact Australia platform releases and certain…