Google has released emergency Chrome updates to fix CVE-2026-11645, a zero-day in the V8 JavaScript engine that has been exploited in the wild. This is the fifth Chrome zero-day patched this year, following earlier fixes for flaws including CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281. #CVE-2026-11645 #CVE-2026-2441 #CVE-2026-3909 #CVE-2026-3910 #CVE-2026-5281 #Google #Chrome #V8
Category: Cyber Security News
Apple announced an Apple Intelligence-powered feature in iOS 27 that can automatically update weak, duplicate, or compromised passwords to stronger ones in Safari and the Apple Passwords app. The company says the agentic password manager runs with privacy-first protections using on-device processing and Private Cloud Compute, with a beta available now through the Developer Program. #AppleIntelligence #iOS27 #ApplePasswords #Safari #PrivateCloudCompute
WhatsApp accused NSO Group of using spearphishing and social engineering attacks against its users in violation of a court-ordered ban on targeting the messaging app. The company is asking a federal court to hold NSO in contempt while warning users about malicious links and related indicators tied to the attacks. #WhatsApp…
Armenian Prime Minister Nikol Pashinyan won re-election after his Civil Contract party defeated a pro-Russian rival, despite a months-long Russia-linked influence campaign aimed at undermining Armenia’s vote. Researchers said the Matryoshka operation used fake news, manipulated videos, bot activity, and hoax bomb threats to spread fear and damage trust in the…
SoFi Hong Kong says a third-party vendor database was accessed without authorization, potentially exposing customer information, and the investigation is still ongoing. The company is urging customers to watch for phishing, strengthen account security, and monitor financial activity while it assesses the scope of the incident. #SoFiHongKong #SoFiSecuritiesHongKongLimited
NFCShare Android malware is being spread through fake banking app updates on GitHub and now targets customers of multiple banks across Europe to steal payment card data. The malware uses a fake NFC verification screen to capture card details and a PIN, then sends the stolen information to its C2 server for relay-based payment fraud. #NFCShare #D3Lab #Intesa #Sella #Nexi #Fideuram #Mooney #CaixaBank #DeutscheBank
The United Kingdom has given Apple, Google, and other tech companies three months to add device-level safeguards that detect and block nude images of children on smartphones and tablets. The move aims to curb child sexual abuse imagery and predator exploitation, with possible fines, criminal liability, and new legislation if companies…
Check Point has disclosed active exploitation of CVE-2026-50751, a critical flaw affecting Remote Access VPN and Mobile Access deployments using deprecated IKEv1, allowing unauthenticated attackers to bypass authentication and open VPN sessions. The activity has targeted a limited number of organizations globally and has been linked in one case to a…
Security researchers released a working exploit for CVE-2026-23111, a Linux kernel use-after-free in nf_tables that can let an unprivileged local user gain root and escape a container. The flaw has been publicly reproduced across multiple distributions, so defenders should patch and reboot immediately if their kernels still lack the fix. #CVE-2026-23111…
WhatsApp says it disrupted spear-phishing and social engineering campaigns linked to NSO Group after user reports, including attempts to lure targets to external sites with malicious links. Meta says the activity involved test accounts, groups, and domains such as ikhwancast[.]com, ghazacast[.]com, and fr24cast[.]com, despite prior court action and U.S. sanctions against NSO Group. #NSOGroup #WhatsApp #Meta #Pegasus
Hackers compromised 19 PyPI packages in a new Shai-Hulud supply-chain attack that used malicious startup hooks to steal developer secrets from infected systems. The campaign targeted popular bioinformatics tools and exfiltrated credentials through GitHub repositories and HTTPS, while also adding persistence and evasion techniques. #ShaiHulud #PyPI #Dynamo #Spateo #CoolBox #UFISH #NapariUFISH
Meta said it disrupted a spearphishing campaign linked to NSO Group and filed a contempt-of-court complaint after alleging the company violated a permanent injunction against targeting WhatsApp users. The activity involved malicious links, fake accounts, and WhatsApp groups, and Meta argued the case shows why NSO Group should remain on the U.S. Entity List. #NSOGroup #Pegasus #WhatsApp #CitizenLab
Meta said it blocked spear-phishing attempts linked to NSO Group and is seeking a federal contempt order over violations of a permanent injunction against targeting WhatsApp users. The company also reported malicious test accounts, groups, and domains tied to the activity, while urging users to keep apps updated and enable strict…
Vibe coding is rapidly expanding software creation through AI, but it is also creating a major security blind spot as employees deploy internet-facing apps without IT or security oversight. Research shows many AI-generated and vibe-coded applications expose sensitive data or lack authentication, while AI agents themselves can accidentally damage production systems….
A Security emerged from stealth with $37 million in funding to advance its autonomous offensive security and remediation platform. The platform uses AI agents to discover real-world exploit paths, validate vulnerabilities, and automate remediation before attackers can exploit them. #ASecurity #LightspeedVenturePartners #Cyberstarts #AssafRapaport #YotamSegev…