Category: Cyber Security News

Wazuh Cloud is presented as a managed, cloud-native SIEM/XDR platform that helps security teams reduce deployment delays, maintenance burden, and alert fatigue in complex hybrid and multi-cloud environments. It uses automation, scalable architecture, and an AI Security Analyst to improve visibility, lower false positives, and speed up detection and response. #WazuhCloud #Wazuh #WazuhAISecurityAnalyst

Researchers showed that three fixed UniFi OS Server flaws, CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, can be chained to bypass authentication and achieve unauthenticated remote code execution with root privileges. Bishop Fox released a detection script and advised upgrading UniFi OS Server to version 5.0.8 or later to stop the exploit chain. #CVE-2026-34908 #CVE-2026-34909 #CVE-2026-34910 #UniFiOSServer #BishopFox

Gogs has fixed a critical zero-day argument injection flaw that could let authenticated attackers compromise Internet-facing instances, access private repositories, steal credentials, and alter hosted source code. The issue affects Gogs releases up to 0.14.2 and 0.15.0+dev, and users are urged to upgrade to 0.14.3 or apply mitigations such as disabling registration and limiting repository creation. #Gogs #Rapid7 #JonahBurgess

Defiant says a critical flaw in the Everest Forms Pro WordPress plugin, tracked as CVE-2026-3300, has been exploited in the wild for months to execute arbitrary PHP code and take over vulnerable sites. Attackers have used the issue to create administrator accounts and deploy web shells, with most attempts tied to…

May 2026 saw 26 cybersecurity-related M&A deals, with major companies like Akamai, Check Point, Cisco, Cyera, Torq, WatchGuard, and Zscaler expanding their portfolios through acquisitions. Many of the transactions focused on AI security, Zero Trust, identity management, DSPM, and tools for monitoring autonomous agents and shadow AI. #Akamai #LayerX #CheckPoint #Deepchecks…

WhatsApp says it disrupted a spear-phishing campaign linked to NSO Group that tried to trick users into opening malicious links, and it plans to seek contempt action for violating a permanent injunction. The dispute follows years of legal battles over NSO’s use of spyware against WhatsApp users, including damages rulings and…

The University of Oxford disclosed a breach in its CareerConnect platform after Group GTI reported unauthorized access to users’ names, email addresses, and encrypted passwords. Oxford said the incident appears focused on credential theft and phishing, with no evidence that university systems or financial data were compromised. #UniversityofOxford #GroupGTI #CareerConnect

Check Point has patched CVE-2026-50751, a critical authentication bypass flaw in Remote Access VPN and Mobile Access deployments that was actively exploited in zero-day attacks. The company also discovered CVE-2026-50752, a related IKEv1 certificate validation issue that could enable man-in-the-middle attacks on site-to-site VPN connections. #CheckPoint #CVE-2026-50751 #CVE-2026-50752 #Qilin

OpenAI is expanding access to two ChatGPT security features, Lockdown Mode and Active Sessions, to help users better protect accounts and sensitive data. These controls aim to reduce prompt-injection-based data exfiltration and let users review and manage logged-in sessions, while OpenAI also recently introduced Advanced Account Security for higher-risk users. #ChatGPT…

Silent Ransom Group (SRG), also tracked as Chatty Spider, Luna Moth, and UNC3753, is using fast flux infrastructure built on infected devices to conceal its operations while conducting vishing and social engineering attacks. The group targets law firms and other sensitive industries for data theft and extortion, with its activity linked…

Lansing Community College has notified more than 174,000 people that their personal information was exposed in a breach tied to compromised credentials and discovered in February 2025. The institution says it found no evidence that the data was removed or misused and is offering 24 months of credit monitoring and identity…

The White House’s new executive order seeks to strengthen federal cybersecurity and prepare agencies for frontier AI models such as Anthropic’s Claude Mythos, while creating voluntary early-access pathways for private-sector developers. It also establishes an AI Cybersecurity Clearinghouse and pushes agencies to improve defenses for critical infrastructure, though the real impact will depend on implementation and industry participation. #Anthropic #ClaudeMythos #WhiteHouse

Anthropic’s Claude Mythos and OpenAI’s Daybreak highlight how AI innovation is reshaping trust, risk, and the need for stronger governance. The article argues for collaboration between industry and policymakers to balance accountability, responsible deployment, and global competitiveness. #Anthropic #ClaudeMythos #OpenAI #Daybreak #WhiteHouse

CISA warned that attackers are targeting a recently patched SolarWinds Serv-U flaw tracked as CVE-2026-28318, which can crash the service through specially crafted POST requests without authentication. SolarWinds fixed the issue in Serv-U 15.5.4 Hotfix 1 and urged customers, including those on end-of-life versions, to upgrade immediately as CISA added the…