Category: Cyber Security News

Brave Software has released Brave Origin, a paid minimalist version of its browser that removes features like Brave Rewards, Brave Wallet, Brave Leo AI, and other monetization-focused components while keeping Brave Shields for privacy and ad blocking. The launch has sparked debate over whether Brave Origin offers meaningful value or simply charges users to disable features already available in the free browser. #Brave #BraveOrigin #BraveShields #BraveRewards #BraveWallet #BraveLeoAI

DTEX researchers found that Anthropic’s Claude Cowork can be used to quickly access and move sensitive corporate data through tools like Dispatch, Salesforce plugins, Outlook, OneDrive, and SharePoint. The research highlights how agentic AI can create insider-threat risks when organizations lack logging, monitoring, and access controls, especially as North Korean-linked applicants and other legitimate users may abuse these tools. #Anthropic #ClaudeCowork #DTEX #Salesforce #Outlook #OneDrive #SharePoint #NorthKorea

House Democrats criticized a draft DHS spending bill, saying it would cut $250 million from the Cybersecurity and Infrastructure Security Agency even as Republicans argued the measure still funds CISA at $2.4 billion. The debate centers on whether the bill strengthens core cyber defenses or weakens protection against foreign adversaries targeting U.S. infrastructure, elections, and government systems. #CISA #TomCole #DHS

Cisco has fixed CVE-2026-20230 in Unified Communications Manager, a server-side request forgery flaw that can let an unauthenticated attacker write arbitrary files and potentially escalate to root. Proof-of-concept code is already public, and affected systems running Cisco WebDialer are urged to patch or disable the service immediately. #CVE-2026-20230 #CiscoUnifiedCommunicationsManager #WebDialer…

Microsoft fixed an issue that caused some Windows devices to install driver updates despite policies meant to block auto-updates. The problem was traced to a Windows Update caching service misconfiguration that briefly lost device enrollment data, and Microsoft has now confirmed the issue is resolved. #Microsoft #Intune #WindowsUpdate #Windows

A forum thread titled “Hacking for Profit. Working method” shows how the actor “Hercules” turns vulnerability exploitation into a simple, repeatable workflow that teaches beginners how to scan, validate, monetize, and exploit exposed systems. The post gained wide attention across multiple forums and highlights how underground communities use plain-language tutorials and mentorship to recruit new threat actors and encourage disclosure or resale of findings. #Hercules #Nuclei #projectdiscoveryio #Flare

A new supply-chain attack has infected 36 npm packages with IronWorm, an infostealer that targets developer secrets, cloud credentials, SSH keys, and cryptocurrency wallet files. JFrog says the Rust-based malware hides behind an eBPF kernel rootkit, uses Tor for communication, and self-propagates by abusing stolen npm publishing credentials. #IronWorm #npm #JFrog #Rust #Tor

Willow, formerly known as Webrix, has emerged with a $7 million seed round and an identity and access platform built to secure enterprise AI agents. The system provides centralized control over tools like Claude, Gemini, ChatGPT, and custom models, while enforcing least-privilege access, discovering shadow AI, and tying every agent to…

This live webinar on June 4, 2026 will explore the gap between how organizations believe their third-party risk programs are performing and what is actually happening in practice. It will use benchmark data to highlight slow assessments, manual bottlenecks, visibility gaps, and the growing impact of third-party and fourth-party exposure. #ThirdPartyRisk…

Offroad has emerged from stealth with $7 million in seed funding to help organizations investigate, govern, remediate, and verify identity risks using agentic AI. The company also released an audit of 2,890 OAuth apps and launched ohauth.ai to expose over-privileged scopes, dead publisher domains, and silent permission drift. #Offroad #ohauthai #OAuth…

AI-driven security tools are rapidly discovering vulnerabilities faster than organizations can patch them, creating a widening gap between exposure and remediation. The article highlights how XBOW exposed serious issues in Moderna’s development environment and how Cisco is pushing Live Protect to temporarily shield vulnerable systems until patches can be applied. #XBOW #Moderna #ClaudeMythos #Cisco #LiveProtect #eBPF

Cisco has released security updates for CVE-2026-20230, a critical Unified CM flaw that can let remote attackers gain root privileges through a low-complexity SSRF attack. The issue affects systems with WebDialer enabled, and Cisco recommends upgrading to Unified CM 14SU6 or 15SU5 or disabling the WebDialer service until patching is complete. #Cisco #UnifiedCM #CVE-2026-20230 #WebDialer

French and Spanish authorities dismantled an online marketplace in Alicante that sold forged identity documents to migrant smuggling rings across the European Union. The operation led to one arrest and the seizure of counterfeit IDs and document-production equipment used to help criminal networks evade border controls and obtain residence rights. #Europol #ECAMS #Alicante

Law enforcement and tech companies disrupted more than 1.4 million accounts and the infrastructure used by scam networks operating across Southeast Asia. The joint “Disruption Week” operation led to arrests, frozen cryptocurrency assets, and the takedown of servers, social media accounts, and network connections tied to fraud compounds in Cambodia, Laos,…