Category: Cyber Security News

A single VPN vulnerability exposed data across more than seventy financial institutions using Marquis Software’s infrastructure, showing how a one-time annual test can miss fast-changing real-world risk. The article argues that continuous testing is needed to catch issues like a third-party mortgage portal flaw that allowed cross-tenant data exposure and potential submission forgery before attackers exploit them. #MarquisSoftware #Mandiant #CrowdStrike #PCI_DSS #FFIEC #NYDFS #SprocketSecurity

CISA has added CVE-2025-48595 in the Android Framework and CVE-2022-0492 in the Linux kernel to its Known Exploited Vulnerabilities catalog after evidence of exploitation. The Android flaw affects Android 14 through 16 and the Linux issue can enable container escape and root access on affected systems, with federal patching required by June 5. #CVE-2025-48595 #CVE-2022-0492 #AndroidFramework #LinuxKernel

This session explains why traditional patch-and-firewall assumptions no longer protect modern networks, especially when unknown assets and hidden connections create exploitable seams. HD Moore of runZero shows how attackers view environments as paths and attack routes, not just isolated devices, and why that perspective matters for IT, IoT, and OT networks….

Modern enterprise identity is becoming fragmented across applications, teams, machine identities, and AI agents, creating “Identity Dark Matter” that security teams often cannot see. Orchid Security and Gartner’s IVIP model aim to unify visibility, intelligence, and control across the full identity estate, turning hidden identity activity into governed, observable security data….

A one-click attack in Microsoft Visual Studio Code and GitHub.dev can let an attacker steal a victim’s GitHub OAuth token after they click a crafted link. The token can then be used to access private repositories, and Microsoft has acknowledged the issue and is working on a fix. #VSCode #GitHub.dev #GitHubOAuthToken…

Acer is addressing two maximum-severity zero-day vulnerabilities in its Wave 7 mesh routers that can expose plaintext credentials or enable persistent backdoor access. The flaws, tracked as CVE-2026-49200 and CVE-2026-49201, affect firmware version T7c_GBL_1.01.000055 or earlier, with fixes planned by the end of June 2026. #Acer #Wave7 #CVE-2026-49200 #CVE-2026-49201

Hackers compromised the Outlook mailbox of a senior executive at a major global stock exchange and quietly exfiltrated data for about 150 days, with the activity investigated by Broadcom’s Symantec and Carbon Black team. The attack appears to have been espionage-focused, using disguised Adobe, OneDrive, and Lenovo tasks along with Dropbox…

Adversa AI evaluated 100 AI agents across ten categories and found that only 11% are both capable and well-defended, with most agents exposed to the “lethal trifecta” of private data access, untrusted content exposure, and outbound actions. The report warns that computer agents and coding agents have the largest attack surfaces…

Defiant warned that hundreds of thousands of WordPress sites may be exposed to attacks exploiting serious flaws in the Kirki and Burst Statistics plugins. The vulnerabilities could let unauthenticated attackers take over admin accounts and fully compromise affected websites. #Kirki #BurstStatistics #CVE-2026-8206…

Kali365 has expanded from a Microsoft 365-focused phishing kit into a broader account-compromise platform targeting AWS, Okta, Xerox DocuShare, and major Russian services such as MAX Messenger, Mail.ru, Yandex Disk, and Odnoklassniki. By abusing device code phishing and OAuth token capture, the operators can bypass MFA and steal access tokens without ever needing a victim’s password. #Kali365 #Microsoft365 #MAXMessenger #AWS #Okta #XeroxDocuShare #Mailru #YandexDisk #Odnoklassniki

A security researcher has released proof-of-concept exploit code for a VS Code zero-day that can steal GitHub OAuth tokens by luring users into clicking a malicious link. The flaw can be abused through github.dev to install a malicious extension and enumerate private repositories accessible to the victim. #VisualStudioCode #githubdev #GitHubOAuthTokens #AmmarAskar

Google is rolling out a new Android feature called “fake call detection” that uses encrypted confirmation signals to spot scam calls where attackers impersonate personal contacts with AI. The protection is enabled by default on Android 12 and later devices, and it targets spoofing and deepfake voice scams that have caused billions in losses worldwide. #Google #Android #PhonebyGoogle #RCS #FTC #INTERPOL

European and international law enforcement dismantled nine organized crime groups and arrested 29 suspects in Operation KRATOS 2, a seven-month crackdown on illegal streaming services. Investigators also removed more than 27,000 illegal URLs and exposed the wider ecosystem behind piracy platforms that put users at risk of malware infections, spyware, and data theft. #OperationKRATOS2 #Europol #Bulgaria

Researchers uncovered Weedhack, a Minecraft-themed malware-as-a-service campaign spread through YouTube and SEO poisoning that uses malicious JAR files, EtherHiding, and a multi-stage infection chain to steal data and enable remote control of victims’ systems. McAfee Labs also reported related campaigns including CountLoader infections and a pirated-content operation delivering SilentCryptoMiner, with #Weedhack…