Category: Cyber Security News

Infostealers are a growing threat because they quietly steal passwords, autofill data, and session cookies, often leading to account takeover even when 2FA is enabled. Reddit case studies show how cracked software, fake game invites, and Discord scams can trigger infections that result in financial loss, extortion, and serious emotional distress. #Infostealer #Discord #HudsonRock

Microsoft has resolved an issue that caused Windows 11 KB5089549 installations to fail with 0x800f0922 errors on devices with low EFI System Partition free space. The fix is included in KB5089573 and later, with Known Issue Rollback and Group Policy available as workarounds for users and enterprise admins who have not yet installed the latest update. #KB5089549 #KB5089573 #Windows11

Microsoft fixed an outage that stopped some users from setting up MFA or accessing the My Sign-Ins website, with affected users seeing 504 Gateway Timeout errors. The company later restored service and said a recent cache configuration change and failover led to high CPU and memory usage during peak EU traffic. #Microsoft #MySignIns #MFA

BleepingComputer and Tines will host a live webinar on June 2, 2026, focused on fixing gaps in network incident response with automation and AI-assisted workflows. The session will show how teams can enrich alerts, improve coordination, and speed resolution across complex environments. #BleepingComputer #Tines

The Centre for Cybersecurity Belgium warned that CVE-2026-41089, a critical Windows Netlogon flaw, is now being actively exploited in the wild and could enable remote code execution on vulnerable domain controllers. Microsoft had previously patched the issue in May 2026, and the advisory says all currently supported Windows Server versions, including Windows Server 2025, are affected. #CVE-2026-41089 #Windows #Netlogon #WindowsServer2025

Check Point Software Technologies says 2026 midterm election threats are focusing on campaign email accounts, donation platforms, and election-themed websites rather than voting machines or ballot systems. The report also warns that AI is making phishing, stolen-credential abuse, and manipulated political content more convincing and harder to detect. #CheckPointSoftwareTechnologies #OpenAI #ActBlue #WinRed

Researchers uncovered a malicious supply chain campaign hiding in the npm package codexui-android, which secretly steals OpenAI Codex authentication tokens from developers and sends them to sentry.anyclaw[.]store. The same exfiltration chain was also found in Android apps linked to BrutalStrike, while a separate finding showed deleted Google API keys can remain…

Threat actors began exploiting CVE-2026-0257 in Palo Alto Networks PAN-OS just four days after it was publicly disclosed, using forged cookies to bypass authentication on GlobalProtect portal and gateway devices. Rapid7 and CISA reported active exploitation, while Palo Alto Networks issued fixes and urged organizations to patch affected PAN-OS and Prisma…

A 19-year-old Linux kernel flaw in the CIFS subsystem, dubbed CIFSwitch, can let low-privileged users gain root access by abusing request_key and cifs.upcall behavior. The issue affects multiple Linux distributions and has already been patched, with proof-of-concept code released to help defenders validate exposure. #CIFSwitch #CIFS #cifs-utils #LinuxKernel…

Dutch authorities have taken down a botnet that enslaved at least 17 million infected devices and used more than 200 servers in the Netherlands as backend infrastructure. The operation was linked by local reporting to Asocks, a residential proxy service, after the NCSC and Politie seized servers and shut the network…

Hackers are actively targeting WordPress sites running vulnerable WP Maps Pro versions to create rogue administrator accounts without authentication. The critical flaw, tracked as CVE-2026-8732, has been fixed in WP Maps Pro 6.1.1, and administrators should update immediately to stop ongoing exploitation attempts. #WPMapsPro #CVE20268732 #Wordfence #DavidBrown

A Canadian man, Ramanan Pathmanathan, was sentenced to 33 years in U.S. federal prison for using fake social media identities to coerce more than 145 children into producing sexually explicit content. He targeted victims across the United States for years, threatened to expose the material, and is already serving a 12-year…

Carnival confirmed that hackers stole personal information, including passport and driver’s license details, during an April cyberattack linked to ShinyHunters. The breach may have exposed nearly 6 million people, and the group later leaked records tied to the Mariner Society loyalty program. #Carnival #ShinyHunters #MarinerSociety…

Microsoft condemned a wave of uncoordinated Windows zero-day disclosures by the pseudonymous researcher Nightmare Eclipse, saying that publishing proof-of-concept code for unpatched flaws is “never justifiable.” Several of the disclosed bugs, including BlueHammer, UnDefend, and RedSun, have already been exploited, while Microsoft said its Digital Crimes Unit will continue pursuing those…