Category: Cyber Security News

Obsidian Security disclosed technical details and proof-of-concept code for CVE-2026-40933, a critical RCE flaw in Flowise tied to Anthropic’s MCP protocol. The vulnerability can let attackers trigger command execution during chatflow import, affecting self-hosted Flowise deployments by default while Flowise Cloud remains unaffected. #Flowise #CVE-2026-40933 #AnthropicMCP #ObsidianSecurity…

Russia’s intelligence agencies are intensifying efforts to steal Western technology, defense secrets, and dual-use research as sanctions and war strain the country’s economy. European officials say Moscow is using fake companies, intermediaries, and cyber operations to target sectors such as Sweden’s defense industry, Finland’s space and quantum technology, and critical infrastructure…

A newly disclosed Linux kernel privilege escalation flaw called CIFSwitch can let unprivileged attackers forge CIFS authentication requests and gain root access through the kernel key request path. The issue affects multiple Linux distributions under certain configurations, and a patch plus mitigations such as disabling CIFS, removing cifs-utils, and restricting user namespaces are recommended. #CIFSwitch #cifs-utils #LinuxKernel

Palo Alto Networks is warning that CVE-2026-0257 in PAN-OS GlobalProtect is being actively exploited to bypass authentication and attempt unauthorized VPN access on unpatched devices. Rapid7 and CISA have confirmed real-world attacks, with exploitation linked to forged authentication override cookies and affected organizations urged to patch or disable the feature immediately. #PaloAltoNetworks #PANOS #GlobalProtect #CVE20260257 #Rapid7 #CISA

Palo Alto Networks says CVE-2026-0257 in PAN-OS and Prisma Access is being actively exploited, allowing attackers to bypass authentication and establish unauthorized VPN connections through GlobalProtect. Rapid7 observed successful exploitation in multiple customer environments, and Palo Alto Networks urges urgent patching or temporary mitigations such as disabling authentication override or using…

An unknown threat actor exploited CVE-2026-39987 in a public Marimo instance and used an LLM agent to adaptively continue post-compromise actions, including credential harvesting, AWS Secrets Manager access, and SSH access to a bastion host. The intrusion ended with rapid exfiltration of an internal PostgreSQL database, highlighting the growing use of…

Researchers found that ChatGPT can be abused through a vulnerability called ChatGPhish, where Markdown links and images from summarized web pages are rendered as trusted, clickable content that can leak data and enable phishing. The report also highlights related AI-agent attacks such as SymJack, TrustFall, ClaudeBleed, and WebPromptTrap, showing that prompt…

MokN, a Paris-based startup founded in 2023, raised $15 million in a Series A led by Google Ventures to expand its phish-back platform for identity protection. The company uses realistic honeypots to expose compromised credentials and plans to grow in the US and UK while strengthening its engineering and R&D teams….

ShinyHunters has allegedly published data stolen from Charter Communications on its Tor-based leak site, claiming it includes more than 42 million customer records and CPNI. HaveIBeenPwned’s analysis suggests the exposed data may actually affect 4.9 million people, while Charter says only sales tools were impacted and no sensitive PI or CPNI…

This week’s roundup covers major cybersecurity incidents, including the Trump Mobile data exposure, deep Russian state-sponsored access to Treasury emails tied to SolarWinds, a VS Code Remote-SSH RCE flaw, and large-scale phishing and supply chain attacks. It also highlights urgent patches from Veeam, Notepad++, and Roundcube, along with CISA’s response to…

A Department of Commerce inspector general report says NIST has mismanaged the National Vulnerability Database through poor planning, inefficient enrichment work, duplicated efforts with CISA, and weak communication with users. The backlog of unprocessed vulnerabilities has grown sharply since the enrichment contract lapsed in February 2024, prompting six recommendations for NIST to improve the NVD. #NIST #NationalVulnerabilityDatabase #CISA #CVE

A Tennessee man, Zachary Sweeney, pleaded not guilty to charges alleging he abused and exploited children while participating in the 764 extremist collective tied to The Com. Prosecutors say his case highlights the group’s spread of child sexual abuse material, coercion, blackmail, and violent criminal activity across multiple states. #ZacharySweeney #764 #TheCom #LeonidasVaragiannis #PrasanNepal #AlexisAldairChavez #8884

Dutch authorities and the NCSC took down a botnet of at least 17 million infected devices and seized more than 200 servers in the Netherlands. The operation is reportedly linked to Asocks, a proxy service accused of supporting cyberattacks through infrastructure used to control compromised devices. #Asocks #NCSC

DDoS-as-a-service has evolved from scattered tools and forum posts into a polished underground market with attack panels, API access, monthly plans, reseller options, and customer support. Flare researchers found a sharp rise in high-signal DDoS service ads from 2023 to 2026, while real-world attacks attributed to Cloudflare, Microsoft Azure, and the Aisuru botnet show the scale and impact of this trend. #Cloudflare #MicrosoftAzure #Aisuru #Flare