Category: Cyber Security News

Cyera warns that four OpenClaw vulnerabilities, dubbed Claw Chain, can be chained to bypass sandbox protections, steal sensitive data, and plant persistent backdoors on the host. The flaws affect OpenShell and the MCP loopback flow, and patches were released after disclosure to OpenClaw maintainers. #OpenClaw #OpenShell #ClawChain #CVE-2026-44112 #CVE-2026-44113 #CVE-2026-44115 #CVE-2026-44118…

Several major healthcare data breaches were recently added to the HHS breach tracker, with affected individual counts only now becoming public. The largest incidents include NYC Health and Hospitals, Erie Family Health Centers, and Nacogdoches Memorial Hospital, exposing sensitive personal, medical, and financial data. #NYCHealthAndHospitals #ErieFamilyHealthCenters #NacogdochesMemorialHospital #FloridaPhysicianSpecialists #CoastalCarolinaHealthCare #WesternOrthopaedics…

ShinyHunters breached Instructure’s Canvas platform twice in one week, stealing 3.65 terabytes of data from 275 million users and disrupting thousands of schools during final exams. The incident shows why SaaS security must focus on identity governance, blast-radius reduction, and cryptographic protections that limit the value of stolen data. #ShinyHunters #Instructure #Canvas #HouseHomelandSecurityCommittee

Microsoft has confirmed that the May 2026 Windows 11 update KB5089549 can fail to install on some devices because the EFI System Partition does not have enough free space. Affected systems may roll back during reboot with 0x800f0922 errors and can be temporarily mitigated using Known Issue Rollback or Group Policy settings. #Windows11 #KB5089549 #EFISystemPartition #KnownIssueRollback

Sean Plankey, who recently withdrew as nominee to lead CISA, has joined UFORCE as its U.S. chief executive officer. The defense technology startup, which builds combat drones and autonomous vessels, says his appointment supports its plan to scale U.S. manufacturing and expand its Western deployment. #SeanPlankey #UFORCE #CISA

Pwn2Own Berlin 2026 ended with researchers earning $1,298,250 for exploiting 47 zero-day flaws across enterprise software, browsers, AI systems, and virtualization technologies. DEVCORE topped the leaderboard, with standout wins against Microsoft Exchange, Microsoft Edge, Windows 11, Red Hat Enterprise Linux for Workstations, NVIDIA Container Toolkit, and VMware ESXi. #Pwn2OwnBerlin2026 #DEVCORE #MicrosoftExchange #MicrosoftEdge #Windows11 #RedHatEnterpriseLinux #VMwareESXi #NVIDIAContainerToolkit

A researcher known as Chaotic Eclipse has released the MiniPlasma proof-of-concept exploit, claiming it can still gain SYSTEM privileges on fully patched Windows 11 systems through the cldflt.sys Cloud Filter driver. The disclosure adds to a series of recent Windows zero-days from the same researcher, including BlueHammer, RedSun, YellowKey, and GreenPlasma. #MiniPlasma #ChaoticEclipse #cldfltsys #GoogleProjectZero #Microsoft

A newly disclosed NGINX Plus and NGINX Open flaw, CVE-2026-42945, is already being actively exploited in the wild, with attackers attempting to weaponize a heap buffer overflow that can crash worker processes and, in some cases, enable remote code execution. VulnCheck also reported active exploitation against multiple openDCIM flaws that can…

Tycoon2FA has expanded to support device-code phishing, using Trustifi click-tracking URLs and a multi-layered redirect chain to hijack Microsoft 365 accounts. After a law enforcement disruption in March, the kit returned on new infrastructure with stronger obfuscation and anti-analysis protections. #Tycoon2FA #Trustifi #Microsoft365 #Entra

Grafana said an unauthorized party used a stolen token to access its GitHub environment and download its codebase, but no customer data, personal information, or customer systems were impacted. The company invalidated the compromised credentials, strengthened defenses, and refused extortion demands, while reports suggest the activity may be tied to CoinbaseCartel….

Microsoft is accused of quietly fixing an Azure Backup for AKS privilege escalation flaw after rejecting the researcher’s report and helping block a CVE. Justin O’Leary says the issue let a low-privileged Backup Contributor gain cluster-admin access through Trusted Access, while Microsoft denies a vulnerability and says no product changes were made. #AzureBackupforAKS #AKS #JustinOLeary #MSRC #CERTCC #MITRE

Microsoft says Secret Blizzard has turned the Kazuar backdoor into a modular P2P botnet built for stealth, persistence, and long-term espionage. The malware uses a leader-based architecture with separate kernel, bridge, and worker modules to collect data and exfiltrate it while reducing external visibility. #SecretBlizzard #Kazuar #Turla #Uroburos #VenomousBear #FSB

A critical vulnerability in the Funnel Builder WordPress plugin is being actively exploited to inject malicious JavaScript into WooCommerce checkout pages and steal payment data. Sansec says attackers are disguising the skimmer as Google Tag Manager code, while other recent attacks have used backdoored Joomla sites to load instructions from attacker-controlled…