Category: Cyber Security News

The FCC has extended deadlines that would ban software and firmware updates for foreign-made routers and drones, pushing both requirements to January 1, 2029. The move follows industry concerns that blocking updates could leave widely used devices unpatched and vulnerable, while the agency considers formal rulemaking that could further alter the…

Texas Attorney General Ken Paxton has sued Netflix, alleging the company collected and shared subscriber data with advertisers and data brokers without proper user consent. The complaint says Netflix tracked viewing habits, location, devices, and children’s profile behavior, while its privacy disclosures remained vague and incomplete. #Netflix #KenPaxton #Experian #Acxiom #GoogleDisplayVideo360…

Checkmarx confirmed that a modified version of its Jenkins AST plugin was published to the Jenkins Marketplace, and users were advised to verify they are running the safe 2.0.13-829.vc72453fa_1c16 release or earlier. The incident is part of a wider TeamPCP campaign that has also hit Checkmarx’s KICS Docker image, VS Code…

Google disclosed an unknown threat actor likely used an AI-generated Python exploit to discover and weaponize a zero-day 2FA bypass in an open-source web-based system administration tool. The report also highlights multiple AI-abuse campaigns, including PromptSpy on Android, which uses Gemini-related techniques for autonomous device control, credential capture, and persistence. #PromptSpy…

Mr_Rot13 has been linked to exploiting CVE-2026-41940 in cPanel and WHM to install the Filemanager backdoor on compromised systems. The campaign uses web shells, credential theft, persistent SSH access, and cross-platform payloads while targeting victims through infrastructure tied to cp.dene.de.com, wrned.com, and wpsock.com. #Mr_Rot13 #CVE-2026-41940 #Filemanager #cPanel #WHM…

Frame Security has emerged from stealth with $50 million in funding to scale its AI-powered human risk management platform for cybersecurity awareness and training. The platform delivers personalized phishing, voice, and video deepfake simulations, automated training, and real-time threat triage for organizations including startups and Fortune 500 companies. #FrameSecurity #TalShlomo #SharonShmueli…

A new TrickMo Android banking malware variant, tracked as Trickmo.C, is being spread through fake TikTok and streaming apps to target banking and crypto wallet users in France, Italy, and Austria. The latest version uses TON-based communications with .ADNL addresses to obscure its command-and-control infrastructure and adds new networking and remote-access commands. #TrickMo #TrickmoC #ThreatFabric #TON

Modern attacks now combine AI-generated phishing, business email compromise, ransomware, and SaaS abuse to bypass traditional defenses and disrupt operations. This BleepingComputer webinar with Austin O’Saben of Kaseya explains why backup, recovery, and business continuity are now essential parts of cyber resilience. #Kaseya #BleepingComputer #AustinOSaben

Google Threat Intelligence Group says a zero-day exploit against an unnamed open-source web administration tool was likely created with AI to bypass two-factor authentication, and the attack was stopped before mass exploitation. The report also links AI use to other threat activity involving APT27, APT45, UNC2814, UNC5673, UNC6201, CANFAIL, LONGSTREAM, Overload, and PromptSpy. #APT27 #APT45 #UNC2814 #UNC5673 #UNC6201 #CANFAIL #LONGSTREAM #Overload #PromptSpy

Password resets in Active Directory and hybrid Entra ID environments do not always immediately remove all attacker access, because cached credentials, active Kerberos sessions, and synchronization delays can keep old access paths alive. Defenders must invalidate sessions, rotate privileged credentials, and audit directory changes to fully evict intruders and close gaps left after a reset. #ActiveDirectory #EntraID #Kerberos #KRBTGT #AdminSDHolder

Instructure confirmed that attackers exploited cross-site scripting flaws to hijack authenticated admin sessions, modify Canvas login portals, and post an extortion message. ShinyHunters claimed responsibility for the breach, saying it stole data from Instructure and targeted the Free-for-Teacher Canvas environment used by schools and educators. #Instructure #Canvas #ShinyHunters #FreeForTeacher

Google says it has identified the first zero-day exploit it believes was developed with artificial intelligence, including a Python script used to bypass two-factor authentication on an open source web-based system administration tool. The report also highlights AI-driven vulnerability research and exploit development by Chinese and North Korean threat actors, including…

Supply chain attacks are increasingly exploiting flaws introduced during the CI/CD build process, where compromised packages and malicious versions can slip into widely used software. The article argues that a build application firewall, combined with deeper inspection and accurate SBOM generation, could help stop attacks like those involving SolarWinds, Axios, Trivy,…

Google researchers discovered a zero-day exploit that appeared to be developed with artificial intelligence and warned the vendor before a cybercrime group could launch a mass exploitation campaign. The incident is the clearest evidence yet that AI-assisted vulnerability research and exploit development is already happening, with Google noting the affected open-source administration tool was patched before widespread abuse. #Google #GTIG #BigSleep

Checkmarx warned users that a modified version of its Jenkins AST plugin was published in the Jenkins Marketplace as part of an ongoing supply chain attack. The company advised users to verify they are running version 2.0.13-829.vc72453fa_1c16 while it released new plugin versions, including 2.0.13-848.v76e89de8a_053. #Checkmarx #JenkinsAST #Trivy #TeamPCP #Lapsus…