ShinyHunters claims it breached Instructure’s Canvas platform and says data from nearly 9,000 education institutions may be leaked unless a payment is made by May 12. The group says the stolen information includes names, email addresses, student ID numbers, and user communications, while schools such as Harvard, MIT, Columbia, and UC Berkeley are listed among the affected organizations. #ShinyHunters #Instructure #Canvas #Harvard #MIT #UCBerkeley #Columbia
Category: Cyber Security News
A Virginia man and his brother were convicted and charged for destroying dozens of government databases after being fired by a federal contractor that served more than 45 U.S. agencies. The case includes unauthorized access to State Department systems, data theft, and attempts to conceal the deletions, with Sohaib Akhter now facing sentencing and Muneeb Akhter facing up to 45 years. #SohaibAkhter #MuneebAkhter #StateDepartment #DepartmentofHomelandSecurity #FDICOIG
ShinyHunters claimed responsibility for the Zara breach, and Have I Been Pwned said the stolen data exposed information for 197,400 people, including email addresses, purchases, support tickets, and geographic locations. Inditex said the incident came from a former technology provider and did not expose credentials or payment data, while MANGO also recently disclosed a separate breach tied to a marketing vendor. #Zara #Inditex #ShinyHunters #MANGO
A vulnerability in the Claude extension for Chrome, dubbed ClaudeBleed, could let attackers take over the AI agent through remote prompt injection and bypass user-confirmation protections. LayerX says the flaw can be abused to steal data from Gmail, GitHub, and Google Drive, while also sending emails, deleting data, and sharing documents…
RansomHouse has claimed responsibility for the attack on Trellix after the cybersecurity firm disclosed that part of its source code repository was breached. Trellix says it has found no evidence that its source code release or distribution process was affected, and it will provide more details after finishing its investigation. #RansomHouse…
A threat actor is using the PCPJack framework to remove TeamPCP artifacts from infected systems while stealing credentials and deploying its own tooling across cloud and on-premises environments. SentinelOne says the campaign can spread through vulnerable web apps, Kubernetes, Docker, Redis, RayML, MongoDB, and SSH, with ties to TeamPCP and Sliver-based…
A new Linux zero-day called Dirty Frag lets local attackers gain root privileges on major distributions with a single command, by chaining two kernel flaws in the algif_aead interface. Hyunwoo Kim disclosed the issue with a PoC, and no CVE or patch is available yet for affected systems including Ubuntu, Red Hat Enterprise Linux, CentOS Stream, AlmaLinux, openSUSE Tumbleweed, and Fedora. #DirtyFrag #HyunwooKim #Ubuntu #RedHatEnterpriseLinux #CentOSStream #AlmaLinux #openSUSETumbleweed #Fedora
Palo Alto Networks disclosed active exploitation of CVE-2026-0300, a zero-day in the User-ID Authentication Portal of PA and VM series firewalls that enables unauthenticated remote code execution with root privileges. The attack has been linked to the likely state-sponsored group CL-STA-1132, with indicators suggesting China and tooling such as Earthworm and…
The trial between Elon Musk and Sam Altman centers on allegations that OpenAI drifted from its nonprofit mission, while both sides claim they are acting in humanity’s best interest. Testimony also highlighted broader fears about advanced AI, including job displacement, misinformation, discrimination, and the risk of artificial general intelligence. #ElonMusk #SamAltman…
Ivanti released May 2026 security updates for Endpoint Manager Mobile to fix five vulnerabilities, including CVE-2026-6973, a zero-day that was exploited in targeted attacks. The company warned that a small number of customers were affected and noted the flaw may have been chained with earlier issues, including CVE-2026-1281 and CVE-2026-1340, while…
Two U.S. nationals were sentenced to 18 months in prison for hosting laptop farms that helped North Korean IT workers appear to be working remotely from the United States. Their schemes affected nearly 70 U.S. companies and generated more than $1.2 million for the North Korean regime. #NorthKorea #MatthewIssacKnoot #ErickNtekerezePrince #Taggcar
The Trump administration is reshaping the CyberCorps Scholarship for Service program into CyberAI SFS, steering it toward AI-related training for future scholars. Current participants say the shift was made without warning and have raised concerns about communication, placement, and how the changes affect their obligations. #CyberCorps #CyberAI SFS #OfficeofPersonnelManagement #NationalScienceFoundation #CISA
Ivanti has disclosed active exploitation of CVE-2026-6973, a zero-day in Endpoint Manager Mobile that lets authenticated administrators execute remote code, and has released patches for five related vulnerabilities. The issue adds to a long pattern of attacks against Ivanti products, following earlier exploited flaws that affected nearly 100 victims, including the Dutch Data Protection Authority and the Council for the Judiciary. #Ivanti #CVE-2026-6973 #CVE-2026-1281 #CVE-2026-1340
Ivanti warned customers to patch CVE-2026-6973, a high-severity remote code execution flaw in Endpoint Manager Mobile (EPMM) that has been exploited in zero-day attacks and affects EPMM 12.8.0.0 and earlier. The company also released fixes for four other high-severity EPMM issues and advised administrators to review and rotate privileged credentials where needed. #Ivanti #CVE-2026-6973 #EPMM #CISA
The Australian Cyber Security Center (ACSC) is warning that Australian organizations are being targeted in a ClickFix campaign that uses fake verification prompts on compromised WordPress sites to deliver Vidar Stealer. The malware steals browser data, wallets, and system details while hiding its activity by deleting its executable and using memory-only execution. #AustralianCyberSecurityCenter #ACSC #ClickFix #VidarStealer #WordPress #Cloudflare