Category: Cyber Security News

The Federal Trade Commission will ban data broker Kochava and its subsidiary Collective Data Solutions from selling precise location data without consumers’ explicit consent as part of a settlement over allegations that the companies collected and monetized geolocation information from hundreds of millions of mobile devices. The proposed court-enforceable order requires consent verification, a sensitive location data program, disclosure and deletion mechanisms, incident reporting, and other safeguards to prevent misuse of location data. #Kochava #CollectiveDataSolutions

Google released an Android update to patch a critical remote code execution vulnerability in the System component tracked as CVE-2026-0073. The flaw affects adbd, requires no user interaction to exploit, and there are currently no reports of in-the-wild exploitation; patches for Wear OS, Pixel Watch, Android XR, and Android Automotive were…

A critical unauthenticated heap out-of-bounds vulnerability (CVE-2026-7482), dubbed Bleeding Llama, affects roughly 300,000 internet-exposed Ollama deployments and can leak sensitive heap data such as prompts, messages, environment variables, and API keys. Attackers can exploit the GGUF model loader and use Ollama’s model push feature to exfiltrate stolen data with only three…

Joey Melo applies a control-first approach to AI red teaming, manipulating conversation context and payloads to bend models’ outputs without changing their source code. After moving from pentesting to AI red teaming following wins in competitions and a role at Pangea, he now researches jailbreaking, data poisoning, and responsible disclosure at…

Write 2 sentences summarizing the content. At the end, add hashtags for specific keywords mentioned in the article—such as names of malware, threat actors, or affected organizations/systems. Avoid general terms like #malware, #ransomware, or #cybersecurity. Use this format: #Keyword1 #Keyword2

Researchers uncovered a new CloudZ RAT plugin called Pheno that hijacks Microsoft Phone Link on Windows to steal SMS and one-time passcodes from a target’s mobile messages without compromising the device. The intrusion chain uses a fake ScreenConnect update to deploy Rust and .NET loaders with anti-analysis checks, and Cisco Talos published IoCs and mitigation guidance. #CloudZ #Pheno #MicrosoftPhoneLink #CiscoTalos

A Latvian national, Deniss Zolotarjovs, was extradited to the United States and sentenced to 8.5 years for acting as a “cold case” negotiator for the Karakurt extortion group. He pleaded guilty to conspiracy to commit wire fraud and money laundering after leveraging stolen personal and children’s health data to pressure victims and coordinating extortion linked to groups like Conti and BlackCat. #Karakurt #DenissZolotarjovs

Hudson Rock partnered with Ransomware.live to launch a public dashboard that uses cybercrime intelligence to show how Infostealer infections feed ransomware operations and provides free, up-to-date statistics. The data reveals Infostealers are a major initial attack vector, exemplified by the “Coinbase Cartel” campaign that used harvested credentials to deploy ransomware across more than 100 companies. #Infostealer #CoinbaseCartel

Cyber-extortion group World Leaks said it stole and published nearly 8.5 terabytes of data from Hungarian media company Mediaworks, including payroll records, contracts, financial statements and internal communications. Mediaworks confirmed the breach, urged journalists not to report on the leaked material while launching an investigation, and the attacker — a rebrand…

Forbes Media has preliminarily agreed to pay roughly $10 million and change its business practices to settle a class-action alleging its website tracked users across the internet without consent. The settlement requires Forbes to provide greater notice about trackers and give California residents more control over data sharing after plaintiffs said…

Researchers at Vega documented attacks exploiting CVE-2026-22679 in Weaver E-cology 10.0 beginning mid-March that allowed unauthenticated remote command execution via an exposed debug API. Attackers ran discovery commands and attempted PowerShell payloads and a target-aware MSI (fanwei0324.msi), but endpoint defenses blocked execution and the vendor’s March 12 fix removes the vulnerable endpoint; users should apply the update immediately. #CVE-2026-22679 #WeaverE-cology

Attackers are exploiting a high-severity Linux kernel vulnerability, CVE-2026-31431 (dubbed “Copy Fail”), that allows anyone with authenticated local access to escalate to root and may affect many mainstream distributions and container environments. Theori used its AI-powered platform Xint to discover and describe the bug, sparking controversy over AI-generated disclosure language as patches and numerous proof-of-concept exploits proliferated. #CopyFail #CVE202631431

A cyber incident over the weekend disrupted operations at Infrastructure, the company behind the Canvas learning platform, and investigators found hackers had accessed user information at some educational institutions. The attack was claimed by the ShinyHunters group, which says it stole 3.6 TB of data from more than 9,000 schools; Infrastructure…

Attackers have shifted from one-off breaches to long-term occupation, exploiting control panels, kernels, CI/CD pipelines, and SaaS sessions to push trusted commits and live inside environments. This recap highlights active exploitation of cPanel (CVE-2026-41940) and the Copy Fail Linux kernel bug (CVE-2026-31431), ongoing supply-chain campaigns by TeamPCP, new backdoors and ransomware…

Cisco announced its intent to acquire Astrix Security, a startup that secures non-human identities such as API keys, service accounts, and OAuth tokens used by applications and AI agents. The move — reported at roughly $400 million — aims to extend zero trust to the emerging agentic workforce by integrating Astrix’s…