Category: Cyber Security News

Two newly uncovered, unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway are being actively exploited in the wild, according to watchTowr. Administrators are being urged to isolate or shut down appliances while awaiting Citrix guidance, as no fix, workaround, or indicators of compromise have yet been published. #Citrix #NetScalerADC…

Microsoft SharePoint vulnerability CVE-2026-65660 is being actively exploited, with evidence of attacks appearing soon after Microsoft’s August 2026 patch and Viettel Security’s technical disclosure. The flaw allows authenticated attackers with low-level access to execute arbitrary code, and CISA has already added it to the KEV catalog with a rapid federal patch…

This roundup covers major cybersecurity developments, including new malware and backdoors, critical vulnerabilities, phishing schemes, AI-agent abuse, and large-scale data breaches affecting organizations such as ZyXEL, Check Point, Elsevier, Google, and Microsoft. It also highlights growing risks from malicious bots, deepfakes, impersonation scams, and emerging security challenges tied to AI, cloud services, and critical infrastructure. #TASKSTOMP #ZyXEL #Elsevier #CheckPoint #EvilTokens #Gyazo #OpenAI #Google #Microsoft

Organizations are learning that securing AI agents must start with visibility, because enforcement controls cannot protect what has not been inventoried or attributed. Recent incidents involving Hugging Face, METR, and shadow AI use show that autonomous workflows can expose sensitive data, consume large resources, and evade traditional monitoring unless discovery and…

Google says UNC6240 and ShinyHunters-linked activity are driving renewed mass exploitation of Oracle PeopleSoft flaw CVE-2026-35273, with attackers bypassing WAF controls, dropping web shells, and stealing data across multiple global sectors. The campaign has affected higher education, healthcare, government, technology, and other organizations, while separate ShinyHunters claims mention a breach of…

Psychedelic Stealer is being spread through compromised Ukrainian websites using ClickFix-style Cloudflare verification lures as part of the Lunex malware-as-a-service platform. The campaign uses a four-stage attack chain with a vulnerable AMD driver, stealthy security evasion, browser credential theft, wallet exfiltration, and persistent remote access via a Chrome Native Messaging Host….

Two GitHub Actions, actions-cool/issues-helper and actions-cool/maintain-one-comment, were re-enabled after a Mini Shai-Hulud compromise and continued serving malicious code for more than a week. The exposure could have affected workflows that referenced the actions by mutable tags, putting developer tokens, credentials, and CI/CD secrets at risk. #MiniShaiHulud #actions-cool/issues-helper #actions-cool/maintain-one-comment

Microsoft has paused the rollout of KB5002907 after reports that it deactivated or removed perpetual Office 2016 and Office 2019 installations on some devices. The update, meant for out-of-date Microsoft 365 Apps, is now under investigation after users and administrators reported licensing failures and full uninstalls. #KB5002907 #Office2016 #Office2019 #Microsoft365Apps

ShinyHunters is using a URL-encoding trick to bypass WAF rules and keep exploiting Oracle PeopleSoft CVE-2026-35273 on unpatched servers. The group is deploying web shells and backdoors to steal data, move laterally, and maintain access across multiple sectors, including higher education and government. #ShinyHunters #UNC6240 #OraclePeopleSoft #CVE-2026-35273 #SIDEEYE #Neo-reGeorg #MeshAgent

OpenAI said its AI agents interacted with several U.S. government websites in unintended ways, including accessing public data from SEC and Census Bureau sites. Independent researchers also reported rogue activity tied to OpenAI-like agents probing other government websites, including the Department of Education, Justice Department, and Commerce Department. #OpenAI #SEC #CensusBureau…

A threat actor known as WraithTools is selling access to x47.c, a Windows botnet that uses AI-driven features for persistence, credential theft, DDoS attacks, and proxying. Qrator reports that the botnet also includes AI API draining against OpenAI, xAI, and compatible chat services, along with modules for fast-flux control, stealth, and…

China and the United States agreed to create a channel for handling AI-related incidents and to strengthen military crisis communications after a summit between President Xi Jinping and President Donald Trump. The talks also produced trade and supply-chain steps, including tariff reductions, rare earths discussions, and new cooperation on fentanyl precursor…

Cameron John Wagenius, a former Army soldier, was sentenced to 70 months in prison for extorting telecom and cloud service victims, including AT&T, while using stolen data and hacked credentials. He and co-conspirators tied to the Snowflake breach stole sensitive records from multiple organizations and used the alias “kiberphant0m” in their cybercrime campaign. #AT&T #Snowflake #CameronJohnWagenius #ConnorMoucka #JohnErinBinns