Category: Cyber Security News

CISA has ordered U.S. federal agencies to patch a Microsoft Defender privilege-escalation zero-day (CVE-2026-33825) within two weeks after evidence of active exploitation. The flaw, dubbed “BlueHammer” after a researcher leak by Chaotic Eclipse, was disclosed alongside two other Defender issues and has been tied to hands-on-keyboard attacks and suspicious FortiGate VPN access. #BlueHammer #CVE202633825

A previously undocumented state-backed threat actor called GopherWhisper has used a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord to conduct command-and-control and exfiltration against government entities. ESET linked the actor to China after recovering hardcoded credentials and thousands of Slack and Discord messages, and identified multiple Go-based backdoors including LaxGopher, RatGopher, and BoxOfFriends. #GopherWhisper #LaxGopher

The UK’s NCSC and international partners warn that China‑nexus threat actors are increasingly routing operations through massive proxy networks made from hijacked SOHO routers, cameras, video recorders, and NAS devices to evade detection. Agencies highlighted botnets and state-linked groups tied to these covert networks and urged defenses like multifactor authentication, dynamic threat feeds, IP allowlists, and zero‑trust controls. #RaptorTrain #VoltTyphoon

OpenAI released Privacy Filter, an open-weight model under the Apache 2.0 license that detects and redacts PII in text and is available on Hugging Face and GitHub. The small token-classification model runs locally, supports long contexts, classifies eight PII categories, and achieved about 96–97% F1 on the PII-Masking-300k benchmark, though OpenAI advises human review for high-sensitivity use cases. #PrivacyFilter #OpenAI

A newly identified China-aligned APT named GopherWhisper runs custom Go-based backdoors and loaders that hide command-and-control traffic inside popular collaboration platforms such as Slack, Discord, and Outlook drafts while exfiltrating data via file.io. ESET recovered thousands of Slack and Discord messages and Outlook drafts tied to a Mongolian government intrusion, revealing development logs, UTC+8 timestamps that support a China-aligned attribution and published indicators of compromise. #GopherWhisper #LaxGopher

Mongolian governmental institutions were targeted by a previously undocumented China-aligned APT tracked as GopherWhisper, which deployed a diverse toolkit of mostly Go-written backdoors, injectors, and loaders. The actor abused legitimate services including Discord, Slack, Microsoft 365 Outlook, and file[.]io for command-and-control and exfiltration, with telemetry showing about a dozen confirmed infections…

A privilege-escalation zero-day in Microsoft Defender, tracked as CVE-2026-33825 (CVSS 7.8) and patched on April 14, has been exploited in the wild following the publication of a public proof-of-concept. The exploit techniques—BlueHammer, RedSun, and UnDefend—were disclosed by researcher Chaotic Eclipse and observed in attacks leveraging FortiGate SSL VPN access; CISA has…

Apple released iOS and iPadOS updates to fix CVE-2026-28950, a logging bug that allowed deleted message notifications to be retained and later recovered. The flaw appears to have been used by law enforcement to extract Signal chats in the Prairieland case, and Signal confirmed the patch removes inadvertently preserved notifications. #CVE-2026-28950…

LangWatch released Scenario, an open-source framework that automates multi-turn red-team exercises against AI agents in production to uncover risks such as compromised agents with database or tool access. Scenario uses a Crescendo four-phase escalation and a secondary scoring model to refine attacks across conversational turns, giving attackers an asymmetric advantage via persistent attacker memory while wiping target memory. #LangWatch #Scenario

In this interview, Sandra McLeod, CISO at Zoom, reflects on her first year moving from reactive “technical firefighter” duties to a proactive business strategist role focused on aligning security with company objectives. She recounts listening to engineers, the board, and customers, preparing for incident management and accountability, and offers candid advice for women considering leadership roles. #SandraMcLeod #Zoom

North Korean threat actor Void Dokkaebi has evolved its “Contagious Interview” job-offer lure into a self-propagating supply-chain attack that infects developer repositories to spread remote access trojans and steal credentials. The campaign abuses Visual Studio Code workspace tasks and commit tampering, uses blockchain networks for payload staging, and can cascade infections across forks and downstream projects. #VoidDokkaebi #VSCode

House Republicans unveiled the Secure Data Act, a draft bill that would let consumers opt out of targeted advertising, sales, and automated decisionmaking, require notice and data portability, impose limits on data collection, and expand FTC oversight of data brokers. Supporters say it creates enforceable protections and accountability, while critics argue it preempts stronger state laws, lacks a private right of action, contains loopholes, and does not sufficiently address AI-related privacy risks. #SecureDataAct #FederalTradeCommission

Sean Plankey asked President Donald Trump to withdraw his nomination to lead the Cybersecurity and Infrastructure Security Agency after thirteen months without an expected Senate confirmation. His withdrawal comes amid senatorial holds over unrelated issues, the recent confirmation of DHS Secretary MarkWayne Mullin, and ongoing leadership and budget upheaval at CISA. #SeanPlankey #CISA

Mozilla tested Anthropic’s Claude Mythos and found the model could identify hundreds of vulnerabilities, with Mythos flagging 271 issues in Firefox 150 after Mozilla’s earlier Opus 4.6 scan led to fixes for 22 security-sensitive bugs in Firefox 148. Anthropic is restricting access through Project Glasswing amid misuse concerns and reports of unauthorized access, while Mozilla says LLMs now rival elite human researchers and defenders must adapt. #ClaudeMythos #Firefox