Category: Cyber Security News

Microsoft released out-of-band updates to fix a critical ASP.NET Core vulnerability, CVE-2026-40372, that can allow an attacker to escalate privileges to SYSTEM. The flaw was caused by a regression in Microsoft.AspNetCore.DataProtection 10.0.0–10.0.6 on non-Windows systems and is fixed in ASP.NET Core 10.0.7; tokens issued during the vulnerable window remain valid unless…

Oracle released 481 security patches in its April 2026 Critical Patch Update covering 28 product families, addressing roughly 450 unique CVEs with more than 300 vulnerabilities that are remotely exploitable without authentication. The update heavily impacted Oracle Communications, Financial Services Applications, and Fusion Middleware, and follows an emergency fix for CVE-2026-21992…

Google Antigravity, an agent-first IDE powered by Gemini, contained a sandbox-escape vulnerability that allowed remote code execution via an unsanitized parameter and was patched by Google in late February. Researchers also found that a fake google-antigravity(.)com site distributed a trojanized installer deploying PowerShell scripts and a stealer that harvests browser data,…

A former ransomware negotiator, Angelo Martino, pleaded guilty to conspiring with the BlackCat/ALPHV group to extort U.S. companies in 2023 by leaking confidential negotiation and insurance details from his incident response firm. Law enforcement has seized roughly $10 million in assets, co-conspirators have also pleaded guilty, and experts urge strict separation of negotiation, payment, and response roles to prevent insider abuse. #BlackCat #ChangeHealthcare

A South Florida man, Angelo John Martino III, pleaded guilty to conspiring with BlackCat/ALPHV affiliates to attack and extort payments from U.S. companies he was supposed to represent as a ransomware negotiator for DigitalMint in 2023. He admitted using confidential negotiation and insurance information to maximize ransom payouts, contributing to roughly $75.3 million in extorted payments, and now faces sentencing; authorities seized assets and cryptocurrency tied to his crimes. #AngeloMartino #BlackCat #ALPHV #DigitalMint

France’s National Agency for Secure Documents (ANTS) disclosed a security incident detected on April 15, 2026, that may have exposed personal and account data from the ants.gouv.fr portal. A threat actor using the moniker ‘breach3d’ claims to be selling up to 19 million records as ANTS notifies affected users and involves CNIL, ANSSI, and the Paris Public Prosecutor. #ANTS #breach3d

Research shows affiliates of The Gentlemen ransomware‑as‑a‑service deployed the SystemBC proxy, with its C2 linked to a botnet of over 1,570 compromised corporate networks worldwide. The operation demonstrates rapid growth and versatile tooling—targeting Windows, Linux, NAS, and ESXi—while using tactics like GPO abuse and Defender disabling to enable fast, domain‑wide encryption…

Oracle released VirtualBox 7.2.8 on April 21, 2026, as a maintenance update addressing crashes, networking and clipboard issues, graphics and UEFI problems, and extended Linux kernel compatibility. Fixes include a VMM Guru Meditation error VERR_IEM_IPE_4, a FreeBSD shutdown crash, Windows 11 BSOD and UEFI secure boot certificate issues, Wayland-to-Windows clipboard repairs, and deprecation of the Oracle vboxvideo module for kernels 7.0+; #VirtualBox #VERR_IEM_IPE_4

Thunderbird 150.0 is released with eight new features, multiple bug fixes, and security patches addressing the email client’s underlying web engine, and it supports Windows 10 or later, macOS 10.15 or later, and Linux with GTK+ 3.14 or higher. Notable additions include searchable OpenPGP and S/MIME encrypted message bodies, OpenPGP Unobtrusive Signatures, a PDF viewer with page reorganization, and several accessibility and Exchange-related fixes. #Thunderbird #OpenPGP

The UK regulator Ofcom has opened investigations into Telegram and two teen chat sites after evidence suggested the platforms may have facilitated the sharing of child sexual abuse material and enabled grooming. Ofcom is probing potential breaches of the Online Safety Act and could impose measures or fines if violations are found; Telegram denies the allegations and the chat sites say they have safety measures in place. #Telegram #Ofcom

Lawmakers debated tougher penalties for ransomware attacks on hospitals, including treating such attacks as terrorism or pursuing homicide charges when deaths occur. The proposals, raised at a House Homeland Security hearing by former FBI cyber official Cynthia Kaiser, come as healthcare sector attacks doubled from 238 in 2024 to 460 in 2025. #Hospitals #FBI

Tyler Robert Buchanan, a core leader of the Scattered Spider subset of The Com, pleaded guilty to conspiracy to commit wire fraud and aggravated identity theft for orchestrating phishing and SIM‑swap attacks that stole more than $8 million in cryptocurrency and harvested thousands of credentials. Arrested in Spain in 2024 and in federal custody since April 2025, Buchanan faces up to 22 years in prison and his plea highlights international law enforcement cooperation against Com-linked criminal networks. #ScatteredSpider #TylerBuchanan

CISA has ordered federal agencies to secure Catalyst SD-WAN Manager systems within four days after adding an information-disclosure flaw (CVE-2026-20133) to its Known Exploited Vulnerabilities catalog. Cisco patched the issue in February, warning that unauthenticated attackers could read sensitive operating system data, although Cisco says it is not aware of public exploitation reports. #CatalystSDWANManager #CVE-2026-20133

Lotus is a previously undocumented data-wiping malware used last year in targeted attacks against Venezuelan energy and utilities organizations, and it was analyzed by Kaspersky after being uploaded from a machine in Venezuela. Attackers used preparatory batch scripts to disable defenses, wipe drives with tools like diskpart/robocopy/fsutil, and then deploy the Lotus wiper to overwrite physical sectors, delete recovery mechanisms, and render systems unrecoverable. #Lotus #PDVSA