Category: Cyber Security News

Mythos represents a meaningful advance in AI-assisted vulnerability discovery, showing unprecedented depth in finding software bugs while not making enterprise compromise cheap, easy, or automatic. Defenders must prioritize building AI-enabled systems for investigation, prioritization, and safe automation so humans can supervise and scale response as models become more capable. #Mythos #OpenBSD

Angelo Martino, a former DigitalMint incident response negotiator, pleaded guilty to helping BlackCat (ALPHV) operators target and extort U.S. companies by sharing victims’ negotiation positions and insurance limits. The scheme involved two other former negotiators and led to multimillion-dollar ransom payments by victims, prompting DigitalMint to fire the employees and prosecutors to tie the activity to the broader BlackCat operation. #BlackCat #ALPHV #AngeloMartino #DigitalMint

Shadowserver found more than 6,400 Apache ActiveMQ servers exposed online that are vulnerable to ongoing attacks exploiting a high-severity code-injection flaw tracked as CVE-2026-34197. Discovered by Horizon3 researcher Naveen Sunkavally using the Claude AI assistant after 13 years, the improper input validation bug allows authenticated attackers to execute arbitrary code and was patched in ActiveMQ Classic 6.2.3 and 5.19.4 on March 30; #ApacheActiveMQ #CVE-2026-34197

The job listing compiles a broad range of cybersecurity roles across application security, cloud architecture, DevSecOps, SOC operations, and offensive testing at organizations worldwide. Positions emphasize integrating automated security controls into CI/CD and cloud environments, threat modeling and AI red-teaming, identity and access management, and incident detection and response. #AzureDevOps #AWS

Secure multi-party computation (MPC) lets organizations run AI models without exposing raw inputs by splitting data into encrypted fragments and distributing computation across non-colluding servers. SecureRouter adds input-adaptive encrypted routing to select a suitably sized model from a pool, cutting average encrypted inference time substantially compared to a fixed large-model approach while keeping accuracy close to the large-model baseline. #SecureRouter #SecFormer

Tal Be’ery showed that WhatsApp leaks metadata that lets an attacker silently learn when someone is online and which devices they use by exploiting WhatsApp Web and per-device encryption fingerprints. Because any user can contact another by phone number and WhatsApp exposes device keys when a chat is initiated, attackers — from scammers to nation-state APTs — can perform silent pings and device fingerprinting without needing zero-day exploits. #WhatsApp #TalBeery

Researchers uncovered 20 new vulnerabilities in popular serial-to-IP converters and found that their firmware stacks contain thousands of known defects, leaving industrial networks widely exposed. Forescout will present these findings at Black Hat Asia 2026, highlighting critical RCE flaws in Lantronix and Silex models (including CVE-2025-70082) and demonstrating how attackers can manipulate physical sensors and devices. #Lantronix #CVE-2025-70082

Threat actors compromised AI tool vendor Context.ai and used stolen OAuth tokens to breach software security vendor Vercel, accessing some environments and environment variables that were not marked as sensitive. The incident underscores OAuth tokens and unsanctioned “shadow AI” tools as a growing attack surface and prompted Vercel to work with Mandiant while urging credential rotation and stronger OAuth governance. #Vercel #ContextAI

The Italian Data Protection Authority fined Poste Italiane €6.6 million and Postepay €5.8 million—over €12.5 million in total—after finding unlawful processing of millions of users’ personal data via intrusive app monitoring. Regulators found disproportionate device-data collection, insufficient transparency and governance, and ordered the firms to stop the practices and align retention…

Bluesky suffered a sophisticated distributed denial-of-service (DDoS) attack beginning late on April 15, 2026, which disrupted feeds, notifications, threads, and search across the platform. Engineers mitigated the incident and reported the application stabilized by the evening of April 16 with no evidence of unauthorized access, while a group claiming responsibility identified…

France’s ANTS portal suffered a data breach detected on April 15, 2026, potentially exposing personal details from individual and professional accounts. Authorities say the leak did not include uploaded administrative documents or allow direct account access but increases phishing and identity misuse risks amid related incidents like EduConnect and FICOBA. #ANTS…

AI demos often impress because they use clean data, crafted prompts, and controlled scenarios, but that performance frequently fails to hold up in messy, latency-sensitive, integrated production environments. Successful teams test with real workflows and data, measure accuracy, latency, and costs under load, prioritize deep integration, and establish governance early to…

Monday’s recap shows attackers increasingly weaponizing trusted paths—third-party tools, update channels, and browser extensions—to gain stealthy, multi-stage access and run code largely in memory. High-profile incidents include the Vercel breach tied to Context.ai and campaigns delivering PHANTOMPULSE, STX RAT, Lumma Stealer, and widespread malicious Chrome extensions. #Vercel #PHANTOMPULSE…

A critical command-injection vulnerability (CVE-2026-5760, CVSS 9.8) in SGLang’s /v1/rerank endpoint can be exploited via a malicious GGUF model containing a Jinja2 SSTI payload to achieve remote code execution. CERT/CC and the discovering researcher recommend rendering templates with ImmutableSandboxedEnvironment instead of jinja2.Environment() to mitigate the issue, and no patch response was…