Category: Cyber Security News

OpenAI is expanding its Trusted Access for Cyber (TAC) program and launching GPT 5.4 Cyber to provide vetted defenders with advanced AI tools for defensive cybersecurity workflows. The move uses identity-verified access tiers and phased rollouts to scale defensive capabilities while managing dual-use risks. #OpenAI #GPT5.4Cyber…

Two newly disclosed vulnerabilities in Ivanti Neurons for IT Service Management (CVE-2026-4913 and CVE-2026-4914) could allow authenticated attackers to persist in user sessions or inject stored XSS payloads to expose session data. Ivanti has applied cloud fixes on December 12, 2025 and released a patched version 2025.4 for all customers, with…

Microsoft has fixed a year-long issue that caused systems running Windows Server 2019 and 2022 to unexpectedly upgrade to Windows Server 2025. The company has re-enabled the in-place upgrade offer in the Windows Update settings after attributing the problem to third-party update management misconfiguration and a procedural error on Microsoft’s side. #WindowsServer2025 #Microsoft

Microsoft confirmed that installing the April 2026 KB5082063 security update can force some Windows Server 2025 devices into BitLocker recovery on first restart when an unrecommended BitLocker Group Policy configuration is present. The issue is limited to specific PCR7-based TPM and Secure Boot configurations on enterprise-managed systems, and Microsoft advises removing the Group Policy or applying a Known Issue Rollback until a permanent fix is released. #BitLocker #KB5082063

Kraken says a criminal group is trying to extort the exchange by threatening to release videos showing internal client-support systems after recruiting support employees to access limited customer data. The company reports no systems were breached and no funds were at risk, has revoked access, notified affected users (about 2,000 accounts), will not pay or negotiate, and is working with law enforcement. #Kraken #Coinbase

Microsoft has added new Windows protections that warn users and disable risky shared resources by default when opening Remote Desktop (.rdp) connection files to thwart phishing attacks. A one-time educational prompt and a subsequent security dialog reveal publisher verification, remote addresses, and list disabled local redirections to help prevent credential and data theft previously abused by groups like APT29. #APT29 #RDP

Microsoft’s April 2026 Patch Tuesday fixes 167 vulnerabilities, including two zero-days (an actively exploited SharePoint spoofing flaw CVE-2026-32201 and a publicly disclosed Microsoft Defender elevation flaw CVE-2026-33825), plus eight Critical issues. Users should prioritize updating Microsoft Office and Defender immediately due to multiple Office RCEs exploitable via the preview pane or malicious documents. #MicrosoftSharePoint #MicrosoftDefender

Microsoft released Windows 11 cumulative updates KB5083769 and KB5082052 for versions 25H2/24H2 and 23H2 to address security vulnerabilities, fix bugs, and add several new features. The mandatory April 2026 Patch Tuesday updates update build numbers, enable toggleable Smart App Control, improve Narrator and File Explorer, and correct sfc /scannow error reporting. #KB5083769 #KB5082052

More than 100 malicious Chrome extensions form a coordinated campaign that steals Google OAuth2 bearer tokens, harvests account data, deploys backdoors, and conducts ad fraud. Researchers traced the command-and-control infrastructure to a Contabo VPS and linked the operation to a suspected Russian MaaS; users should check and remove any matching extension IDs. #GoogleOAuth2 #TelegramWeb #Contabo #ChromeWebStore #Socket

Two high-severity command-injection vulnerabilities in Composer’s Perforce VCS driver (CVE-2026-40176 and CVE-2026-40261) could allow attackers to execute arbitrary commands via malicious composer.json entries or crafted source references. Affected versions (>=2.3,=2.0,…

Virginia’s governor signed a law banning the sale of citizens’ precise geolocation data, creating a 1,750-foot buffer that prevents brokers from pinpointing where people live, work, worship, shop, or travel; the amendment to the state’s comprehensive privacy law passed unanimously and takes effect July 1. The move builds on similar laws…

Adobe’s latest Patch Tuesday fixes 55 vulnerabilities across 11 products, including critical code-execution bugs in Acrobat Reader, ColdFusion, and multiple Creative Cloud apps. ColdFusion receives a priority-1 advisory for five critical flaws that have been exploited in the past, while Adobe reports no known in-the-wild exploitation for the newly patched issues;…

Microsoft’s April 2026 Patch Tuesday fixes 165 vulnerabilities, including a SharePoint Server zero-day tracked as CVE-2026-32201 that has been exploited in the wild. CVE-2026-32201 is an ‘important’ spoofing flaw (CVSS 6.5) added to CISA’s KEV with a federal patch deadline of April 28, and 19 other bugs were flagged as “exploitation…