Category: Cyber Security News

About 50 former national security officials urged Congress to approve a “clean” 18‑month renewal of FISA Section 702 before its April 20 expiration, warning against delays that could hamper intelligence capabilities. The letter, signed by former NSA leaders and ex-DNI James Clapper and ex-FBI Director Christopher Wray, cautioned against tying the…

Iran-affiliated hackers have been attacking internet-facing operational technology devices—particularly Rockwell/Allen-Bradley PLCs and potentially Siemens equipment—causing operational disruptions and financial losses across multiple U.S. critical infrastructure sectors. U.S. agencies link the activity to IRGC-associated APTs that have exploited CVE-2021-22681 and urge removing OT devices from direct internet exposure and checking logs for…

Trent AI emerged from stealth with $13 million in seed funding to deliver a layered security platform that protects AI agents and autonomous workflows throughout their lifecycle. The London-based startup, founded by former AWS engineering leaders and backed by LocalGlobe and Cambridge Innovation Capital, uses collaborating agents to continuously scan, assess,…

AI-enabled cyberwarfare is no longer hypothetical: nation-state actors have deployed autonomous agents that can execute large-scale attacks with minimal human intervention, as documented by Anthropic. Defenders must adopt collective, agentic defenses—like federated learning-based “hive mind” architectures and real-time behavioral analytics—to close the machine-speed gap exposed by incidents involving GTG-1002 and Claude…

Anthropic has unveiled Claude Mythos Preview, a step‑change frontier model with powerful agentic coding abilities that has autonomously discovered thousands of zero‑day vulnerabilities, including decades‑old bugs in OpenBSD and chained Linux kernel flaws. To counter the risk of rapid misuse, Anthropic launched Project Glasswing with major industry partners to scan and…

Automated penetration testing often produces strong initial results but quickly hits a “PoC Cliff,” exhausting its fixed scope and leaving many defenses untested. Breach and Attack Simulation (BAS) complements automated pentesting by running thousands of independent, atomic simulations to validate detection, prevention, identity, cloud, and AI controls and close the Validation Gap. #PicusSecurity #Kerberoasting

A maximum-severity vulnerability, CVE-2025-59528, in Flowise’s CustomMCP node allows unvalidated JavaScript injection that can lead to arbitrary command execution and filesystem access. VulnCheck’s Canary network has observed exploitation activity originating from a Starlink IP, and users are urged to upgrade to Flowise 3.1.1 (or at least 3.0.6) and remove instances from the public internet if not needed. #CVE-2025-59528 #Flowise #VulnCheck #Starlink

Iranian-linked hackers are targeting internet-exposed Rockwell/Allen-Bradley programmable logic controllers (PLCs) on U.S. critical infrastructure networks, causing financial losses and operational disruptions since March 2026. A joint advisory from the FBI, CISA, NSA, EPA, DOE, and U.S. Cyber Command warns that attackers have extracted PLC project files and manipulated HMI/SCADA displays and recommends disconnecting PLCs from the Internet and implementing robust OT protections. #CyberAv3ngers #Handala

A breach at a SaaS integration provider exposed authentication tokens that were used in data theft attacks against more than a dozen companies. Most attacks targeted Snowflake customer accounts while the ShinyHunters extortion group claims responsibility and is demanding ransoms after allegedly exploiting an Anodot incident. #Snowflake #ShinyHunters

An international law enforcement operation with private partners disrupted FrostArmada, an APT28 campaign that hijacked MikroTik and TP‑Link SOHO routers to redirect DNS traffic and steal Microsoft account credentials and OAuth tokens. Microsoft and Lumen’s Black Lotus Labs mapped the activity and, with the FBI, the U.S. Department of Justice, and Polish authorities, took the malicious infrastructure offline. #FrostArmada #APT28

The Trump administration is proposing a $707 million cut to CISA’s FY2027 budget to refocus the agency on protecting federal networks and critical infrastructure. The plan would eliminate programs deemed redundant—including school safety, international affairs, stakeholder engagement, and misinformation efforts—and reduce CISA’s budget to roughly $2 billion amid recent staff departures…

Daniil Maksimovich Shchukin has been identified by the German Federal Criminal Police (BKA) as the alleged mastermind behind the GandCrab and REvil ransomware operations, which ran from early 2019 to mid-2021. The BKA says Shchukin led roughly 130 extortion attempts that caused over $40 million in damages and included at least…

Microsoft warns that the Medusa ransomware group (tracked as Storm-1175) operates as a fast-moving RaaS actor that quickly weaponizes newly disclosed and zero-day vulnerabilities to execute double-extortion attacks across healthcare, education, professional services, and finance in Australia, the UK, and the US. The group moves from initial access to data exfiltration…

Two actively exploited vulnerabilities in Fortinet’s FortiClientEMS allow unauthenticated remote code execution: a critical SQL Injection (CVE-2026-21643) and an improper access control/API bypass (CVE-2026-35616). Fortinet has issued hotfixes and upgrades (upgrade 7.4.4→7.4.5+ for the SQLi; apply the hotfix and move to 7.4.7+ for the access control issue) while CISA and Singapore’s…