Category: Cyber Security News

A supply chain attack inserted a malicious dependency, plain-crypto-js, into axios npm releases (1.14.1 and 0.30.4) on March 31, using a postinstall hook that executed an obfuscated dropper (tracked as SILKBELL) to deploy platform-specific payloads. Multiple threat intelligence firms (GTIG, Mandiant, ThreatBook) attributed the campaign to North Korea’s Lazarus Group/UNC1069, which…

Microsoft issued an out-of-band Windows 11 update (KB5086672) to replace the pulled March 2026 optional preview (KB5079391) after users encountered 0x80073712 installation errors. The emergency patch supersedes previous updates and restores protections while Microsoft continues to address related post‑Patch Tuesday issues. #KB5079391 #KB5086672

Vulnerabilities in the Vim and GNU Emacs text editors can allow remote code execution simply by opening a specially crafted file, and a researcher used the Claude assistant to generate multiple proof-of-concept exploits and mitigation suggestions. Vim was patched in version 9.2.0272 while the Emacs issue remains unpatched due to maintainers attributing the root cause to Git’s behavior; users should avoid opening files from untrusted sources. #Vim #GNUEmacs

An arbitrary file-write vulnerability in the GIGABYTE Control Center’s pairing feature allows unauthenticated remote attackers to write files to any location on affected systems, potentially leading to code execution, privilege escalation, or denial-of-service. GIGABYTE has released version 25.12.10.01 to address the issue tracked as CVE-2026-4415 and urges users to update from earlier versions while downloading patches only from the vendor’s official portal to avoid trojanized installers. #GIGABYTE_Control_Center #CVE-2026-4415

Proton launched Meet, a privacy-first video conferencing service offering end-to-end encrypted calls as a free option for one-hour meetings with up to 50 participants and a Pro plan starting at $7.99/month. Built on WebRTC with Selective Forwarding Units and using the open-source Messaging Layer Security (MLS) and Secure Remote Password (SRP) for authentication, Meet keeps media and chat encrypted client-side, exposes only meeting IDs on servers, and offers mitigations if meeting links are compromised. #ProtonMeet #MessagingLayerSecurity

Researchers at Palo Alto Networks Unit 42 disclosed a permission-model flaw in Google Cloud’s Vertex AI that could let attackers weaponize AI agents to exfiltrate sensitive data and compromise cloud environments. By abusing the Per-Project, Per-Product Service Agent (P4SA) and Agent Engine deployment behavior, attackers can retrieve service-agent credentials via the…

A high-severity flaw (CVE-2026-3502) in TrueConf’s Windows client updater was exploited in the wild to distribute tampered updates and execute arbitrary code across connected endpoints. The TrueChaos campaign, linked to a Chinese-nexus threat actor, weaponized the bug to deploy DLL side-loading implants and likely the Havoc C2 framework against government targets…

Google is rolling out Android developer verification to all developers to stop anonymous bad actors from distributing harmful apps, requiring those who sideload apps to confirm identity via the Android Developer Console. The mandate starts in Brazil, Indonesia, Singapore, and Thailand this September before expanding globally next year, and Apple has…

Jonathan Spalletta was indicted for allegedly stealing more than $54 million from the decentralized finance platform Uranium Finance through two smart-contract exploits in April 2021. He faces charges of computer fraud and money laundering, and investigators traced and seized millions in stolen funds using tools like TRM Labs and Tornado Cash….

Threat actors used stolen credentials from the Trivy supply chain compromise to breach Cisco’s internal development environment and exfiltrate source code from more than 300 GitHub repositories, including AI product code and some customer repositories. Cisco has isolated affected systems, begun reimaging and wide-scale credential rotation, and expects continued fallout linked to follow-on LiteLLM and Checkmarx supply chain attacks. #Cisco #Trivy

A pro-Russian hacker group impersonated Ukraine’s CERT-UA in a phishing campaign that urged organizations to download a password-protected archive from Files.fm containing supposed security software. The archive installed a remote administration tool called AgeWheeze that enables full remote control, and attackers claiming to be CyberSerp later boasted of large-scale targeting though…

A newly proposed dark-web service called Leak Bazaar promises to turn vast, messy datasets stolen in ransomware attacks into structured, searchable intelligence that can be sold or used for extortion. Security researchers warn this could increase leverage for payments, enable follow-on crimes like fraud and business email compromise, and make targeted…

Stolen credentials, harvested by infostealers and sold on the black market, have become the single point of identity abuse enabling ransomware, supply-chain compromises, and AI-assisted attacks. Organizations must shift from trying only to prevent credential theft to deploying adaptive identity controls that detect and block misuse in real time. #LummaC2 #ShaiHulud…

Data integrity is shifting from simply keeping data safe to ensuring data can be trusted for operational and AI-driven decision-making. Organizations must address data distortion, governance gaps, and the need for clear ownership and controls to preserve accuracy and reliability. #AI #DataGovernance…

Censys announced $70 million in strategic funding—$40 million Series D led by Morgan Stanley Expansion Capital plus $30 million in debt—bringing total venture funding to over $149 million. The investment will accelerate product innovation and global expansion of its internet intelligence platform focused on attack surface management, threat hunting, and AI-driven…