Category: Cyber Security News

Astrana Health disclosed that private and confidential information was stolen from its servers after employees were targeted in a social engineering attack. The company said attackers impersonated personnel, spoofed its main phone number, and accessed or exfiltrated sensitive data while it worked to contain the incident and investigate the impact. #AstranaHealth…

SolarWinds has patched two severe vulnerabilities in Observability Self-Hosted, including CVE-2026-28324 and CVE-2026-28325, both of which could allow remote code execution by unauthenticated attackers. The company also recently fixed a separate unauthenticated RCE issue in Access Rights Manager, and there is no evidence that any of the flaws have been exploited…

AI adoption in cybersecurity is moving beyond dashboards and chatbots toward agentic remediation that can close the loop on exposure management. The article argues for “Shift Zero,” where automated, bounded agents help eliminate vulnerability backlogs by fixing known issues at the source. #CTEM #ShiftZero #agenticremediation…

Attackers disrupted water systems in at least seven U.S. states by remotely accessing internet-facing programmable logic controllers, prompting federal investigators to examine possible links to Iran-backed hackers. Honeywell’s survey shows many critical infrastructure organizations still lack full visibility into building automation systems and IoT devices, which can slow recovery from outages and incidents. #FBI #EPA #HoneywellTechnologies

AI agents create exposure by widening access to enterprise data paths, especially when they can rapidly retrieve and combine sensitive information from systems like ticketing platforms, CRM tools, shared drives, and chat history. Kelly Herrell of Nol8 recommends enforcing deterministic policy in the data path so organizations can control what data enters, leaves, and is disclosed by agents. #Nol8 #AIDataPlane #Salesforce #Jira

CISA has released a white paper describing its plan to move the CVE program into a “Quality Era,” focusing on better governance, broader participation, stronger infrastructure, and more reliable vulnerability records. The proposal comes as CVE volume continues to surge, with experts welcoming the emphasis on quality while questioning whether the document goes far enough to solve persistent data issues. #CISA #CVE #NIST #NationalVulnerabilityDatabase #Sonatype #OWASP #VulnCheck

The third-party.com domain, long used as a placeholder in developer documentation, is now serving a fake Cloudflare verification page that tricks Windows users into running malicious PowerShell commands. The ClickFix attack targets only Windows systems and may have been copied into code or docs across many repositories, creating risk if those references are ever opened or executed. #third-party.com #Cloudflare #ClickFix #PowerShell #Windows

Karen Vardanyan, an Armenian national and alleged core member of the Ryuk ransomware gang, was sentenced in U.S. federal court to two years in prison after pleading guilty to computer fraud and conspiracy. Prosecutors said Ryuk carried out more than 2,400 attacks worldwide and extorted at least $15 million, with victims…

U.S. intelligence officials found no evidence that any foreign adversary successfully interfered in the 2024 presidential election, though Russia, Iran, and China each ran influence campaigns to varying degrees. The assessment also highlights growing concerns about AI-enabled election influence efforts and ongoing monitoring ahead of upcoming midterms. #Russia #Iran #China #ODNI…

Ofcom has opened an investigation into Aylo, the parent company of Pornhub, over whether its age-verification controls comply with the UK Online Safety Act and effectively block minors from viewing adult content. The probe centers on Aylo’s use of Apple-based age assurance signals, with Ofcom warning that weak testing or due…

CERT Polska says two MikroTik RouterOS SSH flaws, CVE-2026-67279 and CVE-2026-86060, can be chained to give attackers full administrative control of Internet-exposed routers without a password or completed authentication. Evidence of exploitation appeared before patches were released, with logs showing the suspicious SSH username -2 and post-exploitation activity tied to accounts…

Researchers uncovered Go-based malware distributed through two Go Modules and two Terraform providers, marking the first known abuse of HashiCorp’s centralized repository as a malware delivery channel. The activity overlaps with Graphalgo and other North Korea-linked campaigns that use fake job offers, npm, PyPI, Slack, and blockchain-based command channels to target…

IonQ says it has built a real-time quantum error-correction decoder that runs on a single standard CPU, aiming to reduce classical computing overhead in larger quantum systems. In simulations of up to 408 logical qubits, the decoder reportedly added as little as 0.02% processing time under standard noise conditions. #IonQ #QuantumErrorCorrection…

Check Point has confirmed active exploitation of CVE-2026-85102 and CVE-2026-93616, with attackers using VPNs and proxies to hide their origin while targeting Security Gateway and Management web service flaws. CISA has added both vulnerabilities to its KEV catalog, and Check Point has issued patching and mitigation guidance for affected customers. #CVE-2026-85102 #CVE-2026-93616 #CheckPoint #NCSC #CISA