Category: Cyber Security News

The White House says it will not authorize “letters of marque” or allow private companies to carry out offensive cyberattacks, even as the administration pursues a more routine use of government offensive cyber capabilities. Officials seek closer technical cooperation with industry to identify and scale responses to threats, but stress that…

Aura disclosed a data breach after a phone phishing attack gave attackers access to an employee’s account for about an hour. The intruders accessed roughly 900,000 records—mainly names and email addresses from a marketing tool tied to an acquired company—and Aura says no Social Security numbers, passwords, or financial information were…

Marquis, a Texas-based provider for credit unions and banks, disclosed that a breach discovered in August 2025 exposed personal and financial records of roughly 672,000 individuals. The company says attackers exploited a SonicWall firewall flaw amid reports of a possible ransom payment and ties to the Akira group, while earlier estimates…

Augur Security’s analysis shows a significant buildup of Iran-linked MOIS and IRGC cyber infrastructure in the six months before the February 28, 2026 US/Israeli strikes, enabling rapid post-strike operations against the US, Israel, and Gulf states. A coordinated surge of roughly 60 hacktivist groups and established APTs—using multi-tier hosting and shell-company…

CISA warns that a critical Microsoft SharePoint vulnerability patched in January, tracked as CVE-2026-20963, is being exploited in attacks against unpatched servers including SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Federal agencies were ordered to remediate by March 21, and CISA urged all defenders to apply mitigations or patches while also flagging a separate Zimbra stored XSS flaw as actively exploited. #CVE-2026-20963 #SharePoint #CISA #Zimbra

Perseus is a new Android malware distributed via unofficial IPTV apps that steals sensitive information by scanning user-curated notes and can fully take over infected devices. Researchers say the campaign leverages sideloading lures like Roja Directa TV, abuses Accessibility Services for remote control and overlays, and primarily targets financial and crypto services in Turkey and Italy. #Perseus #RojaDirectaTV

CISA warned U.S. organizations to harden Microsoft Intune after a March 11 attack exploited the platform to steal data and remotely wipe nearly 80,000 Stryker devices. Microsoft published hardening guidance and CISA urged least-privilege RBAC, Entra ID controls, enforced MFA, and multi-admin approval to prevent similar attacks claimed by the Handala group. #Stryker #MicrosoftIntune #Handala #MicrosoftEntraID

Ubiquiti patched two vulnerabilities in the UniFi Network Application, including a maximum-severity path traversal flaw (CVE-2026-22557) that can enable account takeover. The flaws affect UniFi Network 10.1.85 and earlier and were fixed in 10.1.89 or later, amid a history of Ubiquiti devices being abused by state-backed actors and criminal botnets. #CVE-2026-22557 #Ubiquiti

A critical Microsoft SharePoint vulnerability (CVE-2026-20963) disclosed in January has been observed exploited in the wild and was added to CISA’s Known Exploited Vulnerabilities catalog. The deserialization-based remote code execution flaw affects SharePoint Server 2016, 2019, and Subscription Edition and was rated CVSS 9.8 with federal remediation required. #CVE-2026-20963 #SharePointServer…

Raven, a Palo Alto-based startup founded by Israeli cyber intelligence veterans, has emerged from stealth with $20 million in combined seed and post-seed funding to expand its runtime protection for cloud-native applications. Its platform analyzes code behavior at runtime to detect and block anomalous activity and AI agents in production, offering…

The U.S. Intelligence Community’s 2026 Annual Threat Assessment names China, Russia, Iran, and North Korea as the primary nation-state cyber threats to U.S. government, private-sector, and critical infrastructure networks, singling out China as the most active and persistent. The report warns of China’s pre-positioned access for strategic disruption, Russia’s deniable gray‑zone…

Apple released background security updates to address a critical cross-origin Navigation API flaw in WebKit (CVE-2026-20643) that could allow malicious web content to bypass the Same Origin Policy on iOS, iPadOS, and macOS. The issue was fixed via improved input validation and distributed as Background Security Improvements, requiring organizations to monitor…

Amazon’s threat intelligence teams uncovered an Interlock ransomware campaign exploiting a zero-day flaw in Cisco Secure Firewall Management Center (FMC), tracked as CVE-2026-20131. MadPot honeypots recorded exploitation beginning January 26, 2026—36 days before Cisco’s disclosure—and revealed the attackers’ multi-stage toolkit, post-exploitation RATs, memory-resident webshells, and organized data-exfiltration infrastructure while confirming no…

DarkSword is a JavaScript-only iOS full-chain exploit kit that can compromise an iPhone via a single page load on compromised Ukrainian websites, break out of the WebKit sandbox, escalate to kernel read-write access, and exfiltrate messages, photos, passwords, Telegram history, iCloud files, and cryptocurrency keys before erasing traces within minutes. GTIG,…

A critical out-of-bounds write in the LINEMODE Set Local Characters (SLC) handler of the GNU InetUtils telnet daemon (telnetd) — tracked as CVE-2026-32746 with a CVSS score of 9.8 — can be exploited by an unauthenticated remote attacker to achieve root code execution during the initial Telnet handshake. Dream disclosed the…