Category: Cyber Security News

Microsoft is rolling out preview builds to Beta and Dev Windows Insider channels to fix a bug that causes bright white flashes when opening File Explorer on some Windows 11 systems. The fixes (including KB5079382 and KB5079385) follow the earlier KB5070311-linked report and add features like voice typing while Microsoft continues to provide PowerShell workarounds for crashes affecting Explorer.exe and StartMenuExperienceHost. #Windows11 #FileExplorer

A critical unauthenticated vulnerability in Nginx UI (CVE-2026-27944, CVSS 9.8) allows attackers to download full server backups and exposes sensitive configuration data, credentials, and encryption keys. The /api/backup endpoint returns the AES-256 encryption key and IV in the X-Backup-Security response header, enabling immediate decryption of backups and full compromise of the…

Threat actors are abusing the special-use .arpa TLD—especially ip6.arpa reverse DNS—by reserving IPv6 address space and creating nonstandard DNS records that point reverse-hostnames to phishing infrastructure. By leveraging reputable providers like Cloudflare and Hurricane Electric, using short-lived randomized ip6.arpa hostnames and TDS redirects, attackers can bypass domain reputation checks and email security filters, researchers at Infoblox warn. #Infoblox #Cloudflare

Advocate General Athanasios Rantos has advised that under PSD2 banks must immediately refund customers for unauthorised transactions even when the customer’s negligence contributed to the loss. Banks may later seek recovery from the customer only if they can prove intentional conduct or gross negligence, and any suspicion of customer fraud must be communicated in writing to the competent national authority. #PKOBP #PSD2

Microsoft reports threat actors increasingly leverage generative AI across the attack lifecycle to accelerate reconnaissance, phishing, infrastructure provisioning, malware development, and post-compromise activities. Notable groups such as Jasper Sleet and Coral Sleet use AI to create realistic fake identities, automate deployments, and bypass safeguards, prompting advice to harden identity systems and monitor abnormal credential use. #JasperSleet #CoralSleet

Researchers at MalBeacon observed Velvet Tempest use a ClickFix malvertising lure and legitimate Windows utilities to stage DonutLoader and retrieve the CastleRAT backdoor during a 12‑day emulated intrusion. After initial access via a ClickFix/CAPTCHA trick that prompted victims to paste an obfuscated Run command, operators used nested cmd.exe chains, finger.exe, PowerShell, csc.exe compilation, and Python persistence to harvest credentials and deploy loaders. #VelvetTempest #CastleRAT

Microsoft will roll out granular file- and folder-level restore for Microsoft 365 Backup, letting admins browse and search restore points to recover individual files from SharePoint and OneDrive instead of performing full site or drive restores. The feature is admin-only (requires the SharePoint Backup Administrator role), entered public preview in March 2026 and is expected to reach general availability between late April and early May 2026; admins should review coverage and update recovery runbooks. #Microsoft365Backup #SharePoint

Threat actors are using InstallFix, a ClickFix variant, to trick users into running malicious install commands from cloned CLI pages and promoted search ads, delivering the Amatera information stealer. The attacks exploit curl-to-bash habits, legitimate hosting platforms, and sponsored search results to remain evasive, so users should rely on official download sources and avoid promoted search results. #Amatera #ClaudeCode

CISA ordered federal agencies to patch three iOS vulnerabilities exploited by the Coruna exploit kit, which Google researchers say uses multiple exploit chains (including zero-days) to achieve remote code execution and kernel privilege escalation. GTIG observed Coruna deployed by multiple actors — including UNC6353 and financially motivated UNC6691 — to conduct surveillance and steal cryptocurrency, and CISA added three flaws to its Known Exploited Vulnerabilities list urging immediate mitigation. #Coruna #UNC6691

TriZetto Provider Solutions disclosed a data breach that exposed sensitive information for 3,433,965 individuals after unauthorized access to an insurance eligibility verification web portal that began on November 19, 2024. The company detected suspicious activity on October 2, 2025, notified providers on December 9, 2025 and customers in early February 2026, offered 12 months of Kroll identity protection, and says no financial data or confirmed misuse has been found. #TriZetto #Cognizant

A self-propagating JavaScript worm briefly infected Wikimedia’s Meta-Wiki, injecting malicious loaders into user common.js files and the global MediaWiki:Common.js and modifying thousands of pages. Wikimedia engineers temporarily disabled editing, removed the injected code, and say the script was active for 23 minutes with no evidence of a data breach while they…

A Pakistan-based hacking group, APT36, is flooding Indian government networks with a new wave of low-quality, AI-generated malware—what Bitdefender calls “Vibeware”—to overwhelm defenders by sheer volume. The campaign uses niche languages like Nim, Zig, and Crystal, leverages Google Sheets and Discord for C2, and deploys intrusive tools such as LuminousCookies and…