Apple released security updates to patch a zero-day arbitrary code execution vulnerability in dyld tracked as CVE-2026-20700 that was exploited in an “extremely sophisticated” targeted attack against specific individuals. The flaw, discovered by Google’s Threat Analysis Group, affects iPhone, iPad, Mac, tvOS, watchOS, and visionOS devices and was fixed in iOS…
Category: Cyber Security News
CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog—CVE-2024-43468, CVE-2025-15556, CVE-2025-40536, and CVE-2026-20700—based on evidence of active exploitation. FCEB agencies must remediate KEV-listed CVEs under BOD 22-01, and CISA urges all organizations to prioritize timely remediation to reduce exposure. #MicrosoftConfigurationManager #SolarWindsWebHelpDesk…
Conpet S.A. confirmed that the Qilin ransomware gang breached its corporate IT infrastructure and exfiltrated company data while operations remained unaffected. The company is investigating the incident with the Romanian National Cyber Security Directorate (DNSC), warns that leaked files include recent confidential and personal financial documents, and advises individuals to verify…
Dutch telecom provider Odido says a cyberattack on its customer contact system exposed the personal data of about 6.2 million customers. Odido has blocked the unauthorized access, reported the incident to the Autoriteit Persoonsgegevens, and is notifying affected customers while working with external experts to investigate and strengthen security measures. #Odido…
Accenture Cybersecurity revealed that the extortion group World Leaks has deployed a novel Rust-based malware called RustyRocket that provides stealthy persistence, encrypted multi-layer exfiltration tunnels, and proxying across Windows and Linux environments. The tool’s pre-encrypted runtime configuration and heavy obfuscation make detection difficult, and Accenture recommends monitoring anomalous outbound transfers and…
This week’s SecurityWeek roundup highlights notable developments—threat actors are increasingly using AI across attack stages while CISA, EPA and researchers flag persistent vulnerabilities in OT, water systems, and aviation supply chains. It also covers legal and policy actions, including a DoD employee indictment, Disney’s $2.75M CCPA fine, Trend Micro’s new attribution…
Researchers discovered more than 300 Chrome extensions that leak browsing data, spy on users, or steal information, impacting over 37.4 million users. Investigations by Q Continuum and LayerX link many extensions to coordinated operations, data brokers, and known spyware distributors, with some extensions specifically targeting Gmail and injecting remote iframes to…
Researchers at LayerX discovered AiFrame, a campaign of 30 malicious Chrome extensions installed by over 300,000 users that impersonate AI assistants to steal credentials, email content, and browsing data. Many extensions load remote iframes from infrastructure tied to tapnetic[.]pro, target Gmail to extract messages (including drafts), and can capture voice transcripts,…
In Q4 2025, GTIG observed threat actors escalate from experimental prompts to systematic exploitation of LLMs like Gemini for reconnaissance, phishing, malware development, and post-compromise activity. Model extraction and AI-powered frameworks such as HONESTCUE and COINBAIT, along with misuse by actors like UNC6418 and APT42, underscore growing abuse of commercial AI…
An alleged Uzbekistan cyberattack originally claimed to have exposed personal data of 15 million citizens actually involved roughly 60,000 individual data units, not 60,000 people. Digital Technologies Minister Sherzod Shermatov said three government information systems were accessed in late January and authorities have strengthened controls, including added OneID authorization, to limit…
This week’s Cyber Express Weekly Roundup covers cross-border incidents including a breach of the European Commission’s mobile device management system, a ransomware attack that halted Senegal’s national identity services, a landmark AU$2.5 million penalty for FIIG Securities after a data-exposing ransomware incident, and the in‑absentia sentencing of crypto scam leader Daren…
CISA has ordered U.S. federal agencies to secure systems against a critical Microsoft Configuration Manager vulnerability (CVE-2024-43468) patched in October 2024 after proof-of-concept exploit code surfaced. The agency says the flaw is being actively exploited and mandated FCEB agencies patch by March 5 under BOD 22-01 while urging all organizations to apply vendor mitigations immediately. #CVE-2024-43468 #MicrosoftConfigurationManager
Criminal IP is now integrated with IBM QRadar SIEM and QRadar SOAR, bringing AI-powered, IP-based threat intelligence directly into QRadar detection, investigation, and response workflows. The integration provides real-time IP risk scoring from firewall logs, in-context investigations inside QRadar, and automated SOAR enrichment to speed prioritization and response. #CriminalIP #IBMQRadar
South Korea’s Personal Information Protection Commission fined Louis Vuitton, Christian Dior Couture, and Tiffany a combined $25 million after data breaches exposed information for more than 5.5 million customers due to inadequate security controls on a cloud-based customer management service. Investigators linked the incidents to the ShinyHunters campaigns targeting Salesforce-related SaaS access, and regulators stressed that using SaaS does not transfer responsibility for protecting personal data. #ShinyHunters #Salesforce
Threat actors are abusing public Claude artifacts and malicious Google Ads in ClickFix campaigns to trick macOS users into pasting shell commands that install the MacSync infostealer. Researchers from Moonlock Lab and AdGuard observed multiple variants and thousands of views, with the same C2 infrastructure linking the activity to a single actor. #MacSync #Claude