Category: Cyber Security News

Scammers are using a $249 website toolkit to create polished fake subscription sites that imitate products like GPT-6 Astra, PixAI, DaVinci Resolve, and Omegle, then steer visitors to paid plans through genuine Google sign-in pages. Malwarebytes found more than 100 linked sites with shared files and developer details, warning that the real Google login does not prove the service behind it is legitimate. #Google #Malwarebytes #PixAI #DaVinciResolve #Omegle #GPT6Astra

Attackers are actively exploiting CVE-2026-7273 in Zyxel GS1900 series switches, a high-severity stack-based buffer overflow that can let unauthenticated LAN users execute OS commands through malicious HTTP requests. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch affected devices, while GreyNoise reports nearly 1,000 compromised switches across 48 countries. #CVE-2026-7273 #ZyxelGS1900 #CISA #GreyNoise

A new WordPress Core CSRF chain dubbed Click2Shell can let an attacker force-install a theme and achieve pre-authenticated remote code execution when a logged-in administrator visits a crafted link. WordPress fixed the issue in version 7.1.1, and researchers have already published full technical details and a proof-of-concept exploit. #Click2Shell #WordPress #pwn.ai #PaulosYibelo

CISA is warning that attackers are actively exploiting three Linux kernel vulnerabilities, including CVE-2025-39964, which has existed for 14 years and is rated critical. Federal agencies must patch and perform forensic triage immediately, while Red Hat and researchers have confirmed public or known exploits for CVE-2025-39682 and CVE-2026-53266. #CVE-2025-39964 #CVE-2026-53266 #CVE-2025-39682 #LinuxKernel #CISA

BigCommerce notified merchants that attackers compromised credentials for the third-party Ribon and Ribon 1.5 applications and used them to inject malicious scripts into a small number of storefronts. Master of Malt said shopper data including names, email addresses, phone numbers, and shipping addresses was exposed, while BigCommerce said its own platform and payment data were not breached. #BigCommerce #Ribon #MasterofMalt #Fastr #BeAPartOf

Google was fined €403 million by Ireland’s Data Protection Commission for GDPR breaches involving the handling of location data in Web & App Activity, Location History, and Location Accuracy between May 2018 and February 2020. The DPC said Google failed to ensure lawful, fair, and transparent processing, and ordered the company…

North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices in over 100 countries and stolen funds or credentials from more than 7,000 cryptocurrency wallets, causing at least $10.71 million in losses. The operation targets developers and crypto professionals through fake job offers, delivering malware and…

A fake LastPass Authenticator installer on GitHub delivered a signed Windows kernel driver that disabled security tools before a password stealer harvested credentials, wallet files, and session data. Researchers said the campaign used DLL side-loading, BYOVD tactics, and impersonation pages for many brands, while LastPass confirmed its own systems were not…

Microsoft has fixed a known issue in the September 2026 security updates that caused copy-and-paste, autofill, and formula dragging to fail silently in Excel for multiple versions, including Excel Online. Affected users must install the updated Office builds, while some Office 2016 and Office LTSC 2019 scenarios with conditional formatting may still need the Paste Special workaround. #Microsoft #Excel #KB5002914 #Office2016 #OfficeLTSC2019 #OfficeLTSC2021 #OfficeLTSC2024

Ireland’s Data Protection Commission fined Google €403 million for GDPR violations tied to the processing and retention of users’ location data. The case focused on Google’s Web & App Activity, Location History, and Location Accuracy features, with the DPC ordering compliance improvements within six months. #Google #GDPR #DataProtectionCommission

Microsoft will retire the Calendar, People, and Files Microsoft 365 companion apps on December 16, 2026, and admins are being urged to remove them from managed devices. Microsoft has already stopped installing the apps through Microsoft 365 updates and also reminded organizations to prepare for upcoming Entra ID and SMS sign-in changes. #Microsoft365 #EntraID #FIDO2

Noopur Davis built an unconventional path from software developer to Comcast’s Global CISO by embracing unexpected opportunities at Intergraph, Carnegie Mellon University, Intel, and Comcast. Her leadership style emphasizes calm decision-making, strong teamwork, empathy, and balancing security rigor with business needs. #NoopurDavis #Comcast #CarnegieMellonUniversity #Intel…

A fake LastPass Authenticator distributed through GitHub was used in a long-running impersonation campaign that spoofed at least 40 organizations and delivered the Rapuncel infostealer. The malware deploys a kernel driver to disable security tools, steal passwords and wallet data, and persist on infected systems until the driver is removed. #LastPass…

Google was fined 403 million euros by Ireland’s Data Protection Commission for unlawfully handling users’ location data under the EU’s privacy rules. The investigation found issues with Web & App Activity, Location History, and Android’s Location Accuracy feature, and three more Google privacy probes remain open. #Google #IrelandDataProtectionCommission #GDPR #LocationHistory #Android…