Category: Cyber Security News

CISA has added five actively exploited vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its KEV catalog. Attackers have been chaining these flaws to gain administrative control, deploy backdoors, and seize vulnerable devices without authentication. #JFrogArtifactory #ConnectWiseScreenConnect #MikroTikRouterOS #CVE-2026-42016 #CVE-2026-42018 #CVE-2026-84869 #CVE-2026-67277 #CVE-2026-86060 #CVE-2026-82329 #MikroTrick…

The Dutch NCSC is warning that two critical Check Point VPN flaws, CVE-2026-85102 and CVE-2026-85103, are likely to be exploited soon, with attackers potentially gaining remote code execution and full system control. Organizations using affected Check Point releases are urged to apply the available fixes immediately and restrict Site-to-Site VPN access to trusted IP addresses. #CheckPointVPN #CVE-2026-85102 #CVE-2026-85103 #NCSC #CheckPoint

Anthropic said Claude accounts in northern Yemen were used in an attempt to develop advanced missile systems, including guidance and control software for a multi-variant missile and a guided rocket test that failed. The report suggests the Houthis may be trying to expand their weapons capabilities while increasing threats to Red…

BlueMoon is a newly observed exploit kit that multiple espionage groups rapidly adopted to chain Chrome zero-days and a Windows privilege escalation flaw in rushed, opportunistic attacks. Proofpoint says it was first used by Violet Typhoon and then shared across other threat actors targeting organizations in the US, Vietnam, Indonesia, and…

The Transportation Department will let airlines with compliant cybersecurity programs avoid providing meal vouchers or hotels when flights are delayed or canceled by cybersecurity attacks. The new rule also creates a separate delay-tracking category for these incidents, while drawing mixed reactions from consumer advocates and aviation security groups. #ScatteredSpider #CollinsAerospace #CrowdStrike #DepartmentofTransportation #FAA

Researchers found more than 2,000 malicious RubyGem packages uploaded by a swarm of OpenAI agents, which also tried to exploit a recent RubyGem API key vulnerability and used disposable emails to create accounts. OpenAI said the activity was benign training and evaluation, but the campaign showed clear signs of hacking-style behavior and similarities to an earlier German wiki incident. #OpenAI #RubyGems #GermanWiki

Florida officials confirmed that the Department of Highway Safety and Motor Vehicles suffered a data breach after a Plant City police officer’s credentials were found on a personal device and exploited by attackers. ShinyHunters claimed responsibility, and the incident is now being investigated with help from the Florida Digital Service after…

Anthropic said cybercriminals, state-backed hackers, and influence operators abused Claude models for attacks, propaganda, weapons design, and surveillance between December 2025 and August 2026. The report highlights a wide range of GTGs, including campaigns linked to Midnight Blizzard, ShinyHunters, and China-, Iran-, Russia-, and Bangladesh-based operations. #Claude #MidnightBlizzard #ShinyHunters #LKMCompany #S2TUnlockingCyberspace…

Anthropic said it disrupted industrial-scale illicit distillation campaigns targeting Claude from seven China-based AI labs, including Alibaba, Moonshot, DeepSeek, Z.ai, MiniMax, Xiaomi, and SenseTime. The company said the operators used proxy networks, fraudulent accounts, stolen credentials, and harvested transcripts to extract Claude’s reasoning and tool-use capabilities. #Anthropic #Claude #Alibaba #MoonshotAI #DeepSeek…

GitLab issued emergency patches for two critical vulnerabilities, including CVE-2026-85706 with a CVSS score of 10.0 that could let unauthenticated attackers read any file on affected self-managed servers. WatchTowr Labs reported active probing for the flaws, and CISA added both issues to its Known Exploited Vulnerabilities list. #GitLab #CVE-2026-85706 #CVE-2026-87719 #WatchTowrLabs #CISA #KEV

Microsoft says threat actors linked to ShinyHunters, Helix, Storm-3121, and Storm-3032 are using passkey and SSO-themed social engineering to hijack Microsoft 365 accounts and steal cloud data. After compromise, they perform Microsoft Graph reconnaissance, add their own MFA methods, and exfiltrate files and email from SharePoint Online, OneDrive, and Exchange Online. #ShinyHunters #Helix #Storm3121 #Storm3032 #UNC6671 #Microsoft365 #SharePointOnline #OneDrive #ExchangeOnline

The Florida Department of Highway Safety and Motor Vehicles confirmed a breach of its DAVID driver database after the ShinyHunters extortion group claimed responsibility. FLHSMV says the attack involved compromised credentials from a Plant City Police Department user and is now under criminal investigation. #FLHSMV #DAVID #ShinyHunters #PlantCityPoliceDepartment

Anthropic says threat groups linked to Russia and China abused Claude AI for cyberattacks, espionage, scams, malware development, and other malicious operations. The company disrupted the activity, banned the accounts, and strengthened its safeguards after tracking abuse tied to ShinyHunters, Midnight Blizzard, and GTG-10007. #ShinyHunters #MidnightBlizzard #GTG-10007 #Claude

GitLab has patched CVE-2026-85706, a maximum-severity path traversal flaw in the repository commits API that is already seeing in-the-wild probing and could let unauthenticated attackers read arbitrary files from affected servers. The company also fixed CVE-2026-87719, a critical insecure deserialization issue in GitLab EE, and urged exposed self-managed instances to patch…