Category: Cyber Security News

Threat actors are actively exploiting CVE-2026-0768 in Langflow to gain unauthenticated remote code execution and steal credentials, tokens, and keys from vulnerable AI application environments. VulnCheck observed escalating attacks against honeypots, with the attacker targeting environment variables and secret files to collect Langflow, AWS, and OpenAI credentials. #Langflow #CVE-2026-0768 #VulnCheck #OpenAI #AWS

Five Venezuelan nationals pleaded guilty in the US for attempting to install malware on ATMs in Kansas as part of an ATM jackpotting scheme. The FBI says such incidents are rising nationwide, with over 1,900 cases reported since 2020 and major losses in 2025. #ATMJackpotting #FBI #Kansas #Wamego #Manhattan…

Threat actors are exploiting CVE-2026-0768, a critical RCE flaw in Langflow that can allow unauthenticated code execution as root through the custom component editor. VulnCheck says the attacks are being used for reconnaissance and credential harvesting, with activity seen mainly from Russia and more than 360 attempts detected against its UK…

Forescout’s Vedere Labs showed that Anthropic’s Claude could be guided to port a working RCE exploit from the WAGO 750-852 PLC to the WAGO 750-831, but only with heavy researcher oversight, long sessions, and significant API cost. The experiment also showed how quickly the AI could iterate once the flaw was…

Cronos resumed normal operation after halting the network in response to a price-manipulation exploit on Tectonic that enabled an attacker to borrow $74 million. The attacker inflated TONIC’s price 100 times in 20 minutes, but only about $6 million in Ethereum was actually stolen while the rest of the funds remained stuck on Cronos. #Cronos #Tectonic #TONIC #PeckShield

Silver Fox is distributing ValleyRAT through a signed Chinese adware app, using DLL sideloading and trusted processes to evade security controls. Kaspersky linked the campaign to QN Wallpaper abuse, noted serious post-infection capabilities, and urged users and organizations to avoid questionable software and security exclusions. #SilverFox #ValleyRAT #QNWallpaper #Winos40 #Kaspersky…

This week’s cybersecurity roundup shows how trusted systems, familiar prompts, and weak defaults were repeatedly abused to enable espionage, credential theft, ransomware, and backdoor access. From Fire Ant and PlayCrypt to ValleyRAT, Ghost Penal, and malicious ZBT routers, the common theme was attackers turning ordinary infrastructure and user trust into reliable…

DPRK-linked threat actors are expanding their “IT worker” scheme into sales, marketing, healthcare, and finance by using synthetic identities, forged documents, VPNs, proxy services, and AI tools to secure remote jobs at targeted organizations. Investigations also show use of laptop farms, PiKVM, and related infrastructure to maintain access, helping fund North…

The Trump administration launched Project Watershed 250, a six-month pilot in Texas that brings together federal, state, and private-sector expertise to strengthen water system defenses. The initiative follows recent attacks on U.S. water infrastructure and aims to find vulnerabilities, harden systems, and scale proven protections nationwide. #ProjectWatershed250 #TexasCyberCommand #SeanCairncross

Microsoft is investigating a widespread Exchange Online incident that is causing authentication problems, email delays, and mailbox access failures for many users. The outage, tracked as EX1464935 and later MO1465074, also affects other Microsoft 365 services including OneDrive for Business, SharePoint Online, Microsoft Teams, Microsoft Purview, and Microsoft Defender XDR. #ExchangeOnline #Microsoft365 #OneDriveforBusiness #SharePointOnline #MicrosoftTeams #MicrosoftPurview #MicrosoftDefenderXDR

TerminalFix is a new ClickFix variant that uses fake Cloudflare CAPTCHA prompts on compromised sites to trick victims into running malicious PowerShell commands in Windows Terminal. Microsoft says the multi-stage attack can establish a reverse tunnel into internal networks, enabling recon, persistence, and potential follow-on actions like credential theft or ransomware deployment. #TerminalFix #Cloudflare #WindowsTerminal #PowerShell

Microsoft has confirmed that the Windows 11 KB5120998 August 2026 preview update can revert mouse cursor personalization settings, with some users seeing larger white cursors or reset animations after installation. The company is investigating the issue and is asking affected users to report it through the Feedback Hub. #Microsoft #Windows11 #KB5120998

Berlin’s city administration says cybercriminals are trying to extort the city after Rhysida added it to its data leak site, claiming to have stolen 5.79 TB of files. Officials say Berlin will not pay, while investigators continue to assess the breach and protect sensitive government systems. #Rhysida #Berlin

Organizations still rely on on-premises file servers for cost control, sovereignty, and compatibility, but secure access governance is critical to protect data across hybrid environments. The article outlines five file server best practices, including using groups instead of direct user permissions, following the AGDLP model, relying on NTFS for granular control, preserving inheritance, and enforcing least privilege. #AGDLP #NTFS #tenfold