Category: Cyber Security News

Three suspected Russian cyber espionage clusters, UNC6293, UNC5976, and UNC7005, have been using legitimate authentication flows and social engineering to target academia, defense, governments, and think tanks across Europe and the U.S. Their campaigns span app password, OAuth, device code, and WhatsApp phishing, along with malware and token theft to hijack…

The Rust Project removed malicious releases of arrayref, internment, and append-only-vec after a compromised maintainer account published typosquatted dependencies that executed a remote payload during build time. The incident abused proc-macro1 to bypass normal build expectations, and the Rust Security Response Team advised developers to inspect local cargo caches and pin…

Kyle William Spitze, an original member of 764 and leader of the Harm Nation offshoot, was sentenced to 77 years in prison for producing and distributing child sexual abuse material and other coercive abuse crimes. The case exposed his role in a broader 764 network tied to The Com, as federal investigators and the FBI intensified arrests against nihilistic violent extremist groups. #764 #HarmNation #TheCom #KyleWilliamSpitze

This week’s threats show attackers abusing trusted components, exposed systems, and weak assumptions to bypass defenses, from Microsoft-signed BTR.sys and vulnerable drivers to covert backdoors and CI/CD takeover flaws. Other highlights include major action against the Mabna Institute, Grandoreiro DLL sideloading, refrigeration controller RCE issues, and AI tools increasingly used for…

Citrix has warned customers to urgently secure NetScaler Gateway and NetScaler ADC appliances against CVE-2026-19490 and CVE-2026-19489, which can lead to authentication bypass and denial-of-service attacks under specific configurations. The company also urged rapid patching to the recommended firmware builds after previous NetScaler flaws were exploited in the wild, while CISA continues to track Citrix vulnerabilities in its KEV Catalog. #Citrix #NetScaler #CVE-2026-19490 #CVE-2026-19489 #CISA

Hackers compromised the maintainer account for the Rust crate arrayref and pushed a malicious update that executed during compilation, while also poisoning append-only-vec and internment in the same supply-chain attack. The campaign affected widely used Rust projects and showed infrastructure overlaps with recent DPRK-linked attacks, prompting developers to check for compromise and rotate exposed secrets. #arrayref #append-only-vec #internment #proc-macro1 #StepSecurity #Wiz #Cratesio #Rust

A bipartisan bill to combat organized retail theft is advancing in Congress, but critics warn that CORCA could expand ICE-centered surveillance and weaken privacy safeguards through broad data-sharing provisions. Supporters say the measure is narrowly targeted at large-scale theft and cyber-enabled retail crime, including fraud tied to phishing, account takeover, and cargo theft. #CORCA #ICE #HomelandSecurityInvestigations #AmericanCivilLibertiesUnion #NAACPLDF #NationalRetailFederation

A threat actor carried out Operation CameraSwarm, compromising more than 14,000 Dahua IP cameras across Ukraine and Russia by combining brute-force attacks with authentication bypasses and a persistent RPC backdoor. Hunt.io found exposed attacker infrastructure and evidence that the toolkit was prepared for reuse or handoff, but the operator’s final motive…

Surveillance is being expanded by companies, employers, criminals, law enforcement, and intelligence agencies, all of whom collect data for their own benefit rather than for users’ privacy. The article warns that AI is making these practices faster, broader, and more invasive, while regulations like GDPR, BIPA, and Daniel’s Law offer only…

CERT Polska says CVE-2026-73570, a recently patched Zimbra Collaboration flaw, is being actively exploited in the wild. The issue affects systems with the optional zimbra-snmp package and SNMP notifications enabled, allowing unauthenticated attackers to run arbitrary OS commands as the Zimbra user. #CVE-2026-73570 #ZimbraCollaboration #CERTPolska…

AI has transformed phishing into a faster, more personalized, and harder-to-detect threat that can bypass traditional email filters and lead to rapid account compromise. The article explains why MSPs must move beyond inbox-only defenses and use behavior monitoring, identity detection, and rapid response to stop attacks before they become costly breaches. #Kaseya #IBM #HarvardBusinessReview

A critical flaw in Elementor Pro, tracked as CVE-2026-32475, can let attackers upload a malicious PHP file and achieve remote code execution on vulnerable WordPress servers. The issue affects Elementor Pro versions before 4.2.2 and only sites using a published Elementor Form with a File Upload field and the multiple file upload option enabled, with no active exploitation seen yet. #CVE-2026-32475 #ElementorPro #Patchstack #WordPress

A new report from Americans for Responsible Innovation urges the federal government to treat key AI models, companies, and supporting industries as critical infrastructure and to name CISA as the lead agency for AI-related cyberthreats. The report argues that the AI stack is deeply interconnected with other critical sectors, making it vulnerable to disruptions that could cascade across the economy and national security. #AmericansforResponsibleInnovation #CISA #OpenAI #Anthropic #ANCHORCI

CISA warned federal agencies that attackers are exploiting CVE-2026-64849, a critical MLflow DNS-rebinding SSRF bypass that can expose internal services and cloud metadata on unpatched systems. The flaw in MLflow’s webhook delivery can let unauthenticated attackers steal AWS IAM credentials, prompting CISA to add it to its exploited-in-the-wild catalog and order rapid patching. #CVE-2026-64849 #MLflow #CISA #AWSIMDS #IAM