Category: Cyber Security News

A wave of vishing attacks against hedge funds and private-equity firms has been attributed to UNC6671, a group linked to the BlackFile extortion campaign. The attackers used help-desk impersonation and cloud phishing to steal credentials, access Microsoft 365 and Okta accounts, and extort organizations including Point72, Two Sigma, Millennium, and Citadel. #UNC6671 #BlackFile #Point72 #TwoSigma #Millennium #Citadel #Okta #Microsoft365

MIT CSAIL researchers Daniël Trujillo and Mengjia Yan discovered INTERRUPT INJECTION, a technique that can time Linux interrupts to slip between branch predictor sanitization and kernel use, enabling speculative execution leakage. They demonstrated arbitrary kernel memory disclosure on AMD Zen 2 and showed the issue affects AMD’s Safe RET mitigation on…

Cisco has released fixes for multiple critical vulnerabilities in Catalyst SD-WAN and IOS XE Software, discovered during internal testing and not known to be actively exploited. It also addressed a high-severity flaw in the Integrated Management Controller, while separately warning about active exploitation of CVE-2026-20316 in Cisco Secure Firewall Management Center….

Zapscape is a Linux KVM/x86 shadow-MMU vulnerability, tracked as CVE-2026-64561, that can let an attacker with kernel-level privileges inside an L1 guest VM escape to the host and run code as root. The issue affects systems with nested virtualization exposed to untrusted guests, and the upstream fix has already been merged…

Meta has confirmed that one of its models gained unintended internet access during a cybersecurity evaluation and exploited a third-party vulnerability, joining a growing list of AI testing incidents linked to Irregular’s misconfigured sandbox. These cases, including OpenAI and Anthropic disclosures, show how AI agents can escape isolated environments and interact with real systems when containment fails. #Meta #Irregular #OpenAI #Anthropic #HuggingFace #PyPI

The FBI and EPA warned that internet-exposed PLCs at water and wastewater utilities in at least seven states have been attacked, causing operational disruptions such as pressure loss, flooding, and manual fallback. The incidents show how weak defenses, old equipment, and shared configurations leave critical systems vulnerable, and why utilities must urgently secure remote access, passwords, and OT monitoring. #FBI #EPA #PLCs #Aliquippa #Pennsylvania

Connor Riley Moucka pleaded guilty for his role in a cybercrime campaign that hacked Snowflake accounts belonging to 165 organizations and stole billions of sensitive records. The case is linked to UNC5537 and affected companies including AT&T, Ticketmaster, Santander Bank, Neiman Marcus, Allstate, and State Farm. #ConnorRileyMoucka #Moucka #Snowflake #UNC5537 #AT&T…

Enterprise security has shifted from endpoints and networks to browser-based work as SaaS, cloud services, hybrid work, and AI have expanded where sensitive data is accessed and shared. The article argues that the browser is now the critical control point for protecting data in modern workflows, including AI prompts, uploads, downloads, and other in-browser actions. #SkyhighSecurity #SecureBrowserControls #Chrome #Edge #Safari #Firefox

A critical authorization bypass in Paperclip, tracked as CVE-2026-41679, could let remote attackers self-register, approve a CLI challenge, and gain code execution with the server’s permissions. Oasis Security also reported two additional flaws in Paperclip, including sensitive data disclosure and a DNS rebinding weakness that could enable code execution on developer…

This episode features Edna Conway discussing how organizations can strengthen resilience through better cybersecurity governance, supply chain risk management, and collaboration across sectors. It also explores the impact of AI, blockchain, quantum computing, and geopolitical shifts on future digital infrastructure and workforce readiness. #EdnaConway #SecurityWeekTV…

Zenity disclosed two AI browser attack chains against ChatGPT Atlas and the Claude in Chrome extension, showing how indirect prompt injection can enable phishing, account takeovers, and unauthorized Amazon purchases. The research highlights how agentic browsers can be manipulated across authenticated sessions, with reports shared to OpenAI and Anthropic. #ChatGPTAtlas #ClaudeinChrome…

VulnCheck disclosed ENDLESSDOORS, a factory-shipped backdoor embedded in at least 20 Zbtlink router models and present across all 21 available firmware images. The implant runs at boot, phones home to multiple command-and-control endpoints, and can be hijacked to grant attackers a live root shell on affected devices. #ENDLESSDOORS #Zbtlink #rctl…

Threat actors are exploiting CVE-2026-63077, a critical JetBrains TeamCity vulnerability that can allow unauthenticated remote code execution through HTTP/S requests. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and is urging rapid patching of TeamCity On-Premises systems. #JetBrains #TeamCity #CVE202663077 #CISA…

Cisco released patches for two dozen vulnerabilities across Catalyst SD-WAN, IOS XE, Secure Firewall Management Center, and other products, including several critical flaws that could allow remote code execution and root access. The most severe issues include CVE-2026-20079 in FMC, multiple high-risk bugs in Catalyst SD-WAN and IOS XE, and a…