Cyber Alert Security News Daily

No significant updates today.

• A Class 12 ethical hacker found a hardcoded master password in CBSE's evaluation portal, enabling login as any examiner within 30 minutes
• Access...

A high-severity RCE flaw (CVE-2026-9089, CVSS 8.8) in ConnectWise Automate lets attackers bypass integrity checks via plugin and self-update features...

Ivanti released a security update for Ivanti Xtraction addressing CVE-2026-8043.

• Vulnerability: Arbitrary file reading and HTML file crafting...

Attackers are refining multi-stage obfuscation across both niche and broad phishing campaigns.

• Operation Dragon Whistle weaponizes university...

Attackers hid Megalodon malware in commit messages using encoded, self-assembling base64 payloads that only triggered when repositories were fully...

A five-year study reveals exposed databases are almost always compromised, powering a low-yield but massive ransomware operation.

• Researchers...

Attackers are shifting from stealing passwords to hijacking OAuth tokens via legitimate flows, rendering traditional MFA ineffective.

• Kali365...

May campaigns turned everyday tools into access risks, from fake invites to fileless delivery.

• Fake invitations targeted U.S. firms for credential...

AI infrastructure faces escalating risks from targeted supply chain attacks and critical open-source flaws.

• TeamPCP compromised LiteLLM by first...

Hackers claim to sell 340 million stolen OnlyFans records, yet experts are already skeptical about the hack's seriousness and scale. Verifying such massive leaks remains a core challenge.

Critical integer overflow in llama.cpp's GGUF parser enables arbitrary file seeks and out-of-bounds reads on 32-bit systems, hitting every Ollama and...

Two recent breaches by the same group highlight shared risks across sectors.

• Canvas breach exposed names, emails, IDs and messages for millions of...

Microsoft has released patches addressing the critical remote code execution vulnerability CVE-2026-45659 in SharePoint across multiple server...

Attackers are exploiting AI coding tools through poisoned configs and symlink tricks, amplifying risks in the TrapDoor campaign.

• CVE-2025-59145...

Critical SQL injection in Ghost CMS (CVE-2026-26980) let attackers steal Admin API keys without authentication and inject ClickFix malware.

• Flaw...

This week's incidents reveal ongoing PII exposure risks across sectors.

• Trump Mobile website flaw leaked names, addresses, and phones of 27,224...

Two infrastructure-level flaws underscore the urgency of rapid updates across core systems.

• Ubiquiti UniFi OS faces three CVSS 10.0 vulnerabilities...

Exploits drove 31% of initial breach access amid a massive surge in vulnerabilities.

• Patching lag worsens: Median fix time rose to 43 days (from 32...

Iran-linked Screening Serpens has intensified spear-phishing with tailored lures and six new RATs targeting aerospace, defense, and telecom in the US, Israel, and UAE. Companies in these sectors should harden defenses against impersonation attacks.