Cybersecurity Hacking News

The Claude Max giveaway uses browser-in-the-browser phishing to spoof a Google sign-in window, leveraging AI-brand hype and urgency without asking for...

Attackers are zeroing in on enterprise management systems because a single compromise grants control over security policies, logs, and the entire...

Namespace-level access in KubeVirt's virt-exportserver still permits path traversal via symlinks in exported PVCs, letting attackers read arbitrary files from the exporter pod's filesystem and exposing sensitive data.

Proofpoint's new system targets attacks that bypass traditional tools by compromising real accounts and mimicking legitimate threads.

• Intent-based...

A MEDIUM 6.3 CVSS flaw in Pixtream allows remote unrestricted file uploads via /post_upload.php, with the exploit already public and no vendor response, making internet exposure far riskier than the rating suggests.

Network Solutions' Dark Web Monitoring moves small businesses beyond reactive breach disclosures toward continuous 24/7 monitoring of exposed domain...

A critical heap buffer overflow in F5 BIG-IP APM (CVE-2026-94127) enables unauthenticated RCE only when the module serves as an OAuth authorization...

BlueMoon rapidly chains two Chrome V8 bugs for code execution and sandbox escape with a Windows ALPC privilege escalation flaw, letting attackers...

Unsafe reflection during plugin instantiation in Apache Calcite Avatica lets low-privileged authenticated attackers trigger arbitrary class static...

North Korean state-sponsored group Konni launched 'Operation Conflict Compass' using new malware to target Ukraine-focused organizations for strategic...

RemControl abuses Android Accessibility Service for real-time screen streaming, keystroke logging, and full remote control while dynamically serving...

AI is rapidly lowering the expertise and cost needed for convincing impersonation and account-takeover fraud.

• Consumer scams now feature AI-cloned...

• Pre-disclosure strikes: UTA0565 weaponized a Chrome-Microsoft triple chain Sept. 3-4, days before any fixes
• Shared exploit kit: Core components...

Identity and access-control gaps in the 988 lifeline, including missing updated password guidance and incomplete monitoring of contact centers, raise...

PAYLOAD ransomware exploits trusted Active Directory GPOs to disrupt Windows systems, target ESXi infrastructure, and steal sensitive data.

Palo Alto Networks' Unit 42 Continuous Frontier AI Defense delivers always-on testing via a multi-model harness with gated models like Claude Mythos 5...

• CVE-2026-94127 (CVSS 9.8) enables unauthenticated RCE on the TMM data plane when a virtual server pairs an APM access policy with an OAuth...

Organizations using Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions should apply the kernel-rt update to address Important-rated...

FBI confirmed its public job application portal went down Tuesday while responding to the incident, but offered no details on any data theft.

-...

US allies should track potential authoritarian opportunism around the 2026 mid-terms while recognizing this remains speculative.

• Low-probability...