Cybersecurity Hacking News

Infostealers now trigger 86% of corporate breaches by harvesting credentials at scale, feeding the next two vectors.

• They steal passwords, session...

Stale credentials and weak access controls triggered several major 2026 breaches, exposing tens of millions of records.

• Entry point: Klue's...

AI agents uncovered a remotely triggerable crash in Ethereum's gossipsub layer, tracked as CVE-2026-34219, that could knock validators offline with...

U-Boot bootloader vulnerabilities let attackers run malicious code during the earliest boot stages, before any OS security tools activate. This grants...

Traditional access controls fail to block inference attacks that derive sensitive data like health status from non-sensitive sensor readings.

• New...

Karen Serobovich Vardanyan, a 34-year-old Armenian, pleaded guilty to conspiracy and computer fraud for deploying Ryuk ransomware against five U.S....

• Both flaws enable zero-click XSS code execution simply by opening a malicious email in the web client.
• Roundcube's update in 1.7.2 is labeled...

A CVSS 9.8 path traversal vulnerability in Apache IoTDB lets attackers write files anywhere via a crafted JAR upload on the internal RPC port, risking...

Education saw a 16% jump in ransomware attacks, fueled by underfunded IT teams, sensitive student data, and legacy systems.

• Easy targets: Weak MFA,...

The malicious @injectivelabs/sdk-ts version remained live for only 49 minutes before Injective deprecated it, resulting in zero downloads of the...

LLM agents adapted from AutoCodeRover now generate plausible patches for 61-72% of OSS-Fuzz vulnerabilities by extracting exploit-triggered code...

U-Boot bootloader flaws enable code execution during image verification on routers, cameras, and IoT hardware, affecting 50+ releases since v2013.07....

• Suspected Bonzo Finance exploit via SAUCE oracle manipulation drained ~$5.25M, with funds bridged to Ethereum and swapped for 2,284 ETH plus 15.58...

• Delivers critical security updates for the Linux kernel, Nginx, Redis, FFmpeg, Thunderbird, Chromium, PHP and more
• Reverts geoip-database package...

A major 2026 breach stole names, email addresses, student IDs, and private messages from an educational platform.

• Recent attacks: Multiple major ransomware incidents hit Ireland in the past weeks, with more expected to surface soon.
• NCSC response: The centre...

The AFA breach traces back to an infostealer infection on a developer's machine on September 8, 2025, with credentials hoarded for months before use....

• Agentic AI lets attackers compress timelines and misuse tools like Claude Code to compromise developer workflows
• Chatbot flaws in platforms like...

Ransomware attackers are pivoting hard to healthcare business partners, with attacks on billing firms, wholesalers and suppliers jumping 35 percent in...

• Consistent playbook: An initial access broker exploited CitrixBleed2 across about six organizations from January to June 2026, creating rogue admin...