Cybersecurity Hacking News

• Attackers hijack long-lived IAM access keys to call pricey Claude models on Bedrock, producing median losses of $72,000 and peaks of $522,000
  -...

PwnEscape (CVE-2026-99999) lets a guest supply unchecked csum_start and csum_offset values that force the host to overwrite two bytes inside an...

• Methuen staff exposed: Frontline Education breach leaked SSNs, home addresses, and emails for school employees
• California student data hit: Hacker...

• Credential theft and malware via phishing and smishing remain key risks for election and campaign officials.
• Sophisticated campaigns mimic...

• Reported claim: Rhysida advertises 2.6TB of Maryland government data on leak site.
• Theft acknowledgment: Anne Arundel County confirms files were stolen.
• Unconfirmed details: Specific data types and affected individuals remain unverified.

The ransomware group The Seven Deadly Sins has claimed responsibility for an attack on Hospital Sírio-Libanês, listed with 70% confidence and medium...

• Use a password manager for unique logins across accounts to stop credential stuffing
• Enable MFA on email and linked services as the NCSC...

• 25% of campaigns now add physical or psychological threats to staff, creating triple extortion alongside encryption and data leaks.
• Tactics...

CVE-2026-111711 lets unauthenticated attackers send a username longer than 63 bytes to any protected /router/*.cgi route, crashing the main Boa process or potentially executing code.

Autonomous agents can continuously search, test, and adapt against existing weaknesses in forgotten systems and misconfigurations, removing the...

An espionage campaign targeted government Linux systems with LLM-generated payloads alongside custom backdoors and web shells.

Ransomware stands out from broader malware by revealing itself to demand payment, while most malware stays hidden to avoid detection.

• Core...

Attorneys are probing reports of a possible Via Credit Union data breach after Qilin claims surfaced on dark web monitors and cybersecurity blogs, but...

GhostAction escalated sharply, compromising 1,900 GitHub accounts to impact over 30,000 repositories across 3,000 users and organizations while...

The title flags a potential October Windows update issue with Smart App Control, yet the article supplies no specifics on affected versions,...

Attackers quietly monetize hijacked bandwidth by installing legitimate apps like Pawns.app on vulnerable devices, routing traffic through residential...

Microsoft's record October 2026 release addressed 1,411 vulnerabilities across products, with the Office suite contributing over 30 new fixes...

A use-after-free flaw in Samsung's Knox PROCA driver turned the company's own process-integrity enforcement into a kernel attack surface, allowing...

BDG Law Group reported a network disruption on September 11, 2025, leading to an investigation that confirmed an unauthorized actor acquired certain...

• F5 fixed 11 NGINX flaws including critical unauthenticated RCE bugs (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) that can trigger buffer...