Cybersecurity Hacking News

A seemingly innocuous print management system has emerged as a critical attack vector, exposing organizations to severe cyber risks through pre-authentication RCE.

• Pre-auth root RCE: AnyPwn targets AnyDesk Linux 8.0.2 via direct TCP on port 7070, using heap buffer overflow in session protocol for immediate root...

Attackers increasingly impersonate reputable institutions across sectors to exploit trust and extract data or payments.

• MyChart Medicare scams lure...

• AI加剧既有缺陷：CISA指出人工智能正加速漏洞利用，暴露联邦机构长期网络卫生问题。
• 补丁优先级新规：6月指令要求机构优先修补高风险漏洞，12月起最长3天期限，目标24小时。
• Gold Eagle规模化应对：支持AI发现漏洞报告，创建机器可读格式并添加优先级机制。
• CVE转向质量时代：2026年CVE数量激增，CISA推动从增长转向数据质量与自动化。

Between September 1 and October 6, 320 million people's personal information was stolen globally, based on a survey of large-scale incidents. This highlights the sheer volume of today's breach environment.

Springfield schools' retention of personnel data spanning decades dramatically expanded the breach's scope, exposing SSNs of former employees and...

The Alabama Power breach exposed names, addresses, phone numbers, emails, and the last four SSN digits for about 100,000 accounts, raising identity...

Even when disabled by default on Nexus 3000/9000 switches, NX-API becomes a CVSS 9.8 unauthenticated root RCE vector the moment automation enables it....

Dire Wolf disables recovery and logging before encryption to hinder restoration.

• Terminates Event Log service via WMI queries then clears logs with...

A Defense Manpower Data Center system remained exposed for nine months before detection, leaking sensitive records for more than 3 million people....

Bacon County Health Services confirmed unauthorized access and data exfiltration between July 10-27, 2026, but the full extent of patient information...

The FBI and Justice Department seized seven domains tied to Microscan and FishHub, two tools used by Flax Typhoon-linked Integrity Tech for scanning...

September's 1,374 third-party vulnerabilities marked a 61% surge from August, concentrated in Chromium browsers like Brave and Edge.

Exploits hit...

• Faster discovery: OSS Scanner applies Claude models to catch vulnerabilities in eligible projects without cost or human triage.
• Opt-in barriers:...

The Pennsylvania arrest signals accelerating FBI momentum against ShinyHunters after the Dutch leader takedown last week.

• Confirmed facts: Suspect...

This week's security landscape reveals threats hitting multiple layers at once.

• Spectre-v2 revived through JIT compilation tricks in Firefox's...

Flashpoint's patented model shows why CVSS alone fails to flag ransomware risks, as lower-severity flaws often match historical attack patterns.

• It...

IBM and Red Hat's Lightwell initiative uncovered more than 400 unexpected Java vulnerabilities, exceeding projections and signaling that proactive...

数据泄露规模正从单一事件快速扩大至全球层面，企业暴露发现、漏洞修复与披露能力面临严峻考验。

• 规模持续升级：C&N银行仅佛蒙特州1人受影响，但全国范围可能更大；Ricardo平台89万账户泄露；全球9月以来累计3.2亿人受影响。
• 响应速度差异：Ricardo 10月7日发现后立即修补漏洞并通知监管，而多数事件发现与披露仍滞后。
• 防护能力关键：金融机构与平台需加强第三方风险监测、实时漏洞修复及多辖区合规披露，以应对金融账户与个人身份信息泄露风险。

CISA added five vulnerabilities actively exploited by Flax Typhoon to its KEV catalog, setting an October 11 deadline for federal agencies to patch or...