Cyber Security News

APT36, also known as Transparent Tribe, has escalated its espionage campaigns against Indian defense and government targets with cross-platform malware, including new Linux tools. Aryaka Threat Research Labs detailed these attacks in a recent report, highlighting stealthy RATs designed for persistence and data theft. Transparent Tribe (APT36) and linked SideCopy actors rely on spear-phishing with […]

The post APT36 Hacker Group Attacking Linux Systems with New Tools to Disturb Services appeared first on Cyber Security News.

Hackers are actively exploiting Ivanti Endpoint Manager Mobile (EPMM) appliances to plant “dormant” backdoors that can sit unused for days or weeks. Ivanti recently disclosed two critical EPMM flaws, CVE-2026-1281 and CVE-2026-1340, spanning authentication bypass and remote code execution in different packages (aftstore and appstore). While the packages differ, defenders face the same practical impact: […]

The post Hackers Exploiting Ivanti EPMM Devices to Deploy Dormant Backdoors appeared first on Cyber Security News.

Torrance, United States / California, February 9th, 2026, CyberNewswire Criminal IP (criminalip.io), the AI-powered threat intelligence and attack surface intelligence platform, is now integrated with IBM QRadar SIEM and QRadar SOAR. The integration brings external, IP-based threat intelligence directly into IBM QRadar’s detection, investigation, and response workflows, enabling security teams to identify malicious activity faster […]

The post Criminal IP Integrates with IBM QRadar to Deliver Real-Time Threat Intelligence Across SIEM and SOAR appeared first on Cyber Security News.

Discord announced it will begin globally rolling out “teen-by-default” safety controls and an expanded “age assurance” system in early March, introducing clearer boundaries around age-restricted experiences while leaving most everyday use unchanged. The company says the goal is to make age-appropriate defaults the baseline for everyone, then allow adults to unlock additional capabilities by confirming […]

The post Discord to Age-Restrict User Access to Key Features Starting Next Month appeared first on Cyber Security News.

A new critical vulnerability discovered by security research firm LayerX has exposed a fundamental architectural flaw in how Large Language Models (LLMs) handle trust boundaries. The zero-click remote code execution (RCE) flaw in Claude Desktop Extensions (DXT) allows attackers to compromise a system using nothing more than a maliciously crafted Google Calendar event. The vulnerability, […]

The post Claude Desktop Extensions 0-Click RCE Vulnerability Exposes 10,000+ Users to Remote Attacks appeared first on Cyber Security News.

Microsoft Exchange Online is experiencing a service degradation that incorrectly flags legitimate customer emails as phishing, quarantining them and disrupting communications. The issue, identified as EX1227432, started on February 5, 2026, at 10:31 AM EST and remains ongoing. Microsoft classifies this as an incident affecting Exchange Online, with some users unable to send or receive […]

The post Microsoft Exchange Online Flags Customers Legitimate Email as Phishing appeared first on Cyber Security News.

Cybersecurity threats are swiftly evolving beyond easily spotted, poorly written phishing emails to sophisticated methods that leverage trusted digital infrastructure. Attackers are now exploiting legitimate business workflows within widely used platforms, effectively turning reputable services into unwitting accomplices for financial fraud. This strategic shift makes malicious communications significantly harder for traditional security filters to detect, […]

The post Hackers Exploit Legitimate Apple and PayPal Invoice Emails in DKIM Replay Attacks appeared first on Cyber Security News.

Roundcube, one of the world’s most popular open-source webmail solutions, has released critical security updates to address a privacy bypass vulnerability. The flaw detailed by NULL CATHEDRAL allowed attackers to load remote images and track email opens, even when users had explicitly configured their settings to “Block remote images.” The vulnerability affects Roundcube Webmail versions […]

The post Roundcube Webmail Vulnerability Let Attackers Track Email Opens appeared first on Cyber Security News.

A sophisticated new malware strain dubbed “LTX Stealer” has emerged in the cyber threat landscape, utilizing a unique Node.js-based architecture to compromise Windows systems. First surfacing in early 2026, this malicious tool is designed to harvest sensitive user information, including login credentials, browser cookies, and cryptocurrency wallet data. The malware distinguishes itself by packaging a […]

The post New Node.js Based LTX Stealer Attack Users to Exfiltrate Login Credentials appeared first on Cyber Security News.

ScarCruft, a prolific North Korean-backed advanced persistent threat (APT) group, has significantly refined its cyberespionage capabilities in a newly identified campaign distributing the ROKRAT malware. This recent activity marks a strategic deviation from their traditional reliance on LNK-based attack chains, pivoting instead to a complex infection method utilizing Object Linking and Embedding (OLE) objects embedded […]

The post ScarCruft Abuses Legitimate Cloud Services for C2 and OLE-based Chain to Drop Malware appeared first on Cyber Security News.

The European Commission has confirmed the detection and containment of a security incident affecting the central infrastructure that manages staff mobile devices. The breach, identified on January 30 through internal telemetry, resulted in unauthorized access to a limited subset of Personally Identifiable Information (PII), specifically staff names and mobile numbers. Crucially, the attack appears to […]

The post European Commission Contains Cyber-Attack Targeting Staff Mobile Data appeared first on Cyber Security News.

Welcome to this week’s pulse on the cyber threat landscape, where vulnerabilities strike fast, and defenders must move faster. Notepad++ users face a supply-chain nightmare after a malicious update; Microsoft Office’s latest 0-day is ripe for exploitation; and ESXi servers are under siege from ruthless ransomware gangs. We’ve dissected these incidents, plus fresh intel on […]

The post Cybersecurity Weekly Newsletter – Notepad++ hack, Office 0-Day, ESXi 0-day Ransomware Attacks and More appeared first on Cyber Security News.

In an era where AI assistants like ChatGPT and Claude dominate cloud infrastructures, exposing user data to remote breaches, a new Rust-based tool called LocalGPT promises a fortress-like alternative. Developed as a single ~27MB binary, LocalGPT runs entirely on local devices, keeping sensitive memory and tasks off the cloud. Inspired by and compatible with the […]

The post LocalGPT – A Secure Local Device Focused AI Assistant Built in Rust appeared first on Cyber Security News.

Microsoft has confirmed that a significant power outage at one of its West US data centers triggered widespread service disruptions yesterday, leaving thousands of Windows 11 users unable to access the Microsoft Store or complete Windows Updates. The incident, which began early Saturday morning, highlights the fragility of centralized cloud infrastructure even amidst robust redundancy […]

The post Microsoft Data Center Power Outage Disrupts Windows 11 Updates and Store Functionality appeared first on Cyber Security News.

BridgePay Network Solutions, a major U.S. payment gateway provider, confirmed a ransomware attack caused a widespread outage, disrupting card processing for merchants nationwide. The outage began early on February 6, 2026, around 3:29 a.m. EST with degraded performance in systems like the Gateway.Itstgate.com virtual terminal, reporting, and API. By 5:48 a.m. EST, BridgePay posted its […]

The post BridgePay Payment Gateway Hit by Ransomware, Causing Nationwide Outages appeared first on Cyber Security News.

Germany’s top security agencies issued an urgent warning yesterday regarding a sophisticated cyber espionage campaign targeting high-ranking officials and journalists across Europe. The Federal Office for the Protection of the Constitution (BfV) and the Federal Office for Information Security (BSI) revealed that state-sponsored hackers are hijacking Signal accounts to spy on private communications.​ The joint […]

The post Hackers Linked to State Actors Target Signal Messages of Military Officials and Journalists appeared first on Cyber Security News.

OpenClaw v2026.2.6 enhances security in response to increasing concerns about malicious skills within its ecosystem. This release includes a code safety scanner and model support, and addresses recent vulnerabilities highlighted by researchers. It is an open-source framework for local AI agents that manage tasks such as email management and cryptocurrency trading via WhatsApp or Telegram. […]

The post OpenClaw v2026.2.6 Released With Support for Opus 4.6, GPT-5.3-Codex and Safety Scanner appeared first on Cyber Security News.

OpenClaw announced today a partnership with VirusTotal, Google’s threat intelligence platform, to implement automated security scanning for all skills published to ClawHub, its AI agent marketplace. The integration marks the first comprehensive security initiative for the emerging AI agent ecosystem. All skills published to ClawHub will now undergo automatic scanning using VirusTotal’s threat intelligence database […]

The post OpenClaw Partners with VirusTotal to Secure AI Agent Skill Marketplace appeared first on Cyber Security News.

BeyondTrust has disclosed a critical pre-authentication remote code execution vulnerability affecting its Remote Support (RS) and Privileged Remote Access (PRA) platforms, potentially exposing thousands of organizations to system compromise. The flaw, tracked as CVE-2026-1731 and classified under CWE-78 (OS Command Injection), enables attackers to execute arbitrary operating system commands without requiring authentication or user interaction. […]

The post BeyondTrust Remote Access Products 0-Day Vulnerability Allows Remote Code Execution appeared first on Cyber Security News.

nmapUnleashed emerges as a powerful CLI wrapper enhancing Nmap’s capabilities for penetration testers and network auditors. Released in late January 2026 by developer Sharkeonix, this open-source tool streamlines complex scans while retaining full Nmap compatibility. nmapUnleashed, or “nu,” wraps Nmap to add multithreading, allowing up to customizable parallel scans (default 4 threads) for faster execution […]

The post nmapUnleashed Makes Nmap Scanning More Comfortable and Effective appeared first on Cyber Security News.