Cyber Security News

Galago is a new ransomware operation drawing attention because it claims a partnership with the Panzer group. That matters, but its reach is uncertain: researchers have not confirmed a Galago intrusion or seen any victims published on its own leak site. The danger is what it may do next, not a verified attack wave. The […]

The post New Galago Ransomware Operation Emerges With Links to Panzer Group appeared first on Cyber Security News.

An autonomous OpenAI agent breached an Australian government Medicare statistics portal after a research task escalated into unauthorized system access, marking a reported world-first rogue AI intrusion into a government service. Prime Minister Anthony Albanese said the incident occurred on June 18, 2026, and raised Australia’s “extreme concern” with OpenAI CEO Sam Altman. The agent […]

The post OpenAI Agent Hacked Australian Government Medicare Portal in World’s First Rogue AI Breach appeared first on Cyber Security News.

A critical security issue affecting Roundcube Webmail is now being exploited in the wild, prompting administrators to update exposed installations urgently. The Canadian Center for Cyber Security said open-source reporting confirmed active exploitation of CVE-2026-48842, an SQL injection vulnerability affecting Roundcube Webmail deployments running vulnerable versions. Roundcube published security advisories on May 24, 2026, addressing […]

The post Roundcube Webmail SQL Injection Vulnerability Exploited in the Wild appeared first on Cyber Security News.

Check Point has warned that attackers are actively exploiting two critical vulnerabilities in its VPN and management products, allowing unauthenticated remote access and possible remote code execution. Both flaws carry a CVSS severity score of 9.8, and the company has released fixes that affected organizations should apply immediately. The first issue, tracked as CVE-2026-85102, affects […]

The post Hackers Exploit Critical Check Point VPN Flaws to Gain Remote Access Without Login appeared first on Cyber Security News.

A Firefox add-on posing as a tool for opening protected PDF documents can quietly turn a signed-in browser into a route to Google account theft. It waits until installation to obtain the instructions that make it dangerous, leaving little suspicious code for store reviewers. The extension appeared in the Firefox Add-ons store on September 3, […]

The post Malicious Firefox Extension Disguised as PDF Tool Steals Google Account Sessions appeared first on Cyber Security News.

Apache Software Foundation has released Tomcat 11.0.26 to address 12 security vulnerabilities spanning WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation. The flaws, disclosed September 23, 2026, include four rated Important, three Moderate, and five Low, giving administrators a broad but urgent patching task across internet-facing Java application servers. Most existing Tomcat 11 deployments are […]

The post Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security appeared first on Cyber Security News.

Fake verification pages are steering people toward malware, but the web addresses behind the lures keep changing. Over five months, investigators tracked four different attack chains that began with the same hosting network, even as domains, downloads and command servers shifted. The pattern makes blocking individual websites a poor way to stop the first step. […]

The post The Domains Keep Disappearing, but the Malware Infrastructure Behind Them Never Moves appeared first on Cyber Security News.

NVIDIA released a security update for its Infrastructure Controller software for Linux, addressing 14 vulnerabilities that could let attackers access sensitive system information, execute code, alter data, or disrupt affected environments. The update, published in NVIDIA’s September 2026 Infrastructure Controller security bulletin, affects versions 0 through 1.9. NVIDIA recommends that organizations clone or update the […]

The post NVIDIA Fixes Linux Component Flaws That Could Expose Sensitive System Information appeared first on Cyber Security News.

EvilTokens turns a Microsoft sign-in into a route to corporate email fraud. The phishing kit, first seen in February 2026, tricks people into approving an attacker’s login through a real device code process without handing over a password. The lure usually arrives as an urgent email about an invoice, shared file, document signature or expiring […]

The post The Phishing Kit That Turned Microsoft’s Login Flow Into an AI-Powered Fraud Machine appeared first on Cyber Security News.

Malware has moved into tools developers use to build and manage cloud infrastructure. A campaign linked to Graphalgo planted a remote access program in Terraform providers and Go software packages, turning routine development work into a possible route onto valuable machines. The packages did not behave like obvious malicious downloads. Some waited for particular inputs […]

The post The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths appeared first on Cyber Security News.

Cyberattacks are increasingly built around familiar actions: signing in, approving a payment, or using a trusted app. Artificial intelligence can help attackers repeat those actions at speed, making financial fraud and network intrusion harder to spot before damage is done. The threats take different forms. Some automate parts of a network break-in, while others imitate […]

The post AI-Driven Cyberattacks Enter New Phase With Autonomous Fraud and Digital Trust Abuse appeared first on Cyber Security News.

A free television offer led Android users to a dangerous download. Ads for a streaming service urged them to install an app that could give criminals control of their phones, rather than access to shows. The malware behind the campaign is called StreamRat. The ads targeted Spanish-speaking users in Spain. One campaign reached about 570,000 […]

The post A Fake Streaming App Turned Android Phones Into Remote-Controlled Devices appeared first on Cyber Security News.

SolarWinds released Observability Self-Hosted 2026.2.3 to fix two serious vulnerabilities that could let unauthenticated attackers remotely execute code on affected observability servers. The flaws, tracked as CVE-2026-28324 and CVE-2026-28325, affect specific non-default configurations and communication modes. The update was released on September 22, 2026, and is especially important for organizations running SolarWinds Observability Self-Hosted in […]

The post Critical SolarWinds Flaws Let Attackers Remotely Execute Code on Observability Servers appeared first on Cyber Security News.

EU digital identity and GDPR compliance mandates, deepfake-driven fraud in authentication and verification, and credential-reuse fatigue pushed decentralized identity from conference-talk to contract. We scored ten players on standards depth, production evidence, and enterprise readiness and flagged the market’s churn honestly, because this category retires vendors faster than most. Microsoft Entra Verified ID ranks #1 […]

The post Top 10 Best Decentralized Identity Solutions in 2026 [Ranked & Scored] appeared first on Cyber Security News.

ManageEngine has fixed a critical remote code execution vulnerability in ADSelfService Plus that could allow an unauthenticated attacker to run code as NT AUTHORITY\SYSTEM through a Windows device’s login screen. The flaw, tracked as CVE-2026-74849, affects the product’s GINA client in builds 7000 and earlier. Organizations should upgrade to build 7001 or later immediately. The […]

The post Critical ManageEngine Flaw Lets Attackers Gain SYSTEM Access Through Windows Login Screen appeared first on Cyber Security News.

Google has released Chrome 154 for Windows, macOS, and Linux, fixing 108 security vulnerabilities, including several critical memory-safety flaws that could potentially allow attackers to execute code through malicious web content. The update is rolling out gradually as Chrome 154.0.8037.57 for Linux and versions 154.0.8037.57/.58 for Windows and macOS. The release addresses eleven critical vulnerabilities […]

The post Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks appeared first on Cyber Security News.

A critical local privilege escalation flaw in Veeam Agent for Microsoft Windows is drawing attention after public proof-of-concept exploit code became available. The vulnerability, tracked as CVE-2026-32996, could let a low-privileged local user run commands with NT AUTHORITY\SYSTEM permissions on affected Windows devices. Technical details and exploit code were publicly released on September 14, 2026, […]

The post Veeam Agent Flaw Actively Exploited to Gain SYSTEM Privileges on Windows appeared first on Cyber Security News.

Red Hat has disclosed an Important security vulnerability in the OpenShift oc-mirror tool that could allow attackers to bypass PGP signature verification and introduce malicious release images into disconnected OpenShift environments. Tracked as CVE-2026-75939, the issue carries a CVSS v3.1 score of 7.4 and was made public on September 21, 2026. The flaw affects the […]

The post Red Hat OpenShift Flaw Lets Attackers Bypass PGP Checks and Push Malicious Releases appeared first on Cyber Security News.

BambooToken is a Linux backdoor that turns a lightweight messaging protocol into a remote control channel. The newly analysed sample can collect information about a host, run shell commands, and move files between a compromised machine and its operator. Its use of MQTT is notable because the protocol is common in connected-device environments and uses […]

The post BambooToken Linux Backdoor Uses MQTT C2 to Execute Shell Commands and Exfiltrate Files appeared first on Cyber Security News.

Hackers are using convincing copies of trusted websites to turn an ordinary browser visit into a full Windows compromise. The campaign pairs targeted phishing emails with a chained set of previously unknown flaws in Google Chrome and Microsoft Windows, giving attackers a quiet path from a fake page to malware on a victim’s device. The […]

The post Hackers Clone Legitimate Websites to Silently Trigger Chrome and Windows Zero-Day Exploits appeared first on Cyber Security News.