Cyber Security News

Axios has disclosed two high-severity vulnerabilities in its HTTP/2 implementation that could allow attackers to bypass outbound network controls or crash vulnerable Node.js applications. The flaws affect Axios versions 1.13.0 through 1.19.x and have been fixed in version 1.20.0 The first issue, tracked as GHSA-3pq3-5fj3-cg6v and CVE-2026-101898, affects Axios applications that use HTTP/2 requests alongside […]

The post Axios HTTP/2 Flaws Enable SSRF Control Bypass and Node.js Denial of Service appeared first on Cyber Security News.

Cloudflare is building a certificate authority to make post-quantum website authentication practical without burdening TLS connections with oversized signatures. The company plans to issue conventional certificates alongside Merkle Tree Certificates, or MTCs, and is targeting early 2027 for admission to Chrome’s new Quantum-resistant Root Store; standard MTC issuance will be free. The initiative addresses a […]

The post Cloudflare Builds Post-Quantum CA With Merkle Tree Certificates for Faster Quantum-Safe TLS appeared first on Cyber Security News.

Google released a Chrome Stable update fixing 32 security vulnerabilities across Windows, macOS, and Linux, including one critical and multiple high-severity flaws in V8, ANGLE, GPU, WebGPU, Bluetooth, Passwords, and UI components. Chrome version 154.0.8037.92/.93 is being rolled out to Windows and Mac users, while Linux users will receive version 154.0.8037.92. Google said it will […]

The post Google Releases Chrome Update With 32 Security Fixes for Windows, Mac and Linux appeared first on Cyber Security News.

Google has warned that threat actors are actively exploiting two critical Citrix NetScaler zero-day vulnerabilities to gain root access, install stealthy web shells, and move into victim networks. The activity has affected organizations in North America and Europe, including government, financial services, technology, education, legal, and professional-services sectors. Mandiant Consulting and Google Threat Intelligence Group […]

The post Google Warns of Hackers Actively Exploiting Citrix 0-Day Vulnerabilities to Deploy Web Shells appeared first on Cyber Security News.

Russian state-linked hackers have expanded a phishing operation that uses a new RedFlick delivery chain to reach more than 100 organizations. The campaign replaces an obvious malicious attachment with a conversation that looks like ordinary professional correspondence. The activity was recorded in at least 13 campaigns from January through August 2026, chiefly affecting organizations in […]

The post Russian Hackers Target 100+ Organizations With New RedFlick Phishing Attack appeared first on Cyber Security News.

Investigating a phishing alert often means working through several layers of activity before an analyst can confidently close or escalate the case. Modern campaigns can hide malicious activity behind encrypted traffic, CAPTCHA challenges, redirects, browser scripts, and token-based authentication, leaving analysts to reconstruct the attack before they can determine what happened.  The investigation does not […]

The post Phishing Response: 3 Steps SOC Teams Can Take to Investigate Threats Faster  appeared first on Cyber Security News.

PaperPhone is a large headless-browser network built to make automated web requests look like ordinary mobile traffic. It does not rely on a single obvious source. Instead, it spreads activity across thousands of addresses while repeatedly presenting fabricated phone and browser identities. The operation exposes weaknesses in simple IP-based defenses. Websites facing this traffic may […]

The post PaperPhone Headless Browser Network Uses 75,000 IPs and Fabricated Mobile Identities Across 43 Countries appeared first on Cyber Security News.

A routine software update can now open the door to a cloud breach. Attackers are hiding credential stealing malware inside trusted packages and development tools, allowing malicious code to run on developer computers and automated build systems before an application even starts. The threat spans several campaigns rather than one malware family. Shai-Hulud emerged in […]

The post Supply Chain Attacks Turn Developer Machines Into Gateways for Cloud Breaches appeared first on Cyber Security News.

Hackers are using familiar Zoom setup files and PDF reader downloads to place remote-control software on business computers. The campaign turns ordinary workplace prompts into a path for outsiders to take over a device. The phishing emails use meeting invitations, document requests, software updates, RSVP cards, job offers and delivery notices. Victims who follow the […]

The post Hackers Disguise Remote Access Tools as Zoom and PDF Installers to Take Over PCs appeared first on Cyber Security News.

AI coding agents exposed more than 13,000 internal screenshots from over 300 organizations by publishing them in publicly accessible GitHub repositories, according to “PixelLeak” research from Glow Labs. The material spanned more than 900 repositories across cloud, healthcare, fintech, government and AI, including several Fortune 500 companies. The exposures began with a routine development workflow. […]

The post AI Coding Agents Leak 13,000+ Internal Screenshots From 300+ Companies on GitHub appeared first on Cyber Security News.

A vulnerable print server became the entry point for an Active Directory compromise after attackers exploited two PaperCut MF zero-day flaws. The intrusion shows how an overlooked business system can give criminals access to sensitive identity infrastructure. The attackers targeted an internet-facing PaperCut MF server running version 24.0.2, build 69746. They delivered Java code through […]

The post Hackers Turned a PaperCut Print Server Into a Path to the Domain Controller appeared first on Cyber Security News.

RSA has announced RSA Agent ID, a new identity security platform that helps regulated organizations discover, secure, and govern AI agents. The launch targets financial services, government agencies, critical infrastructure operators, and other organizations that need to control what AI agents can access and prove who authorized sensitive actions. The platform addresses a growing problem […]

The post RSA Launches Agent ID Platform to Secure AI Agents and MCP Servers appeared first on Cyber Security News.

RATHat Android malware uses Gemini AI to help take control of infected phones beyond normal app permissions. The banking trojan abuses a developer feature to establish a separate command channel that can survive removal of the malicious application until the phone reboots. Attackers distribute it through malicious adverts and phishing text messages targeting Europe, Latin […]

The post RATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App Permissions appeared first on Cyber Security News.

Autonomous security research platform XBOW has disclosed CVE-2026-72018, a high-severity Linux kernel vulnerability that converts a tightly constrained out-of-bounds memory write into local root access. The flaw affects the DIBS loopback implementation used by the SMC-D shared-memory communication path, where a missing bounds check allows attacker-controlled data to be copied beyond an allocated kernel buffer. […]

The post AI Agent Finds Linux Kernel Bug That Turns a Tiny Memory Write Into Root Access appeared first on Cyber Security News.

A new open-source security tool, OperTraitor, has revealed how Kubernetes operators can create dangerous privilege escalation paths when they receive excessive role-based access control permissions. The tool analyzes operator manifests and compares their documented function with the permissions actually granted to their service accounts. Kubernetes operators automate administrative tasks such as deploying databases, monitoring workloads, […]

The post New OperTraitors Tool Reveals Dangerous Privilege Escalation Paths in Kubernetes Operators appeared first on Cyber Security News.

A now-patched vulnerability in Unsloth Studio allowed a malicious Hugging Face model repository to execute Python code when a user merely selected the model in the browser interface. Unsloth fixed the issue in version 2026.6.9, and users running Studio should upgrade immediately. Unsloth is a popular open-source library used to fine-tune and quantize large language […]

The post Unsloth Studio RCE Flaw Lets Malicious Hugging Face Models Execute Code appeared first on Cyber Security News.

A SectopRAT variant has been found hidden inside tampered Windows software, allowing attackers to control an infected computer and steal sensitive information. The intrusion used legitimate application components as cover, with encrypted files concealing the malware until it was loaded into memory. The affected program came from an Italian developer known for a long-running digital […]

The post Fortinet Uncovers SectopRAT Variant Hidden Inside Tampered Legitimate Windows Software appeared first on Cyber Security News.

A high-severity flaw in the official Model Context Protocol (MCP) Python SDK could allow a malicious MCP server to steal OAuth authentication material and take over AI agent accounts. The issue affects vulnerable HTTP-based MCP clients that connect to untrusted servers while using OAuth to access legitimate identity providers such as Google, Okta, or Microsoft […]

The post MCP Python SDK OAuth Flaw Lets Malicious Servers Hijack AI Agent Accounts appeared first on Cyber Security News.

OpenAI has upgraded Codex with Codex Security Cloud, an always-on application security service designed to scan GitHub repositories, monitor incoming commits, investigate flaws, remove duplicate findings, and prepare fixes for human review. The cloud-hosted system keeps operating when a developer’s laptop is closed, bringing continuous, agent-driven vulnerability analysis into Codex workflows. Available through a plugin […]

The post OpenAI Rolled out Codex Security Cloud, an Always-on Application Security Service appeared first on Cyber Security News.

Octopus Deploy has disclosed a high-severity vulnerability in Octopus Server that could allow authenticated users to execute arbitrary code on affected servers through insecure JSON deserialization. Tracked as CVE-2026-101169, the flaw affects Octopus Server deployments on Linux and Microsoft Windows. The company released Security Advisory 2026-10 on September 29, 2026, and urged customers to upgrade […]

The post Octopus Server Flaw Lets Authenticated Users Execute Code Through Insecure JSON Deserialization appeared first on Cyber Security News.