Cyber Security News

Cybercriminals are exploiting intense interest in Grand Theft Auto VI by pushing fake game downloads that install several types of malware instead of a playable game. The campaign targets people looking for an early build, leaked copy, or unofficial demo before the title’s release. The malicious downloads are distributed through poisoned search results, gaming forums, […]

The post Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware appeared first on Cyber Security News.

WordPress has rolled out an automated, AI-driven security review that screens every plugin release before it reaches the WordPress.org update API, adding a critical checkpoint to a distribution pipeline that had previously lacked one. The move follows a real-world incident in which a backdoor was slipped into an update for a plugin with roughly 20,000 […]

The post WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites appeared first on Cyber Security News.

A new phishing campaign is moving fake login pages into victims’ browsers. Rather than sending people to a malicious website, its operators use browser-generated blob URLs to assemble the page in local memory, leaving less for security tools to inspect before it appears. The operation starts with a DocuSign-themed email carrying a calendar invitation. Its […]

The post Hackers Use Blob URLs and Microsoft Teams to Create Phishing Pages Inside Victims’ Browsers appeared first on Cyber Security News.

Cisco Talos has confirmed active exploitation of two vulnerabilities affecting Cisco Secure Firewall Management Center (FMC) Software, with state-sponsored hacking groups and a ransomware affiliate leveraging the flaws to seize root access, plant malware, and stage attacks on enterprise networks. The disclosure marks one of the year’s more serious enterprise security incidents, given FMC’s role […]

The post Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware appeared first on Cyber Security News.

CISA added a critical Citrix NetScaler authentication bypass flaw (CVE-2026-19490) to its Known Exploited Vulnerabilities catalog after observing in-the-wild attacks targeting the issue. Federal civilian agencies must apply vendor mitigations by September 12, 2026. CVE-2026-19490 affects Citrix NetScaler ADC and NetScaler Gateway appliances configured as an Authentication, Authorization and Auditing virtual server or as a […]

The post CISA Warns of Citrix NetScaler Authentication Bypass Vulnerability Exploited in Attacks appeared first on Cyber Security News.

Hackers are using passkey-themed phishing to take control of Microsoft 365 accounts and collect cloud data. It can defeat MFA protections. The campaign starts with calls and texts to employees. Attackers pose as IT support, claim a passkey, MFA, or single sign-on setting needs attention, and direct targets to lookalike sign-in pages. Compromised accounts can […]

The post Hackers Use Passkey-Themed Phishing to Hijack Microsoft 365 Accounts and Steal Cloud Data appeared first on Cyber Security News.

Enterprise AI workflows can be vulnerable to misuse that exposes sensitive information without prompt injection, account compromise, or jailbreaking a large language model. This vulnerability, termed Workflow Identity Hijacking, exploits authorization gaps between external requesters and the privileged identities used by AI automation. Workflows linked to public-facing email inboxes, web forms, GitHub issues, shared documents, […]

The post Hackers Can Turn AI Workflows Into Privileged Data-Stealing Proxies Without Jailbreaking Models appeared first on Cyber Security News.

Check Point Software has disclosed and patched two critical VPN-related vulnerabilities, CVE-2026-85102 and CVE-2026-85103, both carrying a maximum CVSS score of 9.8 and both capable of allowing unauthenticated remote code execution under specific conditions. Check Point’s own research team uncovered the flaws, and the company says it has found no evidence of active exploitation or […]

The post Critical Check Point VPN Vulnerabilities Enable Remote Code Execution Attacks appeared first on Cyber Security News.

LiteLLM deployments can expose far more than an organization’s AI spending. Newly disclosed weaknesses in the open-source gateway could let attackers run code as root inside a container, reach connected tools, and retrieve cloud credentials that open a path into a wider environment. The risk is serious where the service is internet-facing or retains its […]

The post LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials appeared first on Cyber Security News.

Threat actors are increasingly abusing Active Directory replication to impersonate domain controllers and steal password hashes from enterprise networks. This technique, known as a DCSync attack, can let attackers obtain credential data for privileged accounts without deploying malware directly on a legitimate domain controller. Active Directory domain controllers manage authentication across Windows enterprise environments. They […]

The post Hackers Pose as Domain Controllers to Steal Active Directory Password Hashes appeared first on Cyber Security News.

Multiple espionage-motivated threat actors have rapidly adopted a newly discovered exploit kit that chains Chrome browser and Microsoft Windows vulnerabilities to deploy backdoors and surveillance tools against government, defense, and commercial targets worldwide. Security researchers at Proofpoint have named the kit “BlueMoon,” identifying its use by at least four distinct threat clusters since late August […]

The post Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks appeared first on Cyber Security News.

Healthcare technology company Veradigm Inc. disclosed that a cybersecurity incident at one of its third-party vendors exposed sensitive patient data, including Social Security numbers, for a limited group of the company’s customers. The disclosure, filed with the U.S. Securities and Exchange Commission on September 8, 2026, marks the latest in a string of vendor-related breaches […]

The post Veradigm Confirms Patient Data Exposed in Third-Party Data Breach appeared first on Cyber Security News.

Recently, ANY.RUN researchers uncovered N0va, a new phishkit targeting organizations across North America and the EU, including government, technology, consulting, and healthcare.  What makes N0va especially relevant for SOC leaders is how it spreads the attack across different layers. Legitimate authentication, trusted brand lures, compromised websites, and cloud infrastructure can leave security teams with only part of the picture, […]

The post New N0va Phishkit Targets North America and EU: A Growing Identity Risk for SOCs   appeared first on Cyber Security News.

A Russian-speaking threat actor has weaponized artificial intelligence at an unprecedented scale, deploying hundreds of autonomous AI agents to exploit critical vulnerabilities in PaperCut NG/MF print management software and compromise at least 440 servers across 395 organizations in 48 countries. Security researchers at GreyNoise identified the campaign through their Global Observation Grid, a network of […]

The post Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide appeared first on Cyber Security News.

ClearFake has expanded a fake CAPTCHA scam into a chain that steals cryptocurrency and credentials while disabling endpoint protection. It turns compromised websites into launchpads, relying on visitors to run a command that appears routine. The operation begins with injected browser code, blockchain-hosted instructions, and a ClickFix prompt styled as a Google CAPTCHA. After a […]

The post ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools appeared first on Cyber Security News.

Software developers are being targeted with fake job offers that turn routine coding tests into a path for remote access malware. The campaign uses recruiter personas on LinkedIn and other employment platforms to deliver projects that appear safe enough to run. The operation is attributed to the Iran-linked group Mirage Kitten, also known as UNC1549. […]

The post Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs appeared first on Cyber Security News.

A critical cross-site scripting vulnerability in the widely used MapLibre GL JS library could expose applications and an estimated 2.7 million users to zero-click attacks. The flaw, tracked as CVE-2026-85061 and GitHub Security Advisory GHSA-jrc7-96c5-q579, affects maplibre-gl versions 6.4.0 and earlier. MapLibre GL JS is an open-source JavaScript mapping library used by websites and web […]

The post MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks appeared first on Cyber Security News.

Microsoft is expanding Windows Family Safety with account-based age verification, privacy-focused age signals, and improved parental controls. The company said the updates are designed to help Windows apps, games, services, and AI experiences provide protections that match a user’s age. The initiative uses the Microsoft account as the central identity layer for family safety on […]

The post Microsoft Expands Windows Family Safety With Built-In Age Verification and Parental Controls appeared first on Cyber Security News.

Two critical flaws in ArangoDB can let an outsider bypass login controls, read or alter database data, and then gain root-level code execution on the underlying host. The issues affect installations through version 3.12.10.1, creating serious risk for internet-facing databases and container deployments. The attack does not rely on stolen passwords, a user click, or […]

The post Critical ArangoDB Flaws Allow Authentication Bypass and Remote Code Execution as Root appeared first on Cyber Security News.

Google released the Android Security Bulletin for September 2026, addressing several critical vulnerabilities that could let attackers execute code remotely on affected devices. The update, published on September 8, includes security patch levels dated 2026-09-01 and 2026-09-05. Android users should install the latest available update as soon as their device manufacturer releases it. The most […]

The post Android Security Update September 2026 – Fix for Critical Flaws that Enable RCE Attacks appeared first on Cyber Security News.