Cyber Security News

Windows administrators are facing a disruptive bug in Windows Server 2016 following Microsoft’s May 12, 2026, security update KB5087537. The update introduced a critical flaw that caused domain controller discovery to completely fail on servers configured with hostnames exceeding the 15-character NetBIOS limit, leaving administrators unable to perform essential network operations. Microsoft acknowledged the issue […]

The post Windows Server 2016 Domain Controller May Fail with 15-Character Hostname appeared first on Cyber Security News.

Hackers are targeting software developers by creating fake installation pages for two popular AI coding tools, Gemini CLI and Claude Code. The attackers are using a technique called SEO poisoning to push their malicious websites above real ones in search results, tricking developers into running dangerous commands on their own machines. The campaign began surfacing […]

The post Hackers Use SEO Poisoning to Impersonate Gemini CLI and Claude Code Installers appeared first on Cyber Security News.

A newly disclosed security issue in Memcached has raised concerns after developers confirmed a timing side-channel vulnerability in its SASL authentication mechanism that could allow attackers to infer valid usernames, now tracked as CVE‑2026‑47783. The flaw was addressed in the recently released Memcached version 1.6.42, a security-focused update that fixes multiple critical bugs affecting stability […]

The post Critical Memcached SASL Vulnerability Let Attackers Infer Valid Usernames appeared first on Cyber Security News.

A newly disclosed vulnerability in Apache CXF, tracked as CVE-2026-44930, is raising concerns among enterprise users relying on its XKMS (XML Key Management Specification) services. The flaw, classified as an important severity issue, affects the LDAP-based certificate repository component and could allow attackers to retrieve arbitrary digital certificates from vulnerable systems. Apache CXF is widely […]

The post Apache CXF LDAP Injection Vulnerability Let Attacker Retrieve Arbitrary Certificates appeared first on Cyber Security News.

ConnectWise has disclosed a high-impact security vulnerability in its Automate platform that could allow attackers to bypass critical security checks and execute malicious code under specific conditions. The flaw, tracked as CVE-2026-9089, affects versions of ConnectWise Automate before 2026.5 and has been assigned a CVSS score of 8.8, highlighting its potential severity in managed service […]

The post ConnectWise Automate Vulnerability Let Attackers Bypass Security Checks appeared first on Cyber Security News.

The European Union is on the verge of issuing its largest-ever penalty under the Digital Markets Act, targeting Alphabet’s Google for allegedly manipulating search results to favor its own services over competitors, a move set to further strain transatlantic tech relations. Brussels has formally accused Google and its parent company, Alphabet, of violating the Digital Markets […]

The post EU Finalizes Record DMA Fine Against Google Over Search Self-Preferencing Abuse appeared first on Cyber Security News.

A new wave of phishing operations is quietly changing the way cybercriminals steal financial data from everyday people. Rather than relying on traditional SMS messages that carriers can easily flag and block, threat actors are now using encrypted messaging channels like Rich Communication Services (RCS) and Apple iMessage to deliver malicious links directly to victims’ […]

The post Phishing Services Use RCS and iMessage to Bypass Traditional SMS Security Filters appeared first on Cyber Security News.

A dangerous new ransomware strain called Payload has been quietly building a global victim list since it first appeared in February 2026. The group launched its leak site with a high-profile target and has since expanded operations across Egypt, Mexico, Poland, and beyond. What makes this threat stand out is not just its reach, but […]

The post Payload Ransomware Uses ChaCha20 and Curve25519 ECDH to Encrypt Windows Files appeared first on Cyber Security News.

PuTTY 0.84 has been released with fixes for multiple minor security flaws, including issues that could trigger SSH key exchange crashes and a Telnet prompt spoofing weakness. While these vulnerabilities are considered low severity, they highlight how even small flaws in cryptographic handling and session logic can be abused in specific attack scenarios, particularly by […]

The post PuTTY 0.84 Released With Fix for SSH KEX Crashes and Telnet Prompt Spoofing Flaw appeared first on Cyber Security News.

A critical heap buffer overflow vulnerability has been disclosed in 7-Zip version 26.00, enabling attackers to achieve arbitrary code execution via a vtable hijack by exploiting a defect in the tool’s NTFS archive handler. Tracked as CVE-2026-48095 and assigned advisory GHSL-2026-140, the flaw resides in the CInStream::GetCuSize() function inside NtfsHandler.cpp. The function computes the NTFS […]

The post New 7-Zip Vulnerabilities Let Attackers Execute Arbitrary Code and Compromise Systems appeared first on Cyber Security News.

Anthropic appears to be loosening its grip on Claude Mythos, the company’s most powerful and previously restricted AI model, with new signals pointing to a commercially versioned release under the name Mythos 1 (claude-mythos-1-preview), integrated directly into Claude Code and a revamped Claude Security dashboard targeting enterprise customers. Claude Mythos first surfaced in late March […]

The post Anthropic’s Restricted Claude Mythos Moves Toward Public Release via Claude Code and Security appeared first on Cyber Security News.

A North Korea-linked hacker group has quietly upgraded one of its most dangerous tools, making it harder for security software to detect. InvisibleFerret, an information-stealing malware tied to the threat actor known as Void Dokkaebi (also tracked as Famous Chollima), has been repackaged into a format that slips past many traditional detection methods. Instead of […]

The post InvisibleFerret Malware Now Ships as .pyd and .so Files to Evade Script Detection appeared first on Cyber Security News.

A well-known advanced persistent threat group called Cloud Atlas has been caught using a dangerous technique to hijack Windows systems without alerting anyone on the network. The group modifies a core Windows file called termsrv.dll to unlock multiple simultaneous Remote Desktop Protocol (RDP) sessions on a victim’s computer. This lets attackers work in the background […]

The post Cloud Atlas APT Group Modifies termsrv.dll to Enable Multiple RDP Sessions on Victim Hosts appeared first on Cyber Security News.

Cybercriminals are openly selling verified bank accounts, fintech wallets, and cryptocurrency exchange accounts through Telegram channels, turning money laundering into a structured, on-demand criminal service. This underground market has grown far beyond informal recruitment and now operates like a professional industry, complete with tiered pricing, customer support, and account replacement guarantees. The funds moved through […]

The post Cybercriminals Use Telegram Channels to Sell Verified Bank and Fintech Mule Accounts appeared first on Cyber Security News.

A new supply chain attack campaign is quietly targeting developers through a method most would never think to look for. Hidden inside software packages on GitHub, a malicious script downloads a Linux binary during installation and disguises it using a filename designed to look like a standard system process. The attack has now touched more […]

The post Hackers Hide Linux Payload Under SSH-Like Filename During Package Installation appeared first on Cyber Security News.

A solo Russian-speaking threat actor leveraged a jailbroken instance of Google Gemini to run a five-year MAGA-themed influence operation, crack WordPress administrator credentials, and empty at least one victim’s cryptocurrency wallet, all at near-zero cost using stolen API keys. In May 2026, TrendAI™ Research uncovered the full operational infrastructure of a threat actor tracked as […]

The post Russian Hacker Used Jailbroken Gemini to Steal Admin Credentials and Drain Crypto Wallets appeared first on Cyber Security News.

Hackers are actively abusing a flaw in shared Content Delivery Network (CDN) infrastructure to hide malicious traffic behind trusted, high-reputation domains, effectively slipping past the security tools that organizations rely on every day. The technique, now tracked under the name “Underminr,” is not a software bug but a deliberate abuse of how CDNs are designed […]

The post Hackers Abuse Shared CDN Infrastructure to Bypass Domain Reputation Security Controls appeared first on Cyber Security News.

A newly disclosed zero-day vulnerability in the KnowledgeDeliver Learning Management System (LMS) has been actively exploited in the wild to deploy the BLUEBEAM in-memory web shell, according to Mandiant’s incident response findings. The flaw, now tracked as CVE-2026-5426, enables unauthenticated remote code execution (RCE) and affects deployments that relied on default ASP.NET configuration settings prior […]

The post KnowledgeDeliver LMS Zero-Day Exploited to Deploy BLUEBEAM Web Shell appeared first on Cyber Security News.

A well-known Iranian threat group has found a new way to push malware onto people’s machines. Instead of sending phishing emails, the group built a fake website that impersonated a real database software download page and used search engine tricks to rank it near the top of results. Anyone who searched for the tool online […]

The post Iranian APT Uses SEO Poisoning to Deliver Fake SQL Developer Malware Installer appeared first on Cyber Security News.

A Russian state-sponsored threat group has quietly upgraded one of its most powerful cyber weapons, and the result is a spying tool that is harder to detect, harder to kill, and more capable than ever before. Security researchers have now confirmed that Kazuar, a sophisticated backdoor long used by Secret Blizzard, has evolved from a […]

The post Kazuar Malware Evolves Into Modular Espionage Ecosystem for Secret Blizzard Operations appeared first on Cyber Security News.