Cyber Security News

Hackers are impersonating ChatGPT, Claude and Gemini with fake advertising products that steal passwords and multifactor authentication codes. Instead of delivering a conventional malware download, the campaign uses convincing websites and live human operators to guide victims through fraudulent sign-in screens. Invitation emails lead advertisers to pages promising campaign planning, spending audits and account connections. […]

The post Hackers Use Fake ChatGPT, Claude and Gemini Ads to Steal Passwords and MFA Codes appeared first on Cyber Security News.

WordPress released version 7.1.3 on October 6, 2026, addressing vulnerabilities involving cross-site scripting, SQL injection, information disclosure, and other security weaknesses. The project recommends immediate updates, with fixes also available for older affected branches. Only the latest WordPress version remains actively supported. The release documentation lists seven security issues, although its introductory sentence describes “one […]

The post Critical WordPress Vulnerabilities Enable XSS, SQL Injection and Data Disclosure Attacks appeared first on Cyber Security News.

OpenSSH 10.6, released on October 6, 2026, fixes security flaws that could expose secrets, write files outside intended folders, or enable shell injection under specific conditions. The update covers both client and server tools, making it relevant to administrators and users who rely on SSH for remote access and file transfers. The official release notes […]

The post Multiple OpenSSH Vulnerabilities Could Enable Plaintext Recovery, File Write and Injection Attacks appeared first on Cyber Security News.

Security researchers reportedly exploited 32 unique zero-day vulnerabilities and earned $388,500 on the opening day of Pwn2Own Ireland 2026. Samsung Galaxy S26, OpenAI Codex, smart home devices and AI services fell to working exploits, but the Google Pixel 10 attempt failed within the contest time limit. The October 6 results show how security gaps span […]

The post 32 Unique 0-Days Exploited in Samsung S26, Pixel 10, OpenAI Codex and Other Devices in Pwn2Own 2026 appeared first on Cyber Security News.

Google released a major Chrome security update on October 6, 2026, fixing 247 vulnerabilities, including four critical memory-safety flaws, across Windows, Mac, and Linux. The patched versions are 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 for Linux. Although the critical bugs raise concerns about possible code execution, Google’s announcement identifies them as use-after-free vulnerabilities. It […]

The post Google Chrome Update Fixes Massive 247 Vulnerabilities, Including 4 Code Execution Flaws appeared first on Cyber Security News.

IAST’s core idea watch the running app from inside and confirm which findings are real won so thoroughly that platforms absorbed it, and the standalone market shrank. Integrating Interactive Application Security Testing (IAST) runtime monitoring has transformed how security teams validate exploitable code paths during execution, ensuring that securing modern enterprise applications through DevSecOps relies […]

The post Top 10 Best IAST Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Veeam has released Veeam Backup & Replication 12.3.2 P4, build 12.3.2.4934, to address four security vulnerabilities, including a flaw that lets attackers execute malicious scripts in an authenticated user’s browser. Released on October 6, 2026, the update also fixes a critical remote code execution vulnerability affecting the backup server. The vulnerabilities carry CVSS 4.0 scores […]

The post Veeam Backup and Replication Vulnerability Allow Attackers to Execute Malicious Script appeared first on Cyber Security News.

A scanner that can’t authenticate, crawl a SPA, or read an API schema is testing your login page and calling it coverage. We scored ten DAST options with modern-stack capability as the qualifying bar. Evaluating the market alongside the Top 10 Best Dynamic Application Security Testing (DAST) Platforms makes it clear that black-box security testing […]

The post Top 10 Best DAST Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Hackers concealed the Vasilek backdoor inside an existing VMware Tools installation during a prolonged intrusion at a medical organization. The attackers maintained access for approximately two years, exposing sensitive medical information while leaving systems operational rather than launching a destructive attack. The earliest evidence dates to early 2024. Investigators found signs of remote command execution, […]

The post Hackers Hide Vasilek Backdoor Inside VMware Tools to Target Medical Organizations appeared first on Cyber Security News.

Ernst & Young (EY) has warned that a cyber breach exposed personal and financial information belonging to individuals linked to Goldman Sachs and Man Group. The incident affected a platform used to support EY’s tax services, rather than the financial firms’ own systems. As the Financial Times first reported, the latest disclosures widen the known impact […]

The post EY Data Breach Exposes Goldman Sachs and Man Group Clients’ Data appeared first on Cyber Security News.

A malicious HEIC image can become a route to remote code execution on a WordPress server. Researchers have demonstrated an attack chain that turns a normal Media Library upload into code execution in the PHP-FPM process that runs the site. The risk comes from libheif, a widely used component that reads HEIC, HEIF and AVIF […]

The post Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers appeared first on Cyber Security News.

Investigators in Timor-Leste have detained 16 people after raiding a building in Dili allegedly used to run telephone scams against people in Japan. The suspects are accused of posing as Japanese police, using staged surroundings and a prepared script to make their claims appear credible. The group included seven Japanese nationals and six Chinese nationals. […]

The post 16 Suspects Detained in Timor-Leste for Japanese Police Impersonation Scam appeared first on Cyber Security News.

Blockchain investigator ZachXBT says he infiltrated a Chinese crypto laundering network linked to North Korea’s Lazarus Group after the $1.5 billion Bybit hack. His investigation connected private chats with public blockchain records and, he says, helped freeze stolen funds while exposing operators who claimed to handle money from several major thefts. In an October 5 […]

The post Researcher Infiltrates Lazarus Group’s Crypto Laundering Network After $1.5B Bybit Hack appeared first on Cyber Security News.

An AI agent breached the Dutch Institute for Vulnerability Disclosure by chaining two previously unknown flaws in Zammad, an open source helpdesk platform. The September 21, 2026 attack moved from a hijacked session to root access, giving the intruder full control of the server within seconds. DIVD detected the intrusion the following day and blocked […]

The post Zammad Zero-Day Chain Lets AI Agent Hijack Sessions, Execute Code and Escalate to Root appeared first on Cyber Security News.

The U.S. Cybersecurity and Infrastructure Security Agency has added a Citrix NetScaler vulnerability, tracked as CVE-2026-88779, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw affects Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). CVE-2026-88779 is an improper restriction of operations within the bounds of a memory […]

The post CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.

Google’s Gemini Desktop app may soon introduce a “Full Access” permission that would let the AI assistant read files, control applications, access network services, and take action across a user’s Mac. The capability appears to be part of a hidden “Additional sandbox options” setting discovered in a recent version of the Gemini Desktop app. The […]

The post Google Gemini Will Soon Get Full Access Permission to Use Your Computer appeared first on Cyber Security News.

A new ClickFix campaign is turning a web safety check into a route for malware. Visitors to compromised websites see a fake CAPTCHA or repair message and are told to open the Windows Run dialog, paste copied text, and press Enter. The instruction looks simple, but it makes the victim run the attacker’s command. The […]

The post ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache appeared first on Cyber Security News.

RemoveMacAI, an open-source tool on GitHub, lets Mac users disable Apple Intelligence, remove its downloaded models, and block future downloads. The utility can recover roughly 10GB to 12GB of storage, depending on which models are present. Its changes are reversible, and the removal process leaves macOS System Integrity Protection enabled. The tool addresses a storage […]

The post RemoveMacAI Free Up 12GB of Data by Removing Apple Intelligence Models appeared first on Cyber Security News.

GlassWorm is turning developer tools into malware delivery channels, this time through extensions advertised as attractive VS Code themes. The investigated cluster spans Visual Studio Marketplace and Open VSX, showing how appearance changes can provide cover for code that runs on developer machines. The campaign first surfaced in October 2025 and has since expanded across […]

The post GlassWorm Supply Chain Attack Uses Fake VS Code Themes to Deliver Hidden Malware appeared first on Cyber Security News.

Apple plans to add stronger controls to Full Disk Access in macOS, warning that the powerful permission can expose a user’s most private data as AI agents become more capable. The company said the change will require users to take a far more deliberate action before granting an app this broad level of access. Full […]

The post Apple Tightens macOS Full Disk Access as AI Agents Become More Powerful appeared first on Cyber Security News.