Cyber Security News

New research reveals that malware already sitting on a compromised Windows PC can hijack Google’s synced passkeys and take over accounts without ever prompting the victim for a password, PIN, or fingerprint. The findings, detailed in the third part of a series examining passkey security, expose flaws in how Google’s Cloud Authenticator handles device trust, […]

The post Malware Can Steal Your Google Synced Passkey Without Asking for Your Password or Fingerprint appeared first on Cyber Security News.

Thermo Fisher Scientific has disclosed a high-severity security flaw affecting several of its Applied Biosystems Human Identification (HID) software products, warning that attackers could make nearly undetectable modifications to forensic DNA analysis files before they are processed. The vulnerability, tracked as CVE-2026-17583, carries a CVSS v4.0 score of 8.2 and was published on July 31, […]

The post DNA Test Software Vulnerability Allows Attackers to Alter Analysis Data appeared first on Cyber Security News.

A critical vulnerability in Ruby on Rails has raised new concerns about cloud data breaches, particularly for companies that host customer platforms in Amazon Web Services (AWS). Known as CVE-2026-66066 or KindaRails2Shell, this flaw affects Active Storage deployments that utilize the libvips image-processing library and accept uploads from untrusted users. While there is no specific […]

The post Public PoC Released for Critical Rails Active Storage RCE Vulnerability appeared first on Cyber Security News.

A set of high-severity vulnerabilities in Hugging Face’s diffusers library that allow a malicious model repository to silently execute arbitrary code on any machine that loads it. The flaws bypass trust_remote_code, the very safeguard designed to stop unreviewed code from running during the custom pipeline loading process, raising serious concerns for an AI ecosystem that […]

The post Hugging Face Diffusers Vulnerabilities Enable Remote Code Execution Through Malicious AI Models appeared first on Cyber Security News.

TP-Link has issued a security advisory regarding a high-severity vulnerability affecting its TL-WR940N V6 wireless router. This vulnerability, tracked as CVE-2026-12935, could allow unauthenticated attackers to trigger a denial-of-service condition or achieve remote code execution on vulnerable devices under certain circumstances. The issue lies within the router’s RTSP connection tracking (conntrack) feature. RTSP, or Real-Time […]

The post TP-Link TL-WR940N Vulnerability Enables Remote Code Execution Attacks appeared first on Cyber Security News.

Security researchers have issued a warning about a critical command injection vulnerability that is being actively exploited in on-premises VeloCloud Orchestrator (VCO) deployments. This vulnerability, tracked as CVE-2026-16812, allows remote attackers to access privileged internal functions and potentially take control of the VeloCloud Orchestrator host. The flaw has received the highest severity score of 10.0 […]

The post Hackers Exploit VeloCloud Orchestrator Command Injection Vulnerability in the Wild appeared first on Cyber Security News.

Android users are facing a new remote-access threat that hides behind a fake emergency alert application. The malware, called Octagon, poses as Bahrain’s BH Alert service and leads victims through a convincing setup process designed to win dangerous permissions. The campaign takes advantage of public concern during a period of regional tension. Victims are directed […]

The post Android RAT Survives Reboots Using Watchdog Services and Boot Receivers appeared first on Cyber Security News.

ModernStealer is the name behind underground posts claiming to offer military, government, nuclear, and aerospace material. The posts appeared on dark web forums and Telegram, making a single alias a concern for public-sector and defence teams. The activity is not a confirmed malware campaign or proof that every named organization was breached. It involves alleged […]

The post ModernStealer Threat Actor Linked to Government and Defense Data-Leak Claims appeared first on Cyber Security News.

Internet-facing SonicWall Secure Mobile Access, or SMA, appliances face a serious threat after attackers turned two flaws into a route to full VPN-gateway control. The campaign gives an outsider a way to move from a simple web request to root-level access, without a password, session or user interaction. The activity began before public disclosure and […]

The post Internet-Facing SonicWall SMA Appliances Face Zero-Click Root Compromise appeared first on Cyber Security News.

XCSSET has returned with a way to target macOS developers. The latest version, v40, hides inside poisoned Xcode projects and can turn a local build into a supply-chain compromise. Once activated, it can spread through other projects, raising risk for developers and the organizations that use their code. The malware family was first documented in […]

The post XCSSET v40 Abuses Chrome DevTools Protocol to Steal Cookies and Run Commands appeared first on Cyber Security News.

CALIFORNIA, USA, August 2nd, 2026, CyberNewswire AccuKnox, a leading Zero Trust Security platform, today announced that SabPaisa, an RBI-authorised digital payments company, has selected its AI-powered cloud security platform to ensure robust security of its payments platform. SabPaisa joins a growing roster of financial services leaders using AccuKnox to meet stringent compliance requirements while defending […]

The post SabPaisa Partners with AccuKnox for Zero Trust AI-Powered Cloud Security to Secure Its Payments Platform appeared first on Cyber Security News.

AI systems moved from experimental risk to confirmed attacker, a Cisco firewall zero-day was actively exploited in the wild, and a critical VMware authentication bypass put enterprise virtualization infrastructure at risk. Below is a roundup of the week’s most significant vulnerabilities, breaches, and security research. Critical VMware Authentication Bypass Flaws Broadcom issued advisory VMSA-2026-0006 covering […]

The post Weekly Cyber Security Newsletter– Claude Hacked 3 Companies, Cisco 0-Day, Word Copilot and VMware Flaw +20 Stories appeared first on Cyber Security News.

A significant data breach has hit SplitVPN, a Russian VPN provider formerly known as NotVPN, exposing the personal records of roughly 865,000 unique users. The incident, which occurred in July 2026, has raised fresh concerns about the reliability of “no-logs” promises made by privacy-focused services, since the exposed data reveals far more retention than the […]

The post SplitVPN Data Breach Exposes 865k Users’ Personal Records appeared first on Cyber Security News.

Brinks Home, one of North America’s largest residential security providers, has confirmed that hackers breached its IT systems after the notorious ShinyHunters extortion group claimed responsibility for stealing nearly five million records tied to the company’s Salesforce environment. The confirmation comes after the threat actors listed “BH Security, LLC (brinkshome.com)” on their leak site, threatening […]

The post Brinks Home Confirms Data Breach Following ShinyHunters Claim appeared first on Cyber Security News.

Nearly every attack touches DNS the phishing click, the malware callback, the exfiltration tunnel which makes the DNS layer the cheapest place to break kill chains. Cisco Umbrella is our top pick for 2026 on the strength of Talos-fed intelligence and proven scale, with Infoblox leading DDI-integrated security and Akamai delivering edge-scale protection. DNS security […]

The post Top 10 Best DNS Security Solutions in 2026 appeared first on Cyber Security News.

A web application firewall (WAF) filters malicious HTTP/S traffic SQL injection, cross-site scripting, credential stuffing, and API abuse — before it reaches your applications. Cloudflare is our top WAF pick for 2026 on the strength of protection-per-dollar and a massive attack-visibility network, with Akamai and Imperva holding the enterprise depth tier and AWS WAF owning […]

The post Top 10 Best Web Application Firewall (WAF) in 2026 appeared first on Cyber Security News.

Cloud workloads don’t sit behind your data-center firewall, and attackers know it. A cloud firewall inspects and controls traffic to, from, and between cloud workloads VPC-to-VPC, workload-to-internet, and cloud-to-on-prem where traditional appliances can’t reach. Palo Alto Networks Cloud NGFW is our top pick for 2026 on managed NGFW depth, with Fortinet delivering the best licensed […]

The post Top 10 Best Cloud Firewall Solutions in 2026 appeared first on Cyber Security News.

Microsoft has released a detailed update on its Windows quality initiative, four months after committing in March to improve performance, reliability, and everyday user experiences across Windows 11. The company says early improvements are already reaching Windows Insiders and will begin rolling out more broadly to Windows 11 PCs this fall, while stressing that work […]

The post Windows 11 Gets More Taskbar Control and AI Integration as Microsoft Details Quality Progress appeared first on Cyber Security News.

Adform, a major advertising technology company serving roughly 14,000 businesses and holding nearly 30% of the demand-side platform market, has suffered a supply chain compromise that turned its trusted ad-serving infrastructure into a distribution channel for cryptocurrency-stealing malware. Security researcher Kevin Beaumont uncovered the breach and revealed that attackers hijacked a widely used JavaScript file […]

The post Hackers Turned a Trusted Advertising Platform Into a Crypto-Stealer Delivery Network appeared first on Cyber Security News.

Arch Linux has temporarily disabled package adoption on its Arch User Repository (AUR) after security teams detected a wave of malicious takeovers and follow-up commits designed to compromise unsuspecting users. The move, announced by Robin Candau (known online as Antiz) on behalf of the Arch Linux DevOps team, comes as attackers increasingly exploit an abandoned […]

The post Arch Linux Disables AUR Package Takeovers as Attackers Push Malicious Commits appeared first on Cyber Security News.