Cyber Security News

An Israeli spyware firm, Paragon Solutions, accidentally exposed its secretive Graphite control panel in a LinkedIn post, drawing sharp criticism from cybersecurity experts. The blunder offers a rare glimpse into the tool’s operations targeting encrypted communications. Cybersecurity researcher Jurre van Bergen spotted the image posted by Paragon’s general counsel on LinkedIn on February 11, 2026. […]

The post Israeli Spyware Firm Exposes Paragon Spyware Control Panel on LinkedIn appeared first on Cyber Security News.

Apple released iOS 26.3 and iPadOS 26.3 on February 11, 2026, patching over 40 vulnerabilities, including a critical zero-day in the dyld component actively exploited in targeted attacks. The update addresses CVE-2026-20700, a memory-corruption flaw discovered by Google’s Threat Analysis Group, which enables arbitrary code execution for attackers with memory-write access. Dyld, Apple’s Dynamic Link […]

The post Apple 0-Day Vulnerability Actively Exploited in Sophisticated Attack to Target Individuals appeared first on Cyber Security News.

A newly tracked intrusion framework called VoidLink is drawing attention for its modular design and focus on Linux systems. It behaves like an implant management framework, letting operators deploy a core implant and add capabilities as needed, which shortens the time from access to action. Recent activity has been linked to a threat actor Cisco […]

The post VoidLink Framework Enables On-Demand Tool Generation with Windows Plugin Support appeared first on Cyber Security News.

Modern warfare extends far beyond physical battlefields, increasingly infiltrating the digital servers and supply chains that safeguard national defense. Today, the sector faces a relentless barrage of cyber operations from state-sponsored actors and criminal groups alike. These attacks no longer focus solely on military entities but aggressively target defense contractors, aerospace manufacturers, and individual employees […]

The post GTIG Analysis Highlights Escalating Espionage and Supply Chain Risks Facing Defense Sector appeared first on Cyber Security News.

A sophisticated cyber threat has emerged, targeting users across multiple operating systems through compromised mirror websites and GitHub repositories. The RU-APT-ChainReaver-L campaign represents one of the most elaborate supply chain attacks identified recently, affecting Windows, macOS, and iOS platforms simultaneously. This campaign employs advanced techniques including code signing with valid certificates, deceptive redirect chains, and […]

The post RU-APT-ChainReaver-L Hijacks Trusted Websites and GitHub Repos in Massive Cross-Platform Supply Chain Campaign appeared first on Cyber Security News.

An unprecedented surge in exploitation attempts targeting CVE-2026-1281, a critical vulnerability in Ivanti Endpoint Manager Mobile (EPMM). On February 9, 2026, Shadowserver scans revealed over 28,300 unique source IP addresses attempting to exploit the flaw, marking one of the largest coordinated attack campaigns observed against enterprise mobile management infrastructure this year. CVE-2026-1281 is a pre-authentication […]

The post Massive Spike in Attacks Exploiting Ivanti EPMM Systems 0-day Vulnerability appeared first on Cyber Security News.

A sophisticated attack is targeting Windows Server systems using Prometei, a Russian-linked botnet that has been active since 2016. This multi-functional malware combines cryptocurrency mining, credential theft, and remote-control capabilities to maintain long-term access to compromised systems. The Prometei botnet infiltrates systems by exploiting weak or default credentials via Remote Desktop Protocol (RDP). Once attackers […]

The post Prometei Botnet Attacking Windows Server to Gain Remote Access and Deploy Malware appeared first on Cyber Security News.

A severe sandbox escape vulnerability has been discovered in the JavaScript library, enabling attackers to execute arbitrary code on host systems. The flaw, tracked as CVE-2026-25881 with a critical CVSS score of 8.3/10, affects all versions up to 0.8.30 and has been patched in version 0.8.31. The vulnerability exploits a weakness in SandboxJS’s protection mechanism. […]

The post Critical SandboxJS Vulnerability Allows Remote Host Takeover – PoC Released appeared first on Cyber Security News.

Cybercriminals have developed a sophisticated attack campaign that exploits user trust in artificial intelligence platforms to distribute the Atomic macOS Stealer (AMOS), marking a dangerous evolution in social engineering tactics. This new threat combines legitimate AI chatbot services from ChatGPT and Grok with paid Google advertising to lure unsuspecting Mac users into executing malicious terminal […]

The post Threat Actors Weaponize ChatGPT, Grok and Leverages Google Ads to Distribute macOS AMOS Stealer appeared first on Cyber Security News.

The ransomware landscape continues to evolve with new threat actors adopting unconventional tactics. Coinbase Cartel emerged in September 2025, quickly claiming 14 victims in its first month of operation. Unlike traditional ransomware groups, this threat actor focuses exclusively on data exfiltration without encrypting systems, representing a shift in cybercriminal strategies. This approach makes attacks quieter […]

The post Coinbase Cartel Targets High-Value Sectors with Data-Theft-First Extortion Strategy appeared first on Cyber Security News.

Microsoft has patched a zero-day vulnerability in the Windows Remote Access Connection Manager (RasMan) service, tracked as CVE-2026-21525, which allowed attackers to trigger denial-of-service (DoS) conditions on unpatched systems. The flaw, stemming from a NULL pointer dereference (CWE-476), was actively exploited in the wild before disclosure, earning an “Exploitation Detected” rating from Microsoft’s MSRC exploitability […]

The post Windows Remote Access Connection Manager 0-Day Vulnerability Let Attackers Trigger DoS Attack appeared first on Cyber Security News.

A sophisticated phishing campaign targets wedding planners and vendors with stealer malware disguised as Microsoft Teams meetings. Security researchers highlight the use of compromised legitimate emails to build trust before delivering payloads. Threat actors impersonate legal professionals in emails from czimmerman@craigzlaw[.]com, a domain tied to The Law Offices of Craig Zimmerman, a real consumer protection […]

The post Sophisticated Cyber Attack Targets Wedding Industry With Teams-Based Malware Delivery appeared first on Cyber Security News.

A dangerous information-stealing malware called Socelars is actively targeting Windows systems to collect sensitive authentication data, with particular focus on Facebook Ads Manager accounts and session cookies. Unlike traditional malware that causes immediate system damage, Socelars operates silently in the background, turning infected machines into gateways for account takeover and financial fraud. Socelars is sophisticated […]

The post Socelars Malware Attacking Windows Systems to Steal Sensitive Business Data appeared first on Cyber Security News.

Microsoft released Microsoft Patch Tuesday updates to address a critical zero-day vulnerability in Windows Shell that is currently being actively exploited in the wild. Tracked as CVE-2026-21510, this security flaw allows remote attackers to bypass essential protection mechanisms, putting millions of Windows users at risk. The vulnerability is classified as a “Security Feature Bypass” with a […]

The post Windows Shell Security Feature 0-Day Vulnerability Let Attackers Bypass Authentication appeared first on Cyber Security News.

A critical security update has been released for both the Community Edition (CE) and Enterprise Edition (EE) to address multiple high-severity vulnerabilities. The patches, available in versions 18.8.4, 18.7.4, and 18.6.6, fix flaws that could allow attackers to crash servers, steal data, or hijack user sessions. Security experts urge administrators of self-managed instances to upgrade […]

The post GitLab Patches Multiple Vulnerabilities That Enables DoS and Cross-site Scripting Attacks appeared first on Cyber Security News.

Microsoft has patched a critical remote code execution (RCE) flaw in the Windows Notepad app, tracked as CVE-2026-20841, which could let attackers run malicious code on victims’ machines. Disclosed on February 10, 2026, Microsoft Patch Tuesday updates, the vulnerability stems from improper neutralization of special elements in commands (CWE-77: Command Injection) and carries a CVSS […]

The post Windows Notepad Vulnerability Allows Attackers to Execute Malicious Code Remotely appeared first on Cyber Security News.

Microsoft has patched CVE-2026-21533, a zero-day elevation of privilege vulnerability in Windows Remote Desktop Services (RDS) that attackers are exploiting in the wild to gain SYSTEM-level access. The flaw stems from improper privilege management and was addressed in the February 2026 Patch Tuesday updates released on February 10. CVE-2026-21533 carries a CVSS v3.1 base score […]

The post Windows Remote Desktop Services 0-Day Vulnerability Exploited in the Wild to Escalate Privileges appeared first on Cyber Security News.

Microsoft released its February 2026 Patch Tuesday updates on February 10, addressing 54 vulnerabilities, including six zero-days across Windows, Office, Azure, and developer tools. The updates fix issues in products like Windows Remote Desktop Services, Microsoft Defender, Azure services, GitHub Copilot, Visual Studio Code, Microsoft Exchange, and Office apps. Severity ratings include two Critical flaws […]

The post Microsoft Patch Tuesday February 2026 – 54 Vulnerabilities Fixed, Including 6 Zero-days appeared first on Cyber Security News.

Fortinet has disclosed a high-severity cross-site scripting (XSS) vulnerability in its FortiSandbox platform, tracked as CVE-2025-52436 (FG-IR-25-093), that enables unauthenticated attackers to execute arbitrary commands on affected systems. Dubbed an “Improper Neutralization of Input During Web Page Generation” issue (CWE-79), the flaw resides in the graphical user interface (GUI) component and scores a 7.9. At […]

The post FortiSandbox XSS Vulnerability Let Attackers Run Arbitrary Commands appeared first on Cyber Security News.

High-performing SOC teams are increasingly turning to sandbox-derived threat intelligence to make threat hunting repeatable and impactful. Tools like ANY.RUN’s TI Lookup enables faster hunts grounded in real attacker behaviours from millions of analyses. Threat hunting remains a cornerstone of mature Security Operations Centers (SOCs), aiming to detect stealthy adversaries before they cause damage. However, […]

The post Threat Hunting Is Critical to SOC Maturity but Often Misses Real Attacks appeared first on Cyber Security News.