Cyber Security News

Security researchers successfully exploited vulnerabilities in the StealC malware infrastructure, gaining access to operator control panels and exposing a threat actor’s identity through their own stolen session cookies. The breach highlights critical security failures in criminal operations built around credential theft. XSS Vulnerability Exposes StealC Operators StealC, an information-stealing malware operating under a Malware-as-a-Service model […]

The post Researchers Gain Access to StealC Malware Command-and-Control Systems appeared first on Cyber Security News.

Microsoft’s January 13, 2026, security update for Windows 11 has triggered a frustrating bug: affected PCs refuse to shut down or hibernate, instead restarting. The issue is caused by KB5073455, which targets OS Build 22621.6491 on Windows 11 version 23H2. It was first reported on January 15 and arises from interference with Secure Launch, a […]

The post Windows 11 PCs Fail to Shut Down After January Security Update appeared first on Cyber Security News.

Cloudflare has acquired the team behind Astro, the popular open-source web framework for building fast, content-driven sites. Announced on January 16, 2026, the deal brings The Astro Technology Company’s full-time employees under Cloudflare’s umbrella to accelerate Astro’s development. Cloudflare positions the move as a commitment to open-source innovation, with Astro staying MIT-licensed, contribution-friendly, and platform-agnostic. […]

The post Cloudflare Acquired Open-source Web Framework Astro to Supercharge Development appeared first on Cyber Security News.

Cisco has confirmed active exploitation of a critical zero-day remote code execution vulnerability in its Secure Email Gateway and Secure Email and Web Manager appliances. Tracked as CVE-2025-20393, the flaw allows unauthenticated attackers to execute arbitrary root-level commands via crafted HTTP requests to the Spam Quarantine feature. The vulnerability stems from insufficient validation of HTTP […]

The post Cisco 0-Day RCE Secure Email Gateway Vulnerability Exploited in the Wild appeared first on Cyber Security News.

Google is gradually rolling out the ability to change the @gmail.com email address associated with a Google Account to a new @gmail.com address. This feature, previously unavailable, addresses a common pain point for users who regret their original username choice but didn’t want to abandon years of emails, photos, and data. We already notified you […]

The post Google Rolls Out Long-Awaited @gmail.com Email Change Feature for Users appeared first on Cyber Security News.

The Go programming language team has rolled out emergency point releases, Go 1.25.6 and 1.24.12, to address six high-impact security flaws. These updates fix denial-of-service (DoS) vectors, arbitrary code execution risks, and TLS mishandlings that could expose developers to remote attacks. While not branded as version 1.26, the patches urge immediate upgrades for projects relying […]

The post Go 1.25.6 and 1.24.12 Patch Critical Vulnerabilities Lead to DoS and Memory Exhaustion Risks appeared first on Cyber Security News.

Wiz Research has exposed that CodeBreach originated from unanchored regular expression patterns in CodeBuild webhook filters for the ACTOR_ID parameter, which should restrict builds to trusted GitHub user IDs. Without ^ and $ anchors, the filter matched any user ID containing an approved substring, allowing bypass via “eclipse” events where new, longer GitHub IDs incorporate […]

The post New AWS Console Supply Chain Attack Allows Hijack of AWS GitHub Repositories appeared first on Cyber Security News.

Threat actors are increasingly using trusted cloud and content delivery network platforms to host phishing kits, creating major detection challenges for security teams. Unlike traditional phishing campaigns that rely on newly registered suspicious domains, these attacks use legitimate infrastructure from providers like Google, Microsoft Azure, and AWS CloudFront. This approach allows hackers to bypass many […]

The post Hackers Abusing Legitimate Cloud and CDN Platforms to Host Phishing Kits appeared first on Cyber Security News.

Large language models have become deeply integrated into everyday business operations, from customer service chatbots to autonomous agents managing calendars, executing code, and handling financial transactions. This rapid expansion has created a critical security blind spot. Researchers have identified that attacks targeting these systems are not simple prompt injections as commonly believed, but rather sophisticated, […]

The post Promptware Kill Chain – Five-Step Kill Chain Model for Analyzing Cyberthreats appeared first on Cyber Security News.

Fortinet FortiSIEM vulnerability CVE-2025-64155 is under active exploitation, as confirmed by Defused through their honeypot deployments. This critical OS command injection flaw enables unauthenticated remote code execution, posing severe risks to enterprise security monitoring systems. CVE-2025-64155 stems from improper neutralization of special elements in OS commands within the FortiSIEM phMonitor service, which handles internal data […]

The post Fortinet FortiSIEM Vulnerability CVE-2025-64155 Actively Exploited in Attacks appeared first on Cyber Security News.

New York, United States, January 15th, 2026, CyberNewsWire BreachLock, a global leader in offensive security, today announced that its Adversarial Exposure Validation (AEV) solution now supports autonomous red teaming at the application layer, expanding beyond its initial network-layer capabilities introduced in early 2025.  BreachLock AEV’s generative AI-powered autonomous red teaming engine can now emulate real-world […]

The post BreachLock Expands Adversarial Exposure Validation (AEV) to Web Applications appeared first on Cyber Security News.

McLean, Virginia, United States, January 15th, 2026, CyberNewsWire A new Top 10 Cybersecurity Innovators profile by AppGuard has been released, spotlighting growing concerns over AI-enhanced malware. AI makes malware even more difficult to detect. Worse, they use AI to assess, adapt, and move faster than any cyber stack can keep up. The report advocates for […]

The post AppGuard Critiques AI Hyped Defenses; Expands its Insider Release for its Next-Generation Platform appeared first on Cyber Security News.

A high-severity vulnerability in Windows Admin Center’s Azure Single Sign-On implementation has exposed Azure virtual machines and Arc-connected systems to unauthorized access across entire tenants. Cymulate Research Labs discovered the flaw, now tracked as CVE-2026-20965, which demonstrates how improper token validation can collapse security boundaries between individual machines and complete Azure environments. Microsoft patched the […]

The post Azure Identity Token Vulnerability Enables Tenant-Wide Compromise in Windows Admin Center appeared first on Cyber Security News.

Cloudflare, the San Francisco-based cybersecurity and internet infrastructure giant, has acquired Human Native, a UK-based AI data marketplace. The deal aims to empower content creators with control over their data in the generative AI era, addressing rising tensions around web scraping and bot traffic. Human Native specializes in converting unstructured multimedia videos, articles, and more […]

The post Cloudflare Acquires Human Native to Strengthen AI Data Security appeared first on Cyber Security News.

Silver Spring, Maryland, January 15th, 2026, CyberNewsWire Aembit today announced the agenda and speaker lineup for NHIcon 2026: The Rise of Agentic AI Security, a virtual conference scheduled for Jan. 27. The second-annual event will examine the technical, operational, and security challenges emerging as agentic artificial intelligence systems enter enterprise environments. NHIcon 2026 will feature […]

The post Aembit Announces Agenda and Speaker Lineup for NHIcon 2026 on Agentic AI Security appeared first on Cyber Security News.

Critical security updates addressing CVE-2026-20824, a protection mechanism failure in Windows Remote Assistance that permits attackers to circumvent the Mark of the Web (MOTW) defense system. The vulnerability was disclosed on January 13, 2026, and affects multiple Windows platforms spanning from Windows 10 through Windows Server 2025. CVE-2026-20824 represents a security feature bypass vulnerability with […]

The post Windows Remote Assistance Vulnerability Allow Attacker to Bypass Security Features appeared first on Cyber Security News.

A new information-stealing malware named MonetaStealer has been discovered actively targeting macOS users through deceptive file disguises and social engineering tactics. Security researchers at Iru first identified this threat on January 6, 2026, when they found a suspicious Mach-O binary masquerading as a Windows executable file named Portfolio_Review.exe. The malware represents a growing concern for […]

The post MonetaStealer Malware Powered with AI Code Attacking macOS Users in the Wild appeared first on Cyber Security News.

A joint operation led by Microsoft and international law enforcement has dismantled a business email compromise (BEC) attack chain powered by the RedVDS fraud engine. RedVDS operated as a low‑cost “cybercrime subscription” platform, giving criminals disposable virtual machines that looked like normal Windows systems on the internet. Using these rented hosts, threat actors sent huge […]

The post Microsoft and Authorities Dismatles BEC Attack Chain Powered by RedVDS Fraud Engine appeared first on Cyber Security News.

A critical authentication bypass vulnerability in Cal.com’s scheduling platform enables attackers to hijack any user account by exploiting a flaw in the NextAuth JWT callback mechanism. Tracked as CVE-2026-23478, this vulnerability affects versions from 3.1.6 up to but not including 6.0.7, with patches available in version 6.0.7 and later. The vulnerability resides in a custom […]

The post Critical Cal.com Vulnerability Let Attackers Bypass Authentication and Hijack any User Account appeared first on Cyber Security News.

Mozilla released Firefox 147 on January 13, 2026, addressing 16 security vulnerabilities detailed in the Mozilla Foundation Security Advisory. The update patches critical issues across components such as graphics, JavaScript, and networking, addressing six high-impact flaws, including multiple sandbox escapes, that could enable arbitrary code execution if exploited. These fixes also apply to Firefox ESR […]

The post Firefox 147 Released With Fixes for 16 Vulnerabilities that Enable Arbitrary Code Execution appeared first on Cyber Security News.