Cyber Security News

A major identity-theft operation is now targeting over 100 high-value organizations across multiple industries. The threat comes from SLSH, a dangerous alliance combining the tactics of Scattered Spider, LAPSUS$, and ShinyHunters. Unlike typical automated attacks, this campaign uses real people calling your employees while simultaneously running fake login pages that look exactly like your company’s […]

The post Canva, Atlassian, Epic Games Among the 100+ Enterprises Targeted by ShinyHunters Group appeared first on Cyber Security News.

Threat actors have started targeting companies in the insurance, e-commerce, and IT sectors through a critical vulnerability tracked as CVE-2025-55182, commonly known as React2Shell. This flaw exists in the Flight protocol that handles client-server communication for React Server Components, allowing attackers to run unauthorized code on vulnerable servers. The vulnerability originates from insecure deserialization, where […]

The post Attackers Exploiting React2Shell Vulnerability to Attack IT Sectors appeared first on Cyber Security News.

Security Operations Centers live or die by their ability to respond quickly and accurately to alerts. At the heart of this process is alert triage — the initial evaluation that decides whether an alert is a real incident, a false positive, or something that needs immediate escalation. When Tier 1 analysts get triage wrong, detection speed collapses, response resources are misused, and […]

The post Your Tier 1 Analyst at SOC Team Is Failing at Effective Triage. That’s a Business Problem  appeared first on Cyber Security News.

Cybercriminals have adopted a deceptive strategy to compromise users searching for common software applications online. These attackers are using search engine optimization poisoning techniques to place malicious links at the top of search results. When unsuspecting users click on these links, they download infected files instead of legitimate tools. This growing threat targets individuals seeking […]

The post Hackers are Leveraging SEO Poisoning to Attack Users Looking for Legitimate Tools appeared first on Cyber Security News.

MEDUSA, an AI-first Static Application Security Testing (SAST) tool boasting 74 specialized scanners and over 180 AI agent security rules. This open-source CLI scanner targets modern development challenges like false positives and multi-language coverage. MEDUSA consolidates security scanning across 42+ languages and file types, including Python, JavaScript, Go, Rust, Java, Dockerfiles, Terraform, and Kubernetes manifests. […]

The post MEDUSA Security Testing Tool With 74 Scanners and 180+ AI Agent Security Rules appeared first on Cyber Security News.

Over 6,000 SmarterMail servers exposed on the internet are running vulnerable versions that are at risk of active remote code execution (RCE) attacks. Security researchers identified the flaws through daily HTTP vulnerability scans, and exploitation attempts have already been observed in the wild. This represents a significant threat to organizations worldwide relying on SmarterMail for […]

The post 6000+ Vulnerable SmarterTools SmarterMail Servers Exposed to Actively Exploited RCE Vulnerability appeared first on Cyber Security News.

In today’s digital world, online privacy and security have never been more important. With cybercrime on the rise and government surveillance becoming more common, protecting your personal information online is crucial. Whether you’re browsing on public Wi-Fi, shopping online, or just scrolling through social media, using a Virtual Private Network (VPN) is one of the […]

The post Best VPN Services of 2026: Fast, Secure & Affordable appeared first on Cyber Security News.

Clawdbot, the surging open-source AI agent gateway, faces escalating security concerns, with 900+ unauthenticated instances exposed online and multiple code flaws that enable credential theft and remote code execution. Clawdbot is an open-source personal AI assistant that integrates with messaging platforms like WhatsApp, Telegram, Slack, Discord, Signal, and iMessage. It features a Gateway for control […]

The post Hundreds of Exposed Clawdbot Gateways Leave API Keys and Private Chats Vulnerable appeared first on Cyber Security News.

A major accounting firm in the Netherlands has reportedly become the latest victim of Nova, an active ransomware operation. The breach was discovered and indexed by ransomware live on January 23, 2026, with the estimated attack date coinciding with the discovery date. The attackers claim to have exfiltrated sensitive data and have issued a 10-day […]

The post Nova Ransomware Allegedly Claiming Breach of KPMG Netherlands appeared first on Cyber Security News.

A critical authentication bypass vulnerability in the telnetd component of GNU Inetutils has exposed approximately 800,000 internet-accessible Telnet instances to unauthenticated remote code execution (RCE). Tracked as CVE-2026-24061 with a CVSS score of 9.8, the flaw allows attackers to gain root-level access without valid credentials, posing a severe risk to exposed infrastructure worldwide. Vulnerability Details […]

The post 800K+ Telnet Servers Exposed to RCE Attacks – PoC Released appeared first on Cyber Security News.

The curl project ended its bug bounty program in January 2026 because it received too many low-quality and useless bug reports. The decision reflects growing frustration within the open-source security community regarding the unintended consequences of financial incentive structures on vulnerability disclosure practices. The program, which was designed to encourage responsible vulnerability disclosure, paradoxically generated […]

The post Curl to End Bug Bounty Following Low-Quality AI-Generated Vulnerability Reports appeared first on Cyber Security News.

Browser attacks have become far more dangerous and organized than before. A new threat called Stanley, discovered in January 2026, shows just how serious the problem has become. This malware-as-a-service toolkit, priced between $2,000 and $6,000, does something particularly deceptive: it displays fake websites to users while the URL bar keeps showing the legitimate address. […]

The post New Malware Toolkit Sends Users to Malicious Websites While the URL Stays the Same appeared first on Cyber Security News.

Lazarus, a sophisticated North Korean-aligned hacking group also known as HIDDEN COBRA, has launched a new wave of targeted attacks against European drone manufacturers and defense contractors. The campaign, tracked as Operation DreamJob, emerged in late March 2025 and specifically targets organizations developing unmanned aerial vehicle technology across Central and Southeastern Europe. Researchers have identified […]

The post Lazarus Hackers Actively Attacking European Drone Manufacturing Companies appeared first on Cyber Security News.

A new Embedded Systems Threat Matrix™ (ESTM) framework was introduced to help secure embedded systems used in critical infrastructure and defense technologies across the U.S. Developed collaboratively with the Air Force’s Cyber Resiliency Office for Weapon Systems (CROWS). ESTM addresses a critical security gap in protecting mission-critical systems that remain increasingly vulnerable to sophisticated cyber […]

The post MITRE Releases New Cybersecurity Framework to Protect the Embedded Systems appeared first on Cyber Security News.

North Korea’s Lazarus Group has launched a sophisticated supply chain attack targeting software developers through a campaign called “Fake Font.” The threat actors are using fake job interviews and malicious GitHub repositories to trick engineers into downloading code that contains hidden malware. This campaign, which began over 100 days ago, has recently intensified with 19 […]

The post New DPRK Interview Campaign Leverages Fake Fonts to Deploy Malware appeared first on Cyber Security News.

In December 2025, threat researchers uncovered an alarming espionage operation targeting residents of India through sophisticated phishing campaigns. The attack, dubbed SyncFuture, demonstrates how cybercriminals can abuse legitimate business software as a vehicle for launching advanced malware attacks. Attackers sent fraudulent emails impersonating India’s Income Tax Department, tricking victims into downloading malicious files containing multiple […]

The post ‘SyncFuture’ Campaign Weaponizing Legitimate Enterprise Security Software to Deploy Malware appeared first on Cyber Security News.

A moderate-severity vulnerability in the Hadoop Distributed File System (HDFS) native client could allow attackers to trigger system crashes or corrupt critical data through maliciously crafted URI inputs. The vulnerability, tracked as CVE-2025-27821, affects Apache Hadoop versions 3.2.0 through 3.4.1. Stems from an out-of-bounds write flaw in the URI parser of the HDFS native client. […]

The post Apache Hadoop Vulnerability Exposes Systems Potential Crashes or Data Corruption appeared first on Cyber Security News.

An out-of-band (OOB) cumulative update, KB5078127, to address critical file system compatibility issues affecting Windows 11 users. The update resolves widespread problems introduced by the January 13, 2026, security update (KB5074109) that caused application freezes and cloud storage failures across multiple platforms. The most significant fix addresses file system corruption affecting cloud-based storage applications. Users […]

The post Microsoft Releases Out-of-Band Update KB5078127 to Fix Windows 11 File System and Outlook Freezes appeared first on Cyber Security News.

A sophisticated phishing campaign active between November 2025 and January 2026 has been exploiting Vercel’s legitimate hosting platform to distribute remote access tools to unsuspecting victims. The attack chain combines social engineering with trusted domain exploitation, making it particularly effective at bypassing traditional security layers. Attackers craft phishing emails using financially themed lures such as […]

The post New Phishing Attack Leverages Vercel Hosting Platform to Deliver a Remote Access Tool appeared first on Cyber Security News.

A critical server-side vulnerability in Instagram’s infrastructure allowed unauthenticated attackers to access private photos and captions without a login or follower relationship, according to a disclosure released this week by security researcher Jatin Banga. The vulnerability, which was reportedly patched silently by Meta in October 2025, relied on a specific configuration of HTTP headers to […]

The post New Instagram Vulnerability Exposes Private Posts to Anyone appeared first on Cyber Security News.