ACTIVE THREATS: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers • AI-powered attack exploited PaperCut flaws to hack 395 organizations • Microsoft Excel KB5002914 update breaks copy and paste for some users • Surfshark VPN says hackers breached internal testing, proxy servers • PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances ACTIVE THREATS: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers • AI-powered attack exploited PaperCut flaws to hack 395 organizations • Microsoft Excel KB5002914 update breaks copy and paste for some users • Surfshark VPN says hackers breached internal testing, proxy servers • PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
Latest cybersecurity breaches news, analysis, and intelligence.
A security study of 281 free Android VPN apps with 2.4 billion downloads found critical flaws where some apps transmit unencrypted configuration files, allowing attackers to hijack encrypted tunnels. Billions of users unknowingly have compromised privacy while believing their traffic is protected.
Exposed server revealed WP-SHELLSTORM, targeting 1.4M WordPress sites for resale. Leaked data included exploit tools, C2 configs, and logs from one of the largest hacking operations discovered.
HalluSquatting weaponizes AI hallucinations by registering fake packages that assistants invent with 85-100% reliability. Developers unknowingly install malicious code, granting attackers terminal access to compromise machines at scale.
Phishing campaigns impersonating Netflix, Adobe, and OpenAI target job seekers to steal Google credentials. Compromised accounts unlock email, cloud storage, and connected services across personal and corporate networks.
Attackers compromised Injective Labs' GitHub and injected wallet-stealing malware into @injectivelabs/sdk-ts on npm. It affected 310+ downloads, impacting thousands of developers.
Attackers use dormant GitHub accounts and compromised tokens to map corporate repositories undetected. Ghost accounts with clean histories bypass security alerts, enabling stealthy reconnaissance of organizational infrastructure.
Admin oversights—weak validation and reused credentials—caused this week's breaches, not sophisticated tactics. INTERPOL arrested 5,811 fraudsters and recovered $293M, proving operational discipline defeats breaches better than technical sophistication.
KDDI, Japan's largest telco, exposed 12M customers via zero-day in third-party email system. The breach compromised customer data and highlights supply chain security risks.
GhostApproval tricks AI assistants into editing system files via symlinks while showing false approval paths, bypassing security checks. This enables remote code execution and supply-chain attacks on developers.
Dangerous gap: 73% of European security leaders believe their collaboration tools are secure, yet fewer than 40% have DLP controls and 62% lack visibility into channel access—leaving sensitive corporate data significantly exposed to risk.
AssuranceAmerica disclosed a breach exposing 6.9 million drivers' personal data including SSNs, license numbers, addresses, and VINs—one of the largest insurance sector breaches in years. Discovered during an internal security audit, the company is offering credit monitoring, though experts warn the
Agentic AI enabled attacker to compromise AWS and extort customer in 72 hours through autonomous reconnaissance, escalation, and persistence—a significant escalation in threat techniques.
Ransomware gang CMD breached Mount Royal University, demanding $1.9M and stealing personal data including passports, IDs, employment records, and financial information from thousands of students and staff.
Malicious SDKs for Paysafe, Skrill, and Neteller were uploaded to npm and PyPI to steal developer credentials and payment secrets. The typosquatting supply chain attack compromises payment processing accounts and customer payment data when developers integrate the counterfeit packages.
China-linked APT UAT-7810 developed three new backdoor variants (LongLeash, DogLeash, JarLeash) to weaponize 1000+ compromised SOHO routers as a relay network for persistent espionage and lateral movement. The operational relay box (ORB) infrastructure enables long-term access and compartmentalizes
Accenture confirmed a 35GB data breach with stolen source code, Azure credentials, and cryptographic keys. The company claims no operational impact but left details about breach scope and personal data exposure unanswered.
Threat actor '888' publicly offered 35GB of stolen Accenture source code, cryptographic keys, and credentials for sale. Accenture downplayed the incident despite it being the company's third major breach in five years.
Three critical memory corruption vulnerabilities in Labcenter Proteus enable arbitrary code execution through malicious design files. Widely used in critical infrastructure sectors—power grids, telecom, medical devices—compromised designs could inject malicious code into hardware at the CAD stage; C
An Ohio county paid $1 million to prevent leaked stolen data in a data-theft extortion attack. The growing threat targets resource-strapped local governments nationwide.
DEBULL attacks exploit device-code phishing to bypass MFA and hijack Microsoft 365 accounts. The campaign abuses Microsoft's OAuth 2.0 flow, needing no passwords or traditional MFA compromise.
GitLost exploits GitHub Agentic Workflows via prompt injection to leak private repository contents through public issues. Attackers embed hidden instructions that trick AI agents into posting sensitive data publicly, bypassing GitHub's safeguards with simple linguistic tricks.
Spain arrested a pro-Russian CARR member targeting US and European critical infrastructure. The raid seized computers and cryptocurrency, escalating international enforcement against hacktivists.
Iran-linked APT targeted Israeli organizations by compromising IT service providers with a modular C&C framework. The supply-chain attack showcases adaptive malware and sophisticated tradecraft.
Critical flaw in Writer AI enabled one-click account takeover via token leakage, affecting millions across organizations. Unauthenticated attackers could hijack sessions and compromise user data through improper session validation in the agent preview feature.
A Windows device ID linked Peter Stokes, 19, to Scattered Spider's May 2025 jewelry breach. Microsoft records traced it to his accounts, proving sophisticated cybercriminals leave forensic evidence.
Iran's MOIS deployed Cavern, a new modular C2 framework targeting Israeli IT providers in a supply-chain strategy. The sophisticated malware escalates Iranian state-sponsored cyber capabilities.
North Korean hackers compromised 100+ open source repositories via PolinRider. The attack injects backdoors and stealers targeting developer credentials and build environments.
Chinese actors deployed DcRAT via fake Indian tax software, targeting accountants and finance professionals. 'Operation DragonReturn' impersonated the Income Tax Department during peak filing season.
**TrojPix** exfiltrates data from air-gapped systems by imperceptibly modulating video pixel emissions, achieving megabit-speed throughput with only user-level malware—no admin privileges or hardware modifications required. The technique represents a dramatic speed increase over prior covert channel
North Korean PolinRider distributed 108 malicious packages across npm, Go, Composer, and Chrome to compromise 2,000+ GitHub repos via social engineering and remote access malware. The packages masquerade as legitimate libraries, targeting developers across multiple ecosystems.