ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
Google discovered the first AI-developed zero-day exploit—a 2FA bypass affecting web admin software, actively exploited in mass campaigns. The attack combines stolen credentials with authentication bypass; the LLM-generated code marks a watershed moment where AI threatens shifted from theoretical to
A critical cPanel flaw (CVE-2026-41940) is being exploited by 2,000+ attackers to deploy backdoors, miners, and ransomware worldwide. Attacks began immediately after disclosure in late April 2026.
Google detected the first AI-generated zero-day exploit. LLM signatures in the code show threat actors weaponizing AI for vulnerability discovery, advancing beyond reconnaissance.
Instructure's Canvas suffered a breach exposing 275M records via XSS flaws. ShinyHunters stole 3.6TB and then exploited the same vulnerability for extortion against schools worldwide.
Cloudflare laid off 1,100 employees (20% of staff) despite beating Q1 financial forecasts, framing it as necessary adaptation to the "agentic AI era" rather than cost-cutting. The paradox: strong earnings but a 20% stock drop highlights the market's skepticism about using AI to justify massive workf
State-sponsored group HeartlessSoul targets aviation and drone operators through phishing attacks to steal geospatial intelligence and GPS data supporting regional military conflicts.
Dirty Frag is a critical Linux kernel vulnerability enabling reliable root escalation from unprivileged users. Already exploited in active attacks, the deterministic exploit affects xfrm-ESP and RxRPC subsystems across major distributions.
A malicious fake OpenAI Privacy Filter repository on Hugging Face executed a sophisticated supply chain attack, reaching #1 trending with 244,000 downloads before removal. The multi-stage malware targeted cryptocurrency wallets, Discord credentials, and browser data across Windows, Linux, and macOS
German police shut down Crimenetwork 2.0, the rebooted dark web marketplace, arresting a 35-year-old administrator and seizing €194,000. The resurrected platform had generated €3.6 million with 22,000 users before law enforcement intervention, highlighting both the lucrative scale of cybercrime mark
cPanel patched three critical flaws enabling code execution and privilege escalation. A related vulnerability is actively exploited to distribute Mirai botnet and Sorry ransomware.
Sri Lanka arrested 37 in a crypto scam targeting U.S. victims who lost $5.8B annually. But authorities warn: these operations relocate when raided, making lasting solutions difficult.
Canvas LMS provider Instructure faced twin breaches during exam week; ShinyHunters announced a second attack after the company claimed containment. Hundreds of millions of student and teacher records were exposed, disrupting critical exams across US schools.
ShinyHunters hacked Canvas LMS, affecting ~9,000 schools during finals season and exposing billions of private messages and student records. Instructure, Canvas's parent company, has not publicly commented on the breach or restoration timeline.
CallPhantom duped 7.3M Android users with fraudulent call history apps on Google Play across Asia-Pacific. Users paid subscriptions for fake data about call histories, SMS records, and WhatsApp logs—completely fabricated information with no actual access to target phone numbers.
SOC's real problem isn't staffing—it's the alert triage model. 120-150 daily alerts require 40+ analyst-hours while attackers exfiltrate in 29 minutes. Adding headcount won't fix the broken operating model.
CISA ordered federal agencies to patch Ivanti zero-day CVE-2026-6973 by May 10—the third critical flaw in five months. The vulnerability allows remote code execution with admin credentials.
Dirty Frag is a critical unpatched Linux kernel privilege escalation that chains two page-cache bugs to bypass distribution protections and enable unprivileged attackers to gain root access. A working proof-of-concept has been publicly leaked, with no official patch available yet.
Dirty Frag is a critical Linux zero-day that lets unprivileged users gain root access on all major distributions. It chains two kernel vulnerabilities deterministically without race conditions, making it highly reliable.
Ivanti patched CVE-2026-6973 in EPMM after detecting targeted zero-day exploitation. Attackers chain it with prior RCE flaws to achieve full MDM system compromise and control enrolled devices.
Musk sues OpenAI over abandoning its non-profit mission for AI safety in favor of commercial profits. The lawsuit challenges AI governance and corporate responsibility.
Imperceptible pixel changes can fool AI vision systems while invisible to humans, threatening autonomous vehicles and facial recognition. Unlike traditional hacking, these attacks leave no detectable traces.
MAXHUB Pivot client (pre-v1.36.2) exposes tenant emails due to hardcoded encryption keys—CVE-2026-6411, CVSS 7.3. Attackers can remotely decrypt sensitive data without authentication.
PCPJack exploits five CVEs to steal credentials across cloud platforms and removes competing malware for control consolidation, signaling an evolution in cloud-focused threat campaigns. The framework targets container orchestration, cloud authentication, and privileged access vulnerabilities with mu
Ivanti EPMM faces active RCE exploitation (CVE-2026-6973, CVSS 7.2) affecting versions 12.6–12.8. Improper input validation allows authenticated admins to execute arbitrary code. Immediate patching required.
Chrome 148 patches 127 vulnerabilities, including critical integer overflow and use-after-free bugs that could enable arbitrary code execution. Deploy immediately to prevent exploitation.
Boost Security raised $4M for SDLC security as developers become primary attack targets. Early vulnerability fixes cost ~100x less than production ones, driving shift-left security adoption.
TrustFall is a critical vulnerability in AI code assistants (Claude Code, Cursor, Gemini, CoPilot) enabling arbitrary code execution through malicious GitHub repositories via inadequate security warnings—a significant supply chain attack risk for developers using these tools.
Incident response contracts create false confidence. Real readiness requires pre-positioned access, system documentation, and tested procedures established beforehand. Organizations without these waste critical hours when breaches occur.
Critical buffer overflow (CVE-2026-0300) in Palo Alto PAN-OS User-ID Portal allows unauthenticated root RCE from outside networks. The internet-facing design enables direct exploitation from the network perimeter. Active exploitation confirmed in April 2026.
Two Americans were sentenced to 18 months for operating "laptop farms" masking North Korean IT workers as U.S. employees at 70 companies, generating $200k+ for the regime in violation of sanctions.