ACTIVE THREATS: How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor ACTIVE THREATS: How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
Bleeding Llama exposes 300,000 Ollama deployments to unauthenticated remote memory theft via heap out-of-bounds read vulnerability, risking sensitive data leaks from AI systems worldwide.
Microsoft warns of a sophisticated phishing campaign using fake conduct reports and adversary-in-the-middle attacks to intercept credentials and session tokens, bypassing MFA protections. The attack demonstrates nation-state-level sophistication targeting US organizations.
FTC bans Kochava from selling location data on hundreds of millions of devices without explicit consumer consent. The settlement escalates regulatory scrutiny of data brokers.
CVE-2026-29014 is a critical flaw in MetInfo CMS enabling unauthenticated PHP code execution. Already under active exploitation, it requires no credentials or user interaction. Organizations must patch immediately.
A 2000s USB drop test became cybersecurity's defining lesson: employees' curiosity bypasses firewalls. The simple social engineering test proved human behavior, not technology, is security's weakest link.
Google raised Android exploit bounties to $1.5 million for critical vulnerabilities, but reduced payouts for AI-assisted discoveries by 10-50%, reflecting how automation is reshaping security research economics while rewarding pure human ingenuity over machine-assisted findings.
Meta fixed two critical WhatsApp vulnerabilities: file spoofing (disguising malicious files) and URL scheme hijacking. Both posed risks to 2+ billion users and were responsibly disclosed before patching.
Microsoft disclosed a massive phishing campaign targeting 35,000 users across 13,000 organizations in 26 countries (April 14-16, 2026). Attackers used code-of-conduct lures to harvest authentication tokens, bypassing standard security controls.
Critical CVE-2026-22679 in Weaver E-cology enables unauthenticated RCE under active exploitation. Attackers execute code via exposed API endpoints with no authentication needed—patch immediately.
Critical vulnerability CVE-2026-22679 in Weaver E-cology has been actively exploited since March 2026 for reconnaissance and network mapping. Thousands of organizations using the enterprise content management platform are urged to patch immediately to prevent deeper compromise.
Cisco acquired Astrix ($650M) to protect machine identities like API keys and service accounts. This addresses a critical security gap that attackers exploit to move laterally through networks.
A critical cPanel vulnerability allows unauthorized admin access. Exploitation occurred for a month pre-disclosure; multiple PoCs now public, threatening millions of websites globally.
Threat actors abuse Amazon SES to send phishing emails that bypass security filters using AWS's earned infrastructure reputation. The service's low cost ($0.10 per 1,000 emails) and accessibility make large-scale credential theft campaigns economical.
Attackers prioritize persistent infrastructure control over rapid breaches. AI-enabled phishing at scale and coordinated supply chain attacks now outpace defensive response times.
Progress Software patched a critical authentication bypass in MOVEit Automation. Attackers can access the platform without credentials, exposing sensitive files at major enterprises.
Cybersecurity saw record consolidation in April 2026 with 33 M&A deals announced, driven by demand for comprehensive defense ecosystems across cloud security, API protection, and AI-powered threat detection.
OpenAI introduced Advanced Account Security for ChatGPT to prevent account takeovers and protect sensitive conversations, credentials, and proprietary data increasingly stored on the platform by organizations.
"Copy Fail" Linux vulnerability added to CISA's Known Exploited Vulnerabilities list after active exploitation began. Currently limited to proof-of-concept testing, but expected to escalate rapidly across critical infrastructure within weeks or months.
In 2006, Dark Reading launched digital-only when print dominated. Twenty years later, the bold strategy proved prescient, reshaping how the security industry consumes information.
A critical cPanel vulnerability fuels coordinated attacks on Southeast Asian governments and MSPs globally. The campaign uses stolen credentials and suggests nation-state involvement.
A teenager hacked Kaikatsu Club, breaching 7 million user records to fund Pokémon purchases. The incident reveals corporate security gaps and emerging risks from AI-assisted attacks by minors.
Microsoft's April 2026 security update (KB5039856) breaks third-party backup applications like Veeam and Acronis by changing the psmounterex.sys driver behavior, causing up to 95% backup failure rates. Vendors and Microsoft are releasing immediate workarounds to restore compatibility.
CISA warns the Linux "Copy Fail" vulnerability enabling root-level code execution is actively exploited. Attackers weaponized it within 24 hours of PoC disclosure, giving admins minimal patching time.
Progress Software warns of a critical authentication bypass in MOVEit Automation that allows unauthorized file access without credentials, affecting enterprises across multiple sectors relying on this managed file transfer platform.
Over 40,000 cPanel servers have been compromised via zero-day CVE-2026-41940, granting attackers full administrative access to hosting infrastructure. The ongoing exploitation campaign threatens all hosted websites and their data, underscoring the critical need for rapid patch deployment across the
International law enforcement arrested 276 suspects and seized $701M in cryptocurrency investment fraud. The coordinated operation, led by Dubai Police with US and Chinese authorities, dismantled nine major scam centers that used fake investment platforms and social engineering to target victims wit
Pentagon partnered with seven tech firms (Google, Microsoft, AWS, Nvidia, OpenAI, Reflection AI, SpaceX) to deploy AI on classified military networks. The initiative accelerates warfighter decision-making and counters China and Russia's military AI advances.
CVE-2026-31431, a critical Linux privilege escalation flaw (CVSS 7.8) actively exploited, lets unprivileged users gain root access. CISA added it to KEV catalog, requiring immediate patching.
cPanel flaw CVE-2026-41940 bypasses authentication, enabling "Sorry" ransomware attacks at scale. Affecting 40% of websites globally, attackers gain admin access to execute code, steal data, and deploy ransomware across hundreds of thousands of sites.
Bluekit automates phishing campaigns with AI-powered personalization and domain registration, lowering technical barriers for attackers. It exemplifies how cybercriminals are leveraging AI to scale sophisticated social engineering attacks.