CyberNews

Cybersecurity’s Dark Mirror: CISA Red Team Compromises Two Critical Infrastructure Orgs, Exposing Deep Vulnerabilities The US Cybersecurity and Infrastructure Security Agency (CISA) has revealed a disturbing incident that highlights the vulnerabilities of even the most secure systems. In an internal exercise, the CISA Red Team successfully compromised two critical infrastructure organizations, with one organization remaining … Read more

A sophisticated cyber campaign, dubbed “NovaCookies,” has been uncovered, leveraging genuine DocuSign notifications to steal Microsoft 365 session credentials. The attacks, which have been ongoing for months, target organizations with a high volume of DocuSign usage, allowing hackers to phish employees and gain unauthorized access to sensitive data. At the heart of the NovaCookies campaign … Read more

Cybersecurity Threats Rampant as Hackers Target Microsoft SharePoint Servers Threat actors are exploiting a pair of vulnerabilities in Microsoft’s SharePoint platform, allowing them to execute arbitrary code on unpatched servers. The chain of attacks involves a vulnerability in the JWT token validation pipeline, which can be exploited by attackers without privileges, and a subsequent remote … Read more

Boston Scientific Hit by Global Cyberattack, Disrupting Operations and Customer Orders Medical technology giant Boston Scientific has been caught in a global cyberattack that has caused operational disruptions and impacted access to critical systems. The company, which develops and manufactures devices used in minimally invasive procedures, detected the incident on August 25 and is still … Read more

A critical vulnerability in Kaltura’s mwEmbed software has been discovered, allowing remote attackers to read sensitive files and execute malicious code on affected systems. The unpatched flaw affects various industries, including media, education, and healthcare, where Kaltura’s video streaming platform is widely used. Kaltura’s mwEmbed is a JavaScript library that enables cross-domain communication between web … Read more

Critical Infrastructure Orgs Left Exposed After CISA Red Team Simulation Breaches The Cybersecurity and Infrastructure Security Agency (CISA) has revealed that its red team, a group tasked with testing an organization’s defenses, successfully breached two critical infrastructure organizations in recent simulations. What’s more alarming is that one of the companies failed to detect the intrusion … Read more

A sophisticated cyber campaign, dubbed NovaCookies, has been exploiting genuine DocuSign notifications to hijack Microsoft 365 sessions and steal sensitive user data. The attack’s clever use of phishing tactics and exploitation of legitimate authentication mechanisms has left security experts sounding alarm bells. At its core, the NovaCookies campaign relies on social engineering, where attackers send … Read more

A critical security vulnerability is being actively exploited by hackers to inject malicious code into self-hosted Git services, putting thousands of organizations at risk. The vulnerability, tracked as CVE-2026-60004, affects Gitea, a popular open-source platform for developers to host and manage their own Git repositories. Gitea provides a suite of DevOps tools similar to cloud-based … Read more

Microsoft has taken a significant step towards giving users more control over their personal data and device features with the introduction of new privacy controls for Windows 11 desktop applications. These controls, which are currently being tested in Insider Preview builds, will allow users to choose which apps can access sensitive resources such as cameras, … Read more

Russian operatives have been caught using compromised ChatGPT accounts to spread disinformation and influence public opinion, a worrying trend that highlights the dark side of AI-powered chatbots. OpenAI, the company behind the popular language model, has since taken action, banning these Russian accounts from accessing its platform. The scope of this operation is not clear, … Read more