CyberNews Microsoft has rolled out a batch of 22 critical security updates to address severe vulnerabilities in its products, including one that’s already being exploited by attackers. The tech giant has patched the issue internally, but hasn’t disclosed any information about the attacks involving this flaw. The most pressing concern is a zero-day vulnerability tracked as … Read more
Federal Government’s Secret Hacking Practices Under Scrutiny as Lawmakers Demand Transparency A growing concern over the US government’s use of hacking and spyware to surveil American citizens has led a pair of lawmakers to request an investigation into the matter. Sen. Ron Wyden (D-Ore.) and Rep. Greg Casar (D-Texas) have written to the Government Accountability … Read more
Apollo Global Management has revealed it was hit by a data breach as part of a wave of social engineering attacks targeting the financial sector. The private equity firm, which manages over $1 trillion in assets, confirmed that attackers accessed its cloud platforms between July 6 and July 10, compromising sensitive personal data. The attack … Read more
US Cybersecurity Agency Warns of Active Attacks on TrueConf Video Conferencing Platform The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning to federal agencies, urging them to immediately patch two critical vulnerabilities in the popular video conferencing platform, TrueConf. The agency has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) … Read more
Microsoft has just rolled out a batch of 22 critical security updates to patch severe vulnerabilities in multiple products. Among these patches is one that addresses a zero-day exploit in its Entra ID service, which was being actively targeted by attackers. The exploited vulnerability, tracked as CVE-2026-69836, had the potential for remote code execution (RCE), … Read more
Cybersecurity Compliance Confidence Soars Among Defense Contractors, but Can They Back It Up? The defense industry is breathing a collective sigh of relief as contractors express increased confidence in their cybersecurity compliance. However, a closer look at two recent surveys reveals a concerning disconnect between confidence and actual readiness. According to a survey by Kiteworks, … Read more
A Growing Divide Between Defense Contractors’ Confidence and Reality Two recent surveys paint a concerning picture for defense contractors: while they claim to be more confident than ever in their cybersecurity compliance, their ability to prove it is lagging behind. This disconnect has significant implications for both individual companies and the broader national security landscape. … Read more
North Korean hackers have launched a sophisticated supply chain attack on the Rust programming language ecosystem, compromising one of its most popular packages and potentially putting millions of users at risk. The attack, which occurred on August 20, involved a malicious version of the arrayref crate being pushed to crates.io from a legitimate maintainer’s account. … Read more
Critical Isolated-vm Vulnerability Exposes Host Systems to Remote Code Execution Attacks A severe security flaw in a popular Node.js library has left developers scrambling to patch their applications and protect against potential remote code execution (RCE) attacks. The isolated-vm library, used by many organizations to execute untrusted JavaScript code within a sandboxed environment, contains a … Read more
A New Phishing Toolkit Emerges, Using Passkeys to Bypass Password Resets Cybersecurity researchers have uncovered a sophisticated new phishing toolkit that uses passkeys to maintain access to compromised accounts even after password resets. iAuthFlow V2, a malware toolkit available on Russian-language cybercrime forums for $10,000, has been analyzed by Abnormal researchers, who have revealed its … Read more