Cyber Security News

BambooToken is a Linux backdoor that turns a lightweight messaging protocol into a remote control channel. The newly analysed sample can collect information about a host, run shell commands, and move files between a compromised machine and its operator. Its use of MQTT is notable because the protocol is common in connected-device environments and uses […]

The post BambooToken Linux Backdoor Uses MQTT C2 to Execute Shell Commands and Exfiltrate Files appeared first on Cyber Security News.

Hackers are using convincing copies of trusted websites to turn an ordinary browser visit into a full Windows compromise. The campaign pairs targeted phishing emails with a chained set of previously unknown flaws in Google Chrome and Microsoft Windows, giving attackers a quiet path from a fake page to malware on a victim’s device. The […]

The post Hackers Clone Legitimate Websites to Silently Trigger Chrome and Windows Zero-Day Exploits appeared first on Cyber Security News.

Aikido Security has unveiled Altar-1, an open-weight artificial intelligence model designed to run defensive cybersecurity workloads entirely inside an organization’s own infrastructure. The model aims to help security teams use advanced AI for vulnerability discovery and penetration testing without sending source code, internal documentation, or security findings to external cloud-based inference services. Altar-1 is built […]

The post Aikido Security Unveils Altar-1 Open-Weight AI for Cybersecurity Defense appeared first on Cyber Security News.

A hidden “context bomb” prompt in a cloud decoy can disrupt AI agents and force Qwen3.8-27B to stop simulated attacks. The technique worked against both the original and modified “abliterated” versions. Context bombs are defensive strings placed in vulnerable resources, like AWS Secrets Manager. When an AI agent scans the environment and encounters this embedded […]

The post Context Bombs Trick Autonomous Qwen AI Agents Into Stopping Cyberattacks appeared first on Cyber Security News.

A newly uncovered software supply chain attack has shown how quickly a trusted developer account can become a delivery route for malware. The operation, tracked as GHAPPIER, reached 65 GitHub repositories, infecting 73 files across 22 accounts. It involved a legitimate npm package that distributed a malicious loader to users. Attackers used access to a […]

The post GHAPPIER Supply Chain Attack Compromises 65 GitHub Repositories and Poisons npm Package appeared first on Cyber Security News.

A suspected Chinese-speaking threat actor has used WordPress vulnerabilities to break into at least 49 organizations across 29 countries. The campaign exposed how a compromised website can become a launchpad for database theft, credential abuse, and wider network intrusion. The attackers exploited the wp2shell chain, tracked as CVE-2026-63030 and CVE-2026-60137, against vulnerable WordPress installations. After […]

The post Hackers Exploit WordPress Flaws to Steal 18,566 Government Records and Plaintext Passwords appeared first on Cyber Security News.

A newly detailed Windows privilege escalation flaw tracked as CVE-2026-66804 allowed a standard, low-privileged user to plant a malicious DLL and execute arbitrary code with full NT AUTHORITY\SYSTEM privileges, exploiting a lingering weakness in how Windows handles Component Object Model (COM) registrations. The bug, patched by Microsoft in its August Patch Tuesday, was reported by […]

The post Windows COM Flaw Lets Attackers Gain SYSTEM Privileges With a Malicious DLL appeared first on Cyber Security News.

D-Link Systems has disclosed that it is investigating a critical security vulnerability in its DIR-822A router, tracked as CVE-2026-86296. The flaw has received the maximum CVSS severity score of 10.0. It may allow remote attackers to compromise vulnerable devices without authentication or user interaction. The issue affects the udhcpcd component in the reported DIR-822A firmware […]

The post D-Link Router Hit by CVSS 10.0 Flaw Exploitable Remotely Without Authentication appeared first on Cyber Security News.

Remus is a Windows information stealer that is gaining attention for the way it hides before taking data. The malware surfaced on underground marketplaces in March 2026 and is built to collect browser information, cryptocurrency wallet data, passwords, and files from compromised computers. Its newer versions also seek credentials linked to AI tools, putting personal […]

The post Remus Infostealer Removes Syscall Hooks to Evade EDR and Steal Sensitive Credentials appeared first on Cyber Security News.

A new malware campaign is using blockchain technology to keep its control servers out of reach. The operation tricks visitors to compromised business websites into running a malicious command, then steals bank logins and two-factor authentication codes. The campaign has been active since at least November 2025. It combines a fake human-verification prompt, malicious PowerShell […]

The post Hackers Hide Malware Servers on Blockchain to Steal Bank Logins and 2FA Codes appeared first on Cyber Security News.

Security researcher MSNightmare, also known as Nightmare-Eclipse, has released BigDiskBuster, a proof-of-concept denial-of-service technique designed to stop Microsoft Defender Antivirus from completing platform and security-intelligence updates. The project is presented as a successor to UnDefend. The researcher claims it works across all supported Windows versions, although the experimental code remains buggy; compatibility has not been […]

The post MSNightmare has Released a Windows Defender Update DoS Vulnerability Called BigDiskBuster appeared first on Cyber Security News.

Hackers are exploiting a critical cPanel and WHM flaw to place Mirai malware on exposed servers, extending a botnet threat normally associated with connected devices. The activity produced a sharp rise in suspicious Telnet traffic and exposed a wider Internet security problem. Its use directly against servers creates concern for organizations that may not associate […]

The post Hackers Exploit cPanel CVE-2026-41940 Auth Bypass to Deploy Mirai Malware appeared first on Cyber Security News.

North Korean-linked WaterPlum operators have turned job hunting into a route for theft. By posing as recruiters, they persuaded software developers to run harmful files during apparently normal online interviews. The campaign, also known as Contagious Interview, reached at least 30,000 computers in more than 100 countries between December 2025 and July 2026. The attackers […]

The post North Korean WaterPlum Hackers Infect 30,000 PCs via Fake Job Interviews, Steal $10.7M Crypto appeared first on Cyber Security News.

A newly identified Android banking Trojan called RatHat uses phone features for account theft. The malware can guide itself through an infected device, capture banking logins, intercept verification codes and reconstruct a victim’s screen-lock PIN or pattern. The campaign begins with deception rather than a software flaw. Victims receive SMS phishing messages or see malicious […]

The post New Android Malware Uses AI to Steal Bank Logins and Reconstruct Your PIN appeared first on Cyber Security News.

Push-bombing, real-time phishing kits, and helpdesk social engineering broke “any MFA is fine.” The 2026 question is which MFA survives an attacker who can relay codes and spam approvals so we scored ten leading solutions against a weighted rubric that puts phishing resistance first. Microsoft Entra MFA takes #1 on the strength of bundled economics […]

The post Top 10 Best Multi-Factor Authentication (MFA) Solutions in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Quick Answer: Microsoft Entra ID is the bundled default for M365 estates; Okta leads neutral catalog breadth; Ping Identity owns complex enterprise; JumpCloud wins SMB directory+SSO (free tier); Cisco Duo pairs SSO with best-in-class MFA. Ownership note: Auth0 belongs to Okta it’s the developer/customer-login product line, not a separate vendor. Single sign-on is the front […]

The post Top 10 Best Single Sign-On (SSO) Solutions in 2026 appeared first on Cyber Security News.

OpenAI Codex recently faced two significant security vulnerabilities that allowed malicious repositories to potentially execute commands on a developer’s local system. These vulnerabilities, identified as Overpatch and Heapjack, were reported to OpenAI on August 12, 2026, and were addressed in under a week. The more critical issue, Heapjack, emerged when a developer accessed an attacker-controlled […]

The post OpenAI Codex Sandbox Flaws Let Malicious Repositories Execute Commands on Host Systems appeared first on Cyber Security News.

Adam Ochayon, VP of Strategy, Oasis Security  Deploying agentic AI in the enterprise is no longer optional – it’s fundamental to survival. And the main unlock to ensure security while deploying agentic AI is through agentic access management.  AI agents improve efficiency, reduce costs, and automate both complex and repetitive tasks: From HR and marketing to IT and […]

The post Business Survival in the Age of AI  appeared first on Cyber Security News.

For several years the forecast has been constant: AI lowers the skill barrier, AI writes novel malware, AI will soon run attacks end to end with minimal human direction. It is worth noticing where that forecast mostly came from. Not from the people who reverse malware for a living, who were largely skeptical throughout, but from the commentary layer around them: […]

The post Autonomous AI Attacks: The Hugging Face Reality Check  appeared first on Cyber Security News.

By Crystal Morin  Ransomware crews have always followed the money. For years, that meant targets like banks and hospitals organizations with high-value assets and sensitive data who couldn’t afford downtime. Now, it means AI models too.  A threat actor the Sysdig Threat Research Team (TRT) dubbed JADEPUFFER has already shown us where the future of ransomware is heading. In the span of a […]

The post When Ransomware Targets AI Models: Defending the AI/ML Recovery Chain  appeared first on Cyber Security News.