Cyber Security News

Ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. ReliaQuest reports that multiple threat groups, including Qilin and Settra, are using the flaw to create unauthorized VPN sessions and enter internal networks through trusted remote access services. The activity presents a serious detection challenge because attackers […]

The post Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access appeared first on Cyber Security News.

REA, short for Reverse Engineer Anything, connects AI coding agents such as Claude Code and Cursor to tools that inspect software without its source code. The open-source project brings Ghidra, IDA Pro, and Hopper into an agent-driven workflow, helping researchers trace program behavior and explain findings with supporting evidence. Rather than replacing a disassembler, REA […]

The post REA Tool Connects Claude Code and Cursor to Ghidra and IDA Pro to Reverse Engineer Anything appeared first on Cyber Security News.

A single prompt sent to a public-facing AI agent could have exposed every Amazon Bedrock AgentCore agent in the same AWS account and region, according to new research from Zenity Labs. The attack chain, named AgentCorruption, gave the researchers access to private chats, source code, long-term memories, API keys, OAuth tokens, and secrets held in […]

The post One Prompt Could Hijack AWS AI Agents and Steal Cloud Credentials appeared first on Cyber Security News.

Microsoft is extending Teams security to detect malicious links hidden inside QR codes and warn users after a message has been delivered. The update adds QR code checks to existing Microsoft Defender for Office 365 protections, giving users clearer warnings and security teams more data to investigate suspicious messages. According to Message Center notice MC1490905, […]

The post Microsoft Teams to Warn Users About Malicious Links Hidden in QR Codes appeared first on Cyber Security News.

AT&T will pay $177 million to settle lawsuits over two major customer data breaches disclosed in 2024, after a federal judge granted final approval on October 2, 2026. The agreement covers separate incidents that exposed personal details and call records, creating lasting privacy risks for millions of current and former customers. Judge Sidney A. Fitzwater […]

The post AT&T to Pay $177 Million After Two Massive Customer Data Breaches appeared first on Cyber Security News.

A working proof-of-concept for a serious AnyDesk Linux vulnerability that can let remote attackers run commands as root without authentication or user approval. The issue, named AnyPwn, affects AnyDesk Linux 8.0.2 and was fixed in version 8.0.3. Organizations using AnyDesk for Linux should update immediately and check whether TCP port 7070 is exposed to untrusted […]

The post AnyDesk Linux Flaw Lets Remote Attackers Execute Code as Root Without Authentication appeared first on Cyber Security News.

A new GhostAction campaign has compromised 346 GitHub repositories after threat actors used two hijacked maintainer accounts to add a fake “security audit” workflow designed to steal CI/CD secrets, cloud keys, API tokens, and credentials stored in source-code history. Security firm Socket reported that the October 8 activity affected repositories connected to the GitHub accounts […]

The post New GhostAction Attack Compromises Hundreds of GitHub Repos to Steal Secrets appeared first on Cyber Security News.

A free agentic AI red-team checklist offers 222 tests across 20 attack categories to assess autonomous AI systems beyond prompt injection, covering infrastructure, cloud access, tools, memory, and agent communications. The checklist targets a common testing gap. Teams may spend days trying to manipulate a model while overlooking an exposed MLflow server, a reachable cloud […]

The post New Agentic AI Red Team Checklist Adds 222 Tests Across 20 Attack Categories appeared first on Cyber Security News.

CastleStealer, an emerging C#-based information stealer, has added browser protection bypass and remote shell features that give its operators a wider path into compromised Windows systems. The newer malware samples can collect browser data protected by Chromium’s App-Bound Encryption, run commands on a victim device, download extra payloads, and move stolen information through small encrypted […]

The post CastleStealer Malware Uses Browser Protection Bypass and Remote Shell to Expand Attacker Access appeared first on Cyber Security News.

Autonomous AI agents could move beyond noisy vulnerability scans and become quiet, persistent attackers, Cisco Talos has warned. The concern is not simply that AI can find security gaps faster. It is that groups of agents could learn to stay hidden, share findings, and keep working until they reach sensitive systems. In an October 7 […]

The post Cisco Talos Warns Autonomous AI Agents Could Turn Pentests Into Stealthy Red Team Attacks appeared first on Cyber Security News.

A newly identified supply-chain campaign is abusing Terraform provider workflows to infect developer systems with malware built for macOS, Linux, and Windows. The activity uses a trojanized Terraform provider that appears to be a legitimate AWS-related plugin, allowing it to run malicious code while still behaving like a normal provider. The campaign is a major […]

The post Hackers Abuse Trusted Terraform Workflows to Infect Developer Systems With Cross-Platform Malware appeared first on Cyber Security News.

A fast-growing Windows information stealer called Warden Stealer is being spread through ClickFix lures, malicious advertisements, cracked software downloads, and fake game cheats. The malware is sold as a malware-as-a-service offering, allowing different criminal operators to create their own builds, choose targets, and use separate command-and-control servers. Its main goal is to steal browser data, […]

The post Warden Stealer Spreads Through ClickFix, Malvertising, Cracked Software and Game Cheats appeared first on Cyber Security News.

MATCHBOIL, a C# malware downloader linked to UAC-0099, uses command-and-control (C2) servers hidden behind Cloudflare to deliver backdoor payloads. Its changing code shows how the group has moved from a simple downloader toward repeated server contact, stronger code hiding, and checks designed to stop security researchers from studying infections. The observed victims were all in […]

The post MATCHBOIL Malware Uses Cloudflare-Hidden C2 Servers to Deliver Backdoor Payloads appeared first on Cyber Security News.

A public proof of concept has exposed a flaw in Telegram Desktop that could let attackers steal local files and take over accounts after a user clicks a crafted external link. Tracked as CVE-2026-107181, the vulnerability affects versions before 7.2.9 and carries a CVSS 4.0 severity rating of 8.6 (High). Researcher Beaksec published the technical […]

The post PoC Released for Telegram Desktop Flaw Enabling One-Click File Account Takeover appeared first on Cyber Security News.

Every image scan returns hundreds of CVEs; the question is which ten your containers actually execute and which base image would zero the list entirely. We scored ten options with context and elimination weighted above raw detection. Evaluating scanners alongside the Top 10 Best Container Security Tools in 2026 reveals that static vulnerability counts alone […]

The post Top 10 Best Container Image Scanning Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.

A malicious release of the Tensorlake npm package has been published with a Shai-Hulud worm variant that can steal developer secrets and attempt to spread through connected software supply chains. The affected version, [email protected], was released on October 8, 2026. Tensorlake is a serverless sandbox platform for AI agents, and its npm package has recorded […]

The post Tensorlake npm Package Compromised to Spread Shai-Hulud Worm and Steal Developer Secrets appeared first on Cyber Security News.

Scanning and remote code execution attempts targeting video surveillance devices in Ukraine rose between September 21 and October 1, 2026. Most activity focused on CVE-2021-36260, a critical command injection flaw in unpatched Hikvision products. The surge occurred alongside Russian missile and drone strikes, but researchers have not established a connection between the cyber activity and […]

The post Hikvision Camera Vulnerability Targeted in Remote Code Execution Exploitation Attempts appeared first on Cyber Security News.

Hackers have used 16 malicious Firefox extensions to target cryptocurrency users with fake wallet screens that capture recovery phrases and private keys. The add-ons posed as wallet portals, desktop tools, and browser utilities, while hidden code attempted to send the secrets to attacker-controlled Cloudflare Workers. The campaign copied interfaces from Rabby Wallet and OKX Wallet, […]

The post Hackers Use Fake Firefox Wallet Extensions to Steal Crypto Recovery Phrases appeared first on Cyber Security News.

Microsoft Teams is preparing to support synthetic audio and video detection to help organizations spot deepfake attacks. The feature will connect Teams with certified third-party providers that check meeting media for signs of manipulation. Microsoft lists the update as in development, with rollout scheduled to begin in November 2026. According to the Microsoft 365 roadmap […]

The post Microsoft Teams Adds Synthetic Audio and Video Detection to Fight Deepfake Meeting Attacks appeared first on Cyber Security News.

DarkSword operators are using Coruna malware to steal cryptocurrency wallet recovery phrases from iPhones, turning browser exploits into a ready-to-use theft service. Exposed server directories revealed wallet modules, command systems, and records of stolen data, giving researchers a closer look at how the platform works beyond its initial exploit chain. A copy of one production […]

The post DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases appeared first on Cyber Security News.