Cyber Security News

A new academic study from Beacom College of Computer & Cyber Sciences has revealed that every automation script generated by leading AI models ChatGPT, Microsoft Copilot, and Google Gemini contained exploitable security vulnerabilities. As enterprises increasingly rely on AI tools to accelerate development workflows, these findings highlight serious risks associated with deploying unreviewed AI-generated code […]

The post Security Flaws Found in Every Script Generated by ChatGPT, Copilot, and Gemini appeared first on Cyber Security News.

A newly disclosed HTTP/2 denial-of-service vulnerability is raising concerns across the cybersecurity community after researchers confirmed that unauthenticated attackers can crash vulnerable servers by triggering memory exhaustion conditions. The issue affects multiple HTTP/2 implementations that fail to manage resource consumption properly when handling stalled data flows, enabling attackers to degrade or completely disrupt services. HTTP/2, […]

The post New HTTP/2 Vulnerability Lets Hackers Crash Servers With Memory Exhaustion Attacks appeared first on Cyber Security News.

One compromised hotel Wi-Fi gateway can silently redirect every guest to attacker controlled servers, putting corporate accounts at risk even when users think they are browsing safely. The campaign starts with a simple idea that many travelers overlook. When you connect to hotel or conference Wi-Fi, you trust that gateway to handle your traffic honestly. […]

The post One Compromised Wi-Fi Gateway Can Redirect Every Hotel Guest to Attacker Controlled Servers appeared first on Cyber Security News.

Infostealer malware has quietly become the single most important initial-access commodity in the cybercrime economy, replacing traditional phishing and exploit-driven intrusions as the leading precursor to enterprise breaches and ransomware. Rather than breaking into networks, modern threat actors buy their way in by purchasing “stealer logs” containing valid usernames, passwords, session cookies, and SSO tokens […]

The post How Infostealer Logs Became the Fuel Behind Massive Cloud Data Breaches appeared first on Cyber Security News.

Google has released an emergency security update for its Chrome browser, addressing four high-severity vulnerabilities that could expose users to serious risks if left unpatched. The update, now rolling out globally, upgrades Chrome to version 150.0.7871.186/.187 for Windows and macOS, and 150.0.7871.186 for Linux systems. The latest release focuses primarily on security fixes, with Google […]

The post Google Rolls Out Emergency Chrome Update for Four High-Severity Security Flaws appeared first on Cyber Security News.

Hackers are using fake payment receipt emails to deliver a 750MB Lampion remote access trojan to targets in Portugal. The campaign relies on familiar financial language, convincing business details, and oversized files designed to slow down analysis and evade security checks. The attack begins with phishing emails that pose as routine financial or administrative messages. […]

The post Hackers Hide 750MB Lampion RAT Inside Fake Payment Receipt Emails appeared first on Cyber Security News.

Email phishing remains one of the most common ways attackers gain access to business accounts. During the second quarter of 2026, criminals continued to use fake login pages, malicious attachments, and convincing business messages to steal credentials or deliver malware. The problem is no longer limited to the inbox. Attackers are increasingly using collaboration tools […]

The post Microsoft Detects 7.6 Billion Email Phishing Threats as Teams Vishing Attacks Increases 10-Fold appeared first on Cyber Security News.

A serious security flaw has been discovered in Claude Cowork’s local sandbox, allowing a malicious AI agent to escape its Linux virtual machine (VM) and access the host Mac’s filesystem. This breach can enable the agent to read sensitive information, including SSH private keys and cloud credentials, without any user prompts. The root of this […]

The post Claude Cowork Sandbox Escape Flaw Lets AI Agent Read SSH Keys and Cloud Credentials From Host appeared first on Cyber Security News.

Russian state-backed hackers, identified as LAUNDRY BEAR, are exploiting a zero-day vulnerability in the Zimbra Collaboration Suite (ZCS) to stealthily extract sensitive information, including emails, from Western organizations. This operation is focused on espionage rather than financial gain, targeting sectors such as government, defense, energy, education, media, NGOs, and technology. The attack takes advantage of […]

The post Russian Hackers Exploiting Zimbra Zero-Day to Steal 90 Days of Emails appeared first on Cyber Security News.

A malicious RubyGems campaign has turned seemingly useful developer packages into tools for hidden cryptocurrency mining. The poisoned packages can consume a machine’s computing power, slow down development work, and quietly generate Monero for the attackers. The campaign also goes beyond a typical package-based infection. One set of malicious gems can examine a compromised developer […]

The post Malicious RubyGems Turn Developer Machines Into Monero Miners and Spread Through SSH appeared first on Cyber Security News.

A new Linux vulnerability dubbed “RefluXFS” is a race condition in the Linux kernel’s XFS filesystem copy-on-write path that lets an ordinary local user silently overwrite protected system files and seize host root privileges, even on systems running SELinux in Enforcing mode. The vulnerability tracked as CVE-2026-64600 uncovered by Qualys Threat Research Unit (TRU) exploits […]

The post RefluXFS Linux Kernel Vulnerability Lets Attackers Gain Root Access appeared first on Cyber Security News.

A newly disclosed flaw in the Adobe Acrobat Chrome extension allowed attackers to silently harvest WhatsApp Web chats, contacts, and profile data from any user who simply visited a malicious webpage no clicks, downloads, or credential theft required. Security researchers at Guardio Labs uncovered the flaw, dubbed “HermeticReader,” and officially tracked as CVE-2026-48294 with a […]

The post Adobe Acrobat Extension Flaw Lets Attackers Steal WhatsApp Chats From 329 Million Users appeared first on Cyber Security News.

ASUS has released critical security updates to address a high-severity router vulnerability that could allow remote attackers to execute arbitrary commands on affected devices. The flaw, tracked as CVE-2026-13385, impacts multiple ASUS router firmware branches, including the widely deployed 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102 series. According to the ASUS Product Security Advisory, the vulnerability stems from […]

The post ASUS Patches Critical Router Vulnerability Enabling Remote Command Execution appeared first on Cyber Security News.

A recently disclosed vulnerability in AWS Kiro, an AI-powered Integrated Development Environment (IDE), reveals how a hidden line of text on a webpage can be exploited for remote code execution on a developer’s machine, bypassing the platform’s security model. Kiro operates on a “human-in-the-loop” principle, requiring user approval for potentially dangerous actions like executing shell […]

The post A Hidden Line of Website Text Can Turn AWS Kiro Into a Remote Code Execution Tool appeared first on Cyber Security News.

Public proof-of-concept (PoC) exploit code was released for CVE-2026-42980, a local privilege escalation vulnerability in the Windows NT OS Kernel. This vulnerability occurs due to an integer underflow in kernel-mode code. CVE-2026-42980 is an elevation-of-privilege flaw in the Windows NT OS Kernel caused by an integer underflow (wraparound) condition in a kernel code path. This […]

The post Public PoC Released for Windows NT OS Kernel Privilege Escalation Vulnerability appeared first on Cyber Security News.

Multi-factor authentication is meant to stop stolen-password attacks. A newly documented phishing technique instead persuades users to approve a real Microsoft sign-in, allowing attackers to take over the resulting Microsoft 365 session without directly stealing credentials. The campaign abuses the OAuth device-code flow, a feature intended for devices such as smart TVs and meeting-room systems […]

The post Hackers Let Victims Complete MFA Then Steal the Entire Microsoft 365 Session appeared first on Cyber Security News.

A phishing kit known as Kali365 is targeting U.S. organizations through device code phishing attacks that abuse Microsoft’s legitimate authentication process to hijack Microsoft 365 accounts. Unlike conventional phishing campaigns that direct targets to counterfeit login portals, Kali365 sends victims to a real Microsoft Device Login page. Victims are persuaded to enter an attacker-provided device […]

The post Kali365 Phishing Kit Abuses Microsoft Device Codes to Hijack Microsoft 365 Accounts appeared first on Cyber Security News.

New research finds that modern AI coding models frequently generate insecure code that exposes AI-generated applications to denial-of-service attacks, hardcoded secrets and authorization failures. The rapid adoption of AI coding assistants has transformed software development, enabling developers to generate production-ready applications in minutes rather than days. But as organizations increasingly rely on AI-generated code, a […]

The post What 434 AI-Generated Vulnerabilities Reveal About Secure Software Development appeared first on Cyber Security News.

Iran-linked hackers are not relying only on loud attacks, public leaks, or website defacements. They are quietly building access inside companies, cloud accounts, service providers, and industrial networks that could later be used to disrupt operations during a crisis. The activity includes stolen credentials, remote management tools, recruitment-themed phishing, and attacks on exposed industrial systems. […]

The post Iranian Hackers Are Quietly Building Access They Can Turn Into Wartime Disruption appeared first on Cyber Security News.

Apple has released a security fix addressing a critical flaw in its iCloud+ “Hide My Email” feature that could expose users’ real email addresses, undermining the core privacy promise of the service. The vulnerability, which reportedly remained unresolved for over a year, allowed attackers to determine a user’s actual email address from an anonymized alias […]

The post Apple Releases Fixes for Hide My Email Flaw that Exposes Users’ Real Email Addresses appeared first on Cyber Security News.