Cyber Security News

Cybersecurity giant Trellix has disclosed a significant security incident involving unauthorized access to a portion of its source code repository. The company confirmed the breach in an official statement published on its website, stating it immediately engaged leading forensic experts upon discovering the intrusion. Threat actors gained unauthorized access to part of Trellix’s internal source […]

The post Trellix Source Code Breach – Hackers Gain Unauthorized Access to Repository appeared first on Cyber Security News.

A sophisticated adversarial campaign targeting South-East Asian government and military infrastructure, combining rapid exploitation of a critical cPanel authentication bypass with a custom zero-day exploit chain against an Indonesian defense-sector portal and ultimately pivoting to exfiltrate over 4GB of sensitive Chinese railway documents. The campaign’s initial access vector centered on CVE-2026-41940, a critical CVSS 9.8 […]

The post Hackers Breach Government and Military Servers by Exploiting cPanel Vulnerability appeared first on Cyber Security News.

The Exim development team has released version 4.99.2 to address four newly discovered security vulnerabilities affecting their mail server software. These flaws allow attackers to potentially crash servers, corrupt memory, or leak sensitive information. Because Exim is one of the most widely used message transfer agents on the internet, system administrators need to apply this […]

The post Multiple Exim Mail Server Vulnerabilities Leads to Crash with Malicious DNS data appeared first on Cyber Security News.

Threat actors are rapidly shifting their intrusion tradecraft toward high-speed, SaaS-centric attacks that completely bypass traditional endpoint security. Since October 2025, security researchers have tracked two distinct adversaries, identified as CORDIAL SPIDER and SNARKY SPIDER, conducting aggressive data theft campaigns. These groups operate almost exclusively within trusted SaaS environments such as SharePoint, HubSpot, and Google […]

The post Attackers Deploy AiTM Phishing Pages to Access SharePoint, HubSpot, and Google Workspace appeared first on Cyber Security News.

A sophisticated cybercriminal operation dubbed “AccountDumpling” has compromised approximately 30,000 Facebook accounts worldwide. Discovered by Guardio Labs, this Vietnamese-linked campaign abuses Google’s AppSheet platform to bypass traditional email security filters. By routing fully authenticated phishing lures through legitimate channels, the attackers successfully harvest credentials and identity documents. These stolen Facebook Business accounts are subsequently monetized […]

The post Attackers Abuse Google AppSheet, Netlify, and Telegram in Facebook Phishing Campaign appeared first on Cyber Security News.

A weaponized proof-of-concept (PoC) exploit framework dubbed “cPanelSniper” has been publicly released for CVE-2026-41940, a maximum-severity authentication bypass in cPanel & WHM that has already led to the compromise of tens of thousands of servers worldwide with attack activity traced as far back as late February 2026. CVE-2026-41940 is a critical pre-authentication flaw rooted in […]

The post cPanelSniper – PoC Exploit Disclosed for cPanel Vulnerability, 44,000 Servers Compromised appeared first on Cyber Security News.

Torrance, United States / California, May 1st, 2026, CyberNewswire Criminal IP partners with Securonix to integrate Criminal IP’s Threat Intelligence into ThreatQ, allowing organizations to incorporate external IP intelligence into their existing workflows, helping security teams accelerate analysis and response with more actionable context. Unlike traditional intelligence feeds, Criminal IP provides visibility into how assets […]

The post Criminal IP and Securonix ThreatQ Collaborate to Enhance Threat Intelligence Operations appeared first on Cyber Security News.

A new and well-planned malware campaign has been actively targeting enterprise administrators, DevOps engineers, and security analysts by hijacking their everyday search habits. Rather than using mass phishing or broad spam waves, threat actors behind this operation have carefully crafted a delivery chain that puts dangerous software directly in front of high-privilege IT professionals when […]

The post EtherRAT Campaign Uses SEO Poisoning and GitHub Facades to Target Enterprise Admins appeared first on Cyber Security News.

By Marceu Martins De Souza Filho, M.Sc. I. The 1999 Mirror: We’ve Been Here Before In 1999, the world was obsessed with “eyeballs.” The goal was to get a website up as fast as possible. In that rush, we sometimes skipped the “boring” stuff like security and privacy because they felt like they just slowed […]

The post The Agency Mirage: Why AI Needs Real Engineering, Not Just Hype appeared first on Cyber Security News.

A new Android spyware tool is being sold openly on the internet, and it comes with something far more dangerous than its surveillance features alone. For a fee, anyone can buy it, put their own name and logo on it, and start selling it as their own product. This is not just a malware story. […]

The post New Spyware Platform Lets Buyers Rebrand and Resell Android Surveillance Malware appeared first on Cyber Security News.

Cybercriminals are no longer relying on simple email tricks alone. Across the first quarter of 2026, attackers have been sharpening their approach by using CAPTCHA pages and ClickFix techniques to supercharge credential theft operations at an alarming scale. During Q1 2026, Microsoft Threat Intelligence tracked approximately 8.3 billion email-based phishing threats between January and March, […]

The post Attackers Abuse CAPTCHA and ClickFix Tactics to Boost Credential Theft Campaigns appeared first on Cyber Security News.

A newly discovered DDoS botnet is exploiting exposed Jenkins servers to launch powerful attacks against Valve Source Engine game infrastructure. Security researchers at Darktrace identified the threat after capturing it on one of their honeypot systems. What makes this malware stand out is its specific targeting of video game servers, combined with a smart infection […]

The post New DDoS Malware Exploits Jenkins to Attack Valve Source Engine Game Servers appeared first on Cyber Security News.

Canonical, the company behind the Ubuntu Linux distribution, is currently experiencing widespread service disruptions across its core web infrastructure following a coordinated Distributed Denial-of-Service (DDoS) attack. The hacktivist group identifying itself as “The Islamic Cyber Resistance in Iraq – 313 Team” has claimed responsibility for the offensive, marking one of the most significant attacks against […]

The post Ubuntu Website and Canonical Web Services Hit by DDoS Attack appeared first on Cyber Security News.

The ransomware threat has reached a new and alarming level. According to Fortinet’s newly released 2026 Global Threat Landscape Report, the number of confirmed ransomware victims worldwide jumped to 7,831 in 2025, up from roughly 1,600 victims recorded in the previous year’s report. That is a 389% increase year-over-year, a rise that reflects how deeply […]

The post Ransomware Victims Jump to 7,831 as AI Crime Tools Scale Global Attacks appeared first on Cyber Security News.

A newly identified Python-based malware known as DEEP#DOOR has surfaced as a serious threat to Windows users, combining a fully-featured backdoor with a powerful credential-stealing engine. What makes this threat especially concerning is how quietly it operates, embedding itself deep inside a compromised system while collecting sensitive data from multiple sources at once. The malware […]

The post Deep#Door Stealer Harvests Browser Passwords, Cloud Tokens, SSH Keys, and Wi-Fi Credentials appeared first on Cyber Security News.

A China-aligned threat group has been carrying out a carefully planned espionage campaign against government agencies and critical infrastructure across Asia. The group, tracked under the temporary designation SHADOW-EARTH-053, has been active since at least December 2024, quietly targeting organizations in at least eight countries. The campaign uses a combination of malware tools and living-off-the-land […]

The post China-Aligned Attackers Use ShadowPad, IOX Proxy, and WMIC in Multi-Stage Espionage Campaign appeared first on Cyber Security News.

Wireshark, the world’s most widely used open-source network protocol analyzer, has released a major security update addressing over 40 vulnerabilities, several of which enable arbitrary code execution through malformed packet injection or malicious capture files. Organizations and individuals relying on Wireshark for network monitoring, forensics, and traffic analysis should update immediately to Wireshark 4.6.5. Critical […]

The post Critical Wireshark Vulnerabilities Let Attackers Execute Arbitrary Code Via Malformed Packets appeared first on Cyber Security News.

Anthropic has opened Claude Security to public beta for Claude Enterprise customers, bringing AI-powered vulnerability detection directly into production codebases without the need for custom tooling or API integrations. Claude Security leverages the Opus 4.7 model to perform end-to-end security analysis across your codebase. The platform scans for vulnerabilities, validates each finding to reduce false […]

The post Anthropic Launches Claude Security in Public Beta for Enterprise Customers appeared first on Cyber Security News.

Microsoft’s April 2026 cumulative security update for Windows 11 is causing significant disruptions for users relying on third-party backup software, triggering an MS-DEFCON level 3 advisory from security patch analyst Susan Bradley at AskWoody. The problematic update, KB5083769, applies to Windows 11 versions 24H2 and 25H2 (OS Builds 26200.8246 and 26100.8246), released on April 14, […]

The post Microsoft Windows 11 April 2026 Security Update Breaks Third-Party Backup Applications appeared first on Cyber Security News.

Qilin ransomware is one of the most active and damaging threats in the cyber landscape today. The group has steadily evolved its tactics since it first appeared in 2022, and its latest technique of enumerating Remote Desktop Protocol (RDP) authentication history on compromised servers gives it a fast, quiet way to map out a network […]

The post Qilin Ransomware Enumerates RDP Authentication History on a Compromised Server appeared first on Cyber Security News.