Cyber Security News

A newly released open-source security framework called T3MP3ST is turning general-purpose AI coding agents like Claude Code, OpenAI’s Codex, and Hermes into autonomous red-teaming operators without requiring new API keys, cloud infrastructure, or additional billing. Built by researcher elder-plinius, T3MP3ST acts as a multi-agent orchestration layer rather than shipping its own model, coordinating multiple agent […]

The post T3MP3ST Security Framework With 35 Tools, Turns AI Coding Agents Into 0-Day Bug Hunters appeared first on Cyber Security News.

Flipper Devices has responded to intense community backlash over perceptions that it had abandoned active development of the Flipper Zero firmware. In a statement addressing the controversy, the company announced it will allocate dedicated resources to firmware maintenance while overhauling how it engages with contributors and feature requesters. The Flipper Zero project launched via Kickstarter […]

The post Flipper Zero Firmware Development Continues With New Community Contribution Rules appeared first on Cyber Security News.

This week’s roundup covers a major AI security model redeployment, several critical RCE vulnerabilities across popular tools, a landmark WhatsApp privacy update, and the latest Kali Linux release. Anthropic Confirms Claude Mythos 5 Redeployment Anthropic’s most powerful AI cybersecurity model Claude Mythos 5 is being restored to vetted US critical infrastructure organizations after a government-led suspension […]

The post Cyber Security News Bulletin Weekly – Mythos is Back, WhatsApp Username, Kali Linux 2026.2, +20 Stories appeared first on Cyber Security News.

Microsoft has rolled out KB5095189, a new cumulative update targeting the Out-of-Box Experience (OOBE) for Windows 11, versions 24H2 and 25H2. Released on June 23, 2026, this update refines the initial setup flow that users encounter when configuring a new or freshly reset Windows 11 device, rather than touching the core operating system components. KB5095189 […]

The post Microsoft Releases OOBE Cumulative Update for Windows 11, Versions 24H2 and 25H2 appeared first on Cyber Security News.

PamStealer is a newly identified macOS infostealer that disguises itself as the popular open-source clipboard manager “Maccy” while silently harvesting sensitive user data. Discovered by Jamf Threat Labs, the malware uses a stealthy two-stage infection chain designed to evade detection and blend into normal macOS activity. The attack begins with a malicious disk image file […]

The post PamStealer Mimics Maccy Clipboard Manager Silently Harvests Data and Clipboard Contents appeared first on Cyber Security News.

Security researchers at runZero have disclosed seven new CVEs affecting FatFs, the ubiquitous lightweight FAT/exFAT filesystem driver used across embedded and IoT ecosystems. The vulnerabilities range from CVSS Medium to High, with no Critical-rated findings, but their reach is significant: FatFs underpins platforms including Espressif ESP-IDF, STMicroelectronics STM32Cube, Zephyr RTOS, MicroPython, ArduPilot, RT-Thread, Mbed, Samsung […]

The post Multiple FatFs Vulnerabilities Expose Millions of Embedded Devices to Cyber Risks appeared first on Cyber Security News.

A newly disclosed Linux kernel flaw dubbed “Bad Epoll” (CVE-2026-46242) allows an unprivileged local user to escalate to root on Linux servers, desktops, and Android devices by exploiting a race condition and a use-after-free (UAF) in the kernel’s epoll subsystem. Bad Epoll is a UAF vulnerability in ep_remove(), which clears file->f_ep under file->f_lock but continues […]

The post New “Bad Epoll” 0-Day Vulnerability Allows Root Access on Linux Servers and Android Devices appeared first on Cyber Security News.

The Indian government has directed Google and Apple to take down three mobile applications, BAT-BMS, Lossigy, and Epoch-i-ion, after they were allegedly misused to remotely disable e-rickshaws and other battery-operated three-wheelers mid-journey, putting passenger safety at risk. Authorities have also warned that any additional apps found to enable similar remote-kill functionality will face the same […]

The post Indian Govt Bans Apps Being Misused to Stop E-Rickshaws Remotely appeared first on Cyber Security News.

Quantum computing has crossed the line from research curiosity to board-level risk. Once a cryptographically relevant quantum computer arrives — an event security planners call “Q-Day” — the public-key cryptography that protects banking, government, healthcare, and the entire internet (RSA, ECC, Diffie-Hellman) collapses in hours. Worse, the threat is already live: adversaries are running “harvest […]

The post Top 10 Best Post-Quantum Cryptographic Solutions in 2026 appeared first on Cyber Security News.

Scammers are hijacking trusted brand names to push people toward online casinos unrelated to those companies. Instead of building fake bank sites or phishing emails, they exploit the trust people place in familiar logos. The scam starts simply. A consumer scrolling Facebook, Instagram, TikTok, or Threads sees an ad claiming a familiar brand, such as […]

The post Scammers Impersonate Trusted Brands in Gambling Ads to Drive Casino Traffic appeared first on Cyber Security News.

Apache ActiveMQ users are advised to urgently update their deployments after three important vulnerabilities were disclosed, exposing messaging infrastructure to denial-of-service (DoS) attacks, broken isolation, and improper authorization risks. The issues, tracked as CVE-2026-53917, CVE-2026-54475, and CVE-2026-49877, affect core components across both the 5.x and 6.x branches and can lead to broker crashes and unauthorized […]

The post Multiple Apache ActiveMQ Vulnerabilities Enable DoS Attacks and Lead to Crashes appeared first on Cyber Security News.

Artificial intelligence agents are quickly becoming the new front door to the internet, and attackers have noticed. A fresh wave of malicious websites is using search engine tricks and invisible code to feed false instructions directly into AI systems, turning ordinary web pages into weapons against automated tools. These sites do not target people in […]

The post Hackers Abuse SEO Poisoning and Hidden HTML to Trick AI Agents Into Following Malicious Instructions appeared first on Cyber Security News.

Alibaba is reportedly set to ban Anthropic’s Claude Code from its internal workplace environments starting July 10, 2026, over alleged embedded backdoor risks. The company has not officially confirmed the decision and did not respond to media queries at the time of publication. The move follows claims that Claude Code, Anthropic’s command-line AI coding assistant, […]

The post Alibaba to Ban Claude Code Over Alleged Embedded Backdoor Risks appeared first on Cyber Security News.

A new open-source security tool is bringing large language models directly into the penetration tester’s terminal. Nebula, developed by BerylliumSec, integrates state-of-the-art AI models into the command-line interface, allowing ethical hackers and security professionals to automate vulnerability assessments, generate exploit scripts, and maintain engagement documentation without switching contexts. Nebula supports multiple AI backends, giving users […]

The post Nebula AI-Powered Penetration Testing Platform Automates Vulnerability Assessments appeared first on Cyber Security News.

Stelios Kouloglou, a former Member of the European Parliament (MEP) who served on the committee investigating Pegasus spyware abuses, was himself repeatedly infected with NSO Group’s Pegasus spyware during his tenure, according to new forensic findings from the Citizen Lab. The finding marks the first time a PEGA committee member has been publicly identified as […]

The post Former MEP Investigating Spyware Abuses Has Phone Hacked With Pegasus appeared first on Cyber Security News.

Multiple high‑severity vulnerabilities in WatchGuard Firebox devices running Fireware OS could let authenticated attackers execute arbitrary code and take full control of affected appliances. WatchGuard has disclosed three high‑impact vulnerabilities in Fireware OS affecting Firebox firewall appliances, all scored 8.6 under CVSS v4.0 and already patched in recent firmware releases. Tracked as CVE‑2026‑13053, CVE‑2026‑13050, and […]

The post Multiple WatchGuard Firebox OS Vulnerabilities Enable Arbitrary Code Execution Attacks appeared first on Cyber Security News.

A new wave of supply chain attacks is spreading across the open source world, and this time the target is developers themselves. Security researchers have uncovered a campaign called PolinRider that hides malicious JavaScript loaders inside trusted code repositories, waiting for unsuspecting developers to run them. The campaign has been linked to North Korean threat […]

The post North Korea-Linked Hackers Hide JavaScript Loaders in Open Source Repositories appeared first on Cyber Security News.

Security researchers from HawkTrace have disclosed technical details of a high-severity server-side request forgery (SSRF) vulnerability in Microsoft Exchange, tracked as CVE-2026-45504. The flaw, which carries a CVSS score of 8.8, allows authenticated, low-privileged users to read arbitrary files from vulnerable Exchange servers, raising serious concerns for enterprises relying on on-premises deployments. Microsoft Exchange is […]

The post Microsoft Exchange SSRF Vulnerability Details Released Along With Public PoC Exploit appeared first on Cyber Security News.

A critical unauthenticated SQL injection vulnerability in Front Gate Tickets (FGT), a Live Nation/Ticketmaster subsidiary that powers ticketing for major US festivals including EDC, Bonnaroo, and Outside Lands, allowed full administrative takeover of the platform with help from Anthropic’s Claude AI model. The researcher Ian Carroll noticed that nearly every major US festival funneled ticketing […]

The post Hacker Used Claude AI to Score Free Tickets to Nearly Every US Music Show appeared first on Cyber Security News.

Anthropic has published detailed technical documentation on the cybersecurity safeguards protecting Claude Fable 5, following the model’s global redeployment. The disclosure covers both the AI’s safety classifier system and a draft framework for grading jailbreak severity, developed in partnership with Glasswing. Fable 5’s safety classifiers sort cybersecurity requests into four categories rather than blocking all […]

The post Anthropic Details Claude Fable 5 Cybersecurity Safeguards and Jailbreak Framework appeared first on Cyber Security News.