Cyber Security News

A serious security flaw has been discovered in Claude Cowork’s local sandbox, allowing a malicious AI agent to escape its Linux virtual machine (VM) and access the host Mac’s filesystem. This breach can enable the agent to read sensitive information, including SSH private keys and cloud credentials, without any user prompts. The root of this […]

The post Claude Cowork Sandbox Escape Flaw Lets AI Agent Read SSH Keys and Cloud Credentials From Host appeared first on Cyber Security News.

Russian state-backed hackers, identified as LAUNDRY BEAR, are exploiting a zero-day vulnerability in the Zimbra Collaboration Suite (ZCS) to stealthily extract sensitive information, including emails, from Western organizations. This operation is focused on espionage rather than financial gain, targeting sectors such as government, defense, energy, education, media, NGOs, and technology. The attack takes advantage of […]

The post Russian Hackers Exploiting Zimbra Zero-Day to Steal 90 Days of Emails appeared first on Cyber Security News.

A malicious RubyGems campaign has turned seemingly useful developer packages into tools for hidden cryptocurrency mining. The poisoned packages can consume a machine’s computing power, slow down development work, and quietly generate Monero for the attackers. The campaign also goes beyond a typical package-based infection. One set of malicious gems can examine a compromised developer […]

The post Malicious RubyGems Turn Developer Machines Into Monero Miners and Spread Through SSH appeared first on Cyber Security News.

A new Linux vulnerability dubbed “RefluXFS” is a race condition in the Linux kernel’s XFS filesystem copy-on-write path that lets an ordinary local user silently overwrite protected system files and seize host root privileges, even on systems running SELinux in Enforcing mode. The vulnerability tracked as CVE-2026-64600 uncovered by Qualys Threat Research Unit (TRU) exploits […]

The post RefluXFS Linux Kernel Vulnerability Lets Attackers Gain Root Access appeared first on Cyber Security News.

A newly disclosed flaw in the Adobe Acrobat Chrome extension allowed attackers to silently harvest WhatsApp Web chats, contacts, and profile data from any user who simply visited a malicious webpage no clicks, downloads, or credential theft required. Security researchers at Guardio Labs uncovered the flaw, dubbed “HermeticReader,” and officially tracked as CVE-2026-48294 with a […]

The post Adobe Acrobat Extension Flaw Lets Attackers Steal WhatsApp Chats From 329 Million Users appeared first on Cyber Security News.

ASUS has released critical security updates to address a high-severity router vulnerability that could allow remote attackers to execute arbitrary commands on affected devices. The flaw, tracked as CVE-2026-13385, impacts multiple ASUS router firmware branches, including the widely deployed 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102 series. According to the ASUS Product Security Advisory, the vulnerability stems from […]

The post ASUS Patches Critical Router Vulnerability Enabling Remote Command Execution appeared first on Cyber Security News.

A recently disclosed vulnerability in AWS Kiro, an AI-powered Integrated Development Environment (IDE), reveals how a hidden line of text on a webpage can be exploited for remote code execution on a developer’s machine, bypassing the platform’s security model. Kiro operates on a “human-in-the-loop” principle, requiring user approval for potentially dangerous actions like executing shell […]

The post A Hidden Line of Website Text Can Turn AWS Kiro Into a Remote Code Execution Tool appeared first on Cyber Security News.

Public proof-of-concept (PoC) exploit code was released for CVE-2026-42980, a local privilege escalation vulnerability in the Windows NT OS Kernel. This vulnerability occurs due to an integer underflow in kernel-mode code. CVE-2026-42980 is an elevation-of-privilege flaw in the Windows NT OS Kernel caused by an integer underflow (wraparound) condition in a kernel code path. This […]

The post Public PoC Released for Windows NT OS Kernel Privilege Escalation Vulnerability appeared first on Cyber Security News.

Multi-factor authentication is meant to stop stolen-password attacks. A newly documented phishing technique instead persuades users to approve a real Microsoft sign-in, allowing attackers to take over the resulting Microsoft 365 session without directly stealing credentials. The campaign abuses the OAuth device-code flow, a feature intended for devices such as smart TVs and meeting-room systems […]

The post Hackers Let Victims Complete MFA Then Steal the Entire Microsoft 365 Session appeared first on Cyber Security News.

A phishing kit known as Kali365 is targeting U.S. organizations through device code phishing attacks that abuse Microsoft’s legitimate authentication process to hijack Microsoft 365 accounts. Unlike conventional phishing campaigns that direct targets to counterfeit login portals, Kali365 sends victims to a real Microsoft Device Login page. Victims are persuaded to enter an attacker-provided device […]

The post Kali365 Phishing Kit Abuses Microsoft Device Codes to Hijack Microsoft 365 Accounts appeared first on Cyber Security News.

New research finds that modern AI coding models frequently generate insecure code that exposes AI-generated applications to denial-of-service attacks, hardcoded secrets and authorization failures. The rapid adoption of AI coding assistants has transformed software development, enabling developers to generate production-ready applications in minutes rather than days. But as organizations increasingly rely on AI-generated code, a […]

The post What 434 AI-Generated Vulnerabilities Reveal About Secure Software Development appeared first on Cyber Security News.

Iran-linked hackers are not relying only on loud attacks, public leaks, or website defacements. They are quietly building access inside companies, cloud accounts, service providers, and industrial networks that could later be used to disrupt operations during a crisis. The activity includes stolen credentials, remote management tools, recruitment-themed phishing, and attacks on exposed industrial systems. […]

The post Iranian Hackers Are Quietly Building Access They Can Turn Into Wartime Disruption appeared first on Cyber Security News.

Apple has released a security fix addressing a critical flaw in its iCloud+ “Hide My Email” feature that could expose users’ real email addresses, undermining the core privacy promise of the service. The vulnerability, which reportedly remained unresolved for over a year, allowed attackers to determine a user’s actual email address from an anonymized alias […]

The post Apple Releases Fixes for Hide My Email Flaw that Exposes Users’ Real Email Addresses appeared first on Cyber Security News.

NULLZEREPTOOL is a newly uncovered attack framework that turns a Telegram bot into a remote control panel for powerful distributed denial of service campaigns backed by rotating proxy infrastructure. The framework came to light when a single Pastebin post was flagged during continuous paste‑site monitoring, exposing the full Python source for a Telegram‑managed DDoS and […]

The post New NULLZEREPTOOL Uses Telegram to Launch 20 DDoS Methods With Rotating Proxies appeared first on Cyber Security News.

Oracle has released its July 2026 Critical Patch Update (CPU), shipping 1,449 security patches that collectively remediate more than 1,200 vulnerabilities across databases, middleware, cloud services, and enterprise applications, in what is now the largest CPU in the company’s history. The scale of this release reflects not only expanding product complexity, but also a new […]

The post Oracle Patches 1,400+ Vulnerabilities, Critical Flaws Expose Enterprise Servers to Remote Attacks appeared first on Cyber Security News.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about an actively exploited SQL injection vulnerability in WordPress Core that could allow attackers to compromise websites and potentially achieve remote code execution. This flaw, tracked as CVE-2026-63030, was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on July 21, 2026. This designation […]

The post CISA Warns of WordPress Core SQL Injection Vulnerability Actively Exploited in the Wild appeared first on Cyber Security News.

Zimbra fixed a critical Zimbra Collaboration Suite (ZCS) command injection flaw in version 10.1.20 that could allow attackers to abuse the SNMP service and execute arbitrary commands on affected servers. The flaw affects environments where SNMP notifications are enabled, potentially allowing remote attackers to manipulate monitoring data and inject system-level commands, which could lead to […]

The post Critical Zimbra Flaw Lets Attackers Inject Commands Through the SNMP Monitoring Service appeared first on Cyber Security News.

The FBI has issued a new Public Service Announcement warning that cybercriminals are increasingly using AI-generated deepfakes and spoofed Internet Crime Complaint Center (IC3) websites to target victims who have already lost money to scams. This advisory, released on July 20, 2026, highlights how threat actors are evolving traditional fraud schemes by combining social engineering, […]

The post FBI Warns Scammers Use AI Deepfakes and Fake IC3 Sites to Re-Victimize Fraud Victims appeared first on Cyber Security News.

An anonymous GitHub user has quietly assembled one of the most disruptive exploit collections of the year, dropping 204 zero‑day proof‑of‑concept files for dozens of open‑source projects before vendors had a chance to patch them. The archive, hosted under the name “exploitarium” by a researcher using the handle “bikini,” turned coordinated disclosure on its head […]

The post Anonymous Researcher Dumps 204 0-Day Exploit Files Before Vendors Can Patch Them appeared first on Cyber Security News.

A newly disclosed flaw in Microsoft’s official Azure DevOps MCP server shows how an invisible comment in a pull request can silently hijack a developer’s AI coding assistant and turn it into a data-exfiltration tool. Security researchers at Manifold Security found that the bug lets an attacker with access to just one project steer a […]

The post Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Agents and Steal Data appeared first on Cyber Security News.