Popular
Nothing found for . Try a course, an exam code (SC-200), a tool or a topic.
↑↓ moveEnter openEsc close
Cyber security news, as it breaks.
Updated 125 stories in 24 hours
Global Cyber Attacks
The incidents, breaches and state campaigns making headlines.
161stories this week
4today
the last seven days
Most fromThe Record, BleepingComputer, SecurityWeek, The Hacker News
In the news hereMicrosoft14Google13ConnectWise11OpenAI8SafePay2APT28 (Fancy Bear)2Qilin1RansomHub1
MyCyberWay trainingEvery story here started as an alert. Learn to triage them.See Blue Team Analyst
-
LiteLLM on Wednesday disclosed that threat actors compromised “multiple independent security controls” to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM’s release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took…
The Hacker News
-
Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams.
BleepingComputer
-
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most…
Security Affairs
-
Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.
Securelist (Kaspersky)
-
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse against South Korean financial institutions, to speed up…
The Hacker News+2 sources
-
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly exploited” across the internet.
WIRED
-
Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the data comes home to roost.
Dark Reading
-
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks.
BleepingComputer+1 source
-
Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said.
CyberScoop
-
Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers’ servers.
BleepingComputer
-
Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.
Cisco Talos+2 sources
-
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware.
BleepingComputer
