Popular
Nothing found for . Try a course, an exam code (SC-200), a tool or a topic.
↑↓ moveEnter openEsc close
Cyber security news, as it breaks.
Updated 85 stories in 24 hours
Cyber Security News
Parent Category for MyCyberWay Blog
MyCyberWay trainingEvery story here started as an alert. Learn to triage them.See Blue Team Analyst
-
Unit 42 dissects a cyberattack targeting a European bank’s IT infrastructure, delivering concrete defense strategies to help organizations detect and counter comparable threats.
Unit 42
-
Operation Lonestar Roundup uncovered an operation that used stolen identities to secretly funnel $3 million from 70 U.S. employers back to Pyongyang.
CyberScoop
-
A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files.
BleepingComputer
-
The Democratic People’s Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple reply-baiting phishing attacks.
Dark Reading
-
Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland, because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously…
Zero Day Initiative
-
A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The flaw was in the feature that converts a personal account into an…
The Hacker News
-
A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP’s official Python client for BTP services. An attacker must…
The Hacker News
-
Exploited
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to “act immediately.” A fix for the third is still pending, according…
The Hacker News
-
Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers.
BleepingComputer
-
A fake WatchGuard VPN download site steals SSL VPN credentials, then serves the real signed client. Learn how it works and how to spot it.
Huntress
-
It’s not clear exactly for what purpose the recording device was used, but FBI director Kash Patel said the scheme was to “capture sensitive communications about the company’s super intelligence technology.”
TechCrunch
-
If you’ve ever looked at a list of cybersecurity jobs and felt like none of them fit you, you might just be looking at a short list. Most career guides cover the same few roles, like the analyst watching alerts or the pen tester (penetration tester, someone hired to legally break into systems to find…
AWS Security Blog
