> TODAY'S SUMMARY (16 articles)
Today's cyber news highlights several significant threats and trends. The Brenner Base Tunnel SE has confirmed a data breach involving 812 GB of stolen data, while Iris Ohyama reported a breach affecting 7.7 million customers. The emergence of the "sshole" vulnerability (CVE-2026-123158) is leading to increased exploitation attempts. Additionally, hackers breached French Bank Crédit Mutuel Arkéa through a third-party provider, resulting in a theft of up to $133 million. On a positive note, Brava Security has secured $15 million in funding to enhance enterprise defenses using AI. The landscape is increasingly influenced by AI, prompting predictions for identity security by 2027. Meanwhile, cyber readiness remains a critical focus for organizations as they prepare for potential incidents.
|
// AI-powered summary generated at 20:00
Executive Summary During the March–April 2026 reporting period, AI use in offensive operations advanced from development and planning to real-time operational deployment. Multiple independent cases, involving individual criminal actors, mass exploitation platforms, ransomware groups, and state-spons...
Court documents reveal how tech support scammers relied on infrastructure supplied by a US business.
The two own Dutch companies that allegedly provided bulletproof hosting services to Russia-aligned threat actors.
The post Admins of Bulletproof Hosting Service Used by Russian Hackers Arrested in Netherlands appeared first on SecurityWeek.
As Americans stew over the looming risk of job-stealing AI and data centers in their back yards, the feds are raising the alarm about a new category of threat, documents obtained by WIRED show.
At the Span Cyber Security Arena conference, I sat down with Eric Woodruff, Chief Identity Architect at Semperis, to talk about how organizations perceive identity and the challenges those perceptions create for security. He shared his perspective on where organizations struggle with identity, why i...
The Indian Computer Emergency Response Team (CERT-In) has issued new guidelines requiring organizations to patch critical security vulnerabilities in internet-exposed systems within 12 hours of being flagged where "feasible" to safeguard against potential threats stemming from threat actors' abuse o...
Iran's Nimbus Manticore pushes AI-built MiniFast backdoor via phishing and SEO poisoning
Nimbus Manticore accelerated cyberattacks during wartime, using AI-assisted malware, fake Zoom installers, and SEO poisoning. When the United States launched Operation Epic Fury against Iran at the end of February 2026, most analysts expected the country’s cyber apparatus to hunker down and weather...
I’ve spent years building compliance into security products. FedRAMP and Department of War Impact Level authorizations, vulnerability management pipelines: They all follow the same pattern. Build the product, then prove it meets requirements. The compliance layer sits outside...
The malware pairs remote access capabilities with ready-made campaign tools, lowering the barrier for full device compromise
CISA has given U.S. government agencies until Wednesday evening to secure their servers against an SQL injection vulnerability in the Drupal content management system (CMS) that it flagged as actively exploited. [...]
Information published.
North Korea-linked Lazarus APT Group is using a stealthy memory-only RAT that leaves almost no forensic traces behind. North Korea-linked APT group Lazarus has never been shy about its ambitions, the threat actor has been tied to some of the most audacious financial heists in recent memory, draining...
Microsoft has confirmed a new known issue affecting Windows Server 2016 systems that causes domain controller lookups to fail after installing the KB5087537 May 2026 security update. [...]
The Iranian state-sponsored threat actor known as Nimbus Manticore (aka Screening Serpens and UNC1549) has been attributed to a fresh campaign using lures impersonating organizations in the aviation and software sectors across the U.S., Europe, and the Middle East following the joint U.S.-Israeli mi...
The ShinyHunters extortion gang stole the personal information of over 183,000 people after hacking the systems of convenience store chain giant 7-Eleven in April, according to data breach notification service Have I Been Pwned. [...]
Patching practices are coming under intense pressure of late, as time-to-exploit windows accelerate — a new reality likely to worsen as AI assistance in attack chains rises.
Now cyber defenders have another cause for flaw alarm: Vulnerability exploitation has significantly...
Dans le cadre du projet Glasswing, l'intelligence artificielle Claude Mythos Preview d'Anthropic a découverte plus de 10 000 failles de sécurité en un mois.
Le post Claude Mythos trouve 10 000 failles de sécurité en un mois et bouscule l’écosystème Tech a été publié sur IT-Connect.
I’m doing Open Source primarily because I love it. The social aspects, the for-the-good angle and for the challenge of engineering this to work for everyone. I also do it because it is my full-time job and getting food on the table and provide for my family is not unimportant. It may come as a … Con...
The Oncology Institute disclosed a data breach tied to a third-party vendor, potentially exposing patient information after a 2025 cyberattack. The Oncology Institute has confirmed that patient information was impacted in a cybersecurity incident involving a third-party software provider. The health...