> TODAY'S SUMMARY (54 articles)
Today's cybersecurity news highlights several key threats and trends. Vanderbilt University has experienced a ransomware attack, reportedly by the BYOD group, compromising sensitive data. The Russian state-sponsored Turla group is utilizing a new malware toolset named "Cereal" to infiltrate Microsoft Exchange servers of government entities in Kazakhstan and Romania, showcasing escalating cyber-espionage tactics. Google has issued its eighth zero-day patch for Chrome this year, addressing a vulnerability actively exploited in the wild. Meanwhile, Apple and SAP have released important security updates to fix critical flaws in their software. Finally, spyware attacks are increasingly targeting a broader range of individuals, emphasizing the need for enhanced vigilance and protection measures.
|
// AI-powered summary generated at 12:00
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:
Cisco Talos uncovers CloudZ RAT and Pheno plugin abusing Microsoft Phone Link to intercept SMS OTPs
The company raised another $35 million as an extension to its previously announced Series C funding round.
The post Autonomous Offensive Security Firm XBOW Raises $35 Million appeared first on SecurityWeek.
Several security issues were fixed in WebKitGTK.
The federal SECURE Data Act is not a serious consumer privacy bill, and its provisions—if enacted—would be a retreat from already insufficient state protections.
Republicans on the House Energy and Commerce Committee released a draft of the bill late last month without bipartisan support. The bill i...
Iran-linked APT MuddyWater used ransomware-style tactics to mask espionage, combining phishing, credential theft, data exfiltration, and extortion without encryption. A newly discovered cyber intrusion attributed to the Iran-linked APT MuddyWater (aka SeedWorm, TEMP.Zagros, Mango Sandstorm, TA450, a...
Backups don't fail because they're missing, they fail because attackers destroy them first. Acronis explains how ransomware targets backup systems before encryption, leaving no path to recovery. [...]
A new survey found that kids find it easy to bypass age checks, despite a rise in age verification laws around the world.
The startup will invest in expanding its training categories, optimizing video generation, and growing its partnership ecosystem.
The post Herd Security Raises $3 Million for AI-Powered Training Platform appeared first on SecurityWeek.
Several security issues were discovered in the WebKitGTK Web and JavaScript
engines. If a user were tricked into viewing a malicious website, a remote
attacker could exploit a variety of issues related to web browser security,
including cross-site scripting attacks, denial of service attacks, and
ar...
CISA’s CI Fortify initiative aim for critical infrastructure operators to build isolation & recovery
Activists say ministers are targeting access rather than Big Tech's data-hungry business models
The MuddyWater Iranian hackers disguised their operations as a Chaos ransomware attack, relying on  Microsoft Teams social engineering to gain access and establish persistence. [...]
The Iranian state-sponsored hacking group known as MuddyWater (aka Mango Sandstorm, Seedworm, and Static Kitten) has been attributed to a ransomware attack in what has been described as a "false flag" operation.
The attack, observed by Rapid7 in early 2026, has been found to leverage social engineer...
Kaspersky researchers uncovered another supply chain compromise involving a popular Windows tool: Daemon Tools, an app for mounting disk image files as virtual drives that is widely used by gamers, developers, and IT professionals. Since April 8, 2026, the official Daemon Tools download site (at Dea...
Rapid7 reveals an Iranian false flag operation masquerading as a Chaos ransomware attack
Likely perpetrated by MuddyWater, the attack combined social engineering, persistence, credential harvesting, and data theft.
The post Iranian APT Intrusion Masquerades as Chaos Ransomware Attack appeared first on SecurityWeek.
Most network incidents don't escalate due to a lack of alerts; they escalate when response breaks down. This webinar explores how to fix gaps in triage, enrichment, and coordination. [...]
A legitimate developer tool is being repurposed by attackers to package and spread this Windows infostealer in harder-to-detect ways.
ShinyHunters claims it stole personal data from 275 million users on Instructure’s Canvas platform across schools and education providers.