Cybersecurity News

A newly analyzed computer virus from over 20 years ago, named fast16.sys, reveals an early Stuxnet-style attack. The malware was designed to selectively target high-precision calculation software, subtly altering results in memory. This highlights a long-standing threat of data manipulation in critical systems.

Cybersecurity researchers have identified four malicious packages on the npm registry: `chalk-tempalte`, `@deadcode09284814/axios-util`, `axois-utils`, and `color-style-utils`. These packages were designed to steal information from developer systems and have been downloaded thousands of times.

Dutch authorities have successfully dismantled a massive botnet controlling at least 17 million infected devices globally. The operation, led by the Dutch Politie and NCSC, targeted over 200 servers in the Netherlands that formed the core infrastructure for the network of compromised devices.

Palo Alto Networks warns a medium-severity security flaw in its PAN-OS and Prisma Access products is under active attack. The vulnerability, CVE-2026-0257, allows attackers to bypass authentication and potentially establish unauthorized VPN connections, posing a significant risk to affected networks.

The market for DDoS-as-a-Service (DDoSaaS) is evolving from scattered tools into sophisticated platforms. These services now offer subscription tiers, customer support, and reseller programs, making powerful cyberattacks more accessible and easier to launch for a wider range of malicious actors.

Security firms WatchGuard and ESET have identified two active banking trojan campaigns. The Grandoreiro malware targets Windows users, while the BTMOB malware targets Android devices. The campaigns are primarily focused on companies and mobile users in Spain, Portugal, Mexico, and Brazil, aiming to steal financial information.

AI presents both opportunities and significant risks for growing businesses. Cybercriminals are leveraging AI to launch more effective and targeted attacks. For example, AI-automated phishing has proven to be 4.5 times more effective than traditional methods, creating new challenges for business leaders balancing growth and security.

INTERPOL coordinated a major cybercrime operation across 13 countries in the Middle East and North Africa. The initiative, which ran from October 2025 to February 2026, resulted in 201 arrests and the identification of 382 additional suspects, aiming to dismantle malicious infrastructure in the region.

Researchers have developed a new attack called CrossMPI that targets multimodal AI models. It uses nearly invisible changes in images to manipulate how the AI interprets both visual and text inputs. This technique bypasses safety measures without altering the original text prompt, creating new security risks.

Critical vulnerabilities have been found in the SEPPMail Secure E-Mail Gateway, an enterprise email security solution. Attackers could exploit these flaws to execute code remotely, read all email traffic passing through the appliance, and potentially gain access to the company's internal network, posing a significant security risk.

Multiple security vulnerabilities have been discovered in the Linux kernel, affecting its cryptographic API and packet sockets. A significant flaw, dubbed "Copy Fail," could allow a local attacker to escalate privileges or even escape a container, potentially leading to a full system compromise. An update has been released.

Cryptologist Bruce Schneier noted that artist Laurie Anderson has quoted him in her new album and in interviews. The quote, "If you think technology will solve your problems, you don't understand technology and you don't understand your problems," highlights a critical perspective on technology's role.

Ubuntu has issued a security notice for multiple vulnerabilities discovered in the Linux kernel. The flaws affect key subsystems, including network drivers and the BTRFS file system. An attacker could potentially exploit these issues to compromise a system, making immediate updates essential for all affected users.

A popular GitHub Actions workflow, `actions-cool/issues-helper`, has been compromised in a supply chain attack. Attackers altered repository tags to point to malicious code designed to steal sensitive credentials from CI/CD environments and send them to an external server.

Security researchers have uncovered a major Android ad fraud operation named 'Trapdoor'. The scheme used 455 malicious apps and extensive infrastructure to generate up to 659 million fraudulent ad bid requests daily, targeting the mobile advertising ecosystem and device users with malvertising.

A vulnerability has been found in GStreamer Good Plugins due to improper handling of specific MOV/MP4 media files. A remote attacker could exploit this flaw to crash the application, leading to a denial of service, or potentially gain the ability to execute arbitrary code on the affected system.

A CISA contractor exposed highly sensitive credentials on a public GitHub repository. The leak included access keys to AWS GovCloud accounts and internal CISA systems, along with details on the agency's internal software development and deployment processes, marking a significant government data breach.

New analysis from Symantec and Carbon Black reveals that the Fast16 malware, a precursor to Stuxnet, was a cyber sabotage tool. The Lua-based malware was specifically engineered to corrupt uranium-compression simulations, which are a critical part of nuclear weapons design and testing, altering their results.

The US Cybersecurity and Infrastructure Agency (CISA) accidentally exposed sensitive credentials, including plaintext passwords and SSH keys, in a public GitHub repository. The repository, discovered by security firm GitGuardian, was accessible for an extended period before being taken offline after a security researcher reported the issue.

A recent analysis looks back at the last 20 years of cybersecurity, highlighting significant failures and missteps. The review covers major incidents like the CrowdStrike outage, persistent systemic issues, and major business blunders, reflecting on the lessons learned and the industry's evolution.

Microsoft's Deputy CISO for Gaming, Aaron Zollman, discussed the unique security challenges in the gaming sector. With over 500 million monthly active players on platforms like Xbox and PC, the scale presents distinct security demands compared to traditional enterprise environments, requiring specialized strategies.

Security researchers discovered and patched a series of vulnerabilities, named 'Claw Chain', in the OpenClaw AI agent framework. These flaws could have allowed attackers to steal credentials, escalate privileges, and maintain persistent access within affected systems, posing a significant threat to deployments using the framework.

The US cybersecurity agency has updated its Known Exploited Vulnerabilities (KEV) catalog with seven new entries, including flaws in Microsoft Windows, Defender, and Adobe Acrobat. The additions signal that these vulnerabilities are being actively used by attackers, requiring urgent attention from IT and security teams.

Ubuntu has released a security update for the Linux kernel used in NVIDIA Tegra systems. The update addresses several vulnerabilities in network drivers, NVME drivers, and Netfilter that could allow an attacker to compromise an affected system. Applying the patch is recommended for all users.

A software supply chain attack has compromised several popular npm packages within the @antv ecosystem. Attackers gained control of a maintainer's account to distribute malicious code. The affected packages include `echarts-for-react`, a library with over one million weekly downloads, posing a significant risk.

Typosquatting has evolved from a user-focused issue to a software supply chain threat. Attackers are now embedding malicious lookalike domains, sometimes generated by AI, directly into legitimate third-party scripts. This makes them difficult for standard security tools to detect, exposing web properties to new risks.

Microsoft's May security update for Windows 11 is failing for some users, leaving their systems unprotected. The installation fails and rolls back when the device's boot partition has insufficient free space. The issue occurs during the reboot phase, leaving dozens of security patches uninstalled.

Ubuntu has patched multiple vulnerabilities in Unbound, a popular DNS resolver. The flaws could allow remote attackers to cause a denial of service or, in some cases, execute arbitrary code. One critical issue affects recent Ubuntu LTS versions, making immediate updates essential for affected systems.

A new Linux kernel vulnerability named "Dirty Frag" has been found in versions 4.10 and later. It allows for local privilege escalation by combining two previously known flaws. The issue is in the IP packet fragmentation system and was publicly disclosed on May 7, 2026.

Attackers are expanding software supply chain attacks to target developer workstations and CI/CD pipelines directly. Recent campaigns on npm, PyPI, and Docker Hub aimed to steal secrets like API keys, cloud credentials, and tokens, shifting the focus from injecting malicious code to stealing developer access.