Cybersecurity news

A new analysis highlights how advanced AI models can now autonomously discover software vulnerabilities at an unprecedented scale. This fundamentally changes the balance between offense and defense in cybersecurity, making traditional disclosure timelines potentially obsolete and requiring an urgent rethinking of security strategies.

Dutch authorities have successfully dismantled a massive botnet controlling at least 17 million infected devices globally. The operation, led by the Dutch Politie and NCSC, targeted over 200 servers in the Netherlands that formed the core infrastructure for the network of compromised devices.

Palo Alto Networks warns a medium-severity security flaw in its PAN-OS and Prisma Access products is under active attack. The vulnerability, CVE-2026-0257, allows attackers to bypass authentication and potentially establish unauthorized VPN connections, posing a significant risk to affected networks.

The market for DDoS-as-a-Service (DDoSaaS) is evolving from scattered tools into sophisticated platforms. These services now offer subscription tiers, customer support, and reseller programs, making powerful cyberattacks more accessible and easier to launch for a wider range of malicious actors.

Security firms WatchGuard and ESET have identified two active banking trojan campaigns. The Grandoreiro malware targets Windows users, while the BTMOB malware targets Android devices. The campaigns are primarily focused on companies and mobile users in Spain, Portugal, Mexico, and Brazil, aiming to steal financial information.

Discussions about autonomous weapons, once confined to hypothetical scenarios at UN forums, are now confronting a new reality. The use of AI in modern conflicts is accelerating, raising urgent questions about ethics, international law, and the future of warfare for global leaders and the tech industry.

An attacker exploited a vulnerability in a Marimo notebook (CVE-2026-39987) to gain access to a system. They then used a large language model (LLM) agent to perform post-compromise actions, including stealing cloud credentials. This marks a new evolution in automated attack techniques.

Arm has open-sourced Metis, an AI-powered security framework designed to find complex software vulnerabilities. Unlike traditional tools that rely on pattern matching, Metis uses agentic AI and semantic reasoning to analyze dependencies across components, providing clear explanations for its findings.

The EU's Cyber Resilience Act (CRA) will introduce major cybersecurity requirements for all software and hardware products sold in the region. Companies must prepare for new accountability and reporting rules, with key deadlines set for September 2026 and December 2027 to ensure consumer protection.

Microsoft has launched MDASH, a new AI-powered security platform for large-scale vulnerability discovery. The system uses more than 100 specialized AI agents that work together to automatically scan, validate, and prove security flaws across complex codebases like Windows and other Microsoft software.

Anthropic's Project Glasswing, an AI-powered security initiative, has discovered over 10,000 high- or critical-severity vulnerabilities in widely used software. The project, which launched last month with around 50 partners, demonstrates AI's growing capability in automated vulnerability detection for critical systems.

AI presents both opportunities and significant risks for growing businesses. Cybercriminals are leveraging AI to launch more effective and targeted attacks. For example, AI-automated phishing has proven to be 4.5 times more effective than traditional methods, creating new challenges for business leaders balancing growth and security.

Researchers have developed a new attack called CrossMPI that targets multimodal AI models. It uses nearly invisible changes in images to manipulate how the AI interprets both visual and text inputs. This technique bypasses safety measures without altering the original text prompt, creating new security risks.

Critical vulnerabilities have been found in the SEPPMail Secure E-Mail Gateway, an enterprise email security solution. Attackers could exploit these flaws to execute code remotely, read all email traffic passing through the appliance, and potentially gain access to the company's internal network, posing a significant security risk.

Ubuntu has issued a security notice for multiple vulnerabilities discovered in the Linux kernel. The flaws affect key subsystems, including network drivers and the BTRFS file system. An attacker could potentially exploit these issues to compromise a system, making immediate updates essential for all affected users.

New analysis from Symantec and Carbon Black reveals that the Fast16 malware, a precursor to Stuxnet, was a cyber sabotage tool. The Lua-based malware was specifically engineered to corrupt uranium-compression simulations, which are a critical part of nuclear weapons design and testing, altering their results.

The US cybersecurity agency has updated its Known Exploited Vulnerabilities (KEV) catalog with seven new entries, including flaws in Microsoft Windows, Defender, and Adobe Acrobat. The additions signal that these vulnerabilities are being actively used by attackers, requiring urgent attention from IT and security teams.

Security researchers have uncovered a major Android ad fraud operation named 'Trapdoor'. The scheme used 455 malicious apps and extensive infrastructure to generate up to 659 million fraudulent ad bid requests daily, targeting the mobile advertising ecosystem and device users with malvertising.

A recent analysis looks back at the last 20 years of cybersecurity, highlighting significant failures and missteps. The review covers major incidents like the CrowdStrike outage, persistent systemic issues, and major business blunders, reflecting on the lessons learned and the industry's evolution.

Security researchers discovered and patched a series of vulnerabilities, named 'Claw Chain', in the OpenClaw AI agent framework. These flaws could have allowed attackers to steal credentials, escalate privileges, and maintain persistent access within affected systems, posing a significant threat to deployments using the framework.

Typosquatting has evolved from a user-focused issue to a software supply chain threat. Attackers are now embedding malicious lookalike domains, sometimes generated by AI, directly into legitimate third-party scripts. This makes them difficult for standard security tools to detect, exposing web properties to new risks.

A new Linux kernel vulnerability named "Dirty Frag" has been found in versions 4.10 and later. It allows for local privilege escalation by combining two previously known flaws. The issue is in the IP packet fragmentation system and was publicly disclosed on May 7, 2026.

Microsoft's Deputy CISO for Gaming, Aaron Zollman, discussed the unique security challenges in the gaming sector. With over 500 million monthly active players on platforms like Xbox and PC, the scale presents distinct security demands compared to traditional enterprise environments, requiring specialized strategies.

The source code for a self-replicating worm named Shai-Hulud has been publicly released. Security researchers are concerned this will lead to the rapid creation and spread of new variants, posing a significant threat to software developers and the broader software supply chain with scalable attacks.

Phishing emails that bypass security filters create a dangerous gap for businesses. After a single click, security teams are often unsure about the extent of the exposure. Early detection systems are crucial for closing this gap, helping teams quickly understand the risk and respond effectively to threats.

A researcher released a proof-of-concept exploit for a new Windows zero-day vulnerability named 'MiniPlasma'. The exploit allows an attacker with local access to gain the highest system privileges on fully patched Windows 10 and 11 machines. Microsoft has not yet released a patch.

Anthropic has updated its Claude Managed Agents platform with self-hosted sandboxes and MCP tunnels. These new features allow enterprises to use AI agents to interact with their internal systems securely, without exposing sensitive data or infrastructure to the public internet, addressing a key security barrier.

Ivanti, Fortinet, SAP, VMware, and n8n have released security updates to fix several critical vulnerabilities. The flaws could allow attackers to bypass authentication, execute arbitrary code, and disclose information. A particularly severe bug in Ivanti Xtraction received a critical CVSS score of 9.6.

Researchers have discovered two vulnerabilities in OpenVPN. One flaw could allow an attacker to crash the service, causing a denial of service. The second could leak sensitive data from previous sessions under specific conditions, potentially exposing private information. Both issues affect the handling of network packets.

Attackers are expanding software supply chain attacks to target developer workstations and CI/CD pipelines directly. Recent campaigns on npm, PyPI, and Docker Hub aimed to steal secrets like API keys, cloud credentials, and tokens, shifting the focus from injecting malicious code to stealing developer access.

Apple announced it has prevented over $11 billion in fraudulent transactions on its App Store since 2018. The company's fraud prevention systems, which combine machine learning with human review, stopped more than $2.2 billion in a single year alone, safeguarding developers and users.

A new Linux malware named Showboat has been discovered targeting a telecommunications provider in the Middle East. Active since at least mid-2022, Showboat is a modular post-exploitation tool. It can create a remote shell, transfer files, and establish a SOCKS5 proxy for attackers to use.

A China-aligned hacking group known as Webworm is using new custom backdoors, EchoCreep and GraphWorm. The group leverages popular services like Discord and the Microsoft Graph API for its command-and-control communications, primarily targeting government agencies with this updated tooling, according to recent cybersecurity research.

Traditional identity verification is no longer enough to stop sophisticated attacks. Attackers are increasingly using stolen session tokens and compromised devices to bypass logins. Security strategies must evolve to include continuous device verification, making it a critical component of any modern Zero Trust security framework.

Microsoft has released a mitigation for a BitLocker security bypass vulnerability known as "YellowKey." The zero-day flaw, tracked as CVE-2026-45585, was publicly disclosed last week and carries a CVSS score of 6.8, affecting the Windows disk encryption feature.

A new phishing-as-a-service platform called EvilTokens has compromised over 340 Microsoft 365 organizations. The attack tricks users into authorizing a malicious app via a device login flow, effectively bypassing multi-factor authentication and granting attackers access to their accounts without needing passwords or MFA codes.

GitHub is investigating a claim by a threat actor group called TeamPCP. The group alleges it accessed GitHub's internal repositories and is attempting to sell the platform's source code on a cybercrime forum. GitHub has found no evidence that customer data has been impacted so far.

A BeyondTrust report found that while Microsoft's total vulnerability count was stable in 2023, critical flaws doubled. Attackers are shifting focus from initial access to privilege escalation, using identity-based attacks to gain deeper control over systems. This trend highlights the growing importance of internal security controls.

Verizon's latest Data Breach Investigations Report (DBIR) reveals a critical trend: exploiting unpatched vulnerabilities now accounts for 31% of initial breach access. The findings underscore a persistent and dangerous gap between when security fixes are released and when organizations actually apply them, leaving systems exposed.

Microsoft has detailed a financially motivated group called Fox Tempest that operates a service selling fraudulent code-signing certificates to other criminals. This service helps malware, including ransomware, appear legitimate to bypass security software and infect systems more easily.

Microsoft has officially acknowledged that the May 2026 Windows 11 security update, KB5089549, is failing to install on some devices. Affected users are reporting an error code 0x800f0922, which prevents the update from completing. The company is currently investigating the issue.

Microsoft's May Security Update for Windows 11 is failing to install on some devices. The issue is caused by insufficient free space on the EFI System Partition. This leaves affected systems vulnerable, as they do not receive the dozens of security patches included in the update.

Microsoft has taken down a major malware code-signing service that enabled ransomware groups to make their malicious software appear legitimate. The operation involved seizing a website, revoking over 1,000 abused certificates, and shutting down hundreds of virtual machines hosted on Azure.

Ubuntu has patched several vulnerabilities in the Linux kernel. A key flaw, dubbed "Copy Fail," could allow a local attacker to escalate privileges or escape a container. Other issues affect the cryptographic API, packet sockets, and TLS protocol, potentially leading to system compromise.

A security researcher has released a proof-of-concept for a new zero-day vulnerability in Windows, codenamed MiniPlasma. The flaw affects fully patched systems and allows an attacker to gain the highest level of system privileges. The vulnerability exists in the Windows Cloud Files Mini Filter Driver.

A critical security flaw in NGINX Plus and NGINX Open is being actively exploited in the wild, just days after it was disclosed. The vulnerability, CVE-2026-42945, is a heap buffer overflow affecting a wide range of NGINX versions from 0.6.27 through 1.30.0.

A spoofing vulnerability in Microsoft Exchange Outlook Web Access (OWA) is being actively exploited. The U.S. CISA is urging organizations to prioritize patching. Microsoft has released a fix and recommends enabling Extended Protection for Exchange Server (EEMS) to mitigate the significant risk.

New AI agents can automatically find and exploit obscure software vulnerabilities. At the same time, developers are increasingly using AI to generate large volumes of code that may contain new flaws. This dual threat is forcing security teams to rethink their defensive strategies and adapt quickly.

A phishing kit named Tycoon2FA has been updated to bypass two-factor authentication on Microsoft 365 accounts. It uses a technique called device-code phishing and abuses legitimate click-tracking URLs to evade detection, posing a significant threat for organizations using Microsoft's cloud services.

A recently published guide demonstrates how a vulnerability in SAR2HTML version 3.2.1 can be exploited for remote code execution. The walkthrough, based on a TryHackMe challenge, shows how attackers can gain root privileges and full control over a target system by leveraging this specific software flaw.