Security Stuff

Cybersecurity firm Forescout has discovered that hundreds of industrial control systems and operational technology environments are dangerously exposed to the internet through unsecured VNC and RDP servers. Their research found 670 VNC servers providing direct access to ICS and OT control panels without any authentication, with nearly 60,000 VNC servers total lacking password protection and over 1...

CISA has added new ConnectWise and Windows vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming they are being actively exploited in the wild. Federal agencies are now required to patch these flaws within a specified deadline to protect their networks. The additions highlight ongoing risks to both enterprise software and the Windows operating system, as threat actors continue...

A critical authentication vulnerability has been identified in cPanel, prompting security experts to urge immediate server updates. The flaw represents a serious security risk that could allow unauthorized access to systems running the popular web hosting control panel. Administrators are being advised to patch their servers without delay to prevent potential exploitation of this authentication by...

Zscaler is hosting a webinar focused on automating exposure validation to keep pace with AI-powered cyberattacks. The session comes as new research from their ThreatLabz team reveals that AI has significantly compressed response times for defenders while simultaneously making VPNs a vulnerable entry point for rapid breaches. The webinar aims to address how security teams can adapt their validation...

A new report from Zscaler ThreatLabz warns that VPNs have become a major vulnerability, with AI-powered attacks now moving so quickly through remote access points that they've effectively collapsed the window for human response. The research suggests that traditional VPN infrastructure is struggling to keep pace with AI-driven threats, making remote access one of the fastest routes to securit...

A sophisticated cyberattack targeting Venezuelan energy firms and utilities in late 2025 deployed a new data-wiping malware called Lotus Wiper that systematically destroyed system recovery mechanisms, overwritten physical drives, and deleted files to leave systems unrecoverable. Security researchers at Kaspersky Lab found the attack used living-off-the-land techniques with two coordinated batch sc...

A Chinese national accused of being part of the Silk Typhoon hacking group has been extradited from Italy to the US to face charges of cyberattacks on American universities and COVID-19 researchers. Xu Zewei allegedly worked for China's Ministry of State Security, targeting virologists and immunologists in 2020 and 2021, and participated in exploiting Microsoft Exchange Server vulnerabilities...

A new ransomware variant called VECT 2.0 has emerged with an unusually destructive approach, permanently destroying files larger than 131 kilobytes instead of encrypting them for potential recovery. The malware targets multiple operating systems including Windows, Linux, and ESXi, making it a cross-platform threat that eliminates the possibility of ransom payment and file restoration for affected...

Spectrum Security has come out of stealth mode with 19 million dollars in seed funding led by TechOperators. The San Francisco-based startup, founded this year, offers an automated threat detection platform that works with existing security tools to identify and fix coverage gaps in real-time. The company says its solution reduces engineering hours while continuously monitoring environments to ens...

Germany suspects Russia is behind a sophisticated phishing campaign on Signal that compromised around 300 accounts belonging to high-ranking officials, military personnel, and journalists. The attackers used a fake Signal security chatbot to trick users into scanning QR codes or entering PINs, which linked their accounts to devices controlled by the hackers, giving them access to past chats, ongoi...

Kaspersky researchers have discovered PhantomRPC, a new Windows privilege escalation technique that exploits architectural weaknesses in the operating system's Remote Procedure Call mechanism to allow attackers to gain System-level access. The vulnerability works by deploying fake RPC servers that impersonate legitimate Windows services, intercepting requests from high-privilege processes and...

Sevii has launched Cyber Swarm Defense, a new pricing model for its AI-powered security platform that charges a fixed annual rate per protected asset rather than by AI token usage. This addresses a growing problem for security teams where unpredictable AI costs can spike during multiple simultaneous attacks, potentially exhausting budgets mid-incident and leaving organizations vulnerable. The serv...

Electric motorcycles and scooters from Zero Motorcycles and Yadea are vulnerable to hacking attacks that could pose serious safety risks to riders. Zero's vulnerability allows attackers within Bluetooth range to connect to bikes and upload malicious firmware that could manipulate critical safety systems like throttle response and braking, while Yadea's scooter flaw lets attackers interce...

Security researchers have discovered more than 70 suspicious extensions in the Open VSX marketplace linked to the GlassWorm malware campaign, which targets developer credentials and cryptocurrency. These extensions are clones of popular legitimate extensions, published by newly created accounts as "sleepers" that appear harmless initially but can deliver malware through future updates. A...

A Chinese national linked to the hacker group known as Silk Typhoon has been extradited to the United States to face charges related to cyberattacks targeting COVID-19 research institutions. The extradition marks a significant development in ongoing efforts to prosecute state-sponsored hackers who targeted critical healthcare and research infrastructure during the pandemic. Authorities allege the...

Security researchers have discovered a critical unpatched vulnerability in Hugging Face's LeRobot framework that could allow attackers to execute remote code without authentication. The flaw poses a significant risk to users of the popular robotics platform, and as of now, no patch has been released to address the security issue. Organizations using LeRobot are advised to take precautionary m...

Zscaler's ThreatLabz has released its 2026 VPN Risk Report highlighting how artificial intelligence has dramatically accelerated cyber attacks, essentially eliminating the time humans have to respond to security threats. The report emphasizes that traditional VPN remote access systems have become one of the fastest pathways for attackers to breach networks, as AI-powered threats now move at s...

A new report from Zscaler ThreatLabz highlights that AI-driven attacks have dramatically shortened the time defenders have to respond, making traditional VPN-based remote access a critical vulnerability in zero trust architectures. The research suggests that attackers are now moving at AI-accelerated speeds, while legacy VPNs provide them with one of the fastest pathways to breach corporate networ...

The Trump administration has launched a major crackdown on Southeast Asian cyberscam operations, announcing sanctions against Cambodian senator Kok An and 28 others, while filing criminal charges against two Chinese nationals operating from Myanmar. The initiative, led by a new government Scam Center Strike Force, aims to combat operations that defrauded Americans of nearly 21 billion dollars in 2...

Researchers have discovered a vulnerability in Firefox that allows websites to fingerprint users even in Private Browsing mode and affects the Tor anonymity browser. The flaw, tracked as CVE-2026-6770, involves the IndexedDB browser API where database names are stored using internal UUID mappings that maintain consistent ordering across different sites during the same browser session, enabling unr...

A critical Linux vulnerability dubbed "Pack2TheRoot" allows unprivileged users to gain root access by exploiting a flaw in PackageKit, the cross-distribution package management tool. The bug, which has existed for potentially 14 years and affects major distributions including Ubuntu, Debian, Fedora, and RHEL, is easily exploitable within seconds and allows attackers to install arbitrary...

A threat actor tracked as UNC6692 has been using email bombing combined with Microsoft Teams impersonation to trick victims into installing a sophisticated malware framework called Snow. The attackers overwhelm targets with emails, then pose as IT support offering a fake mailbox repair tool that actually deploys a browser-based backdoor, allowing them to harvest credentials, move laterally through...

Itron, a major energy and water management firm serving over 8,000 customers in 100 countries, has disclosed a cyberattack after detecting unauthorized access to some of its systems on April 13th. The company says it has removed the unauthorized activity and seen no further intrusions, with operations continuing normally and no compromise detected in customer-hosted systems. Itron told regulators...

Google researchers have discovered a growing number of malicious AI prompt injection attacks on websites, with a 32 percent increase observed between November 2025 and February 2026, though the sophistication remains relatively low. These indirect prompt injection attempts involve planting malicious instructions on websites to trick AI assistants like Gemini and ChatGPT into stealing data or execu...

A 15-year-old vulnerability in OpenSSH has been discovered that could allow attackers to gain full root shell access to servers by exploiting a simple comma in certificate principal names. The bug, tracked as CVE-2026-35414, works because OpenSSH mistakenly treats the comma as a list separator, turning a low-privilege identity into a root credential, and the attack doesn't trigger authenticat...