Security Stuff

Russian authorities used Cellebrite mobile hacking technology to unlock a jailed activist's iPhone, even though this occurred months after the Israeli company had publicly stopped sales to Russia. The case raises serious questions about how Russian law enforcement continued to access Cellebrite tools despite the company's stated policy against selling to authoritarian regimes, suggesting...

Security researchers have discovered Miasma, a new malware campaign targeting software developers through compromised npm packages and GitHub Actions workflows. The attack represents a sophisticated supply chain threat that exploits the developer tools and automation pipelines that programmers rely on daily. This latest campaign highlights the growing risk to software supply chains as attackers in...

Microsoft is warning about an active phishing campaign targeting hotels that uses fake photo attachments in ZIP files to deliver a Node.js-based malware implant. The attackers are specifically going after hospitality businesses, likely aiming to compromise guest data or payment systems. Security researchers are urging hotels to be cautious of unsolicited emails containing photo attachments, as ope...

A newly discovered Linux kernel vulnerability dubbed DirtyClone allows local users to escalate privileges and gain root access through exploiting the way the kernel handles cloned packets. The flaw presents a significant security risk for Linux systems, as attackers with local access could leverage it to take complete control of affected machines. Organizations running vulnerable Linux kernel vers...

Guardian Agents represent an emerging approach to identity governance that adds an additional layer of security beyond traditional identity and access management systems. These AI-powered agents act as intelligent intermediaries that continuously monitor and validate user access decisions in real-time, helping organizations prevent unauthorized access and detect suspicious behavior patterns. The t...

CISA has added an exploited remote code execution vulnerability in PTC Windchill to its Known Exploited Vulnerabilities catalog, as web shell attacks leveraging this flaw continue to be observed in the wild. Organizations using PTC Windchill are urged to apply available patches immediately to prevent attackers from gaining remote access through this security weakness.

Dark Reading's submissions editor is asking contributors for patience as the publication works through an overflowing inbox of article submissions. The team specifically requests that contributors stop sending AI-generated content and product promotions, both of which are slowing down their review process significantly. Instead, they're looking for original, human-written opinions and te...

A new Linux vulnerability called the pedit COW exploit has been discovered that allows attackers to gain root access to systems by poisoning cached binaries. The exploit takes advantage of a flaw in how Linux handles copy-on-write operations, potentially compromising system security. This represents a significant security concern for Linux systems, as root access enables complete control over affe...

President Trump signed two executive orders on June 22nd that set an aggressive 2030 deadline for federal agencies and contractors to transition to post-quantum cryptography, a timeline that significantly accelerates previous industry expectations of 2035. The mandate requires agencies to appoint quantum migration leads within 30 days and establish new cryptographic systems to protect against futu...

The National Institute of Standards and Technology has released updated Internet of Things security guidelines for public comment through August 24th. The revised guidance, called SP 800-213 Revision 1, focuses on helping federal agencies and organizations securely incorporate IoT products into their systems by establishing cybersecurity requirements and addressing current security challenges that...

Google has released Chrome 149, patching 18 security vulnerabilities including four critical and 14 high-severity flaws. More than half of these are use-after-free bugs, which are memory corruption issues that could potentially allow remote code execution or help attackers escape Chrome's security sandbox. The update is rolling out now for Windows, Mac, and Linux users, and Google says there&...

The open source data transfer tool curl has patched 18 vulnerabilities this week, including a 25-year-old flaw that dates back to March 2001. The most notable issue, discovered by AI platform Mythos from Aisle, is a medium-severity authentication bypass vulnerability that could allow an attacker to reuse connections after client certificate settings had changed. While curl is used by over 30 billi...

CISA has added a Lantronix serial-to-IP converter vulnerability to its list of actively exploited flaws, warning federal agencies to patch immediately. The vulnerability, CVE-2025-67038, affects Lantronix EDS5000 device servers and allows unauthenticated attackers to inject commands with root privileges, potentially compromising industrial, healthcare, and other operational technology systems. The...

GitLab has released security updates fixing 13 vulnerabilities, including three high-severity flaws that could allow attackers to execute malicious code or access sensitive information. The most serious issues include cross-site scripting vulnerabilities in the Analytics dashboard and Web IDE that could let attackers run code in users' browser sessions, plus a flaw in Duo Workflows that could...

California Water Service has found no evidence that hackers accessed its operational technology systems after the Iranian hacker group Handala claimed they could have disrupted the water supply but chose not to. An investigation by cybersecurity firm Mandiant revealed that the hackers only gained unauthorized access to a small number of user accounts within two third-party service provider platfor...

Cybersecurity researchers have identified a new backdoor called Mistic that's connected to the KongTuke threat actor group, which has been deploying it in campaigns involving ClickFix and ModeloRAT malware. The discovery adds another tool to the arsenal of this threat group, expanding their ability to compromise systems and maintain persistent access to infected networks. Security teams are b...

New York-based Runlayer has raised 30 million dollars in Series A funding, bringing its total funding to 42 million dollars for a platform that acts as a secure control layer for AI tools in enterprise environments. Founded just this year in 2025, the company has already attracted Fortune 500 clients with its solution that monitors AI access, manages agent deployment, and blocks threats like promp...

Richard Bejtlich makes the case for Network Detection and Response, or NDR, as organizations navigate what he calls the "Mythos Era" of cybersecurity. Bejtlich argues that NDR remains crucial for detecting threats and understanding network activity, even as organizations adopt modern security frameworks like zero trust. The discussion highlights how visibility into network traffic contin...

Security researchers have discovered a new macOS malware called Gaslight that uses an innovative defense technique: prompt injection to interfere with AI-powered security analysis tools. The malware is designed to manipulate AI assistants that security professionals might use to analyze suspicious code, potentially causing them to misidentify the threat or overlook malicious behavior. This represe...

Security researchers have uncovered a range of new threats including proxyware being installed on smart TVs and a 24-year-old bug discovered in the widely-used curl software tool. The bulletin also highlights concerns about AI-powered crime forums emerging as new platforms for cybercriminal activity, while security experts emphasize the growing importance of AI in discovering software vulnerabilit...

After a temporary slowdown in global ransomware attacks, cybercriminal gangs are increasingly targeting Europe, making the EU their preferred hunting ground. The region's organizations and their supply chain partners are now facing a surge in attacks, as ransomware operators shift their focus to exploit what they see as a lucrative and vulnerable new market.

AI has dramatically accelerated the exploit timeline, turning new vulnerabilities into working attacks in hours rather than weeks, forcing security teams to move beyond traditional patch-and-pentest cycles. A webinar scheduled for June 24th will address how organizations can validate exposures in real-time, combining automated penetration testing with exposure validation to make evidence-based sec...

LastPass and BeyondTrust are among over a dozen cybersecurity firms affected by a breach at competitive intelligence platform Klue, where attackers used a compromised credential to generate OAuth tokens and access customers' Salesforce instances. The threat actor known as Icarus used automated scripts to exfiltrate business contact information and customer relationship management data, though...

Cybersecurity firm Novee has uncovered a critical class of vulnerabilities dubbed Cordyceps that exposes millions of repositories to complete takeover through flawed CI/CD workflows. The security defects, found in GitHub Actions and similar systems, allow unauthenticated attackers to hijack developer workflows, forge approvals, and steal credentials, with confirmed impacts on major projects from M...

Agentic AI systems in cybersecurity face a critical challenge: they can only make decisions as good as the context they're given, yet they operate with confidence and speed even when that context is incomplete or wrong. As security teams increasingly turn to AI agents to handle the growing volume of automated attacks, there's a fundamental risk that these systems will make catastrophic d...