Apple Warns Older iPhones Vulnerable to Coruna, DarkSword Exploit Kit Attacks

Fri Mar 20 2026

Apple is urging users who are still running an outdated version of iOS to update their iPhones to secure against web-based attacks carried out via powerful exploit kits like Coruna and DarkSword. These attacks employ malicious web content to target out-of-date versions of iOS, triggering an infection chain that leads to the theft of sensitive data. "For example, if you're using an older...

The Hacker News

Die besten IAM-Tools

Fri Mar 20 2026

Identity & Access Management ist für sicherheitsbewusste Unternehmen im Zero-Trust-Zeitalter Pflicht.

CSO Online

US Takes Down Botnets Used in Record-Breaking Cyberattacks

Fri Mar 20 2026

The Aisuru, Kimwolf, JackSkid, and Mossad botnets had infected more than 3 million devices in total, many inside home networks, according to the US Justice Department.

Wired

CISA urges IT to harden endpoint management systems after cyberattack by pro-Iranian group

Thu Mar 19 2026

The US is urging infosec leaders to harden their endpoint management system configurations after last week’s hack of American medical supplies provider Stryker by pro-Iranian threat actor Handala.

CSO Online

That cheap KVM device could expose your network to remote compromise

Thu Mar 19 2026

Researchers have found nine vulnerabilities in four popular low-cost KVM-over-IP devices, ranging from unauthenticated command injection to weak authentication defenses and insecure firmware updates.

CSO Online

Speagle Malware Hijacks Cobra DocGuard to Steal Data via Compromised Servers

Thu Mar 19 2026

Cybersecurity researchers have flagged a new malware dubbed Speagle that hijacks the functionality and infrastructure of a legitimate program called Cobra DocGuard. "Speagle is designed to surreptitiously harvest sensitive information from infected computers and transmit it to a Cobra DocGuard server that has been compromised by the attackers, masking the data exfiltration process as legitimate...

The Hacker News

54 EDR Killers Use BYOVD to Exploit 35 Signed Vulnerable Drivers and Disable Security

Thu Mar 19 2026

A new analysis of endpoint detection and response (EDR) killers has revealed that 54 of them leverage a technique known as bring your own vulnerable driver (BYOVD) by abusing a total of 35 vulnerable drivers. EDR killer programs have been a common presence in ransomware intrusions as they offer a way for affiliates to neutralize security software before deploying file-encrypting malware. This...

The Hacker News

Ransomware group exploited Cisco firewall vulnerability as a zero day, weeks before a patch appeared

Thu Mar 19 2026

One of the world’s most active ransomware groups, Interlock, started exploiting a critical-rated Cisco firewall vulnerability as a zero day weeks before it was patched in early March, Amazon has revea

CSO Online

Beijing wants its own quantum-resistant encryption standards rather than adopt NIST’s

Thu Mar 19 2026

China is reportedly planning to develop its own national post-quantum cryptography standards within the next three years, even as most of the world has already begun migrating to those finalized by th

CSO Online

Telnet vulnerability opens door to remote code execution as root

Thu Mar 19 2026

A critical Telnet vulnerability with a CVSS rating of 9.

CSO Online

ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More

Thu Mar 19 2026

ThreatsDay Bulletin is back on The Hacker News, and this week feels off in a familiar way. Nothing loud, nothing breaking everything at once. Just a lot of small things that shouldn’t work anymore but still do. Some of it looks simple, almost sloppy, until you see how well it lands. Other bits feel a little too practical, like they’re already closer to real-world use than anyone...

The Hacker News

Signal’s Creator Is Helping Encrypt Meta AI

Thu Mar 19 2026

Moxie Marlinspike says the technology powering his encrypted AI chatbot, Confer, will be integrated into Meta AI. The move could help protect the AI conversations of millions of people.

Wired

New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data

Thu Mar 19 2026

Cybersecurity researchers have disclosed a new Android malware family called Perseus that's being actively distributed in the wild with an aim to conduct device takeover (DTO) and financial fraud. Perseus is built upon the foundations of Cerberus and Phoenix, at the same time evolving into a "more flexible and capable platform" for compromising Android devices through dropper apps distributed...

The Hacker News

How Ceros Gives Security Teams Visibility and Control in Claude Code

Thu Mar 19 2026

Security teams have spent years building identity and access controls for human users and service accounts. But a new category of actor has quietly entered most enterprise environments, and it operates entirely outside those controls. Claude Code, Anthropic's AI coding agent, is now running across engineering organizations at scale. It reads files, executes shell commands, calls external APIs,...

The Hacker News

The multi-billion dollar mistake: Why cloud misconfigurations are your biggest security threat

Thu Mar 19 2026

Last year, most businesses faced a cloud security incident.

CSO Online

5 key priorities for your RSAC 2026 agenda

Thu Mar 19 2026

RSA Conference 2026 arrives at a significant inflection point for the cybersecurity industry — one that will see its more than 43,000 attendees and 600-plus exhibitors navigating an agenda that has fu

CSO Online

DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover

Thu Mar 19 2026

A new exploit kit for Apple iOS devices designed to steal sensitive data from is being wielded by multiple threat actors since at least November 2025, according to reports from Google Threat Intelligence Group (GTIG), iVerify, and Lookout. According to GTIG, multiple commercial surveillance vendors and suspected state-sponsored actors have utilized the full-chain exploit kit, codenamed DarkSword...

The Hacker News

Your MFA isn’t broken — it’s being bypassed, and your employees can’t tell the difference

Thu Mar 19 2026

Multi-factor authentication was supposed to be the solution.

CSO Online

Anthropic ban heralds new era of supply chain risk — with no clear playbook

Thu Mar 19 2026

The Trump administration’s decision to ban AI company Anthropic from Pentagon assets and other government systems as a “supply chain risk” could force CISOs into a position few have faced before: prep

CSO Online

CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks

Thu Mar 19 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged government agencies to apply patches for two security flaws impacting Synacor Zimbra Collaboration Suite (ZCS) and Microsoft Office SharePoint, stating they have been actively exploited in the wild. The vulnerabilities in question are as follows - CVE-2025-66376 (CVSS score: 7.2) - A stored cross-site scripting...

The Hacker News

Cloud Access Security Broker – ein Kaufratgeber

Thu Mar 19 2026

Lesen Sie, worauf es bei der Wahl eines Cloud Access Security Broker ankommt – und welche Anbieter was genau zu bieten haben.

CSO Online

OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs

Wed Mar 18 2026

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) has sanctioned six individuals and two entities for their involvement in the Democratic People's Republic of Korea (DPRK) information technology (IT) worker scheme with an aim to defraud U.S. businesses and generate illicit revenue for the regime to fund its weapons of mass destruction (WMD) programs. "The North Korean...

The Hacker News

Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access

Wed Mar 18 2026

Amazon Threat Intelligence is warning of an active Interlock ransomware campaign that's exploiting a recently disclosed critical security flaw in Cisco Secure Firewall Management Center (FMC) Software. The vulnerability in question is CVE-2026-20131 (CVSS score: 10.0), a case of insecure deserialization of user-supplied Java byte stream, which could allow an unauthenticated, remote attacker to...

The Hacker News

Hundreds of Millions of iPhones Can Be Hacked With a New Tool Found in the Wild

Wed Mar 18 2026

A powerful iPhone-hacking technique known as DarkSword has been discovered in use by Russian hackers. It can take over devices running iOS 18 that simply visit infected websites.

Wired

Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE

Wed Mar 18 2026

Cybersecurity researchers have disclosed a critical security flaw impacting the GNU InetUtils telnet daemon (telnetd) that could be exploited by an unauthenticated remote attacker to execute arbitrary code with elevated privileges. The vulnerability, tracked as CVE-2026-32746, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of out-of-bounds write in the LINEMODE Set...

The Hacker News

Reco targets AI agent blind spots with new security capability

Wed Mar 18 2026

SaaS security platform Reco has decided to address the “agent sprawl” challenge from the increased adoption of AI-driven tools by enterprises.

CSO Online

Claude Code Security and Magecart: Getting the Threat Model Right

Wed Mar 18 2026

When a Magecart payload hides inside the EXIF data of a dynamically loaded third-party favicon, no repository scanner will catch it – because the malicious code never actually touches your repo. As teams adopt Claude Code Security for static analysis, this is the exact technical boundary where AI code scanning stops and client-side runtime execution begins. A detailed analysis of where Claude...

The Hacker News

9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors

Wed Mar 18 2026

Cybersecurity researchers have warned about the risks posed by low-cost IP KVM (Keyboard, Video, Mouse over Internet Protocol) devices, which can grant attackers extensive control over compromised hosts. The nine vulnerabilities, discovered by Eclypsium, span four different products from GL-iNet Comet RM-1, Angeet/Yeeso ES3 KVM, Sipeed NanoKVM, and JetKVM. The most severe of them allow...

The Hacker News

BSI moniert Software-Sicherheit im Gesundheitswesen

Wed Mar 18 2026

Schwachstellen bei Praxisverwaltungssystemen hätten zu Cyberangriffen führen können.

CSO Online

Product Walkthrough: How Mesh CSMA Reveals and Breaks Attack Paths to Crown Jewels

Wed Mar 18 2026

Security teams today are not short on tools or data. They are overwhelmed by both.  Yet within the terabytes of alerts, exposures, and misconfigurations – security teams still struggle to understand context:  Q: Which exposures, misconfigurations, and vulnerabilities chain together to create viable attack paths to crown jewels? Even the most mature security teams can’t answer that...

The Hacker News

Join Our Next Livestream: The War Machine

Wed Mar 18 2026

On March 26, a panel of WIRED experts will dissect the defense tech industry’s impact on modern warfare. Submit your questions now.

Wired

Can you prove the person on the other side is real?

Wed Mar 18 2026

In my role, I spend a lot of time thinking about what “trust” means when money, grief and identity collide.

CSO Online

ClickFix treibt neue Infostealer-Kampagnen an

Wed Mar 18 2026

ClickFix-Kampagnen werden immer raffinierter und zielen verstärkt auf WordPress-Webseiten.

CSO Online

Cybersecurity and privacy priorities for 2026: The legal risk map

Wed Mar 18 2026

Escalating cybersecurity threats and growing privacy concerns lurk around every corner these days.

CSO Online

Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit

Wed Mar 18 2026

A high-severity security flaw affecting default installations of Ubuntu Desktop versions 24.04 and later could be exploited to escalate privileges to the root level. Tracked as CVE-2026-3888 (CVSS score: 7.8), the issue could allow an attacker to seize control of a susceptible system. "This flaw (CVE-2026-3888) allows an unprivileged local attacker to escalate privileges to full root access...

The Hacker News

CISOs rethink their data protection strategies

Wed Mar 18 2026

Scott Kopcha witnessed what CISOs everywhere are seeing: employees eager to use artificial intelligence, whether through public models or custom AI tools, accessing company data at a breathtaking rate

CSO Online

Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS

Wed Mar 18 2026

Apple on Tuesday released its first round of Background Security Improvements to address a security flaw in WebKit that affects iOS, iPadOS, and macOS. The vulnerability, tracked as CVE-2026-20643 (CVSS score: N/A), has been described as a cross-origin issue in WebKit's Navigation API that could be exploited to bypass the same-origin policy when processing maliciously crafted web content. The...

The Hacker News

Die besten Hacker-Filme

Wed Mar 18 2026

Vorsicht, dieses Film-Listicle kann zu Prokrastination verführen!Nomad Soul | shutterstock.

CSO Online

Nvidia NemoClaw promises to run OpenClaw agents securely

Tue Mar 17 2026

In the few short weeks since OpenClaw became the biggest story in agentic AI, it has been dogged by concerns that it is not secure enough to be safely let loose in enterprises.

CSO Online

AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE

Tue Mar 17 2026

Cybersecurity researchers have disclosed details of a new method for exfiltrating sensitive data from artificial intelligence (AI) code execution environments using domain name system (DNS) queries. In a report published Monday, BeyondTrust revealed that Amazon Bedrock AgentCore Code Interpreter's sandbox mode permits outbound DNS queries that an attacker can exploit to enable interactive shells...

The Hacker News

LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader

Tue Mar 17 2026

The ransomware operation known as LeakNet has adopted the ClickFix social engineering tactic delivered through compromised websites as an initial access method. The use of ClickFix, where users are tricked into manually running malicious commands to address non-existent errors, is a departure from relying on traditional methods for obtaining initial access, such as through stolen credentials...

The Hacker News

Cyber-Attacken fluten Eon-Netz: Angriffe verzehnfacht

Tue Mar 17 2026

Eon trägt eine große Verantwortung für die Energieversorgung in Deutschland.

CSO Online

AI is Everywhere, But CISOs are Still Securing It with Yesterday's Skills and Tools, Study Finds

Tue Mar 17 2026

A majority of security leaders are struggling to defend AI systems with tools and skills that are not fit for the challenge, according to the AI and Adversarial Testing Benchmark Report 2026 from Pentera. The report, based on a survey of 300 US CISOs and senior security leaders, examines how organizations are securing AI infrastructure and highlights critical gaps tied to skills shortages and...

The Hacker News

AWS Bedrock’s ‘isolated’ sandbox comes with a DNS escape hatch

Tue Mar 17 2026

AWS’ promise of “complete isolation” for agentic AI workflows on Bedrock is facing scrutiny after researchers found its sandbox mode isn’t as sealed as advertised.

CSO Online

Sears Exposed AI Chatbot Phone Calls and Text Chats to Anyone on the Web

Tue Mar 17 2026

Customer conversations with chatbots can include contact information and personal details that make it easier for scammers to launch phishing attacks and commit fraud.

Wired

Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate Malware

Tue Mar 17 2026

North Korean threat actors have been observed sending phishing to compromise targets and obtain access to a victim's KakaoTalk desktop application to distribute malicious payloads to certain contacts. The activity has been attributed by South Korean threat intelligence firm Genians to a hacking group referred to as Konni. "Initial access was achieved through a spear-phishing email disguised as a...

The Hacker News

Runtime: The new frontier of AI agent security

Tue Mar 17 2026

AI agents are already operating inside enterprise networks, quietly doing some of the work employees once handled themselves — writing code, drafting emails, retrieving files, and connecting to intern

CSO Online

CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths

Tue Mar 17 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a medium-severity security flaw impacting Wing FTP to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, CVE-2025-47813 (CVSS score: 4.3), is an information disclosure vulnerability that leaks the installation path of the application under certain conditions...

The Hacker News

Was ist ein Keylogger?

Tue Mar 17 2026

Keylogger sind Malware der alten Schule.

CSO Online

GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos

Mon Mar 16 2026

The GlassWorm malware campaign is being used to fuel an ongoing attack that leverages the stolen GitHub tokens to inject malware into hundreds of Python repositories. "The attack targets Python projects — including Django apps, ML research code, Streamlit dashboards, and PyPI packages — by appending obfuscated code to files like setup.py, main.py, and app.py," StepSecurity said. "Anyone who runs...

The Hacker News

⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More

Mon Mar 16 2026

Some weeks in security feel normal. Then you read a few tabs and get that immediate “ah, great, we’re doing this now” feeling. This week has that energy. Fresh messes, old problems getting sharper, and research that stops feeling theoretical real fast. A few bits hit a little too close to real life, too. There’s a good mix here: weird abuse of trusted stuff, quiet infrastructure ugliness,...

The Hacker News

Why Security Validation Is Becoming Agentic

Mon Mar 16 2026

If you run security at any reasonably complex organization, your validation stack probably looks something like this: a BAS tool in one corner. A pentest engagement, or maybe an automated pentesting product, in another. A vulnerability scanner feeding an attack surface management platform somewhere else. Each tool gives you a slice of the picture. None of them talks to each other in any...

The Hacker News

ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers

Mon Mar 16 2026

Three different ClickFix campaigns have been found to act as a delivery vector for the deployment of a macOS information stealer called MacSync. "Unlike traditional exploit-based attacks, this method relies entirely on user interaction – usually in the form of copying and executing commands – making it particularly effective against users who may not appreciate the implications of running...

The Hacker News

Open VSX extensions hijacked: GlassWorm malware spreads via dependency abuse

Mon Mar 16 2026

Threat actors are abusing extension dependency relationships in the Open VSX registry to indirectly deliver malware in a new phase of the GlassWorm supply-chain campaign.

CSO Online

Nine critical vulnerabilities in Linux AppArmor put over 12M enterprise systems at risk

Mon Mar 16 2026

Security researchers at Qualys have disclosed nine vulnerabilities in AppArmor, the Linux Security Module that ships enabled by default across Ubuntu, Debian, and SUSE distributions.

CSO Online

DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage

Mon Mar 16 2026

Ukrainian entities have emerged as the target of a new campaign likely orchestrated by threat actors linked to Russia, according to a report from S2 Grupo's LAB52 threat intelligence team. The campaign, observed in February 2026, has been assessed to share overlaps with a prior campaign mounted by Laundry Bear (aka UAC-0190 or Void Blizzard) aimed at Ukrainian defense forces with a malware...

The Hacker News

Models Are Applying to Be the Face of AI Scams

Mon Mar 16 2026

Dozens of Telegram channels reviewed by WIRED include job listings for “AI face models.” The (mostly) women who land these gigs are likely being used to dupe victims out of their money.

Wired

What it takes to win that CSO role

Mon Mar 16 2026

CSO and CISO roles are among the hardest to fill in IT.

CSO Online

ClickFix techniques evolve in new infostealer campaigns

Mon Mar 16 2026

Cybercriminals are combining compromised websites with increasingly sophisticated ClickFix social engineering lures to deliver new infostealer malware, with one campaign alone weaponizing more than 25

CSO Online

Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse

Mon Mar 16 2026

Google is testing a new security feature as part of Android Advanced Protection Mode (AAPM) that prevents certain kinds of apps from using the accessibility services API. The change, incorporated in Android 17 Beta 2, was first reported by Android Authority last week. AAPM was introduced by Google in Android 16, released last year. When enabled, it causes the device to enter a heightened...

The Hacker News

GenAI-Security als Checkliste

Mon Mar 16 2026

Das Open Web Application Security Project (OWASP) gibt Unternehmen eine Checkliste für (mehr) GenAI-Sicherheit an die Hand.

CSO Online

OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration

Sat Mar 14 2026

China's National Computer Network Emergency Response Technical Team (CNCERT) has issued a warning about the security stemming from the use of OpenClaw (formerly Clawdbot and Moltbot), an open-source and self-hosted autonomous artificial intelligence (AI) agent. In a post shared on WeChat, CNCERT noted that the platform's "inherently weak default security configurations," coupled with its...

The Hacker News

GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers

Sat Mar 14 2026

Cybersecurity researchers have flagged a new iteration of the GlassWorm campaign that they say represents a "significant escalation" in how it propagates through the Open VSX registry. "Instead of requiring every malicious listing to embed the loader directly, the threat actor is now abusing extensionPack and extensionDependencies to turn initially standalone-looking extensions into transitive...

The Hacker News

A Hacker Accidentally Broke Into the FBI’s Epstein Files

Sat Mar 14 2026

Plus: A porn-quitting app exposed the masturbation habits of hundreds of thousands of users, Russian hackers are trying to take over people’s Signal accounts, and more.

Wired

Google warns of two actively exploited Chrome zero days

Fri Mar 13 2026

Threat actors are exploiting two high severity zero day vulnerabilities in the Chrome browser that experts say IT teams must patch immediately.

CSO Online

Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware

Fri Mar 13 2026

A suspected China-based cyber espionage operation has targeted Southeast Asian military organizations as part of a state-sponsored campaign that dates back to at least 2020. Palo Alto Networks Unit 42 is tracking the threat activity under the moniker CL-STA-1087, where CL refers to cluster, and STA stands for state-backed motivation. "The activity demonstrated strategic operational patience and...

The Hacker News