CSO Online
Dark Reading
Dark Web Informer
Europol
Krebs on Security
NSA
Reuters
Security Affairs
The Hacker News
Wired
ZDNET
Cisco fixes maximum-severity Secure FMC bugs threatening firewall security
Wed Mar 04 2026
Cisco patched two critical Secure FMC vulnerabilities that could let attackers gain root access to managed firewalls. Cisco addressed two maximum-severity vulnerabilities in its Secure Firewall Management Center (FMC) that could allow attackers to gain root access. Cisco Secure Firewall Management Center (FMC) is a centralized management platform for Cisco firewalls. It lets administrators configure, […]
Security Affairs
Automate or orchestrate? Implementing a streamlined remediation program to shorten MTTR
Wed Mar 04 2026
Security teams want lower MTTR, but flaws persist. How to use automation vs. orchestration to reduce risk effectively? Almost all security teams want to reduce their Mean Time to Remediate (MTTR). And for good reason: research from 2024 found that it takes an average of 4.5 months to remediate critical vulnerabilities. The problem is that […]
Security Affairs
Why AI, Zero Trust, and modern security require deep visibility
Wed Mar 04 2026
AI.
CSO Online
The 10-hour problem: How visibility gaps are burning out the SOC
Wed Mar 04 2026
Security teams aren’t drowning because the threats improved.
CSO Online
Die besten Cyber-Recovery-Lösungen
Thu Mar 05 2026
Nicht greifende Recovery-Prozesse sind für Unternehmen ein Albtraumszenario, das dank ausgefeilter Angriffe immer öfter zur Realität wird.
CSO Online
Microsoft leads takedown of Tycoon2FA phishing service infrastructure
Thu Mar 05 2026
The infrastructure hosting the Tycoon2FA service, which Europol said was among the largest phishing operations worldwide, has been taken down by a coalition of IT companies and law enforcement agencie
CSO Online
How Vulnerable Are Computers to an 80-Year-Old Spy Technique? Congress Wants Answers
Wed Mar 04 2026
A pair of US lawmakers are calling for an investigation into how easily spies can steal information based on devices’ electromagnetic and acoustic leaks—a spying trick the NSA once codenamed TEMPEST.
Wired
LastPass warns of spoofed alerts aimed at stealing master passwords
Wed Mar 04 2026
LastPass warns of a phishing campaign using fake security alerts about unauthorized access or password changes to steal users’ master passwords. LastPass has warned users about a new phishing campaign using fake security alerts that claim unauthorized access or master password changes. The emails, which spoof LastPass’s display name, attempt to trick recipients into revealing […]
Security Affairs
149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict
Wed Mar 04 2026
Cybersecurity researchers have warned of a surge in retaliatory hacktivist activity following the U.S.-Israel coordinated military campaign against Iran, codenamed Epic Fury and Roaring Lion. "The hacktivist threat in the Middle East is highly lopsided, with two groups, Keymous+ and DieNet, driving nearly 70% of all attack activity between February 28 and March 2," Radware said in a Tuesday...
The Hacker News
Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1
Wed Mar 04 2026
Google said it identified a "new and powerful" exploit kit dubbed Coruna (aka CryptoWaters) targeting Apple iPhone models running iOS versions between 13.0 and 17.2.1. The exploit kit featured five full iOS exploit chains and a total of 23 exploits, Google Threat Intelligence Group (GTIG) said. It's not effective against the latest version of iOS. The findings were first reported by WIRED. "The...
The Hacker News
Iranian cyberattacks fail to materialize but threat remains acute
Wed Mar 04 2026
Five days into US and Israel’s war with Iran, the worst predictions for cyber-retaliation have yet to materialize.
CSO Online
From phishing to Google Drive C2: Silver Dragon expands APT41 playbook
Wed Mar 04 2026
APT group Silver Dragon, linked to APT41, targets governments via server exploits and phishing, using Cobalt Strike and Google Drive for C2. Check Point researchers have identified Silver Dragon, an APT group tied to the China-linked group APT41, targeting government entities in Europe and Southeast Asia since mid-2024. The group gains initial access by exploiting […]
Security Affairs
New RFP Template for AI Usage Control and AI Governance
Wed Mar 04 2026
As AI becomes the central engine for enterprise productivity, security leaders are finally getting the green light — and the budget — to secure it. But there’s a quiet crisis unfolding in the boardroom: many organizations know they need "AI Governance," but they have no idea what they are actually looking for. The CISO’s Dilemma: You Have the AI Budget, but Do You Have the Requirements? As AI...
The Hacker News
Fake Laravel Packages on Packagist Deploy RAT on Windows, macOS, and Linux
Wed Mar 04 2026
Cybersecurity researchers have flagged malicious Packagist PHP packages masquerading as Laravel utilities that act as a conduit for a cross-platform remote access trojan (RAT) that's functional on Windows, macOS, and Linux systems. The names of the packages are listed below - nhattuanbl/lara-helper (37 Downloads) nhattuanbl/simple-queue (29 Downloads) nhattuanbl/lara-swagger (49 Downloads)...
The Hacker News
Anthropic AI ultimatums and IP theft: The unspoken risk
Wed Mar 04 2026
Two recent high-profile events concerning Anthropic’s Claude AI underscore a little-discussed risk at the heart of the enterprise’s rush to capitalize on leading AI capabilities.
CSO Online
U.S. CISA adds Qualcomm and Broadcom VMware Aria Operations flaws to its Known Exploited Vulnerabilities catalog
Wed Mar 04 2026
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Qualcomm and Broadcom VMware Aria Operations flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: In […]
Security Affairs
Data breach at University of Hawaiʻi Cancer Center impacts 1.2 Million individuals
Wed Mar 04 2026
A ransomware attack on the University of Hawaiʻi Cancer Center exposed personal data of 1.2 million people. A 2025 ransomware attack targeting the University of Hawaiʻi Cancer Center compromised the personal information of about 1.2 million individuals. The attack hit the University of Hawaiʻi Cancer Center on August 31, 2025, impacting servers that support research […]
Security Affairs
APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2
Wed Mar 04 2026
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) group dubbed Silver Dragon that has been linked to cyber attacks targeting entities in Europe and Southeast Asia since at least mid-2024. "Silver Dragon gains its initial access by exploiting public-facing internet servers and by delivering phishing emails that contain malicious attachments," Check Point said...
The Hacker News
How to know you’re a real-deal CSO — and whether that job opening truly seeks one
Wed Mar 04 2026
Recruiters of senior-level IT professionals often say that a truly skilled and experienced CSO is among the hardest of all IT roles to fill.
CSO Online
CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog
Wed Mar 04 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a recently disclosed security flaw impacting Broadcom VMware Aria Operations to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. The high-severity vulnerability, CVE-2026-22719 (CVSS score: 8.1), has been described as a case of command injection that could allow an...
The Hacker News
Facebook is experiencing a global outage
Tue Mar 03 2026
Facebook is experiencing a global outage since 4:15 PM ET, with users reporting they cannot access their accounts. Facebook users worldwide report problems while attempting to access their accounts. The outage started around 4:15 PM ET. Upon attempting to access their account, users are presented the following message: “Account Temporarily Unavailable. Your account is currently unavailable due […]
Security Affairs
Ariomex, Iran-based crypto exchange, suffers data leak
Tue Mar 03 2026
Resecurity says Iran’s Ariomex crypto exchange suffered a data leak exposing user and transaction data from 2022 to 2025. Resecurity (USA) reports that Ariomex’s database, one of Iran’s cryptocurrency exchange platforms, suffered a data leak. The report published by the cybersecurity company presents the findings of a structured analysis of the leaked database, which contains […]
Security Affairs
AI-powered attack kits go open source, and CyberStrikeAI may be just the beginning
Wed Mar 04 2026
AI is making it ever easier for bad actors to launch attacks, and a newly-identified open source platform, CyberStrikeAI, seems to be lowering the bar even further.
CSO Online
A Possible US Government iPhone-Hacking Toolkit Is Now in the Hands of Foreign Spies and Criminals
Tue Mar 03 2026
A highly sophisticated set of iPhone hijacking techniques has likely infected tens of thousands of phones or more. Clues suggest it was originally built for the US government.
Wired
Fake Tech Support Spam Deploys Customized Havoc C2 Across Organizations
Tue Mar 03 2026
Threat hunters have called attention to a new campaign as part of which bad actors masqueraded as fake IT support to deliver the Havoc command-and-control (C2) framework as a precursor to data exfiltration or ransomware attack. The intrusions, identified by Huntress last month across five partner organizations, involved the threat actors using email spam as lures, followed by a phone call from...
The Hacker News
Oracle EBS 2025 campaign impacts Madison Square Garden, sensitive data leaked
Tue Mar 03 2026
Madison Square Garden confirmed a data breach tied to the 2025 Oracle E-Business Suite hacking campaign. Madison Square Garden (MSG) has confirmed it was affected by a data breach linked to the 2025 cybercrime campaign targeting Oracle’s E-Business Suite (EBS) customers. Madison Square Garden (MSG) is a world-famous multi-purpose indoor arena located in New York […]
Security Affairs
Building a High-Impact Tier 1: The 3 Steps CISOs Must Follow
Tue Mar 03 2026
Every CISO knows the uncomfortable truth about their Security Operations Center: the people most responsible for catching threats in real time are the people with the least experience. Tier 1 analysts sit at the front line of detection, and yet they are also the most vulnerable to the cognitive and organizational pressures that quietly erode SOC performance over time. The Paradox at the Gate:...
The Hacker News
Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries
Tue Mar 03 2026
The threat actor behind the recently disclosed artificial intelligence (AI)-assisted campaign targeting Fortinet FortiGate appliances leveraged an open-source, AI-native security testing platform called CyberStrikeAI to execute the attacks. The new findings come from Team Cymru, which detected its use following an analysis of the IP address ("212.11.64[.]250") that was used by the suspected...
The Hacker News
OAuth phishers make ‘check where the link points’ advice ineffective
Tue Mar 03 2026
Microsoft has warned that phishers are exploiting a built-in behavior of the OAuth authentication protocol to redirect victims to malware, using links that point to legitimate identity provider domain
CSO Online
Phishing campaign exploits OAuth redirection to bypass defenses
Tue Mar 03 2026
Microsoft researchers warn that threat actors abuse OAuth redirects to target government users and deliver malware. Microsoft has warned of phishing campaigns targeting government and public-sector organizations by abusing OAuth URL redirection. Instead of stealing credentials or exploiting software flaws, attackers leverage OAuth’s legitimate by-design behavior to bypass email and browser defenses. The tactic redirects […]
Security Affairs
Jetzt Staats-CISO werden – für unter 160.000 Euro
Tue Mar 03 2026
width="1600" height="900" sizes="auto, (max-width: 1600px) 100vw, 1600px">Das britische Government Communications Headquarters (GCHQ) in Cheltenham, England.
CSO Online
AI Agents: The Next Wave Identity Dark Matter - Powerful, Invisible, and Unmanaged
Tue Mar 03 2026
The Rise of MCPs in the Enterprise The Model Context Protocol (MCP) is quickly becoming a practical way to push LLMs from “chat” into real work. By providing structured access to applications, APIs, and data, MCP enables prompt-driven AI agents that can retrieve information, take action, and automate end-to-end business workflows across the enterprise. This is already showing up in production...
The Hacker News
Starkiller Phishing Suite Uses AitM Reverse Proxy to Bypass Multi-Factor Authentication
Tue Mar 03 2026
Cybersecurity researchers have disclosed details of a new phishing suite called Starkiller that proxies legitimate login pages to bypass multi-factor authentication (MFA) protections. It's advertised as a cybercrime platform by a threat group calling itself Jinkusu, granting customers access to a dashboard that lets them select a brand to impersonate or enter a brand's real URL. It also lets...
The Hacker News
Android devices hit by exploited Qualcomm flaw CVE-2026-21385
Tue Mar 03 2026
Google confirms that the Qualcomm Android vulnerability CVE-2026-21385 was exploited in real-world attacks. Google has confirmed that CVE-2026-21385 (CVSS score of 7.8), a high-severity vulnerability affecting an open-source Qualcomm component used in Android devices, has been actively exploited. “There are indications that CVE-2026-21385 may be under limited, targeted exploitation.” reads Google’s advisory. The flaw is […]
Security Affairs
Studie: Hacker legen Betrieb bei vielen Unternehmen lahm
Tue Mar 03 2026
Hacker hatten auch 2025 deutsche Unternehmen im Visier.
CSO Online
Epic Fury introduces new layer of enterprise risk
Tue Mar 03 2026
Operation Epic Fury — the US administration’s sustained kinetic pressure on core Iranian regime assets — introduces a new layer of operational risk for every multinational with people, assets, or depe
CSO Online
How Journalists Are Reporting From Iran With No Internet
Tue Mar 03 2026
After strikes killed senior Iranian officials, Iran cut off internet access. Journalists are relying on satellite links, encrypted apps, and smuggled footage to report from inside the country.
Wired
Chrome security flaw enabled spying via Gemini Live assistant
Tue Mar 03 2026
A Google Chrome vulnerability lets malicious extensions hijack Gemini Live to spy on users and steal sensitive files. Researchers at Palo Alto Networks found a Chrome vulnerability, tracked as CVE-2026-0628, that could let malicious extensions take control of the Gemini Live AI assistant. By abusing the flaw, attackers could spy on users and exfiltrate sensitive […]
Security Affairs
Microsoft Warns OAuth Redirect Abuse Delivers Malware to Government Targets
Tue Mar 03 2026
Microsoft on Monday warned of phishing campaigns that employ phishing emails and OAuth URL redirection mechanisms to bypass conventional phishing defenses implemented in email and browsers. The activity, the company said, targets government and public-sector organizations with the end goal of redirecting victims to attacker-controlled infrastructure without stealing their tokens. It described...
The Hacker News
Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited
Tue Mar 03 2026
Google on Monday disclosed that a high-severity security flaw impacting an open-source Qualcomm component used in Android devices has been exploited in the wild. The vulnerability in question is CVE-2026-21385 (CVSS score: 7.8), a buffer over-read in the Graphics component. "Memory corruption when adding user-supplied data without checking available buffer space," Qualcomm said in an advisory,...
The Hacker News
7 factors impacting the cyber skills gap
Tue Mar 03 2026
Individuals with strong cybersecurity skills are in high demand.
CSO Online
Middle east crisis prompts UK NCSC warning on potential Iranian cyber activity
Mon Mar 02 2026
UK’s NCSC warns of potential Iranian cyberattacks as Middle East tensions rise, urging vigilance from exposed organizations. The UK’s National Cyber Security Centre (NCSC) has warned organizations of a potential increase in Iranian cyber threats amid the escalating Middle East conflict. While it sees no immediate shift in the direct threat to Britain, officials stress […]
Security Affairs
SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains
Tue Mar 03 2026
The threat activity cluster known as SloppyLemming has been attributed to a fresh set of attacks targeting government entities and critical infrastructure operators in Pakistan and Bangladesh. The activity, per Arctic Wolf, took place between January 2025 and January 2026. It involves the use of two distinct attack chains to deliver malware families tracked as BurrowShell and a Rust-based...
The Hacker News
Das gehört in Ihr Security-Toolset
Tue Mar 03 2026
Lesen Sie, welche Werkzeuge essenziell sind, um Unternehmen gegen Cybergefahren abzusichern.
CSO Online
Vulnerability monitoring service secures public-sector websites faster
Mon Mar 02 2026
An automated scanning system has cut the time it takes to fix cybersecurity vulnerabilities across public sector IT systems, reducing median remediation time for general cyber vulnerabilities from 53
CSO Online
Attacks on GPS Spike Amid US and Israeli War on Iran
Mon Mar 02 2026
New analysis shows that attacks on satellite navigation systems have impacted some 1,100 ships in the Middle East since the US and Israel attacked Iran on February 28.
Wired
New Chrome Vulnerability Let Malicious Extensions Escalate Privileges via Gemini Panel
Mon Mar 02 2026
Cybersecurity researchers have disclosed details of a now-patched security flaw in Google Chrome that could have permitted attackers to escalate privileges and gain access to local files on the system. The vulnerability, tracked as CVE-2026-0628 (CVSS score: 8.8), has been described as a case of insufficient policy enforcement in the WebView tag. It was patched by Google in early January 2026...
The Hacker News
Google Develops Merkle Tree Certificates to Enable Quantum-Resistant HTTPS in Chrome
Mon Mar 02 2026
Google has announced a new program in its Chrome browser to ensure that HTTPS certificates are secure against the future risk posed by quantum computers. "To ensure the scalability and efficiency of the ecosystem, Chrome has no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the Chrome Root Store," the Chrome Secure Web and Networking Team said. "...
The Hacker News
Russia-linked APT28 exploited MSHTML zero-day CVE-2026-21513 before patch
Mon Mar 02 2026
Russia-linked APT28 reportedly exploited MSHTML zero-day CVE-2026-21513 before Microsoft patched it, a high-severity bypass flaw. Akamai reports that Russia-linked APT28 may have exploited CVE-2026-21513 CVSS score of 8.8), a high-severity MSHTML vulnerability (CVSS 8.8), before Microsoft patched it in February 2026. The vulnerability is an Internet Explorer security control bypass that can lead to code […]
Security Affairs
APT37 combines cloud storage and USB implants to infiltrate air-gapped systems
Mon Mar 02 2026
North Korea-linked APT 37 used Zoho WorkDrive and USB malware to breach air-gapped networks in the Ruby Jumper campaign. North Korean group ScarCruft (aka APT37, Reaper, and Group123) deployed new tools in a campaign dubbed Ruby Jumper, using a backdoor that leverages Zoho WorkDrive for C2 and a USB-based implant to breach air-gapped systems. Zscaler ThreatLabz […]
Security Affairs
War in Iran Spiked Oil Prices. Trump Will Decide How High They Go
Mon Mar 02 2026
The conflict in the Middle East is driving oil prices up in a midterm year when Americans are already focused on high energy bills.
Wired
⚡ Weekly Recap: SD-WAN 0-Day, Critical CVEs, Telegram Probe, Smart TV Proxy SDK and More
Mon Mar 02 2026
This week is not about one big event. It shows where things are moving. Network systems, cloud setups, AI tools, and common apps are all being pushed in different ways. Small gaps in access control, exposed keys, and normal features are being used as entry points. The pattern becomes clear only when you see everything together. Faster scans, smarter misuse of trusted services, and steady...
The Hacker News
How to Protect Your SaaS from Bot Attacks with SafeLine WAF
Mon Mar 02 2026
Most SaaS teams remember the day their user traffic started growing fast. Few notice the day bots started targeting them. On paper, everything looks great: more sign-ups, more sessions, more API calls. But in reality, something feels off: Sign-ups increase, but users aren’t activating. Server costs rise faster than revenue. Logs are filled with repeated requests from strange user agents. If...
The Hacker News
Europol’s Project Compass nets 30 arrests in crackdown on “The Com”
Mon Mar 02 2026
Europol’s Project Compass led to 30 arrests targeting ‘The Com’ network, identifying 62 victims and protecting four children from harm. A yearlong operation, code-named Project Compass, led by Europol has dealt a major blow to The Com,’ a cybercrime network known for targeting children and teenagers. The joint effort, called Project Compass and coordinated by […]
Security Affairs
Innovation without exposure: A CISO’s secure-by-design framework for business outcomes
Mon Mar 02 2026
The brief for security leaders has changed.
CSO Online
APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday
Mon Mar 02 2026
A recently disclosed security flaw patched by Microsoft may have been exploited by the Russia-linked state-sponsored threat actor known as APT28, according to new findings from Akamai. The vulnerability in question is CVE-2026-21513 (CVSS score: 8.8), a high-severity security feature bypass affecting the MSHTML Framework. "Protection mechanism failure in MSHTML Framework allows an unauthorized...
The Hacker News
A scorecard for cyber and risk culture
Mon Mar 02 2026
Have you once watched a leadership team clap for their “security culture month” like they’d landed a rover? Posters everywhere.
CSO Online
ClawJacked flaw exposed OpenClaw users to data theft
Mon Mar 02 2026
“ClawJacked” flaw let malicious sites hijack OpenClaw AI agents to steal data; patch released in version 2026.2.26. A high-severity vulnerability called ClawJacked in OpenClaw allowed malicious websites to brute-force and take control of local AI agent instances. Oasis Security discovered the flaw, which enabled silent data theft. OpenClaw addressed the issue with version 2026.2.26, released […]
Security Affairs
Ukrainian hacker pleads guilty to running OnlyFake AI ID scam site
Mon Mar 02 2026
Ukrainian citizen Yurii Nazarenko admitted running OnlyFake, an AI-driven site that sold over 10,000 fake IDs worldwide. Ukrainian man Yurii Nazarenko pleaded guilty to operating OnlyFake, an AI-powered site that generated and sold more than 10,000 counterfeit IDs globally. “United States Attorney for the Southern District of New York, Jay Clayton, and Assistant Director in Charge […]
Security Affairs
North Korean Hackers Publish 26 npm Packages Hiding Pastebin C2 for Cross-Platform RAT
Mon Mar 02 2026
Cybersecurity researchers have disclosed a new iteration of the ongoing Contagious Interview campaign, where the North Korean threat actors have published a set of 26 malicious packages to the npm registry. The packages masquerade as developer tools, but contain functionality to extract the actual command-and-control (C2) by using seemingly harmless Pastebin content as a dead drop resolver and...
The Hacker News
Hacker erpressen weniger Lösegeld
Mon Mar 02 2026
immer mehr betroffene Unternehmen und Organisationen folgen dem Rat, kein Lösegeld zu zahlen.
CSO Online
How CISOs can build a resilient workforce
Mon Mar 02 2026
With ongoing skills gaps, AI reshaping roles and workforce stress as standing concerns for many CISOs, ensuring the resilience of the workforce has become top of mind.
CSO Online
ShinyHunters leaked the full Odido dataset
Sun Mar 01 2026
Cybercrime group ShinyHunters leaked the full Odido dataset, the Netherlands is facing the biggest data leak in its history. Odido is a Dutch telecommunications company and one of the largest mobile network operators in the Netherlands. It was formed when T-Mobile Netherlands and Tele2 were rebranded as Odido in 2023 after private equity firms Apax Partners and Warburg Pincus […]
Security Affairs
Im Fokus: RZ-Modernisierung
Mon Mar 02 2026
CSO Online
Kubernetes Security: Wie Sie Ihre Cluster (besser) absichern
Mon Mar 02 2026
Anatoliy Eremin | shutterstock.
CSO Online
The 5 Big ‘Known Unknowns’ of Donald Trump’s New War With Iran
Sun Mar 01 2026
The all-out air assault on the Islamic Republic might be the biggest gamble of the president’s career.
Wired
Claude code abused to steal 150GB in cyberattack on Mexican agencies
Sun Mar 01 2026
Hackers abused Claude Code to build exploits and steal 150GB of data in a cyberattack targeting Mexican government systems. Hackers abused Anthropic’s Claude Code AI assistant to develop exploits, create custom tools, and automatically exfiltrate more than 150GB of data in an attack on Mexican government systems, the Israeli cybersecurity firm Gambit Security reports. The […]
Security Affairs
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 86
Sun Mar 01 2026
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Technical Deep Dive: The Monero Mining Campaign Operation Olalampo: Inside MuddyWater’s Latest Campaign VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731) Operation MacroMaze: new APT28 campaign using basic tooling and legit […]
Security Affairs
CVE-2025-64328 exploitation impacts 900 Sangoma FreePBX instances
Sun Mar 01 2026
About 900 Sangoma FreePBX systems were infected with web shells after attackers exploited a command injection flaw. Hundreds of Sangoma FreePBX instances are still infected with web shells following attacks that began in December 2025. Sangoma FreePBX is an open-source, web-based platform for managing Asterisk-powered VoIP phone systems. Maintained by Sangoma Technologies, it allows businesses […]
Security Affairs
Security Affairs newsletter Round 565 by Pierluigi Paganini – INTERNATIONAL EDITION
Sun Mar 01 2026
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Canadian Tire 2025 data breach impacts 38 million users Iran ’s Internet near-totally blacked out amid […]
Security Affairs
Canadian Tire 2025 data breach impacts 38 million users
Sat Feb 28 2026
A data breach at Canadian Tire exposed personal data from over 38 million accounts, including contact details and encrypted passwords. More than 38 million accounts were affected by an October 2025 data breach at Canadian retail giant Canadian Tire (CTC). The incident marks one of the largest retail data breaches in Canada, raising concerns about […]
Security Affairs
ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket
Sat Feb 28 2026
OpenClaw has fixed a high-severity security issue that, if successfully exploited, could have allowed a malicious website to connect to a locally running artificial intelligence (AI) agent and take over control. "Our vulnerability lives in the core system itself – no plugins, no marketplace, no user-installed extensions – just the bare OpenClaw gateway, running exactly as documented," Oasis...
The Hacker News
Hacked Prayer App Sends ‘Surrender’ Messages to Iranians Amid Israeli and US Strikes
Sat Feb 28 2026
As Israeli airstrikes hit Tehran this morning, Iranians received mysterious push notifications saying that “help is on the way,” promising amnesty if they surrender.
Wired
This Is the System That Intercepted Iran’s Missiles Over the UAE
Sat Feb 28 2026
As Iranian missiles targeted US-linked sites across the Gulf, the UAE’s missile shield was activated in real time.
Wired
Who is the Kimwolf Botmaster “Dort”?
Sat Feb 28 2026
In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to assemble Kimwolf, the world's largest and most disruptive botnet. Since then, the person in control of Kimwolf -- who goes by the handle "Dort" -- has coordinated a barrage of distributed denial-of-service (DDoS), doxing and email flooding attacks against the researcher and this author, and more recently caused a SWAT team to be sent to the researcher's home. This post examines what is knowable about Dort based on public information.
Krebs on Security
Iran ’s Internet near-totally blacked out amid US, Israeli strikes
Sat Feb 28 2026
Iran experienced a near-total internet blackout as Israel and the U.S. launched strikes, according to NetBlocks. Internet access across Iran was drastically reduced on Saturday as Israel and the United States carried out strikes against the country, according to independent and non-partisan global internet monitor NetBlocks. Network data indicated a near-total nationwide blackout. The national […]
Security Affairs
Area Man Accidentally Hacks 6,700 Camera-Enabled Robot Vacuums
Sat Feb 28 2026
Plus: The top US cyber agency falls into shambles, AI models develop an upsetting penchant for nuclear weapons, and more.
Wired
Thousands of Public Google Cloud API Keys Exposed with Gemini Access After API Enablement
Sat Feb 28 2026
New research has found that Google Cloud API keys, typically designated as project identifiers for billing purposes, could be abused to authenticate to sensitive Gemini endpoints and access private data. The findings come from Truffle Security, which discovered nearly 3,000 Google API keys (identified by the prefix "AIza") embedded in client-side code to provide Google-related services like...
The Hacker News
US and Israel Launch Strikes Against Iran
Sat Feb 28 2026
US president Donald Trump said a “major combat operation” against Iran had begun as he called for the country’s government to be overthrown.
Wired
Microsoft warns of RAT delivered through trojanized gaming utilities
Sat Feb 28 2026
Attackers spread trojanized gaming tools to deliver a stealthy RAT using PowerShell, LOLBins, and Defender evasion tactics. Threat actors are tricking users into running trojanized gaming utilities shared through browsers and chat platforms to deploy a remote access trojan. “Microsoft Defender researchers uncovered a campaign that lured users into running trojanized gaming utilities (Xeno.exe or […]
Security Affairs
Pentagon Designates Anthropic Supply Chain Risk Over AI Military Dispute
Sat Feb 28 2026
Anthropic on Friday hit back after U.S. Secretary of Defense Pete Hegseth directed the Pentagon to designate the artificial intelligence (AI) upstart as a "supply chain risk." "This action follows months of negotiations that reached an impasse over two exceptions we requested to the lawful use of our AI model, Claude: the mass domestic surveillance of Americans and fully autonomous weapons," the...
The Hacker News
Security hole could let hackers take over Juniper Networks PTX core routers
Fri Feb 27 2026
Network admins with Juniper PTX series routers in their environments are being warned to patch immediately, because a newly-discovered critical vulnerability could lead to an unauthenticated threat ac
CSO Online
‘Silent’ Google API key change exposed Gemini AI data
Fri Feb 27 2026
Google Cloud API keys, normally used as simple billing identifiers for APIs such as Maps or YouTube, could be scraped from websites to give access to private Gemini AI project data, researchers from T
CSO Online
Aeternum botnet hides commands in Polygon smart contracts
Fri Feb 27 2026
Aeternum botnet uses Polygon blockchain smart contracts for C&C, making its infrastructure harder to detect and disrupt. Qrator Labs researchers uncovered Aeternum, a botnet that runs its command-and-control infrastructure through smart contracts on the Polygon blockchain. By decentralizing its C2, the malware avoids traditional server-based takedowns and becomes far harder to disrupt or shut down, […]
Security Affairs
DoJ Seizes $61 Million in Tether Linked to Pig Butchering Crypto Scams
Fri Feb 27 2026
The U.S. Department of Justice (DoJ) this week announced the seizure of $61 million worth of Tether that were allegedly associated with bogus cryptocurrency schemes known as pig butchering. The confiscated funds were traced to cryptocurrency addresses used for the laundering of criminally derived proceeds stolen from victims of cryptocurrency investment scams, the department added. "Criminal...
The Hacker News
900+ Sangoma FreePBX Instances Compromised in Ongoing Web Shell Attacks
Fri Feb 27 2026
The Shadowserver Foundation has revealed that over 900 Sangoma FreePBX instances still remain infected with web shells as part of attacks that exploited a command injection vulnerability starting in December 2025. Of these, 401 instances are located in the U.S., followed by 51 in Brazil, 43 in Canada, 40 in Germany, and 36 in France. The non-profit entity said the compromises are likely...
The Hacker News
Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor
Fri Feb 27 2026
Cybersecurity researchers have disclosed details of a malicious Go module that's designed to harvest passwords, create persistent access via SSH, and deliver a Linux backdoor named Rekoobe. The Go module, github[.]com/xinfeisoft/crypto, impersonates the legitimate "golang.org/x/crypto" codebase, but injects malicious code that's responsible for exfiltrating secrets entered via terminal password...
The Hacker News
iPhone and iPad are the first consumer devices cleared for NATO ‘RESTRICTED’ classification
Fri Feb 27 2026
Apple’s iPhone and iPad are now NATO-approved for classified use, listed in the alliance’s Information Assurance Product Catalogue. Apple announced that its iPhone and iPad have received NATO approval to handle classified information. The devices are now officially listed in the NATO Information Assurance Product Catalogue (NIAPC), allowing military personnel to use them securely for […]
Security Affairs
One of the ‘most influential cybersecurity’ roles will pay under $175,000
Fri Feb 27 2026
A recent job ad is causing plenty of head-shaking, suggesting that some government high-ups appear to be out of touch with the current state of the cybersecurity job market.
CSO Online
ScarCruft Uses Zoho WorkDrive and USB Malware to Breach Air-Gapped Networks
Fri Feb 27 2026
The North Korean threat actor known as ScarCruft has been attributed to a fresh set of tools, including a backdoor that uses Zoho WorkDrive for command-and-control (C2) communications to fetch more payloads and an implant that uses removable media to relay commands and breach air-gapped networks. The campaign, codenamed Ruby Jumper by Zscaler ThreatLabz, involves the deployment of malware...
The Hacker News
Your personal OpenClaw agent may also be taking orders from malicious websites
Fri Feb 27 2026
If you thought running an AI agent locally kept it safely inside your machine’s walls, you’re in for a surprise.
CSO Online
Juniper issues emergency patch for critical PTX router RCE
Fri Feb 27 2026
Juniper released an emergency patch for Junos OS Evolved to fix CVE-2026-21902, a critical RCE flaw affecting PTX routers. Juniper Networks issued an out-of-band security update for Junos OS Evolved to address a critical remote code execution vulnerability, tracked as CVE-2026-21902 (CVSS score of 9.3), impacting PTX routers. The company urges customers to apply the […]
Security Affairs
US authorities punish sellers of malware and spyware
Fri Feb 27 2026
The US authorities have made it clear that they will have no truck with any individuals trying to by-pass regulations on trading cyberweapons with hostile powers.
CSO Online
Why application security must start at the load balancer
Fri Feb 27 2026
For a long time, I thought of the load balancer as a performance device.
CSO Online
Trojanized Gaming Tools Spread Java-Based RAT via Browser and Chat Platforms
Fri Feb 27 2026
Threat actors are luring unsuspecting users into running trojanized gaming utilities that are distributed via browsers and chat platforms to distribute a remote access trojan (RAT). "A malicious downloader staged a portable Java runtime and executed a malicious Java archive (JAR) file named jd-gui.jar," the Microsoft Threat Intelligence team said in a post on X. "This downloader used PowerShell...
The Hacker News
Enterprise Spotlight: Data Center Modernization
Fri Feb 27 2026
CSO Online
Data Broker Breaches Fueled Nearly $21 Billion in Identity-Theft Losses
Fri Feb 27 2026
A report copublished by WIRED sparked a probe into opt-out pages hidden by data brokers. Now congressional Democrats say breaches tied to the industry have cost people tens of billions of dollars.
Wired
How to make LLMs a defensive advantage without creating a new attack surface
Fri Feb 27 2026
Large language models (LLMs) have arrived in security in three different forms at once: as productivity tools that sit beside analysts, as components embedded inside products and workflows and as targ
CSO Online
How AI Aids Incident Response: Why Humans Alone Cannot Do IR Efficiently
Fri Feb 27 2026
AI accelerates incident response by correlating alerts and generating reports in minutes, helping teams scale beyond manual limits. Incident response has always been a race against the clock. It starts ticking the moment an alert is triggered, and each minute thereafter can lead to lost revenue, regulatory exposure, reputational damage, or customer churn. Traditionally, incident […]
Security Affairs
12 Million exposed .env files reveal widespread security failures
Fri Feb 27 2026
Mysterium VPN found 12M IPs exposing .env files, leaking credentials and revealing widespread security misconfigurations worldwide. Configuration mistakes rarely trigger alarms. A forgotten deny rule, an overlooked server setting, or a full project folder uploaded to production can quietly expose a company’s most sensitive secrets. In many cases, those secrets live inside simple environment files […]
Security Affairs