News without the noise
Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.
552 articles · page 12 of 12
ServiceNow has released security patches for three maximum-severity vulnerabilities affecting its AI Platform, warning that unauthenticated attackers could exploit them in low-complexity attacks. The company also addressed a high-severity sandbox escape flaw. The patches come just days after Ubiquiti fixed a similar set of critical vulnerabilities.
The FBI has dismantled infrastructure tied to a technical 'quartermaster' that provided reconnaissance, proxy management, and operational routing capabilities for Chinese cyber espionage activities, according to a notice published Wednesday.
A critical-severity vulnerability in Gitea, the self-hosted Git service, is being actively exploited by attackers in code injection attacks, according to a warning from the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The flaw allows remote threat actors to inject malicious code into repositories, potentially compromising source code, CI/CD pipelines, and developer credentials. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, signaling an urgent need for organizations to apply patches.
The Los Angeles County Museum of Art (LACMA) has disclosed that a data breach last year compromised customer and employee information, including Social Security numbers and medical data, raising concerns about identity theft and privacy protections at one of the nation's largest art institutions.
In a stark opinion piece published on The Hill, cybersecurity expert Tal Kollender warns that Iran is not waiting for the end of its current conflicts to probe and attack US water systems, asserting that these assaults are just the beginning of a broader campaign against American critical infrastructure. The piece, which does not cite specific new incidents, urges US officials to treat the threat as an ongoing and escalating challenge.
A large-scale distributed denial-of-service (DDoS) attack has disrupted Norway’s shared government digital infrastructure since Monday, August 25, 2026, knocking out multiple services relied upon by the public sector and potentially affecting citizens' access to government portals. Norwegian authorities are scrambling to mitigate the ongoing assault, which experts describe as one of the most disruptive cyberattacks against the country’s administrative backbone in recent years.
A cyberattack exploiting an Oracle database's legitimate Java functionality has exposed a critical security gap that even all 1,449 patches released in late July would not have prevented. Security firm Huntress documented the credential theft incident, highlighting that attackers used a 'simple' SQL injection on a public-facing web application to upload a post-exploitation toolkit called khunt directly into the database engine via its embedded Java Virtual Machine. Experts say the breach, while not an Oracle vulnerability, underscores the dangers of misconfigured database features and an over-reliance on patching over basic security hygiene.
Nutex Health, a healthcare services and hospital operator, is investigating a data breach after an unauthorized third party accessed and exfiltrated information from its servers. The company has not yet disclosed how many individuals are affected or the nature of the stolen data.
Security researchers have identified vulnerabilities in Baseboard Management Controllers (BMCs) — specialized processors embedded in server motherboards that enable remote, out-of-band management — potentially exposing thousands of enterprise servers to hardware-level compromise. The flaws could allow attackers to gain persistent control over affected systems, bypassing traditional operating system defenses.
The French tax authority, Direction Générale des Finances Publiques (DGFiP), has confirmed a significant cybersecurity breach that exposed sensitive personal and financial data of citizens, marking one of the most serious attacks on the country's fiscal administration in recent years.
Threat actors have already compromised more than 270 Zimbra Collaboration Suite (ZCS) servers in ongoing attacks that exploit a high-severity remote code execution vulnerability, according to a report by BleepingComputer.
Cybercriminals are exploiting sponsored Google search results to trick Mac developers into installing malware disguised as OpenAI's Codex coding assistant, researchers at Cato Networks have revealed. The campaign uses a 'ClickFix' technique that convinces victims to paste malicious commands into Terminal, ultimately delivering a variant of the Atomic macOS Stealer (AMOS) infostealer.
Law enforcement agencies from 22 countries have arrested 58 individuals and identified 263 suspects in a coordinated global crackdown on cybercrime networks run by West African crime groups, with the largest single haul — 39 arrests — coming in South Africa for romance and investment fraud, authorities announced Tuesday.
Alibaba's global marketplace AliExpress has been accused of deploying hidden audio fingerprinting scripts that silently generate waveforms using a user's browser to collect device characteristics, even when no sound is playing. The discovery, made by developer Matt Callaghan and detailed in a blog post, revealed that the practice interferes with multipoint Bluetooth audio and raises new privacy concerns about browser-based tracking.
Chinese e-commerce giant AliExpress has been secretly fingerprinting visitors by sending inaudible sawtooth waves to their browsers, a researcher discovered after the technique interfered with his Bluetooth headphones. The practice, which uses the WebAudio API to measure unique device characteristics, was uncovered by security researcher Matthew Callaghan and raises fresh privacy concerns about covert tracking methods.
Cybersecurity firm ReliaQuest and the threat actor group ShinyHunters are publicly disputing the impact of a social engineering attack on August 22, with the gang claiming it breached the company while ReliaQuest asserts the attempt was unsuccessful beyond a temporary exposure of one employee's identity.
Security researcher Christopher Domas has disclosed a hardware-level vulnerability in modern CPU architectures that allows unprivileged software to access protected memory regions by manipulating DRAM controller translation registers, raising significant concerns for cloud and confidential computing environments.
Anthropic has announced it is now running its most powerful AI model, Claude Mythos 5, through its Claude Security vulnerability scanner, offering $35 million in credits to open source projects. The move marks a significant deployment of a model the company previously held back from public release, now tasked with scanning codebases for flaws and integrating with partner products protecting critical infrastructure.
In a landmark cyberattack, hackers linked to the Iranian regime have successfully shut down a power plant in the United Kingdom, marking the first time such a facility has been taken offline by state-affiliated actors, according to security officials and reports from The Financial Review.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch two actively exploited vulnerabilities in TrueConf, a Russian-built video conferencing platform, after compromised servers were found distributing malware to meeting participants. The development comes alongside separate supply-chain attacks targeting Android car head units and a confirmed social engineering breach at cybersecurity firm ReliaQuest, highlighting a surge in multi-vector threats.
A joint advisory from U.S. federal agencies has warned that Iranian hackers are actively targeting Siemens S7-series programmable logic controllers (PLCs) used in critical infrastructure, employing AI tools to develop exploits and adapt to defensive measures. The warning, issued by CISA, NSA, FBI, DOE, and EPA, comes amid ongoing Russian cyber-espionage campaigns against academia, government, and defense organizations, as detailed by Google's Threat Intelligence Group.
In a span of 24 hours, three major organizations — France's tax authority, Toronto's Hospital for Sick Children, and private equity firm Apollo Global Management — disclosed data breaches affecting hundreds of thousands of individuals, underscoring a relentless wave of cyberattacks targeting government agencies, healthcare institutions, and financial giants.
A security researcher who inadvertently hijacked a portion of the global phone number routing system has logged hundreds of thousands of misdirected calls, including many to US military bases, revealing a little-known vulnerability in how telephone numbers are resolved on the internet.
Microsoft has fixed a maximum-severity vulnerability in its Entra ID identity and access management service that attackers were already exploiting in the wild. The flaw, tracked as CVE-2026-69836 and carrying a CVSS score of 10.0, stems from unsafe deserialization and allows unauthenticated remote code execution over the network. Microsoft disclosed the issue on Thursday, stating that it has been fully mitigated server-side without requiring any action from customers.