News without the noise
Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.
554 articles · page 5 of 12
Security researchers at Varonis Threat Labs have discovered a new Windows malware loader, named AvisLoader, that uses the encrypted Tox peer-to-peer messaging network for command and control, a design that makes traditional domain-based takedowns difficult.
Ahold Delhaize, one of the world’s largest food retail chains, confirmed today that it has taken some systems offline following a cybersecurity incident, with customers unable to use websites and apps in the Netherlands and Belgium and US employees locked out of scheduling and pay systems.
French authorities were investigating on Monday a cyberattack that forced refrigeration units in hundreds of supermarkets to heat to 50C, spoiling fresh and frozen food worth millions of euros and causing fires, as Prime Minister Sébastien Lecornu instructed the national cybersecurity agency ANSSI to investigate.
The hacking group Cyberleek has issued an ultimatum to Take-Two Interactive and Rockstar Games: release a physical version of Grand Theft Auto VI and apologize, or the group will leak the full build of the game, including the complete story mode. The demand is coupled with a requirement that Cyberleek's Solana memecoin, $CYBERLEEK, reach a market cap of $30 million before the build is released.
Security firm iVerify has disclosed a new variant of iPhone spyware, designated P7 DarkSword, that can remotely scan for cryptocurrency wallet applications and extract sensitive data from compromised devices, highlighting an emerging threat to mobile crypto holders.
A phishing scam that inserts fake meetings into users' electronic calendars is growing exponentially, according to security researchers, exploiting the trust people place in calendar entries to steal login credentials.
King Charles III has warned that malicious online actors are evolving their tactics by using automated technologies, posing challenges to trust and security in the digital age. In a letter to the National Cyber Security Centre (NCSC) to mark its 10th anniversary, the King praised the agency's achievements in defending against cyber attacks and safeguarding democratic institutions, while noting the need to balance the risks and opportunities of powerful new technologies.
Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive who helped companies negotiate with ransomware attackers, has been arrested in Pennsylvania and transferred to Texas on federal conspiracy and extortion charges linked to the FBI's crackdown on the ShinyHunters hacking group.
Ledger has confirmed that some of its hardware wallets sold through Malaysian reseller CryptoBilis contained an unauthorized hardware implant that drained users' cryptocurrency funds. Researchers have now detailed two variants of the implant, which intercepted display output and button presses to steal seed phrases and sent them to attackers over an LTE connection using an eSIM.
Security researchers have identified two characters that bypass the protections Chromium-based browsers use to expose lookalike websites, allowing fake URLs to appear as genuine web addresses. Ian Muscat and Leanne Briffa of Have I Been Squatted registered 20 lookalike domain names to demonstrate the flaw, which defeats the key security measures deployed by Chromium browsers.
The FBI has arrested another suspected member of the ShinyHunters extortion group over last month's breach of the FBIjobs.gov platform, Director Kash Patel announced Friday. The suspect, a Canadian citizen arrested in Pennsylvania, has not been publicly identified.
Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group, following his extradition from Japan this month. Japan's National Police Agency confirmed the action, saying the suspect was detained after arriving in the country as a tourist.
Oleg Korniev, a 42-year-old Ukrainian-Russian dual citizen, has pleaded guilty to running a massive money laundering operation for cybercriminals that used more than 15,000 money mules in the United States and processed over $10 million stolen from more than 750 accounts at 35 banks.
Citrix has issued an urgent advisory urging IT administrators to patch a critical remote code execution vulnerability in NetScaler ADC and NetScaler Gateway appliances. Tracked as CVE-2026-107406, the flaw stems from a memory overflow weakness and can be exploited on devices configured as SAML identity providers or service providers. While Citrix has not observed active exploitation, it strongly recommends upgrading to patched versions immediately.
The FBI has seized seven web domains used by a Chinese state-backed hacking campaign as the US, UK, Australia and other allies jointly warned that Beijing-linked cyber operatives are targeting critical infrastructure globally to steal sensitive data.
The FBI has seized seven internet domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, that were used in attacks breaching critical infrastructure and other organizations worldwide, the U.S. Department of Justice announced Wednesday.
A malware campaign called Midnight Mimosa has been discovered preinstalled on low-cost Android smartphones, with malicious software embedded directly into the device firmware, giving attackers system-level control to install apps, commit ad fraud, and use the phones as residential proxies.
Security researchers hacked the Samsung Galaxy S26 three times on the second day of Pwn2Own Ireland 2026, collecting $232,500 in cash awards after exploiting 45 unique zero-day vulnerabilities across various devices and categories.
The owner of a Florida ransomware remediation company has been indicted on federal wire fraud charges for allegedly paying ransom to cybercriminals behind his clients' backs, then billing those clients far more than the payouts, according to court documents and the U.S. Attorney's Office.
The OpenSSH project released version 10.6 on Tuesday, deliberately disabling the LZ77 compression coder and blocking certain characters in command-line usernames to close security holes that could expose encrypted traffic. The maintainers acknowledged the changes would break existing configurations but argued the risks justified the disruption.
The FBI is warning that FortiBleed attacks are ongoing, with hackers using leaked credentials to break into exposed Fortinet FortiGate firewalls and SSL VPN gateways, stealing data and locking out legitimate administrators.
Google has revealed that hackers obtained unauthorized HTTPS certificates for several of its domains and hijacked domains in the country-code top-level domains (ccTLDs) for Ghana, American Samoa and Sierra Leone, after breaching third-party operators and modifying authoritative DNS records.
A 41-year-old Auckland man took his own life in 2024 after being blackmailed by an AI-generated online persona in a sextortion scam, a coroner has found. Coroner Janet Anderson ruled that the actions of the scammer, who used the name 'Donna Chase', were the primary relevant factor in the man's death. Police believe the account the man paid money into belonged to an overseas organised criminal network.
A cryptomining campaign codenamed PoeLLM has infected more than 3,400 exposed AI servers, using a poem stored on GitHub to generate its command-and-control addresses, according to researchers at Lumen's Black Lotus Labs. The malware has been active since at least April and has primarily targeted poorly configured AI tools such as LiteLLM and Ollama, turning compromised systems into launchpads for further attacks and cryptocurrency mining.
Microsoft will add .msix and .msixbundle file types to the list of blocked attachments in Outlook on the web and the new Outlook for Windows client, beginning in early November and reaching general availability by mid-November, as part of ongoing efforts to protect customers from malicious file attachments.
A teenager from Amman, Jordan suspected of leading the ShinyHunters hacking group has been detained and is cooperating with the FBI, according to sources cited by Reuters and reporting by KrebsOnSecurity. The suspect, who uses the alias "Rey" and has been identified as Saif Al-din Khader, was arrested as the group was in the process of extorting a business unit recently divested by aerospace giant Boeing.
The FBI and US Secret Service have issued a joint advisory warning that attackers involved in the FortiBleed campaign are locking organisations out of their Fortinet firewalls, with evidence linking the stolen credentials to ransomware attacks by the INC/Lynx and Payload groups.
A critical Atlassian vulnerability affecting self-hosted Jira, Confluence, and Bitbucket deployments is being actively exploited without authentication, security researchers report, just hours after a detailed technical analysis was published.
Attackers are actively exploiting a maximum-severity server-side request forgery vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) just three days after the company released patches, according to security researchers, while over 400 appliances remain exposed online.
Florida Attorney General James Uthmeier has filed a lawsuit against TP-Link, accusing the router manufacturer of lying about the security of its devices and its connections to the Chinese Communist Party. The suit alleges that the company misled consumers about its independence from China and exposed Floridians to cybersecurity risks exploited by Chinese state-sponsored hackers.
A 54-year-old North Carolina musician, Michael Smith, has been sentenced to 18 months in federal prison for orchestrating a streaming royalty fraud scheme that netted more than $10 million. Between 2017 and 2024, Smith used AI-generated music and automated bot accounts to artificially stream songs billions of times on platforms including Spotify, Apple Music, Amazon Music, and YouTube Music.
Advantest Corporation, a global manufacturer of automated test equipment for the semiconductor industry, has confirmed that personally identifiable information belonging to some individuals was stolen during a ransomware attack in February 2026. The company issued a data breach notification on October 6, detailing the types of exposed data but not identifying how many people are affected.
Multiple Australian news outlets have reported concerns over a potential hack affecting a fashion retailer, though no specific company, date, or nature of the incident has been disclosed. Reports from the Sydney Morning Herald, WAtoday, and Brisbane Times on October 6, 2026, carried the same headline but contained no substantive information beyond the alert.
Hackers are exploiting stored cross-site scripting vulnerabilities in two popular WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors, create hidden administrator accounts, and establish persistent access to compromised sites.
Attackers hijacked three country code top-level domains and used their control over DNS records to obtain fraudulent TLS certificates for Google and other large online services, Google disclosed on Tuesday. The unauthorized certificates could have enabled cryptographic impersonation of the affected infrastructure.
The Pwn2Own Ireland 2026 hacking competition has concluded, with security researchers earning $1,262,000 in rewards after exploiting 98 zero-day vulnerabilities over three days, organisers have announced.
Asos customers across the UK received a push notification from the retailer's app on Tuesday claiming hackers had compromised the company's Snowflake data storage instance, prompting an immediate investigation by the company and assurances from Snowflake that its platform was not breached.
A new phishing campaign is using fake websites mimicking popular AI tools such as ChatGPT, Gemini, Claude, and Perplexity to steal login credentials and multi-factor authentication codes from advertising account managers, according to researchers at browser security company Island.
A data breach at Trump Mobile may have exposed the personal information of 3,615 individuals, according to reports from PCMag and Straight Arrow News. The leaked dataset includes names, home addresses, email addresses, phone numbers, and order details.
A manufacturer of phone-cracking tools used by law enforcement has developed technology to bypass an Apple security feature that automatically reboots idle iPhones, according to a report from 404Media.
Security researchers have identified a likely suspect behind the AI-powered cyberattacks that struck several South Korean banks this month: a 26-year-old Chinese national who used an open-source penetration testing suite called ARTEX AI and Anthropic's Claude AI agents to steal customer data, according to CrowdStrike.
An unauthorized party has abused a private Danish company's legitimate access to the country's Central Population Register (CPR), exposing names, addresses, identification numbers, and other personal information of approximately 8.8 million people, the CPR administration has confirmed.
Japanese publishing giant Nikkei has disclosed that unknown attackers breached two employee email accounts in separate incidents over the past months, exposing personal information of employees and business partners and sending thousands of phishing emails.
Asos shares dropped nearly 12% on Tuesday after thousands of customers received a push notification from the company's mobile app claiming hackers had 'fully compromised' its data, prompting an ongoing investigation by the British online fashion retailer.
Indian investigators raided three call centers in Pune and Patiala on September 15, discovering approximately 220 people who were allegedly defrauding American citizens, the latest action in a growing crackdown on scam operations that have caused hundreds of millions of dollars in losses.
Atlassian has disclosed a critical arbitrary file access vulnerability (CVE-2026-21589, CVSS 9.3) affecting the datacenter versions of its Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye products. The company warned users to patch immediately, noting an unauthenticated attacker could access specific files within the web application root directory.
A security researcher has reported a full virtual machine escape vulnerability in Linux KVM, the hypervisor used by major cloud providers including AWS and Google. The claim, shared by researcher Paulos Yibelo, was confirmed by Vercel CEO Guillermo Rauch as a zero-day affecting the kernel-level hypervisor. Details remain under wraps for responsible disclosure.
The Five Eyes intelligence alliance issued an unprecedented joint bulletin on June 3 warning that Chinese spies are using professional networking sites such as LinkedIn to run an industrial-scale online espionage campaign against tens of thousands of government staff, military personnel and academics in the United States and NATO countries, with agents now using generative AI to tailor their approaches.