Cyber News

Daily coverage of exploited vulnerabilities, breaches and patches, with what to do first.

Inside the Daily Brief

A real sample of the weekday read

New SynkLoader malware pushed in Microsoft Teams phishing campaign

New SynkLoader malware pushed in Microsoft Teams phishing campaign

Expel says the campaign uses Microsoft Teams messages to push a fake "PowerShell Cleaner" MSI from Azure, then drops a…
GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure

GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure

GitLab CVE-2026-19478 is not a minor project-integrity issue. It is a 9.4 unauthenticated code-injection path against public projects, which means…
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Cisco Talos is describing a change in attacker workflow, not just another flashy AI label. UAT-10147 appears to be using…

The CyberExperts Daily Brief

Keep up with the cyber news that changes the day

Get the weekday brief for people scanning the news: the developments worth a closer look, explained in about five minutes.

CISA warns of hackers exploiting critical MLflow vulnerability

CISA warns of hackers exploiting critical MLflow vulnerability

MLflow is now important enough that an exposed default deployment can become a cloud-credentials problem, not just an AI-tooling problem.…
August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEs

August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEs

CrowdStrike's August Patch Tuesday analysis matters because it turns a wall of Microsoft CVEs into a prioritization map. The real…
Critical Zimbra RCE flaw now actively exploited in attacks

Critical Zimbra RCE flaw now actively exploited in attacks

CVE-2026-73570 is the kind of email-infrastructure issue that creates immediate cleanup pressure because it combines unauthenticated remote code execution with…
#StopRansomware: Gunra Ransomware

#StopRansomware: Gunra Ransomware

CISA's Gunra advisory is useful because it gives defenders more than a ransomware name. It maps how the group gets…
Phishing 3.0: The Fight Moves to Agent Versus Agent

Phishing 3.0: The Fight Moves to Agent Versus Agent

This story is valuable when read as a change in attack economics, not as another vague AI warning. The important…
Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities

Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities

Cisco Talos adds something the broader Patch Tuesday roundups often miss: a defender's view of which Microsoft flaws are likely…
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

CISA's latest KEV additions are not four unrelated patch notes. They expose four different trust boundaries already under pressure: remote…
Hunting MacSync Stealer infrastructure through behavioral pivots

Hunting MacSync Stealer infrastructure through behavioral pivots

Microsoft says MacSync Stealer keeps rotating domains and delivery hosts, but it reuses the same AppleScript-assisted collection and exfiltration patterns,…
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Attackers are exploiting an MLflow SSRF flaw to reach cloud metadata services and steal credentials, while a separate FUXA issue…
Clop created custom web shell for Windchill data theft attacks

Clop created custom web shell for Windchill data theft attacks

ReliaQuest found a custom Clop web shell for PTC Windchill and FlexPLM, used via CVE-2026-12569 to locate and steal design…