Cyber News

Daily coverage of exploited vulnerabilities, breaches and patches, with what to do first.

Inside the Daily Brief

A real sample of the weekday read

CISA: Windows Task Host flaw now exploited by ransomware gangs

CISA: Windows Task Host flaw now exploited by ransomware gangs

CISA now flags Windows Task Host privilege escalation flaw CVE-2025-60710, patched in November 2025, as used in ransomware attacks. Check…
Pokémon Center data breach exposes customer info, cancels some orders

Pokémon Center data breach exposes customer info, cancels some orders

Pokémon Center UK and Germany customer names, addresses, phone numbers, emails and orders were exposed in the CEVA Logistics breach.…
SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch

SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch

Attackers began probing SAP Commerce Cloud flaw CVE-2026-58231 (CVSS 10) three days after the patch. Onapsis advises patching, then rebuilding…

The CyberExperts Daily Brief

Keep up with the cyber news that changes the day

Get the weekday brief for people scanning the news: the developments worth a closer look, explained in about five minutes.

Microsoft working on Defender patch for ShieldBreak zero-day

Microsoft working on Defender patch for ShieldBreak zero-day

Microsoft is working on a patch for ShieldBreak, a public Defender zero-day (CVE-2026-69414) that bypasses the RoguePlanet fix and gives…
New AmnesiaStealer macOS malware hijacks browser sessions via remote control

New AmnesiaStealer macOS malware hijacks browser sessions via remote control

AmnesiaStealer is worth a closer look because it is not just another Mac infostealer. Its operators pair ClickFix-style social engineering…
Max severity SAP Commerce Cloud flaw now targeted in attacks

Max severity SAP Commerce Cloud flaw now targeted in attacks

A max-severity SAP Commerce Cloud flaw being targeted only days after patch release should move this out of routine enterprise-app…
DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

DeadLock matters because Microsoft is describing more than another ransomware name. The operation uses decentralized infrastructure for communications, negotiation, and…
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

A SharePoint authentication bypass becomes much more serious once public proof-of-concept code and real exploitation arrive together. At that point,…
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

A Lazarus-linked Windows zero-day is not routine vulnerability noise. It is the kind of story that forces defenders to treat…
Critical VMware vCenter RCE flaw exploited for reverse SSH access

Critical VMware vCenter RCE flaw exploited for reverse SSH access

Attackers are exploiting vCenter RCE flaw CVE-2026-59310 to install reverse_ssh backdoors. QUIRSO counted 361 attacking IPs in 47 countries by…
Microsoft patches LegacyHive Windows zero-day vulnerability

Microsoft patches LegacyHive Windows zero-day vulnerability

Microsoft fixed LegacyHive (CVE-2026-62832), a Windows User Profile Service flaw disclosed by Nightmare Eclipse that lets a local user gain…
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

The latest LiteLLM fallout matters because the issue is no longer just a package-security anecdote: teams may still have long-lived…
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

Attackers are actively exploiting CVE-2026-59310, a CVSS 9.8 directory-traversal flaw in VMware vCenter, and incident responders are seeing successful compromise…