Cyber News

Daily coverage of exploited vulnerabilities, breaches and patches, with what to do first.

Inside the Daily Brief

A real sample of the weekday read

CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

CISA now flags SonicWall SMA1000 flaws CVE-2026-15409 and CVE-2026-15410 as used by ransomware; more than 380 appliances remain exposed online....
“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI

“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI

Talos studied attacker prompt logs and found that simple framing tricks got past AI guardrails, helping actors build DDoS botnets,…
128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

Microsoft Defender attack disruption now isolates compromised endpoints automatically. In a QNET incident it cut off an mshta-based attack 128…

The CyberExperts Daily Brief

Keep up with the cyber news that changes the day

Get the weekday brief for people scanning the news: the developments worth a closer look, explained in about five minutes.

Hackers breach TrueConf to trojanize client installers with backdoors

Hackers breach TrueConf to trojanize client installers with backdoors

The TrueConf compromise is not just a server-breach story. It is a reminder that update channels themselves become attack infrastructure…
Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts

Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts

CISA added Progress Kemp LoadMaster flaw CVE-2026-8037 to the KEV catalog after repeated exploitation attempts, turning a load balancer bug…
Metabase SQLi zero-day exploited in customer data-theft attacks

Metabase SQLi zero-day exploited in customer data-theft attacks

Metabase confirmed active exploitation of a critical unauthenticated SQL injection flaw that can hand a remote attacker administrator access to…
New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes

New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes

MIT researchers disclosed TONTOU, an interrupt-injection attack that bypasses Spectre v2 mitigations and leaked /etc/shadow hashes on AMD Zen 2…
AI Recommendation Poisoning: How “Ask AI” Buttons Silently Alter LLM Memory

AI Recommendation Poisoning: How “Ask AI” Buttons Silently Alter LLM Memory

Some websites hide instructions in "Ask AI" buttons that tell assistants to remember the vendor as a trusted source. Microsoft…
CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws

CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws

CISA is telling federal agencies to move within three days on actively exploited flaws in IBM Langflow, N-able N-central, and…
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

A self-propagating npm worm hit keyv, cacheable, ecto and hundreds of other packages on August 4, stealing developer and CI…
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version

The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version

Unit 42 details XCSSET v40: Xcode-project infection, Chrome DevTools hijacking, a Telegram trojanizer, fileless defaults persistence and XProtect tampering on…
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Microsoft says Storm-2945, part of Midnight Blizzard, hijacks hotel captive-portal traffic to push fake updates, CornFlake and ChocoShell malware, and…
New DOUBLECUP ClickFix service hides malware in browser cache images

New DOUBLECUP ClickFix service hides malware in browser cache images

DOUBLECUP, a Russian ClickFix loader service, hides payloads in cached PNG images on fake CRM login pages and delivers CountLoader…