Cyber Security News

Krasnoyarsk Regional Airlines (KrasAvia) confirmed a sophisticated cyberattack that has rendered its primary online services inoperable.  The breach targeted the airline’s web portal and associated back-end systems, including the Passenger Service System (PSS) and flight planning applications.  As a result, passengers are currently unable to complete e-ticket purchases or check in online, prompting KrasAvia to […]

The post Russian Airline Suffered Cyberattack Website and Other Systems Affected appeared first on Cyber Security News.

UK law enforcement has arrested two individuals linked to the notorious Scattered Spider cybercriminal group, including 19-year-old Thalha Jubair from London, who faces charges in connection with over 120 network intrusions that resulted in more than $115 million in ransom payments.  The arrests represent a significant breakthrough in dismantling one of the world’s most prolific […]

The post UK Arrested 2 Scattered Spider Hackers Linked to London Transport System Breach appeared first on Cyber Security News.

Detecting remote employment fraud has become a critical priority for organizations striving to secure their digital onboarding processes and safeguard sensitive systems. In recent months, threat actors posing as legitimate hires have leveraged sophisticated tactics to bypass pre-hire screenings and embed themselves within corporate networks. This emerging threat vector, known as Remote Employment Fraud (REF), […]

The post Splunk Releases Guide to Detect Remote Employment Fraud Within Your Organization appeared first on Cyber Security News.

A sophisticated new attack tool targeting jailbroken iOS devices has emerged, representing a significant escalation in digital identity fraud capabilities.  The discovery by iProov’s threat intelligence team reveals a highly specialized tool designed to perform advanced video injection attacks on iOS 15 and later devices, specifically engineered to bypass weak biometric verification systems and exploit […]

The post New iOS Video Injection Tool Bypasses Biometric Verification with Jailbroken iPhones appeared first on Cyber Security News.

The cyberthreat landscape has witnessed the emergence of another sophisticated ransomware operation as GOLD SALEM, a new threat actor group also known as Warlock Group, has been actively compromising enterprise networks since March 2025. This emerging ransomware collective has successfully targeted 60 organizations across North America, Europe, and South America, demonstrating competent tradecraft while deploying […]

The post GOLD SALEM Compromise Networks and Bypass Security Solutions to Deploy Warlock Ransomware appeared first on Cyber Security News.

The Russian covert influence network CopyCop has significantly expanded its disinformation campaign, establishing over 200 new fictional media websites since March 2025. This expansion represents a marked escalation in Russian information warfare efforts, targeting democratic nations with sophisticated artificial intelligence-driven content generation and increasingly polished deception tactics. CopyCop, also designated as Storm-1516, operates as a […]

The post Russian Fake-News Network CopyCop Added 200+ New Websites to Targets US, Canada and France appeared first on Cyber Security News.

When an incident happens, there’s no time to waste.  SOC teams must react fast to protect their organization, and this requires more than expertise. Strong solutions tailored to the needs of businesses can make all the difference.  The secret to radically cutting response time for incidents lies in equipping your SOC team with an enterprise-grade […]

The post How to Radically Cut Response Time for Each Security Incident  appeared first on Cyber Security News.

Cloudflare has published a detailed post-mortem explaining the significant outage on September 12, 2025, that made its dashboard and APIs unavailable for over an hour. The company traced the incident to a software bug in its dashboard that, combined with a service update, created a cascade failure in a critical internal system. The incident began […]

The post Cloudflare API Outage Linked to React useEffect Bug Causes Service Overload and Recovery Failure appeared first on Cyber Security News.

A zero-click vulnerability discovered in ChatGPT’s Deep Research agent allowed attackers to exfiltrate sensitive data from a user’s Gmail account without any user interaction. The flaw, which OpenAI has since patched, leveraged a sophisticated form of indirect prompt injection hidden within an email, tricking the agent into leaking personal information directly from OpenAI’s cloud infrastructure. […]

The post 0-Click ChatGPT Agent Vulnerability Allows Sensitive Data Exfiltration from Gmail appeared first on Cyber Security News.

In 2025, the Model Context Protocol (MCP) revolutionizes AI agent integration, making it seamless for tools, databases, and workflows to work harmoniously in enterprises and developer workspaces. Top MCP servers power next-generation automation and data-driven applications, connecting everything from cloud docs to enterprise CRM and relational databases. Choosing the best MCP server unlocks dramatic efficiency, […]

The post Top 10 Best Model Context Protocol (MCP) Servers in 2025 appeared first on Cyber Security News.

Microsoft is integrating free, on-device artificial intelligence capabilities into the classic Notepad application for Windows 11 users with Copilot+ PCs. The update introduces powerful text generation and editing tools, including “Summarize,” “Write,” and “Rewrite,” without requiring a subscription. The new AI-powered features are designed to enhance productivity by allowing users to generate, refine, and condense […]

The post Windows 11 Notepad to Get AI Support for Free to Generate and Summarize Text appeared first on Cyber Security News.

Attackers injected malicious code into GitHub Actions workflows in a widespread campaign to steal Python Package Index (PyPI) publishing tokens. While some tokens stored as GitHub secrets were successfully exfiltrated, PyPI administrators have confirmed that the platform itself was not compromised and the stolen tokens do not appear to have been used. The attack campaign […]

The post Hackers Injecting Malicious Code into GitHub Actions Workflows to Steal PyPI Publishing Tokens appeared first on Cyber Security News.

A critical vulnerability in Microsoft’s Entra ID could have allowed an attacker to gain complete administrative control over any tenant in Microsoft’s global cloud infrastructure. The flaw, now patched, was discovered in July 2025 and has been assigned CVE-2025-55241. The vulnerability, described by the researcher as the most impactful he will probably ever find, resided […]

The post Critical Microsoft’s Entra ID Vulnerability Allows Attackers to Gain Complete Administrative Control appeared first on Cyber Security News.

SquareX first discovered and disclosed Last Mile Reassembly attacks at DEF CON 32 last year, warning the security community of 20+ attacks that allow attackers to bypass all major SASE/SSE solutions and smuggle malware through the browser. Despite responsible disclosures to all major SASE/SSE providers, no vendor has made an official statement to warn its […]

The post Palo Alto Networks Acknowledges SquareX Research on Limitations of SWGs Against Last Mile Reassembly Attacks appeared first on Cyber Security News.

The JavaScript ecosystem experienced one of its most sophisticated and damaging supply chain attacks in September 2025, when a novel self-replicating worm dubbed “Shai-Hulud” compromised over 477 npm packages, marking the first successful automated propagation campaign in the npm registry’s history. This attack represents a significant evolution in supply chain threats, leveraging both social engineering and […]

The post Lessons Learned from Massive npm Supply Chain Attack Using “Shai-Hulud” Self-Replicating Malware appeared first on Cyber Security News.

Python developers face a growing threat from typosquatted packages in the Python Package Index (PyPI), with malicious actors increasingly targeting this trusted repository to distribute sophisticated malware. Recent discoveries have exposed a concerning trend where threat actors create packages that closely mimic legitimate libraries, using slight spelling variations to trick unsuspecting developers into installing harmful […]

The post Beware of Typosquatted Malicious PyPI Packages That Delivers SilentSync RAT appeared first on Cyber Security News.

Raven Stealer has emerged as a potent information‐stealing threat targeting users of Chromium‐based browsers, most notably Google Chrome. First observed in mid-2025, this lightweight malware distinguishes itself through a modular architecture and stealthy design, allowing it to harvest sensitive information without alerting victims. Delivered predominantly via cracked software bundles and underground forums, Raven Stealer capitalizes […]

The post Raven Stealer Attacking Google Chrome Users to Steal Sensitive Data appeared first on Cyber Security News.

Jenkins has released critical updates addressing four security flaws that unauthenticated and low-privileged attackers could exploit to disrupt service or glean sensitive configuration details.  Administrators running Jenkins weekly releases up to 2.527 or the Long-Term Support (LTS) stream up to 2.516.2 must upgrade to mitigate these risks. HTTP/2 Denial of Service (CVE-2025-5115) A high-severity issue […]

The post Jenkins Patches Multiple Vulnerabilities that Allow Attackers to Cause a Denial of Service appeared first on Cyber Security News.

The newly publicized Pixie Dust attack has once again exposed the critical vulnerabilities inherent in the Wi-Fi Protected Setup (WPS) protocol, enabling attackers to extract the router’s WPS PIN offline and seamlessly join the wireless network.  By targeting weak randomization in the registrar’s nonces, this exploit subverts the intended security of WPS without requiring proximity […]

The post Pixie Dust Wi-Fi Attack Exploits Routers WPS to Obtain PIN and Connect With Wireless Network appeared first on Cyber Security News.

A critical zero-day remote code execution (RCE) vulnerability, identified as CVE-2025-9961, has been discovered in TP-Link routers. Security research firm ByteRay has released a proof-of-concept (PoC) exploit, demonstrating how attackers can bypass Address Space Layout Randomization (ASLR) protections to gain full control over affected devices. The vulnerability resides in the router’s Customer Premises Equipment (CPE) […]

The post TP-Link Router 0-Day RCE Vulnerability Exploited Bypassing ASLR Protections – PoC Released appeared first on Cyber Security News.