Cyber Security News

Microsoft is taking a major step to harden the Windows operating system against kernel-level threats by removing trust for drivers signed by the deprecated cross-signed root program. Starting with the April 2026 update, Windows 11 and Windows Server 2025 will block these untrusted drivers by default. This policy ensures that only drivers certified through the […]

The post Windows 11 and Server 2025 Update to Block Untrusted Cross-Signed Kernel Drivers by Default appeared first on Cyber Security News.

CISA has officially added a critical vulnerability affecting Aquasecurity’s Trivy scanner to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2026-33634, this alarming security flaw poses a severe risk to software development pipelines. By exploiting this vulnerability, threat actors can gain unauthorized access to highly sensitive Continuous Integration and Continuous Deployment (CI/CD) environments. Organizations relying […]

The post CISA Adds Aquasecurity Trivy Scanner Vulnerability to KEV Catalog appeared first on Cyber Security News.

Iran-linked hackers have claimed responsibility for breaching FBI Director Kash Patel’s personal Gmail inbox, leaking photographs, documents, and email correspondence online. The hacker group Handala Hack Team announced the breach on their website, declaring that Patel “will now find his name among the list of successfully hacked victims.” The leaked materials, totaling approximately 800 megabytes, […]

The post FBI Chief Kash Patel’s Gmail Account was Hacked by Iranian Hackers appeared first on Cyber Security News.

Japan’s tax season has become a hunting ground for a well-organized threat actor known as Silver Fox. As Japanese companies enter their annual cycle of tax filing, salary reviews, and personnel changes, this group is taking full advantage of the moment — sending highly targeted spearphishing emails designed to look like routine internal communications. The […]

The post New Silver Fox Campaign Hits Japanese Businesses With Tax-Themed Phishing Lures appeared first on Cyber Security News.

A South Asian financial institution has become the latest target of a focused cyberattack involving two custom-built malware tools — BRUSHWORM, a modular backdoor, and BRUSHLOGGER, a keylogger disguised as a trusted system file. The attack combined file theft, persistent system access, and real-time keystroke capture, underlining the growing risk that financial organizations across South […]

The post Hackers Deploy BRUSHWORM and BRUSHLOGGER Against South Asian Financial Firm appeared first on Cyber Security News.

A highly coordinated cyberespionage campaign has been uncovered targeting a government organization in Southeast Asia, with threat actors deploying a mix of USB-propagated malware, remote access trojans (RATs), and data stealers to secure long-term access to sensitive government systems. The operation, active between June and August 2025, involved three separate clusters of activity running simultaneously […]

The post Hackers Use USB Malware, RATs, and Stealers in Espionage Attacks on Southeast Asian Government appeared first on Cyber Security News.

A new wave of cyberattacks is putting financial institutions on high alert, as threat actors ramp up the use of PXA Stealer — a powerful information-stealing malware — against organizations worldwide. The surge follows law enforcement’s successful dismantling of major infostealer operations, including Lumma, Rhadamanthys, and RedLine, throughout 2025. With those platforms gone, PXA Stealer […]

The post Hackers Use Phishing ZIP Files to Deploy PXA Stealer Against Financial Firms appeared first on Cyber Security News.

The official Telnyx Python SDK on PyPI was compromised this morning as part of an escalating, weeks-long supply chain campaign orchestrated by the threat actor group TeamPCP. Malicious versions 4.87.1 and 4.87.2 of the telnyx package were uploaded to PyPI at 03:51 UTC on March 27, 2026, with the payload executing silently at import time […]

The post Telnyx PyPI Package With 742,000 downloads Compromised in TeamPCP Supply Chain Attack appeared first on Cyber Security News.

Red Hat has issued a critical security warning regarding malicious code discovered in recent versions of the “xz” compression tools and libraries. Tracked as CVE-2024-3094, this highly sophisticated supply chain compromise could allow threat actors to bypass authentication and gain unauthorized remote access to affected Linux systems. The xz utility is a fundamental data compression […]

The post Red Hat Warns of Malware Code Embedded in Popular Linux Tool Allow Unauthorized Access to Systems appeared first on Cyber Security News.

Cloud Software Group has issued a critical security bulletin detailing two newly discovered vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway appliances. These flaws, tracked as CVE-2026-3055 and CVE-2026-4368, could allow remote attackers to leak sensitive information or cause user session mixups. Network administrators and security teams are strongly urged to apply the latest security […]

The post Critical Citrix NetScaler and Gateway Vulnerabilities Let Remote Attackers Leak Sensitive Information appeared first on Cyber Security News.

A new macOS malware that was undocumented previously, is quietly tricking users through fake Cloudflare human verification pages. Called Infiniti Stealer, this threat uses a well-known social engineering trick called ClickFix to convince Mac users into running dangerous commands directly on their own machines, bypassing the need for any software vulnerability or exploit. For a […]

The post Fake Cloudflare CAPTCHA Pages Spread Infiniti Stealer Malware on macOS Systems appeared first on Cyber Security News.

A newly analyzed local privilege escalation vulnerability in the Windows Error Reporting (WER) service allows attackers to easily gain full SYSTEM access. The flaw, tracked as CVE-2026-20817, was considered so structurally dangerous that Microsoft completely removed the vulnerable feature rather than attempting a traditional code patch.​ The security flaw exists within the main executable library […]

The post New Windows Error Reporting Vulnerability Lets Attackers Escalate to Gain SYSTEM Access appeared first on Cyber Security News.

The Internet Systems Consortium (ISC) has released a critical security advisory warning network administrators of a high-severity vulnerability affecting the Kea DHCP server. Tracked as CVE-2026-3608, this flaw allows unauthenticated remote attackers to trigger a stack overflow error. When successfully exploited, the vulnerability causes the receiving daemon to crash, resulting in a sudden and total […]

The post ISC Warns of High-Severity Kea DHCP Flaw That Can Crash Services Remotely appeared first on Cyber Security News.

A social engineering technique called ClickFix has resurfaced with significant force, tricking users on both Windows and macOS into manually executing malicious commands that quietly install malware on their devices. First documented in late 2023, the method has rapidly grown from a niche tactic into one of the most widely adopted initial access strategies across […]

The post New ClickFix Attack Leverage Windows Run Dialog Box and macOS Terminal to Deploy Malware appeared first on Cyber Security News.

A threat actor known as “Snow” from SnowTeam posted an advertisement on the Russian-speaking TierOne (T1) cybercrime forum on March 25, 2026, introducing a new criminal service called Leak Bazaar. The platform is not a traditional data leak site. Instead, it presents itself as a post-exfiltration processing service — one that takes raw stolen corporate […]

The post Leak Bazaar Turns Stolen Corporate Data Into a Structured Criminal Marketplace appeared first on Cyber Security News.

A new and technically advanced rootkit called VoidLink has emerged as a serious threat to Linux systems, blending Loadable Kernel Modules (LKMs) with extended Berkeley Packet Filter (eBPF) programs to hide deep inside the operating system’s core. First documented by Check Point Research in January 2026, VoidLink is a cloud-native Linux malware framework written in […]

The post VoidLink Rootkit Uses eBPF and Kernel Modules to Hide Deep Inside Linux Systems appeared first on Cyber Security News.

The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical security flaw affecting the Langflow platform to its Known Exploited Vulnerabilities (KEV) catalog on March 25, 2026. The vulnerability, tracked as CVE-2026-33017, involves a highly dangerous code injection issue that is currently being actively exploited in the wild. Langflow operates as a popular […]

The post CISA Warns of Langflow Code Injection Vulnerability Exploited in Attacks appeared first on Cyber Security News.

A critical local privilege escalation vulnerability has been identified in the IDrive Cloud Backup Client for Windows. Tracked as CVE-2026-1995, this local privilege escalation vulnerability affects the IDrive Cloud Backup Client for Windows, specifically targeting versions 7.0.0.63 and earlier. Security researchers at FRSecure discovered that weak permission configurations within the application’s directory could quickly lead to […]

The post IDrive for Windows Vulnerability Let Attackers Escalate Privileges appeared first on Cyber Security News.

A new malware campaign called GhostClaw is actively targeting macOS users through fake GitHub repositories and AI-assisted development workflows. The campaign uses social engineering disguised as legitimate developer tools to steal user credentials and drop secondary payloads on infected systems. GhostClaw first surfaced in early March 2026, when JFrog Security Research documented the initial campaign, […]

The post GhostClaw AI Assisted Malware Attacking macOS Users to Deploy Credential-Stealing Payloads appeared first on Cyber Security News.

Russian law enforcement has arrested the suspected administrator of LeakBase, a prominent international hacker forum. The operation, coordinated by the Russian Ministry of Internal Affairs (MVD) alongside the Bureau of Special Technical Measures (BSTM), dismantled a platform that traded in stolen personal data and compromised network access for four years. Authorities apprehended the suspect in […]

The post LeakBase Hacker Forum Admin Arrested in Russia by Law Enforcement Authorities appeared first on Cyber Security News.