Cyber Security News

Meta has disclosed that one of its AI models gained unintended access to the internet during a cybersecurity evaluation and then exploited a vulnerability in another organization’s system. The incident occurred during testing conducted with independent AI security firm Irregular, according to Meta. Meta spokesperson said the event was caused by a misconfiguration in the […]

The post Meta Says AI Model Gained Internet Access and Hacked Another Organization’s System appeared first on Cyber Security News.

Cisco has released a critical security hardening update for Cisco IOS XE Software, fixing several serious vulnerabilities that could expose enterprise network devices to remote attacks. The advisory covers vulnerabilities identified during Cisco’s internal security testing, including testing supported by frontier AI models. Cisco said it is not aware of public exploitation or malicious activity […]

The post Cisco Patches Multiple Critical Cisco IOS XE Software Vulnerabilities – Patch Now! appeared first on Cyber Security News.

The U.S. Cybersecurity and Infrastructure Security Agency has warned that a critical JetBrains TeamCity flaw is being actively exploited. The vulnerability, tracked as CVE-2026-63077, can let an unauthenticated attacker run code remotely on vulnerable TeamCity On-Premises servers. CISA added the issue to its Known Exploited Vulnerabilities catalog on August 5 and set an August 8 […]

The post CISA Warns of TeamCity RCE Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.

Atomic Stealer is being pushed at Mac users through websites that look harmless. A large ClickFix operation uses more than 250 look-alike domains to steer selected visitors toward a fake download page and a malicious Terminal command. ClickFix is built on persuasion, not a software flaw. The pages pose as download checks, updates, or CAPTCHA-style […]

The post 250+ macOS ClickFix Domains Use Browser Fingerprinting to Hide Atomic Stealer Attacks appeared first on Cyber Security News.

A new npm supply chain attack has turned trusted software packages into a route for credential theft. The campaign began after attackers compromised the maintainer account behind the widely used Keyv library, then used that access to push malicious releases across a growing number of projects. The incident matters because npm packages are routinely installed […]

The post New npm Supply Chain Attack Began with the Keyv Library Compromised Hundreds of Popular Packages appeared first on Cyber Security News.

Apple users who rely on iCloud Private Relay to conceal their online location may not be getting the protection they expect. Newly disclosed flaws in WebKit, the browser engine used across iOS, can allow a website to see a visitor’s real IP address. The exposure weakens a privacy safeguard. The issue can be triggered when […]

The post Apple iCloud Private Relay WebKit Flaws Leak Users’ Real IP Addresses appeared first on Cyber Security News.

Cisco has rolled out software hardening updates for its Catalyst SD-WAN Software after an internal security review uncovered multiple critical vulnerabilities affecting the platform. The flaws were identified proactively by Cisco’s own engineering team rather than through external reports, and the company has confirmed there is no evidence of active exploitation in the wild. Even […]

The post Cisco Patched Multiple Critical Vulnerabilities in Catalyst SD-WAN – Update Now appeared first on Cyber Security News.

Thousands of Blogger website owners woke up this week to a jarring surprise: their perfectly legitimate blogs had been locked and slapped with a “Malware and Similar Malicious Content” violation notice. The mass lockout, which began on August 4, 2026, triggered a flood of confused and frustrated reports across Google’s official Blogger Help Community, with […]

The post Google Blogger Locked Legitimate Websites After Mistaking Them for Malware appeared first on Cyber Security News.

Cybercriminals spent July 2026 proving that trusted business utilities including Microsoft authentication pages, Zoom event invitations, and official government portals can be weaponized against enterprise targets. Threat intelligence research from ANY.RUN reveals that attackers across the United States, Europe, and Brazil systematically exploited routine corporate workflows to bypass perimeter security controls, harvest credentials, and maintain […]

The post Hackers Turned Microsoft Logins, Zoom Events, and Government Websites Into Attack Tools appeared first on Cyber Security News.

A shadowy online service called Poison Claude is reselling access to Anthropic’s premium AI models at a significant discount. Researchers suggest that these savings are coming from an unexpected source: cloud accounts that have been fraudulently registered and filled with free bonus credits. As frontier AI tools like Claude have become essential for coding, research, […]

The post Poison Claude is Selling Cheap AI Tokens Built on Fake Accounts and Free Credits appeared first on Cyber Security News.

Las Vegas, Nevada, August 4th, 2026, CyberNewswire The Cybersecurity Excellence Awards today announced the winners of the 2026 Community Choice Award, selected through 79,455 votes cast during the awards season. AI security ranked among the highest-voted award categories this season. The results arrive during Black Hat USA week, where AI risk is also among the […]

The post 2026 Cybersecurity Excellence Awards: Community Choice Winners Selected Through 80,000 Votes appeared first on Cyber Security News.

A new proof-of-concept reveals how attackers can turn Microsoft Copilot, the AI assistant embedded in Microsoft 365, into an unwitting accomplice for business email compromise (BEC) and large-scale wire fraud. The demonstration shows that a single compromised employee account can escalate, with alarming speed, into full CEO account takeover and the theft of a quarter […]

The post Hackers Can Weaponize Microsoft Copilot to Hijack CEO Accounts and Redirect Wire Transfers appeared first on Cyber Security News.

Las Vegas, United States, August 4th, 2026, CyberNewswire As AI-assisted attackers compress exploitation timelines to hours, Mallory turns live adversary intelligence into prioritized, policy-governed action across the tools security teams already run Mallory, the AI-native Threat and Exposure Management platform, today introduced a unified context and intelligence layer for security teams. The architecture has three […]

The post Mallory Unifies Threat Intelligence, Exposure Context, and Response Into One Architecture for Security Teams appeared first on Cyber Security News.

Microsoft is reducing the lifetime of NuGet.org API keys to strengthen supply chain security and reduce the risk of stolen credentials being used to publish malicious .NET packages. Starting August 17, 2026, newly created NuGet.org API keys will have a maximum validity period of 30 days. The platform will no longer allow publishers to create […]

The post Microsoft Strengthens NuGet Supply Chain Security By Reducing API Key Lifetime appeared first on Cyber Security News.

Phishing is the primary initial access vector, driving 16% of breaches at an average cost of $4.8 million. Attackers now leverage Generative AI and AiTM kits to easily bypass MFA and traditional Secure Email Gateways.  Because users click malicious links in a median of just 21 seconds, static reputation-filtering fails against dynamic browser threats. To adapt, top SOCs are shifting toward […]

The post How Top SOCs Detect and Stop AI Phishing that Beats Email Gateways  appeared first on Cyber Security News.

Flowise servers used to build AI agents and automated workflows are facing six newly disclosed remote code execution flaws. The weaknesses could allow authenticated attackers to run commands on the underlying server, putting data, credentials, and connected systems at risk. The attack paths involve several Flowise components, including CSV processing, custom JavaScript functions, MCP configurations, […]

The post Six Flowise RCE Flaws Let Attackers Execute Code on AI Workflow Servers appeared first on Cyber Security News.

DarkSword has expanded from a leaked iOS exploit chain into a broad and fast-changing network of malicious web infrastructure. The campaign targets iPhones running iOS 18.4 through 18.7 and is designed to steal highly sensitive data after a victim visits a lure site. The attack begins with fake sign-in pages, iOS-themed sites, and compromised web […]

The post DarkSword iOS Exploit Kit Spreads Across 180 Web Properties and 27 Hosts appeared first on Cyber Security News.

The Open Worldwide Application Security Project, or OWASP, has introduced the Subtractive Security Top 10 Project, a security engineering initiative focused on eliminating attack paths rather than merely detecting or monitoring them. Traditional cyber defense often relies on adding security products, alerts, logging, endpoint tools, and access controls. The new OWASP project takes a different […]

The post OWASP Subtractive Security Top 10 Project Released to Identify and Reduce Cyber Risks appeared first on Cyber Security News.

Atlanta, GA, August 4th, 2026, CyberNewswire Airlock Digital announces Agentic AI Control & Governance, extending its preventative endpoint security solution with visibility into trusted AI agent behavior and governance over what trusted agents are allowed to do on endpoints.  Airlock Digital, a leader in preventative endpoint security, today announced Agentic AI Control & Governance at […]

The post Airlock Digital Unveils Agentic AI Control & Governance to Extend Preventative Endpoint Security appeared first on Cyber Security News.

CISA has warned that attackers are actively exploiting a critical authentication bypass vulnerability in N-able N-central. Tracked as CVE-2026-18577, the flaw affects N-central servers running versions earlier than 2026.3.1.7. N-central is a remote monitoring and management platform widely used by managed service providers to administer customer systems. Because the platform provides centralized access to many […]

The post CISA Warns of N-able N-central Authentication Bypass Vulnerability Exploited in Attacks appeared first on Cyber Security News.