Cyber Security News

HackerOne has confirmed that all hackers must now complete identity verification before submitting reports to any bug bounty program (BBP) on its platform, a move the company says is necessary to meet regulatory requirements. The policy distinguishes bug bounty programs from vulnerability disclosure programs (VDPs), which remain open to unverified researchers since no monetary reward […]

The post HackerOne Mandates ID Verification for Bug Bounty Submissions appeared first on Cyber Security News.

During the first publicly documented agent-driven intrusion, the defenders tried to analyze the attack with commercial AI models and were refused. The attacker was operating under no usage policy at all. By Brad LaPorte The most quietly alarming sentence in the Hugging Face disclosure was not about the attacker. On July 16, 2026, Hugging Face published […]

The post Your Incident Response Plan Has a Dependency You Never Approved appeared first on Cyber Security News.

Keycloak has addressed a broken access control vulnerability that could allow restricted administrators to access usernames, email addresses, and other profile information belonging to users outside their permitted scope. This issue, tracked as CVE-2026-17059, affects the Keycloak Admin REST API and was discovered by Escape researcher Enzo Mongin, known as Orionexe. Red Hat published the […]

The post Keycloak Vulnerability Exposes User Names and Email Addresses Across Admin Boundaries appeared first on Cyber Security News.

A new open-source project called CyberStrike is positioning itself as the first AI agent built specifically for offensive security, turning any existing Claude, GPT, or LLM subscription into an autonomous red-team operator. Rather than functioning as a simple chatbot wrapper, CyberStrike installs as a terminal-based tool that handles reconnaissance, vulnerability discovery, exploitation, and reporting without […]

The post CyberStrike – AI-Powered Security Platform for Automated Penetration Testing appeared first on Cyber Security News.

JetBrains has announced a critical vulnerability in TeamCity On-Premises, identified as CVE-2026-63077. This vulnerability allows attackers to bypass authentication and execute arbitrary commands remotely. It affects all versions of TeamCity On-Premises. An attacker only requires HTTP or HTTPS access to a vulnerable TeamCity server to exploit this issue, with no need for a valid account, […]

The post Critical JetBrains Flaw Allows Attackers to Execute Malicious Code Remotely – Update Now appeared first on Cyber Security News.

The U.S. State Department, FBI, and allied governments including Japan, Canada, Germany, Australia, the United Kingdom, and the Republic of Korea have issued a joint alert warning companies worldwide that North Korean information technology workers are infiltrating private firms with stolen identities, forged documents, and proxy networks. According to the July 31, 2026 advisory, these […]

The post FBI And Allies Warn of North Korean IT Workers Using Stolen Identities appeared first on Cyber Security News.

Google is expanding the use of artificial intelligence (AI) agents across the Chrome security lifecycle to identify source code weaknesses, test patches, and accelerate the delivery of security updates to users. The Chrome Security team stated that AI systems are now helping discover vulnerabilities across the broader Chromium codebase, rather than only assisting with limited […]

The post Google Uses AI Agents to Find and Fix 1,072 Chrome Security Vulnerabilities appeared first on Cyber Security News.

A North Korean-linked cyber campaign is using fake macOS update screens to trick victims into installing malware. The operation targets cryptocurrency wallets, browser data, and developer credentials, turning a routine web search into a possible entry point for a serious compromise. The attack begins with a ClickFix-style lure that makes a browser page look like […]

The post North Korean EtherHiding Campaign Targets Crypto Wallets and Developer Credentials appeared first on Cyber Security News.

BlackTech has been linked to a newly examined Linux backdoor deployment against organizations in Japan, showing how a familiar remote-access tool can be reshaped for cyberespionage. The malware gives intruders a way to run commands, move files, and route traffic after they have already entered a network, raising the risk to internal systems and sensitive […]

The post BlackTech APT Deploys BlueShell Linux Backdoor Against Japanese Organizations appeared first on Cyber Security News.

By John Grancarich, EVP, Head of Defense & Intelligence, Fortra The recent pause affecting the implementation of Cybersecurity Maturity Model Certification (CMMC) Phase II has understandably generated questions across the Defense Industrial Base (DIB). For many organizations, the immediate reaction has been to ask whether compliance timelines will shift, whether assessment preparation can be slowed, or whether […]

The post CMMC Phase II Is Paused, But Contractors’ Data-Security Obligations Are Not appeared first on Cyber Security News.

A new SSH bot has been caught quietly logging into Linux systems, profiling their CPU, GPU, and memory, and then walking away without dropping any visible payload. The behavior looks harmless at first glance, yet everything about it points to carefully staged cryptomining activity waiting for the right hardware target. Instead of rushing to install […]

The post SSH Bot Profiles Linux CPU, GPU and RAM Before Deploying Cryptocurrency Miner appeared first on Cyber Security News.

Melbourne, Florida, July 30th, 2026, CyberNewswire The growing number of high-profile AI security incidents making headlines around the world are not simply cybersecurity failures. They are architectural failures, according to OpenMatter Network Co-Founder and CEO Renee Davis. “Recent incidents involving increasingly autonomous AI systems – including OpenAI’s widely reported cyber evaluation that resulted in the […]

The post OpenMatter Network Calls on Enterprise Leaders to Rethink AI Security Before the Next Rogue AI Crisis appeared first on Cyber Security News.

A recently disclosed vulnerability in Home Assistant has unveiled how improper handling of FFmpeg inputs can be exploited to steal sensitive files and ultimately enable root-level command execution on affected systems. This issue, discovered by security researchers at elttam, highlights the dangers of integrating powerful multimedia tools like FFmpeg into applications without strict input validation. […]

The post Home Assistant FFmpeg Vulnerability Enables File Theft and Root Command Execution appeared first on Cyber Security News.

AI has a role to play in Security Operations Centre (SOC) environments. According to EY, the number of senior security leaders dedicating at least a quarter of their cybersecurity budget to AI solutions for cybersecurity is expected to rise in the next two years, from nine percent today to 48 percent. The reason for this increased spend […]

The post Planning Your AI Security – How will You Manage All Your Resources? appeared first on Cyber Security News.

Attackers are exploiting a significant portion of vulnerabilities even before defenders receive a published CVE (Common Vulnerabilities and Exposures). In the first half of 2026, 23.43% of known exploited vulnerabilities had evidence of active exploitation on or before the day their CVE was published. This figure is slightly lower than the 28.93% recorded in 2025, […]

The post Hackers Are Exploiting Nearly One in Four Vulnerabilities Before Defenders Get a CVE appeared first on Cyber Security News.

Analog Devices, Inc., a leading U.S. semiconductor manufacturer specializing in analog, mixed-signal, and digital signal processing technology, has confirmed a cybersecurity incident that led to unauthorized access to its internal systems and the exfiltration of company files. The Massachusetts-based chipmaker disclosed the security incident following an initial intrusion detected in late June 2026. According to […]

The post Semiconductor Firm Analog Devices Confirms Data Breach After Internal Systems Intrusion appeared first on Cyber Security News.

A critical vulnerability, dubbed CosmosEscape, in Microsoft Azure Cosmos DB could have let attackers seize control of virtually every database hosted on the service, including Microsoft’s own internal systems. The vulnerability resided in Cosmos DB’s Gremlin API and, if exploited, could have enabled a cross-tenant attack affecting millions of customer workloads and Microsoft’s internal infrastructure. […]

The post New CosmosEscape Vulnerability Lets Attackers Take Over Azure Cosmos DB Instances appeared first on Cyber Security News.

GenieLocker, a newly identified ransomware linked to the financially motivated Toy Ghouls group, targets Windows, Linux, and VMware ESXi systems and has primarily attacked Russia’s manufacturing sector since March 2026. The Toy Ghouls group, also known as Bearlyfy, Labubu, and Laboo.boo, previously relied on ransomware families such as LockBit, Babuk, and RedAlert. The transition to […]

The post New GenieLocker Ransomware Attacks Windows, ESXi, and Linux Instances appeared first on Cyber Security News.

The Stable channel has been updated to Chrome version 151.0.7922.71.72 for Windows and macOS, and 151.0.7922.71 for Linux, with the rollout taking place over the coming days and weeks. According to Google’s security advisory, this release includes 370 distinct security fixes that address vulnerabilities in core browser components, graphics, networking, and platform-specific features. Access to […]

The post Google Chrome 151 Patches 370 Security Flaws, Including Seven Critical Vulnerabilities appeared first on Cyber Security News.

AtlasRAT is being delivered through a fake Flash Player installer that looks harmless but can give attackers remote control of a Windows computer. The campaign abuses a familiar software name to lower a victim’s guard, then loads much of its malicious code directly into memory, where it is harder for traditional file-based checks to catch. […]

The post Fake Flash Player Installer Uses Microsoft-Themed Certificate to Deploy AtlasRAT appeared first on Cyber Security News.