Cyber Security News

Microsoft has officially released the optional non-security preview update KB5074105 for Windows 11, versions 25H2 and 24H2. This release, part of the January 2026 “C-week” schedule, focuses on functionality enhancements, performance optimization, and reliability improvements rather than addressing security vulnerabilities. As a cumulative update, it integrates previous fixes and introduces new changes to the operating […]

The post Microsoft Releases Update for Windows 11, version 25H2 and 24H2 Systems appeared first on Cyber Security News.

Threat researchers have uncovered an actively serving command and control server hosting a complete deployment of the BYOB framework following the discovery of an exposed open directory. The server, located at IP address 38[.]255[.]43[.]60 on port 8081, was found distributing malicious payloads designed to establish persistent remote access across Windows, Linux, and macOS systems. Hosted […]

The post Exposed Open Directory Leaks BYOB Framework Across Windows, Linux, and macOS appeared first on Cyber Security News.

Cybercriminals are taking advantage of Google Search Ads to trick Mac users into visiting fake websites that promise to clean their computers. These sponsored ads appear when users search for common terms like “mac cleaner” or “clear cache macos,” making them look legitimate at first glance. The landing pages are designed to resemble Apple’s official […]

The post Threat Actors Leverage Google Search Ads for ‘Mac Cleaner’ to Direct Users to Malicious Websites appeared first on Cyber Security News.

A malicious VS Code extension has surfaced in the digital threat landscape, targeting developers who rely on coding tools daily. Discovered on January 27, 2026, the fake “ClawdBot Agent” extension presented itself as a legitimate AI-powered assistant, but it concealed a dangerous payload underneath. Unlike the actual Clawdbot service, which never released an official VS […]

The post Beware of Weaponized VS Code Extension Named ClawdBot Agent that Deploys ScreenConnect RAT appeared first on Cyber Security News.

A new Python-based remote access trojan has emerged, targeting both Windows and Linux systems with sophisticated surveillance and data theft capabilities. The malware operates by establishing command-and-control communication through unencrypted HTTP channels, allowing attackers to execute commands, steal files, and capture screenshots remotely. When executed, it immediately begins fingerprinting the victim’s system by collecting details […]

The post Python-based PyRAT with Cross-Platform Capabilities and Extensive Remote Access Features appeared first on Cyber Security News.

Matanbuchus is once again drawing attention in the cybersecurity community as it quietly returns to the threat landscape with refined tactics and better tools to avoid detection. This malware, known for its role as a stealthy downloader, is actively being used to deliver more dangerous payloads, including ransomware, onto targeted systems. Recent activity shows that […]

The post Matanbuchus Malware Downloader Evading AV Detections by Changing Components appeared first on Cyber Security News.

The Aisuru/Kimwolf botnet unleashed the largest publicly disclosed distributed denial-of-service (DDoS) attack in history, peaking at an unprecedented 31.4 terabits per second (Tbps). The massive attack, dubbed “The Night Before Christmas” campaign, targeted Cloudflare’s infrastructure and customers with hyper-volumetric attacks beginning December 19, 2025, combining Layer 4 DDoS attacks at record bandwidth alongside application-layer HTTP […]

The post 31.4 Tbps DDoS Attack Via Aisuru Botnet Breaks Internet With New World Record appeared first on Cyber Security News.

A sophisticated cybercriminal group known as TA584 has expanded its attack toolkit by deploying a new malware called Tsundere Bot through deceptive social engineering tactics. This threat actor, tracked as an initial access broker, has significantly intensified operations throughout 2025, with campaign volumes tripling between March and December. The malware targets organizations globally through carefully […]

The post TA584 Actors Leveraging ClickFix Social Engineering to Deliver Tsundere Bot Malware appeared first on Cyber Security News.

Google has rolled out a comprehensive update to Android’s theft protection capabilities, introducing stronger authentication safeguards and enhanced recovery tools designed to protect users before, during, and after theft attempts. The multi-layered defense system, announced on January 26, 2026, builds on existing protections and aims to transform Android devices into significantly harder targets for criminals. […]

The post Google Announces Android Theft Protection Feature to Make Your Device Harder Target for Hackers appeared first on Cyber Security News.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a critical authentication bypass vulnerability in multiple Fortinet products, actively exploited in the wild. Tracked as CVE-2026-24858, the flaw allows attackers with a FortiCloud account to hijack sessions on devices registered to other accounts when FortiCloud Single Sign-On (SSO) is enabled. First […]

The post CISA Warns of FortiCloud SSO Authentication Bypass Vulnerability Exploited in Attacks appeared first on Cyber Security News.

In a sophisticated supply chain phishing attack, threat actors hijacked an ongoing email thread among C-suite executives discussing a document awaiting final approval. The intruder, posing as a legitimate participant, replied directly with a phishing link mimicking a Microsoft authentication form. Researchers attribute this to a compromised sales manager account at an enterprise contractor, allowing […]

The post Threat Actors Leverage Real Enterprise Email Threads to Deliver Phishing Links appeared first on Cyber Security News.

A critical security advisory has been released for a command injection vulnerability affecting the Archer MR600 v5 router. The flaw, tracked as CVE-2025-14756, enables authenticated attackers to execute arbitrary system commands through the device’s admin interface, potentially leading to complete router compromise. The vulnerability exists in the admin interface component of the Archer MR600 v5 […]

The post TP-Link Archer Vulnerability Let Attackers Take Control Over the Router appeared first on Cyber Security News.

A critical zero‑day vulnerability in Gemini MCP Tool exposes users to remote code execution (RCE) attacks without any authentication. Tracked as ZDI‑26‑021 / ZDI‑CAN‑27783 and assigned CVE‑2026‑0755, the flaw carries a maximum CVSS v3.1 score of 9.8, reflecting its ease of exploitation and severe impact. According to a new advisory from Trend Micro’s Zero Day […]

The post Gemini MCP Tool 0-day Vulnerability Allows Remote Attackers to Execute Arbitrary Code appeared first on Cyber Security News.

The ZAP (Zed Attack Proxy) project, a widely used open-source web application security scanner, has disclosed a critical memory leak in its JavaScript engine. This flaw, likely present for some time, now disrupts active scanning workflows following the introduction of a new JavaScript scan rule in the OpenAPI add-on. Security teams relying on ZAP for […]

The post ZAP JavaScript Engine Memory Leak Issue Impacts Active Scan Usage appeared first on Cyber Security News.

A critical privilege-escalation vulnerability has been discovered in Check Point’s Harmony SASE (Secure Access Service Edge) Windows client software, affecting versions prior to 12.2. Tracked as CVE-2025-9142, the flaw allows local attackers to write or delete files outside the intended certificate working directory, potentially leading to system-level compromise. The vulnerability exists within the Service component of Perimeter81 […]

The post Check Point Harmony SASE Windows Client Vulnerability Enables Privilege Escalation appeared first on Cyber Security News.

In December 2025, music streaming platform SoundCloud disclosed a significant data breach affecting approximately 29.8 million user accounts. The unauthorized access compromised personally identifiable information (PII), including email addresses, usernames, display names, avatars, follower statistics, and geographic location data. The incident represents one of the most significant music platform breaches in recent years, impacting roughly […]

The post SoundCloud Data Breach Exposes 29.8 Million Personal users Details appeared first on Cyber Security News.

Chrome versions 144.0.7559.109 and 144.0.7559.110 have been released to the stable channel, addressing a critical security vulnerability in the Background Fetch API. The update is rolling out across Windows, Mac, and Linux systems over the coming days and weeks, making it essential for users to ensure their browsers are fully updated. The security fix centers […]

The post Chrome Security Update Patches Background Fetch API Vulnerability appeared first on Cyber Security News.

Fortinet has confirmed a critical authentication bypass vulnerability in its FortiCloud SSO feature, actively exploited in the wild under CVE-2026-24858. According to an advisory published on January 27, 2026, the flaw affects FortiOS, FortiManager, FortiAnalyzer, and FortiProxy. With a CVSSv3 score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it stems from improper access control (CWE-288) in the GUI component. […]

The post Fortinet Confirms Critical FortiCloud SSO Vulnerability(CVE-2026-24858) Actively Exploited in the Wild appeared first on Cyber Security News.

Sportswear giant Nike is actively investigating a potential cybersecurity incident after WorldLeaks, a financially motivated ransomware group, claimed responsibility for a significant data breach affecting the company. The group announced the breach on its darknet leak site on January 22, 2026, claiming to have exfiltrated over 1.4 terabytes of internal data and threatening to release […]

The post Nike Investigating Data Breach Following WorldLeaks Ransomware Group Claim appeared first on Cyber Security News.

WhatsApp has strongly denied a new class-action lawsuit accusing Meta of secretly accessing users’ end-to-end encrypted messages, labeling the claims as false and baseless. The messaging giant reiterated that messages remain private through device-based encryption via the open-source Signal protocol. A class-action complaint filed on January 23, 2026, in the U.S. District Court for the […]

The post WhatsApp Denies Lawsuit Claim and Confirms Messages are Device-encrypted and Private appeared first on Cyber Security News.