Latest Cybersecurity News and Articles
02 March 2026
Madhu Gottumukkala has been assigned to a new role within the Department of Homeland Security.
The post Nick Andersen Appointed Acting Director of CISA appeared first on SecurityWeek.
02 March 2026
The AWS Security Hub Extended plan aims to reduce security tool sprawl by correlating findings across multiple security domains.
The post AWS Expands Security Hub Into a Cross-Domain Security Platform appeared first on SecurityWeek.
02 March 2026
In response to the evolving events in the Middle East, the NCSC is advising that UK organisations review their cyber security posture.
02 March 2026
Most SaaS teams remember the day their user traffic started growing fast. Few notice the day bots started targeting them.
On paper, everything looks great: more sign-ups, more sessions, more API calls. But in reality, something feels off:
Sign-ups increase, but users aren’t activating.
Server costs rise faster than revenue.
Logs are filled with repeated requests from strange user agents.
If
02 March 2026
Using Windows shortcut files, the APT deployed a new implant, a loader, a propagation tool, and two backdoors.
The post North Korean APT Targets Air-Gapped Systems in Recent Campaign appeared first on SecurityWeek.
02 March 2026
The internet giant is developing an evolution of the certificates based on Merkle Tree Certificates (MTCs).
The post Google Working Towards Quantum-Safe Chrome HTTPS Certificates appeared first on SecurityWeek.
02 March 2026
Both sides conduct hacking and other attacks, including the deployment of wiper malware, DDoS, and disruptions to critical infrastructure.
The post US-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran Retaliates appeared first on SecurityWeek.
02 March 2026
A recently disclosed security flaw patched by Microsoft may have been exploited by the Russia-linked state-sponsored threat actor known as APT28, according to new findings from Akamai.
The vulnerability in question is CVE-2026-21513 (CVSS score: 8.8), a high-severity security feature bypass affecting the MSHTML Framework.
"Protection mechanism failure in MSHTML Framework allows an unauthorized
02 March 2026
Cybersecurity researchers have disclosed a new iteration of the ongoing Contagious Interview campaign, where the North Korean threat actors have published a set of 26 malicious packages to the npm registry.
The packages masquerade as developer tools, but contain functionality to extract the actual command-and-control (C2) by using seemingly harmless Pastebin content as a dead drop resolver and
02 March 2026
Security magazine reviews four data security events, some of which had a widespread impact.
01 March 2026
The AI was abused to write exploits, create tools, and automatically exfiltrate over 150GB of data.
The post Hackers Weaponize Claude Code in Mexican Government Cyberattack appeared first on SecurityWeek.
28 February 2026
OpenClaw has fixed a high-severity security issue that, if successfully exploited, could have allowed a malicious website to connect to a locally running artificial intelligence (AI) agent and take over control.
"Our vulnerability lives in the core system itself – no plugins, no marketplace, no user-installed extensions – just the bare OpenClaw gateway, running exactly as documented," Oasis
28 February 2026
In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to assemble Kimwolf, the world's largest and most disruptive botnet. Since then, the person in control of Kimwolf -- who goes by the handle "Dort" -- has coordinated a barrage of distributed denial-of-service (DDoS), doxing and email flooding attacks against the researcher and this author, and more recently caused a SWAT team to be sent to the researcher's home. This post examines what is knowable about Dort based on public information.
28 February 2026
Names, addresses, email addresses, phone numbers, and encrypted passwords were compromised in the attack.
The post Canadian Tire Data Breach Impacts 38 Million Accounts appeared first on SecurityWeek.
28 February 2026
New research has found that Google Cloud API keys, typically designated as project identifiers for billing purposes, could be abused to authenticate to sensitive Gemini endpoints and access private data.
The findings come from Truffle Security, which discovered nearly 3,000 Google API keys (identified by the prefix "AIza") embedded in client-side code to provide Google-related services like
27 February 2026
Anthropic on Friday hit back after U.S. Secretary of Defense Pete Hegseth directed the Pentagon to designate the artificial intelligence (AI) upstart as a "supply chain risk."
"This action follows months of negotiations that reached an impasse over two exceptions we requested to the lawful use of our AI model, Claude: the mass domestic surveillance of Americans and fully autonomous weapons," the
27 February 2026
OpenAI and Google, along with Elon Musk’s xAI, also have contracts to supply their AI models to the military.
The post Trump Orders All Federal Agencies to Phase Out Use of Anthropic Technology appeared first on SecurityWeek.
27 February 2026
The U.S. Department of Justice (DoJ) this week announced the seizure of $61 million worth of Tether that were allegedly associated with bogus cryptocurrency schemes known as pig butchering.
The confiscated funds were traced to cryptocurrency addresses used for the laundering of criminally derived proceeds stolen from victims of cryptocurrency investment scams, the department added.
"Criminal
27 February 2026
The Shadowserver Foundation has revealed that over 900 Sangoma FreePBX instances still remain infected with web shells as part of attacks that exploited a command injection vulnerability starting in December 2025.
Of these, 401 instances are located in the U.S., followed by 51 in Brazil, 43 in Canada, 40 in Germany, and 36 in France.
The non-profit entity said the compromises are likely
27 February 2026
Cybersecurity researchers have disclosed details of a malicious Go module that's designed to harvest passwords, create persistent access via SSH, and deliver a Linux backdoor named Rekoobe.
The Go module, github[.]com/xinfeisoft/crypto, impersonates the legitimate "golang.org/x/crypto" codebase, but injects malicious code that's responsible for exfiltrating secrets entered via terminal password