António Guterres labels lethal autonomous weapons “morally repugnant,” resurfacing issue that was central to Anthropic’s clash with the Pentagon.

Read more →

If you’re building multi-agent AI systems, you need to prevent authorization scope from silently expanding as agents delegate tasks through multi-hop chains. Without proper controls, an agent can potentially act beyond what the originating user authorized, even when role-based access control (RBAC) policies are in place. The OWASP Top 10 for Agentic Applications classifies this…

Read more →

A photo of an injured dog by the roadside. A dating profile with pictures that look almost too perfect. A donation appeal showing a family stranded on a rooftop after a flood. Scammers are already using AI-generated images to support fake stories, build trust, and persuade people to send money or share personal information. Instead…

Read more →

Check Point researchers have identified a new cyber adversary targeting Israeli government and IT businesses, tracked as ‘Cavern Manticore’

Read more →

Everything has sped up, but that’s why effective defenses still rely on good people.

Read more →

Apple has been working on a foldable smartphone for more than a decade. Having spent so much time developing the device, the company doesn’t want to ship something if it can’t make something good. Now, it looks like Apple can make a folding iPhone, but manufacturing them in decent quantities is going to take a little longer…

Read more →

Artificial intelligence is claiming many firsts as it permeates every layer of technology, including the tools cybercriminals use to break into networks, steal sensitive data, hop into connected systems and deploy malware.  This includes, for the first time, according to Sysdig researchers, a case of agentic ransomware managing an extortion operation spanning reconnaissance, credential theft,…

Read more →

MeetingTV, a videoconferencing provider, has filed a lawsuit contesting a Koi Security blog post that accused its domain and Zoomcorder service of being fronts for a China-linked threat actor.

Read more →

Zscaler found sites hiding prompt-injection text to manipulate AI agents into crypto payments

Read more →

Stephen Wilson, field chief technology officer for HashiCorp, an IBM company, likens AI agents to “really smart kindergartners.” “They know how to do something, but they have no clue as to why they should do it,” Wilson says. This combination of superior execution power and lack of judgment can create a significant challenge for organizations…

Read more →

New research led by Muhammad Usama Sardar, a researcher at TU Dresden, indicates that the attested TLS protocol, designed to ensure clients are communicating with genuine, unmodified Trusted Execution Environments (TEEs), is susceptible to diversion attacks.

Read more →

The incident, detailed in a case study by Ransom-ISAC, involved Kairos gaining access to a U.S. government entity’s network, reportedly through a brute-force credential attack.

Read more →

In this post, I will show you what a VPN can and cannot protect you from online. Online privacy and cybersecurity have become major concerns for internet users worldwide. From browsing websites and using public Wi-Fi to shopping online and accessing financial services, people constantly transmit data across networks. Cybercriminals, malicious actors, and other security…

Read more →

Opera GX flaw let sites automatically install mods to steal data from other pages, now patched

Read more →

I’ve used Linux for 30 years. This is how I show Windows users what they’re missing.

Read more →

The seven vulnerabilities in FatFs, a library embedded in firmware for devices like security cameras, drones, and industrial controllers, were found to be reachable through malformed USB drives, SD cards, or firmware update files.

Read more →

Every evolution in software development has reduced the friction between an idea and a deployable application. AI may remove the final barrier, but it also removes many of the moments where security decisions have traditionally taken place. […]

Read more →

ServiceNow and Accenture want to make legacy security migrations less painful. If you’ve followed ServiceNow at all over the past year, this shouldn’t feel entirely new. The company has spent a lot of time building out AI governance, security, and workflow automation, and now, it’s teaming up with Accenture to tackle one of the messier…

Read more →

Microsoft’s dominant enterprise footprint in the UK and Ireland is giving its channel ecosystem a key role in the next phase of Copilot adoption, even as customer concerns around data residency, privacy, and AI governance continue to shape deployment decisions.  With Azure holding one of its strongest regional positions globally and Microsoft investing heavily in…

Read more →

An analysis found that over 8% of organizations had no email protection in place, and a mere 0.6% achieved full marks.

Read more →

The videogame unit’s revenue has fallen and its Netflix-like subscription service is far below expectations.

Read more →

Criminal IP has integrated its threat intelligence with OpenCTI, enabling security teams to automatically convert IP addresses, domains, and URLs into structured intelligence within the platform’s knowledge graph. The integration automatically enriches ingested indicators with Criminal IP’s infrastructure intelligence, dual-perspective reputation scoring, vulnerability data, behavioral signals, and phishing analysis. The enriched data is structured as…

Read more →

HP brought aesthetics front and center with the 2026 OmniBook X Flip 14, but thankfully, it didn’t stop there.

Read more →

Attackers are now exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, the Canadian Center for Cyber Security (CCCS) warned on Thursday. […]

Read more →

LTM has launched BlueVerse RightLogic, a cybersecurity assessment and risk assurance framework designed to help enterprises identify, assess and remediate cyber exposure as they accelerate AI adoption. AI is now capable of autonomously identifying and exploiting vulnerabilities, while exposure across infrastructure, applications and supply chains continue to expand. This has elevated cyber risk from a…

Read more →

Operators who manage remote access to Unix and Linux systems keep a close watch on OpenSSH, the software that carries most SSH traffic across the internet. The project released version 10.4 with eight security fixes, a set of bug corrections, and a couple of new features. What the security fixes cover Two of the security…

Read more →

Hidden prompts on malicious websites trick AI agents into making payments or trusting fake sites, exposing new risks for autonomous AI workflows. Zscaler ThreatLabz documented two active campaigns that embed hidden instructions in web pages to manipulate AI agents, not human users, though those get caught too. The technique is called indirect prompt injection: malicious…

Read more →

Dutch consumer organization Consumentenbond has warned users to be careful when choosing their optional WhatsApp username. Meta announced the introduction of usernames on June 29, 2026, and encouraged users to reserve their username now. Meta offers this feature as: “a major privacy feature designed to help you connect with new people without giving away your…

Read more →

Malwarebytes links fake Google and Cloudflare verification pages to shared ClickFix infrastructure delivering StealC, NetSupport and other malware.

Read more →

Toronto, Canada, 6th July 2026, CyberNewswire

Read more →

For the latest discoveries in cyber research for the week of 6th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES River Bank & Trust, a US financial institution, has experienced a ransomware incident after an unauthorized actor accessed the network of parent company River Financial Corporation on June 16. The bank found…

Read more →

In a joint operation, Google, the FBI, and other partners have dealt a significant blow to the residential proxy ecosystem by disrupting the NetNut (also tracked as Popa) botnet. NetNut is a malicious service built on millions of hijacked consumer devices. NetNut marketed itself as a high-quality residential proxy provider, selling access to “real” home…

Read more →

As intelligent systems move into production environments and begin taking actions, organizations quickly discover that accountability becomes much harder. Unlike traditional enterprise software, these tools can produce unpredictable outcomes as they interact dynamically with data, APIs, and business workflows. “When something goes wrong with AI, it is generally assigned to whoever was closest to the…

Read more →

A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver a remote access trojan designed to steal sensitive data from compromised hosts. The multi-stage campaign, codenamed Operation DragonReturn by Seqrite Labs, involves sending spear-phishing emails impersonating the Income Tax Department of India.

Read more →

Generative AI is making document fraud faster and harder to spot, pushing security teams to verify provenance, signatures and file integrity at intake securely.

Read more →

runZero found 7 flaws in FatFs, a filesystem used in IoT and embedded devices. Bugs can cause memory corruption, crashes, or data leaks via crafted storage. Cybersecurity firm runZero has disclosed seven vulnerabilities in FatFs, a compact open-source library that lets embedded devices read and write FAT and exFAT formatted storage, the same formats used…

Read more →

Higher education has consolidated its entire academic operation into a handful of massive SaaS platforms. The LMS manages instruction, grading and communication. The SIS owns enrollment, records and financial aid. Identity and productivity live in a small number of cloud providers. These are not peripheral tools — they are the operational infrastructure of the institution.…

Read more →

If you wanted to become a basketball star, how would you get started? You wouldn’t read a book on basketball and take an online course. You’d set up a hoop in your driveway, join a local team to train, and play in real matches. So why do we expect cybersecurity professionals to learn their skills…

Read more →

I keep hearing the same frustration when I talk with security leaders. The real problem sitting on their desk isn’t finding vulnerabilities. It’s deciding which ones actually matter. The industry has spent billions on better visibility. We’ve convinced ourselves that if we could just discover more vulnerabilities, collect more data, and ingest more threat intelligence,…

Read more →

IWF and NCA warn that growing numbers of images and videos are being manipulated into sexual abuse material

Read more →

Researchers at Shandong University have shown a fast new way to pull data off computers that are cut off from every network. The technique, called TrojPix, tweaks on-screen pixels in ways the eye cannot see, so that the video cable carrying them radiates a faint radio signal a nearby receiver can decode. But TrojPix works only once malware…

Read more →

Bad Epoll (CVE-2026-46242) lets local attackers gain root on Linux and Android. The flaw was missed by AI but found by a security researcher. A newly disclosed Linux kernel vulnerability, named Bad Epoll (CVE-2026-46242), allows a local attacker with no special privileges to gain full root access on affected Linux systems and Android devices. Security updates are…

Read more →

Cybersecurity researchers have flagged a novel Java-based remote access trojan (RAT) called QuimaRAT that’s capable of targeting Windows, Linux, and macOS environments. According to LevelBlue, the cross-platform malware is advertised under a malware-as-a-service (MaaS) model, costing anywhere between $150 for one month to $1,200 for lifetime access. Other subscription tiers include $300 for

Read more →

Q2 has ended, and the second half of the year has begun, though a number of acquisitions cropped up throughout June. Organizations like Salesforce, Cloudflare, and SailPoint have made key moves to scale their businesses and improve services to customers.  Read below about some of the key acquisitions in June, and be sure to catch…

Read more →

Researchers found a flaw in Opera GX, the gaming-focused version of the Opera browser, that let a malicious website silently install a browser add-on and use it to lift specific data from the pages a victim visits. In a proof of concept, they reconstructed a signed-in user’s full Gmail address from a single visit, with no…

Read more →

Last week on Malwarebytes Labs: Verified X ad spreads Mac malware, while ConsentFix steals Microsoft accounts Apple’s Hide My Email doesn’t hide it very well Fake Google and Cloudflare verification pages spread multiple malware families WinRAR flaw could allow attackers to take control of your computer Fake Perplexity Chrome extension spies on your searches BioShocking:…

Read more →

A cyber risk assessment helps security teams identify, estimate, and prioritize potential threats and vulnerabilities to key enterprise digital and physical assets. Yet, despite its importance, many CISOs fall victim to several types of “gotchas” that prevent them from fully achieving their risk assessment goals. An assessment should be an essential part of every organization’s…

Read more →

Scanners meant to catch malicious add-on “skills” for AI coding agents can be fooled by a few simple changes that leave the malware working, according to a new study from researchers at the Hong Kong University of Science and Technology. Their strongest trick slipped past every scanner tested more than 90% of the time, and the same…

Read more →

Your CEO calls about an AI agent security incident in finance. He wants to know whether money moved, whether financial data was exposed, who owned the agent and why it had this level of access. The agent was connected to a spend management application to reconcile invoices, summarize vendor contracts and flag unusual payment activity.…

Read more →

Owners of the Flipper Zero, the pocket-sized wireless testing tool, spent recent weeks worried that its official firmware had gone quiet. Pavel Zhovner, CEO of Flipper Devices, moved to settle that concern with word that the company has set aside staff to keep the firmware maintained and to support outside contributions. The work will run…

Read more →

Organizations often create guest accounts to give contractors, suppliers, and partners temporary access to files and SaaS applications. Many of these accounts remain active long after they are needed, creating overlooked access paths to corporate data. Guest accounts accounted for 69% of monitored SaaS accounts in 2025, an increase of more than 1.9 million compared…

Read more →

Payment fraud is becoming more organized as criminal groups use fake websites, large-scale operations, and, in some cases, forced labor to steal money and personal information. Advances in agentic AI could automate many stages of payment fraud, from collecting and assembling stolen credentials to deploying password-cracking tools. What kind of payment fraud concerns you most?…

Read more →

As public opinion of AI has shifted into the negative, warnings of mass employment reductions have also diminished.

Read more →

The first security service built to govern AI agent identities, permissions, and behaviour before they become a liability

Read more →

Dell Technologies last night announced the winners of its ANZ Partner Awards FY26. The awards recognise partners for driving customer innovation, accelerating AI adoption and…

Read more →

Superloop has put a price on certainty, and it comes to $25.

Read more →

Open source antivirus scanning sits inside mail gateways, file upload checks, and endpoint tooling at organizations of every size. Much of that work runs through ClamAV, the scanning engine maintained by Cisco’s Talos group. The project released two patch versions, 1.5.3 and 1.4.5, carrying fixes for seven security flaws along with smaller hardening changes. Packer…

Read more →

As AI disrupts traditional career paths, these college students are skipping corporate internships for San Francisco hacker houses and incubators.

Read more →

Medtronic says a ShinyHunters attack exposed the personal and medical data of over 3.8 million people. Products and operations were unaffected. Medtronic is notifying 3,834,294 individuals after a cyberattack by the ShinyHunters extortion group exposed personal and medical information. In April 2026, Medtronic confirmed a cyberattack on its corporate IT systems after the hacker group ShinyHunters claimed…

Read more →

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer   Building a CI/CD pipeline for Sigma rules   Inside StegoAd: How a Threat Actor Evolved to Fuel Silent Ad…

Read more →

Flipper Devices says development of the Flipper Zero firmware will continue, albeit with a smaller internal team and greater reliance on community contributions. […]

Read more →

Plus: The end of Anthropic’s Fable ban, high-earner families explore alternative schools, how data-center water use is actually higher than reported and more

Read more →

AI and quantum guidance are driving the future of the National Institute of Standards and Technology Cybersecurity Framework. Here’s how.

Read more →

There are two kinds of people in the world. Those who spend all day sitting in front of a computer, and those who don’t realise just how much time they spend sitting in front…

Read more →

Passwords have long been the weakest link in cybersecurity, but Kensington’s new VeriMark NFC+ Security Keys can help you move to a passwordless, hardware-backed authentication…

Read more →

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. U.S. Government Agency Paid $1M to Data Extortion Group Kairos FBI: TeamPCP Compromised Dev Tools to…

Read more →

A U.S. government agency paid $1M to Kairos, a group focused on data theft and extortion rather than ransomware, Ransom-ISAC reports. A new case study from Ransom-ISAC reconstructs a complete data-extortion incident involving a U.S. government body and a threat actor called Kairos, using a leaked negotiation transcript and blockchain tracing of the ransom payment.…

Read more →

Researchers identified what they believe is the first documented case of a ransomware operation, JadePuffer, conducted entirely by a large language model (LLM) agent. […]

Read more →

The recent decision by the U.S. administration to lift restrictions on Anthropic’s frontier AI models has generated plenty of debate. Some have questioned whether the original restrictions were justified, while others argue they reflected legitimate concerns about the cybersecurity capabilities of increasingly powerful AI systems. Regardless of where you stand, I believe the real story…

Read more →

A U.S. government entity paid about $1 million to keep stolen files from being leaked, according to a new case study by Rakesh Krishnan for Ransom-ISAC, built on a leaked negotiation chat and the blockchain trail the payment left. The odd part: the group that took the money calls itself Kairos, but it may not be…

Read more →

Learn how AI startups use global hiring, EOR partners, and remote systems to access talent, stay compliant, and extend runway efficiently for sustainable growth.

Read more →

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider. “The campaign remains active, and new malicious packages are likely to continue appearing as threat actors…

Read more →