https://cybernewsai.com AI-powered real-time intelligence on cybersecurity threats, vulnerabilities, and defense strategies. en-us Wed, 16 Sep 2026 00:04:49 GMT https://cybernewsai.com /blog/acronis-cpanel-backup-flaw-cve-2026-87886 https://cybernewsai.com /blog/acronis-cpanel-backup-flaw-cve-2026-87886 Tue, 15 Sep 2026 23:50:00 GMT Acronis patched an actively exploited local privilege escalation vulnerability (CVE-2026-87886, CVSS 7.8) affecting its backup plugins for Linux cPanel, WHM, and Plesk hosting servers. Vulnerability WatchCloud DefenseThreat Intelligence CyberNewsAI Admin https://cybernewsai.com /blog/kremlin-malware-hijacks-chrome-app-bound-encryption https://cybernewsai.com /blog/kremlin-malware-hijacks-chrome-app-bound-encryption Tue, 15 Sep 2026 23:45:00 GMT Brazilian banking trojan KREMLIN (REF9334) defeats Chromium App-Bound Encryption to inject covert extensions, harvesting credentials and leveraging Ethereum smart contracts as dead-drop resolvers. Malware & BotnetsIdentity & AccessThreat Intelligence CyberNewsAI Admin https://cybernewsai.com /blog/trojanized-admin-menu-editor-pro-backdoors-wordpress-sites https://cybernewsai.com /blog/trojanized-admin-menu-editor-pro-backdoors-wordpress-sites Tue, 15 Sep 2026 23:30:00 GMT A supply chain attack on the Admin Menu Editor Pro plugin distributed trojanized updates (v2.35/2.36) that planted stealth web shells and hidden admin accounts across 1,500 WordPress websites. Supply Chain AttacksData BreachesThreat Intelligence CyberNewsAI Admin https://cybernewsai.com /blog/cisa-warns-ransomware-gangs-exploit-vmware-vcenter-rce https://cybernewsai.com /blog/cisa-warns-ransomware-gangs-exploit-vmware-vcenter-rce Tue, 15 Sep 2026 13:30:00 GMT CISA warned that ransomware gangs are now actively exploiting a critical CVSS 9.8 remote code execution flaw in VMware vCenter Server (CVE-2026-59310) to compromise enterprise virtualization. Ransomware & ExtortionVulnerability WatchCloud Defense CyberNewsAI Admin https://cybernewsai.com /blog/in-browser-clickfix-google-sheets-c2-crypto-theft https://cybernewsai.com /blog/in-browser-clickfix-google-sheets-c2-crypto-theft Tue, 15 Sep 2026 00:15:00 GMT Cisco Talos uncovered an in-browser ClickFix campaign abusing the Google Visualization API and Google Sheets as C2 to inject malicious JavaScript and hijack cryptocurrency swap transactions. Threat IntelligenceCloud DefenseMalware & Botnets CyberNewsAI Admin https://cybernewsai.com /blog/cisa-adds-screenconnect-mikrotik-jfrog-flaws-kev https://cybernewsai.com /blog/cisa-adds-screenconnect-mikrotik-jfrog-flaws-kev Sun, 13 Sep 2026 19:25:00 GMT CISA added five actively exploited vulnerabilities to its KEV catalog, spanning ConnectWise ScreenConnect (CVSS 9.9), MikroTik RouterOS 'MikroTrick', and JFrog Artifactory. Vulnerability WatchThreat IntelligenceCritical Infrastructure CyberNewsAI Admin https://cybernewsai.com /blog/unc3569-tencent-sogou-ime-grayrabbit-backdoor https://cybernewsai.com /blog/unc3569-tencent-sogou-ime-grayrabbit-backdoor Sun, 13 Sep 2026 19:10:00 GMT PRC-nexus espionage group UNC3569 weaponized a one-click RCE flaw in Tencent's Sogou Input Method to silently drop the GRAYRABBIT backdoor across Windows endpoints. Threat IntelligenceVulnerability WatchMalware & Botnets CyberNewsAI Admin https://cybernewsai.com /blog/dutch-ncsc-warns-check-point-vpn-rce-exploits https://cybernewsai.com /blog/dutch-ncsc-warns-check-point-vpn-rce-exploits Sat, 12 Sep 2026 15:15:00 GMT Dutch NCSC warns of imminent exploitation targeting two CVSS 9.8 flaws in Check Point VPN gateways that allow unauthenticated remote code execution. Vulnerability WatchCloud DefenseCritical Infrastructure CyberNewsAI Admin https://cybernewsai.com /blog/cisco-fmc-zero-days-sandworm-qilin-ransomware https://cybernewsai.com /blog/cisco-fmc-zero-days-sandworm-qilin-ransomware Sat, 12 Sep 2026 14:45:00 GMT Cisco warns of active in-the-wild exploitation of dual FMC vulnerabilities (CVE-2026-20079 CVSS 10.0), leveraged by Sandworm for Cyclops Blink malware and Qilin ransomware operators. Vulnerability WatchRansomware & ExtortionThreat Intelligence CyberNewsAI Admin https://cybernewsai.com /blog/passkey-phishing-lures-fuel-microsoft-365-data-theft https://cybernewsai.com /blog/passkey-phishing-lures-fuel-microsoft-365-data-theft Sat, 12 Sep 2026 03:37:00 GMT Extortion groups Storm-3121 and Storm-3032 weaponize fake passkey lures and device-code phishing to breach Microsoft 365 tenants and covertly exfiltrate enterprise SharePoint data. Threat IntelligenceCloud DefenseData Breaches CyberNewsAI Admin https://cybernewsai.com /blog/shinyhunters-abused-claude-1-8m-android-app-secret-heist https://cybernewsai.com /blog/shinyhunters-abused-claude-1-8m-android-app-secret-heist Sat, 12 Sep 2026 03:25:00 GMT ShinyHunters affiliates automated AWS EC2 clusters and TruffleHog to harvest secrets from 1.8M Android APKs, weaponizing Claude for rapid cross-tenant compromise and extortion. Threat IntelligenceAI SecurityData Breaches CyberNewsAI Admin https://cybernewsai.com /blog/active-exploitation-pan-os-globalprotect-authentication-bypass-cve-2026-0257 https://cybernewsai.com /blog/active-exploitation-pan-os-globalprotect-authentication-bypass-cve-2026-0257 Sun, 31 May 2026 01:12:16 GMT A critical authentication bypass vulnerability (CVE-2026-0257) in PAN-OS GlobalProtect gateways is under active exploitation. Vulnerability WatchThreat IntelligenceData Breaches CyberNewsAI Admin https://cybernewsai.com /blog/uat-4356-targets-cisco-devices-with-firestarter-backdoor https://cybernewsai.com /blog/uat-4356-targets-cisco-devices-with-firestarter-backdoor Sat, 25 Apr 2026 04:16:04 GMT Threat actor UAT-4356 is actively exploiting n-day vulnerabilities in Cisco Firepower devices to deploy the FIRESTARTER backdoor, enabling arbitrary code execution. Immediate mitigation required. Vulnerability WatchThreat Intelligence CyberNewsAI Admin https://cybernewsai.com /blog/storm-2755-payroll-pirate-attacks-target-canadian-staff https://cybernewsai.com /blog/storm-2755-payroll-pirate-attacks-target-canadian-staff Sat, 11 Apr 2026 03:13:52 GMT Threat Actor Storm-2755 is using AiTM phishing and SEO poisoning to bypass MFA, hijack sessions, and divert payroll deposits of employees in Canada. Analysis of TTPs included. Threat IntelligenceVulnerability WatchData Breaches CyberNewsAI Admin https://cybernewsai.com /blog/eviltokens-phaas-abuses-railway-paas-for-m365-attacks https://cybernewsai.com /blog/eviltokens-phaas-abuses-railway-paas-for-m365-attacks Wed, 25 Mar 2026 14:47:22 GMT Active device code phishing campaign attributed to the EvilTokens PhaaS platform is abusing Railway.com PaaS infrastructure to target Microsoft 365 identities, compromising over 340 organizations. Threat IntelligenceCloud DefenseData Breaches CyberNewsAI Admin https://cybernewsai.com /blog/china-linked-actor-cl-sta-1087-targets-military-applechris-memfun https://cybernewsai.com /blog/china-linked-actor-cl-sta-1087-targets-military-applechris-memfun Sat, 14 Mar 2026 10:34:35 GMT Suspected China-based actor CL-STA-1087 targets Southeast Asian military orgs in a long-running espionage campaign using custom backdoors AppleChris and MemFun and a modified Mimikatz tool, Getpass. Vulnerability WatchThreat Intelligence CyberNewsAI Admin https://cybernewsai.com /blog/apt28-linked-campaign-deploys-badpaw-meowmeow-malware https://cybernewsai.com /blog/apt28-linked-campaign-deploys-badpaw-meowmeow-malware Thu, 05 Mar 2026 12:00:25 GMT A new campaign, with moderate confidence attribution to APT28, is targeting Ukrainian entities with previously undocumented malware: the BadPaw loader and the MeowMeow backdoor. Report by ClearSky. Threat IntelligenceVulnerability Watch CyberNewsAI Admin https://cybernewsai.com /blog/critical-cisco-sd-wan-flaws-under-active-exploitation https://cybernewsai.com /blog/critical-cisco-sd-wan-flaws-under-active-exploitation Thu, 05 Mar 2026 11:25:28 GMT Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, including a CVSS 9.8 auth bypass, are under active exploitation. Threat actors can gain root access and bypass authentication. Threat IntelligenceVulnerability Watch CyberNewsAI Admin https://cybernewsai.com /blog/silver-dragon-apt-targets-govs-via-google-drive-c2 https://cybernewsai.com /blog/silver-dragon-apt-targets-govs-via-google-drive-c2 Wed, 04 Mar 2026 14:22:27 GMT Intel Brief: Silver Dragon, an APT41-linked threat actor, is targeting government entities using Cobalt Strike and a novel Google Drive C2 channel. Multiple infection chains detailed. Threat IntelligenceVulnerability WatchCloud Defense CyberNewsAI Admin https://cybernewsai.com /blog/oauth-redirect-abuse-delivers-malware-to-government-targets https://cybernewsai.com /blog/oauth-redirect-abuse-delivers-malware-to-government-targets Tue, 03 Mar 2026 13:18:04 GMT Threat actors are abusing legitimate OAuth redirect features in Entra ID and Google Workspace to deliver malware to government and public sector targets, bypassing conventional defenses. Threat IntelligenceCloud DefenseVulnerability Watch CyberNewsAI Admin https://cybernewsai.com /blog/android-zero-day-cve-2026-21385-actively-exploited https://cybernewsai.com /blog/android-zero-day-cve-2026-21385-actively-exploited Tue, 03 Mar 2026 13:11:51 GMT Google confirms active, targeted exploitation of CVE-2026-21385, a high-severity buffer over-read in Qualcomm's Android Graphics component. Immediate patching is required. Threat IntelligenceVulnerability Watch CyberNewsAI Admin https://cybernewsai.com /blog/sloppylemming-targets-south-asian-governments-with-new-malware https://cybernewsai.com /blog/sloppylemming-targets-south-asian-governments-with-new-malware Tue, 03 Mar 2026 13:04:57 GMT Threat Actor SloppyLemming targets Pakistan & Bangladesh governments with dual attack chains. Vectors include spear-phishing delivering the BurrowShell backdoor and a new Rust-based keylogger. Threat IntelligenceData Breaches CyberNewsAI Admin https://cybernewsai.com /blog/muddywaters-operation-olalampo-targets-mena https://cybernewsai.com /blog/muddywaters-operation-olalampo-targets-mena Mon, 23 Feb 2026 13:20:53 GMT Iranian APT MuddyWater targets MENA region in 'Operation Olalampo.' Campaign utilizes new AI-assisted malware including GhostFetch, GhostBackDoor, and the Rust-based CHAR backdoor. Threat IntelligenceVulnerability WatchAI Security CyberNewsAI Admin https://cybernewsai.com /blog/single-actor-drives-83-percent-of-ivanti-epmm-rce-attacks https://cybernewsai.com /blog/single-actor-drives-83-percent-of-ivanti-epmm-rce-attacks Sun, 15 Feb 2026 10:51:59 GMT A single threat actor, using a bulletproof hosting IP not on public IOC lists, is responsible for 83% of active RCE exploitation against critical Ivanti EPMM vulnerabilities. Patch immediately. Vulnerability WatchThreat Intelligence CyberNewsAI Admin https://cybernewsai.com /blog/lazarus-group-deploys-rat-via-fake-developer-job-offers https://cybernewsai.com /blog/lazarus-group-deploys-rat-via-fake-developer-job-offers Sat, 14 Feb 2026 06:05:07 GMT North Korean threat actor Lazarus Group is targeting developers with fake job offers, using coding challenges to deploy a RAT via malicious npm and PyPi packages in a campaign dubbed 'Graphalgo'. Threat IntelligenceVulnerability WatchData Breaches CyberNewsAI Admin https://cybernewsai.com /blog/lummastealer-resurgence-via-castleloader https://cybernewsai.com /blog/lummastealer-resurgence-via-castleloader Fri, 13 Feb 2026 07:44:30 GMT Intel Brief: LummaStealer infostealer infections surge, delivered by the heavily obfuscated CastleLoader. Campaigns use social engineering and 'ClickFix' vectors to compromise systems. Threat IntelligenceData BreachesVulnerability Watch CyberNewsAI Admin https://cybernewsai.com /blog/notepad-plus-plus-supply-chain-attack-delivers-chrysalis https://cybernewsai.com /blog/notepad-plus-plus-supply-chain-attack-delivers-chrysalis Tue, 03 Feb 2026 10:01:12 GMT China-linked actor Lotus Blossom compromises Notepad++ hosting to deliver Chrysalis backdoor. Attack targeted outdated versions via update hijacking. IOCs and mitigations are available. Threat IntelligenceVulnerability Watch CyberNewsAI Admin https://cybernewsai.com /blog/shinyhunters-abuses-sso-via-vishing-for-cloud-data-theft https://cybernewsai.com /blog/shinyhunters-abuses-sso-via-vishing-for-cloud-data-theft Sun, 01 Feb 2026 12:17:36 GMT Threat actors, including ShinyHunters, are using vishing and phishing kits to steal SSO credentials, bypass MFA, and exfiltrate data from enterprise SaaS applications like Salesforce and Microsoft 365 Cloud DefenseData BreachesThreat Intelligence CyberNewsAI Admin https://cybernewsai.com /blog/illicit-crypto-flows-hit-record-158-billion-2025 https://cybernewsai.com /blog/illicit-crypto-flows-hit-record-158-billion-2025 Sat, 31 Jan 2026 10:52:51 GMT Illicit cryptocurrency flows surged by 145% to a record $158 billion in 2025, reversing a three-year decline. Sanctions evasion, nation-state activity, and AI-driven scams are key drivers. Governance & PolicyThreat IntelligenceData BreachesAI Security CyberNewsAI Admin https://cybernewsai.com /blog/ivanti-epmm-zero-day-rce-vulnerability-alert https://cybernewsai.com /blog/ivanti-epmm-zero-day-rce-vulnerability-alert Fri, 30 Jan 2026 07:47:30 GMT Ivanti has confirmed active exploitation of two critical 9.8 CVSS zero-day RCE flaws. Organizations must apply emergency patches immediately to prevent full server compromise and lateral movement. Threat IntelligenceVulnerability Watch CyberNewsAI Admin