Security · Top stories
PamStealer macOS Malware Updates Payload Decryption and Persistence Mechanisms
A new version of PamStealer macOS malware now uses server-side decryption for its main payload and employs a different lure, advertising a non-existent cryptocurrency wallet service. The updated malware also implements four redundant persistence methods, including suppressing macOS notifications for new background login items.
Welsh Police Force Suffers Cyberattack, Staff Data Potentially Compromised
Dyfed-Powys Police in Wales experienced a cyberattack that disrupted non-emergency systems and may have compromised staff information. The incident, identified earlier this month, is under investigation to determine the extent of employee data access, though no public data appears affected.
Cloudflare launches Turnstile Spin for simplified bot protection setup
Cloudflare introduced Turnstile Spin, an agent-mediated implementation of its Turnstile bot protection service. This new tool simplifies the setup process for Turnstile, making it accessible to a wider range of users beyond developers, and addresses the rise of AI coding agents in web development.
CISA Releases 2026 Election Security Plan, Highlighting Patching Barriers and Voter Database Threats
The US Cybersecurity and Infrastructure Security Agency (CISA) published its 2026 Election Infrastructure Security Plan, detailing cyber and physical threats to election systems. The plan identifies challenges like slow patching due to certification rules and vulnerabilities in voter registration databases, offering recommendations to improve election security.
Asus eShop Data Breach Exposes Customer Order Records and Contact Details
Asus confirmed a data breach in its eShop environment, potentially exposing customer contact details and order records. While payment information was not compromised, the leaked data could be used for targeted phishing scams against affected customers.
File Notification Systems in Major OSes Leak User Activity
Researchers at Graz University of Technology found that file-change notification features in Linux, Android, Windows, and macOS can be exploited to monitor user activity, including typing rhythms and website visits. This vulnerability allows an attacker with local code execution or a permission-less Android app to infer sensitive user actions without accessing file contents, posing a privacy risk across multiple platforms.
Salesforce Agentforce Vulnerabilities Allowed Zero-Click Data Exfiltration and Phishing
Zenity Labs discovered three vulnerabilities, dubbed SalesBleed, in Salesforce Agentforce that could enable zero-click data exfiltration of sensitive CRM data and phishing attacks. These flaws exploited Web-to-Lead forms and Agentforce's Slack integration, allowing attackers to bypass security mechanisms and compromise internal communications.
MacSync Malware Uses Public iCloud Calendars for Payload Delivery
A new variant of the MacSync info-stealing malware for macOS now uses public iCloud calendar events to deliver subsequent payloads. This evolution allows the malware to retrieve additional components and a new Objective-C backdoor, enhancing its persistence and data exfiltration capabilities.
Nearly half of small business websites lack basic security headers
A 2026 study of 4,688 U.S. local business websites found that 49.7% did not meet any of seven defined security header criteria. This indicates a widespread lack of fundamental web security configurations among small and local businesses, potentially exposing them and their users to common web vulnerabilities.
Digital Forensics Firm Oxygen Forensics Accused of Hiding Russian Ownership from US Agencies
The Department of Justice arrested two principals of Oxygen Forensics, alleging the company concealed its Russian ownership and software origin while securing contracts with US federal agencies. The firm sold digital forensics software to the Departments of Defense and Homeland Security, falsely claiming US development. This raises concerns about supply chain integrity for sensitive government tools.
Senators introduce bill for voluntary telecom cybersecurity rules after Salt Typhoon hacks
Senators Mark Warner and Ted Cruz introduced the Telecommunications Cybersecurity and Resilience Act, which proposes voluntary cybersecurity best practices and an optional certification for the telecommunications industry. This initiative responds to the Salt Typhoon attacks, where Chinese hackers breached major U.S. telecom companies over several years, accessing sensitive call data.
Unpatched OnePlus Flaws Allow Installed Android Apps to Gain Root Access Without Permissions
A security researcher discovered and disclosed two chained flaws in OnePlus's OxygenOS that allow any installed Android application to gain root access on affected devices without requiring special permissions. OnePlus confirmed the vulnerabilities in May but had not released a fix by the time of public disclosure, and also threatened legal action against the researcher for publishing the findings.
Azul Launches AI Assistant for Real-time Java Security and Licensing Risk Management
Azul introduced its Intelligence Cloud AI Assistant, a natural-language query interface designed to provide real-time insights into security vulnerabilities and licensing infringements within live Java production environments. This tool addresses the challenge of static reports quickly becoming outdated, especially as AI accelerates the weaponization of newly disclosed vulnerabilities.
Flock Safety Faces Congressional Scrutiny Over AI Surveillance Network
Flock Safety is under increased scrutiny from US lawmakers regarding its AI surveillance network and automated license plate readers (ALPRs). A Senate Judiciary subcommittee hearing addressed concerns about data privacy, storage, and potential misuse of the technology, with lawmakers from both parties expressing unease.
FedRAMP VDR and VER Rules Mandate Daily Scans and Stricter Remediation by 2026
FedRAMP's new Vulnerability Detection and Response (VDR) and Verification (VER) rules become mandatory on December 7, 2026, replacing the monthly scan model with more frequent, tiered scanning requirements. These changes introduce tighter remediation deadlines, shift the burden of proof for exploitability, and classify process failures as vulnerabilities, significantly altering engineering work for certified cloud service offerings.
Kyiv Internet Providers Report Major Outages After Russian Attacks Damage Data Centers
Russian drone strikes damaged data centers and telecommunications infrastructure in Kyiv, causing internet outages for thousands of households. Several internet providers, including Kyiv Link, Pautina, Utels, and Crazy Network, experienced partial connectivity losses. The attacks disrupted critical civilian infrastructure, impacting access to information for residents.
Corp MDM Android Spyware Targets Logistics Firms, Steals SMS and Redirects Calls
A new Android spyware named Corp MDM is targeting the logistics sector through fake Google Play pages, exfiltrating SMS content and diverting calls. The malware is part of a broader campaign that also includes credential phishing and Windows-based malware, indicating a focused attack on logistics companies.
NIST Updates OT Security Guide; CISA/FBI Warn on ICS Integrator Risks
NIST released a draft update to its operational technology security guide, expanding sector coverage and aligning with Cybersecurity Framework 2.0. Separately, CISA and the FBI issued a fact sheet advising critical infrastructure operators on the risks associated with third-party ICS integrators, following a cyber intrusion at an industrial automation company.
Starlink Ground Station in Poland Hit by Suspected Arson Attack
A Starlink ground station in Wola Krobowska, Poland, was damaged by fire in a suspected arson attack. Poland's digital affairs minister, Krzysztof Gawkowski, stated the incident was deliberate and attributed it to Russian hybrid warfare tactics, aiming to disrupt critical telecommunications infrastructure, including internet services to Ukraine.
US Intelligence Finds No Successful Foreign Meddling in 2024 Election
US intelligence agencies found no evidence of successful foreign interference in the 2024 presidential election, according to a classified assessment. The report, however, noted that Russia, Iran, and China conducted influence campaigns, with Russia's efforts being the most significant.
UK Military Jamming Other Nations' Satellites for Defense
The British military has been using a ground-based system for the past year to jam or block satellites from other countries to defend against hostile threats. This development coincides with the creation of a new RAF unit focused on disrupting hostile space threats, highlighting the increasing militarization of space and the reliance of modern infrastructure on satellite technology.
AWS enforces MFA for all root users across all account types by June 2025
AWS completed comprehensive multi-factor authentication (MFA) enforcement for root users across all account types by June 2025, a phased rollout that began in May 2024. This move supports the Australian Signals Directorate's (ASD) campaign to encourage MFA adoption, aiming to prevent over 99% of password-related attacks.
cPanel Fixes Critical Flaw Allowing Root Access and Cross-Account Database Modification
cPanel released fixes for a critical vulnerability in its CalDAV and CardDAV service that allowed any cPanel account holder to execute code as root, gaining full server control. Additionally, a bug in the WP Toolkit plugin was patched, which permitted account holders to alter databases belonging to other accounts.
Honeywell Report: OT Security Teams Adopt AI, but Autonomy Remains Limited
Honeywell's 2026 OT Cybersecurity Benchmark Report indicates a gap between perceived and actual OT security preparedness, with 88% of organizations rating their programs as mature but only 21% having a complete asset inventory. The report also found 99% of respondents expect AI to impact OT security within 2-3 years, with 72% already using AI for threat detection, though only 23% employ autonomous AI.
OpenAI Provides Daybreak AI Cyber Defense System to Ukraine for Free
OpenAI is providing its Daybreak AI cyber defense system and access to its GPT 5.6 Sol model to the Ukrainian government at no cost. This initiative aims to help Ukraine protect its critical civilian infrastructure from cyber-attacks, which numbered nearly 6,000 in 2025 according to CERT-UA.
Adobe Patches Critical Vulnerabilities in Connect and AEM Forms
Adobe released patches for 36 vulnerabilities across its products, including critical flaws in Connect and Experience Manager (AEM) Forms that could lead to arbitrary code execution and privilege escalation. These updates address SQL injection, XSS, and server-side request forgery issues, and users are advised to apply them within 30 days.
Critical Next.js ImageResponse Flaw Allows Server Code Execution via Crafted SVG Input
A critical security vulnerability (CVE-2026-94545) in Next.js ImageResponse allows attackers to execute code on servers by injecting crafted SVG input. This flaw affects Next.js versions 16.2.0 through 16.3.5 running on Node.js and has been patched in version 16.3.6.
New Tool "Einstein" Automates Data-Only Attack Generation, Challenging Mitigation Strategies
Researchers developed "Einstein," a tool that automatically generates data-only attacks, which manipulate program data without altering control flow. This research, presented at USENIX Security 2024, demonstrates that these attacks are easier to create than previously thought, necessitating a re-evaluation of current security defenses.
Rogue external MFA providers can steal passwords during Microsoft Entra logins
Security researchers developed TrustSink, an attack that allows hackers with privileged access to register a rogue external MFA provider to steal user passwords during legitimate login attempts. This technique works with external authentication models, demonstrated using Microsoft Entra, and captures plaintext passwords without disrupting the login process.
Sweden fines Miljödata $183,000 for GDPR violations after 2025 data breach
Sweden's data privacy regulator, IMY, fined IT provider Miljödata $183,000 for inadequate security measures that led to a data breach affecting 2.2 million people in August 2025. The company failed to check new software and lacked real-time monitoring, violating GDPR Article 32(1). This fine highlights regulatory enforcement against insufficient cybersecurity practices, especially for providers handling sensitive personal data.
Nottingham University Hospitals loses 11 years of maternity record viewing history due to IT error
Nottingham University Hospitals NHS Trust (NUH) lost 11 years of maternity record viewing history due to a human error during routine IT work. An incorrect database was overwritten, making it impossible to confirm who viewed specific maternity records between September 2011 and November 2022. This incident highlights the critical need for robust IT change management and data protection protocols in healthcare systems.
Over 1,700 US Water Providers Exposed to Hacks via Stolen Employee Passwords
New research by SpyCloud reveals that 1,787 U.S. water and wastewater providers have had employee passwords and active logged-in sessions compromised by password-stealing malware. This exposure allows hackers to access operational networks and remote-access systems, posing a risk to critical infrastructure.
Linux Kernel Flaw in ARM64 KVM Allows Guest Read-Write Access to Host Memory
A new flaw, CVE-2026-89775, in the Linux kernel's KVM virtualization code for ARM64 processors allows guest virtual machines to read and write host kernel memory when nested virtualization is enabled. This vulnerability can lead to guest escape and arbitrary code execution on the host machine. The issue is fixed in Linux kernel versions 6.18.51, 7.2.5, and 7.3-rc1.
Russian Internet Shutdowns Disrupt Drone Attack Warnings, Endangering Civilians
Russia's increasing restrictions on mobile internet and cellular service are hindering citizens' ability to receive timely warnings about incoming Ukrainian drone and missile attacks. These shutdowns, intended to prevent drones from using cellular networks, also disrupt digital alert systems like Telegram, leading to delayed or absent warnings for residents.
Japan Dismantles First North Korean Laptop Farm, Allies Detail WaterPlum Hacking Scheme
Japan has dismantled its first North Korean laptop farm, while a joint advisory from the US, Japan, Australia, and Germany detailed the WaterPlum hacking group's methods. This action reveals a coordinated international effort to counter North Korea's illicit IT worker and cybercrime operations, which fund the regime.
iOS 27.2 beta 2 reveals details of unannounced iPhone anti-snatching feature
Apple is developing an "AutoLock" feature for iPhones that automatically locks the device when it detects it has been snatched from a user. References in iOS 27.2 beta 2 indicate the feature uses multiple signals and safeguards to prevent false positives, aiming to enhance device security against theft.
Malicious npm package 'mathmain' uses encrypted loader triggered by specific math equation
A remote access implant was discovered hidden within the npm package 'mathmain', a copy of the 'mathjs' library. The malicious code remains dormant until a specific mathematical equation is solved, which acts as a key to decrypt and execute a payload that takes commands via a public chat service and blockchain network.
Google Cloud Secure Source Manager Adds New Capabilities for CI/CD Pipeline Security
Google Cloud Secure Source Manager (SSM) has introduced two new generally available capabilities to enhance CI/CD pipeline security. These updates aim to prevent unauthorized access to CI/CD systems and manage unauthorized code changes by authorized users, addressing growing software supply chain threats.
Miri Caching Vulnerability Exposes Secrets in GitHub Actions
The Rust Security Response Team identified a vulnerability where Miri, when used with GitHub Actions caching, could expose environment variables containing secrets to pull requests. Miri's practice of storing all environment variables in the `target/` directory, which is often cached, allowed unauthorized access to sensitive information.
Belgian Table Tennis and Gymnastics Federations Hit by Cyberattacks
The Royal Belgian Table Tennis Federation (FRBTT) and its French-speaking branch (AFTT) are investigating a cyberattack after a hacker claimed to have stolen data on tens of thousands of members and users. A separate cyberattack also affected Belgium's French-speaking Gymnastics Federation (FfG), with a hacker claiming responsibility for both incidents. This highlights ongoing cybersecurity vulnerabilities within sports organizations.