Security · Top stories
Google tests webcam-based reCAPTCHA that can be bypassed with stock photos
Google is trialing a webcam-based reCAPTCHA that requires users to show hand gestures. However, testers quickly circumvented it using stock photos, highlighting potential weaknesses in its implementation.
Kubota reveals month-long hacker access to employee data
Kubota North America announced that hackers accessed employee data for over a month this year. The breach exposed sensitive information such as Social Security numbers and bank details, prompting the company to enhance its security measures.
IDC Study Finds Mandiant Consulting Yields Significant ROI for Organizations
A recent IDC study shows organizations using Mandiant Consulting report an average annual benefit of $4.3 million, resulting in a 268% ROI over three years with a payback period of 4.1 months. This highlights Mandiant's effectiveness in bridging technical security and financial performance for large organizations.
Criminal IP Enhances OpenCTI with Contextual Cyber Threat Intelligence
Criminal IP integrates with OpenCTI to enrich IP addresses, domains, and URLs with intelligence data. This enhancement allows security teams to better investigate, correlate, and prioritize potential cyber threats.
Japanese companies report cyber breaches affecting millions of customers
Several major Japanese companies, including Aflac Japan, have reported cyber breaches that exposed personal data of millions and disrupted operations. These incidents require further investigation and highlight ongoing cybersecurity challenges faced by the industry.
AWS CIRT updates Threat Technique Catalog, focusing on container security
The AWS Customer Incident Response Team updated the Threat Technique Catalog, adding five new entries focused on container security, organization-level trust, and compute hijacking. This update provides essential insights into recent security threats, particularly around AWS Elastic Kubernetes Service, helping organizations mitigate risks in their cloud environments.
Kiro CLI simplifies AWS security investigations with AI assistance
Kiro has introduced Kiro CLI, an AI-powered tool that assists security teams in investigating AWS incidents. It streamlines the process by providing AWS CLI command suggestions and explanations, significantly reducing the time required for investigations.
AWS Releases Spring 2026 SOC Reports with 188 Services, Now in OSCAL Format
AWS has released its Spring 2026 System and Organization Controls (SOC) 1, 2, and 3 reports, covering 188 services. The SOC 1 and 2 reports are available in both PDF and OSCAL formats for the first time, enhancing automation and efficiency in compliance workflows. These reports provide AWS customers with assurance spanning April 2025 to March 2026, reflecting AWS's ongoing commitment to meeting cloud service compliance standards.
AWS Launches Continuum for Automated Security Vulnerability Management
AWS introduced Continuum for code vulnerabilities, designed to automate the security lifecycle from discovery to resolution. It aims to prioritize vulnerabilities using contextual data and machine reasoning, addressing the increasing backlog of threats facing enterprises.
AWS security maturity roadmap provides phased improvement strategy
A new maturity roadmap for AWS security operations introduces a six-phase process aimed at improving security practices. By integrating AWS Security Hub and Amazon GuardDuty, organizations can enhance their threat detection and overall security posture.
AWS Shield Advanced introduces DDoS attack flow logs for enhanced visibility
AWS Shield Advanced now includes attack flow logs that capture traffic metadata during DDoS attacks. This enables better analysis of attack traffic, showing the origins and mitigating actions taken, integrating seamlessly with existing monitoring tools.
Threat Actors Use SEO-Poisoned Sites to Deploy AsyncRAT via ScreenConnect
Cybercriminals are using the ScreenConnect remote access tool to deploy AsyncRAT through compromised installer archives on spoofed websites. The campaign targets multiple languages and has resulted in a significant security risk as it enables attackers to maintain control over compromised devices and steal sensitive data.
GitHub Security Lab suggests six key settings for maintainers
GitHub Security Lab recommends six essential security settings for project maintainers to implement. These settings help improve security protocols, facilitate vulnerability reporting, and strengthen overall project integrity.
Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures
The Ousaban banking trojan is targeting Windows users in Spain and Portugal through phishing PDFs designed to look like corrupted files. This malware can capture sensitive information during online banking sessions, posing a significant threat to users' accounts.
2026 Cybersecurity Assessment Reveals Awareness vs. Resilience Gap
The 2026 Bitdefender Cybersecurity Assessment reveals significant discrepancies between organizations' awareness of cyber risks and their actual resilience capabilities. While there is broad acknowledgment of AI’s role in cybersecurity, many teams struggle to effectively reduce their attack surfaces and maintain visibility into AI usage, highlighting a critical sector challenge.
Microsoft Accelerates Post-Quantum Cryptography Roadmap to 2029
Microsoft is fast-tracking its quantum-safe security roadmap, aiming for post-quantum cryptography by 2029 in response to advances in quantum computing. This update could significantly impact encryption standards and security protocols across the tech industry.
AI-Generated Domains Used in Phishing Attacks via Phantom Squatting
Attackers are purchasing domains created by AI models before anyone else, leveraging misplaced trust from users. This tactic, termed 'phantom squatting' by Palo Alto Networks' Unit 42, poses significant risks as AI-generated links can mislead users into visiting malicious sites.
Amazon fined $2.25 million for mishandling identity theft complaints
Amazon has been fined $2.25 million by the FTC for failing to assist identity theft victims as required by the Fair Credit Reporting Act. The FTC alleged that Amazon did not provide information on fraudulent purchases, leading to significant difficulties for customers affected by identity theft.
Research reveals vulnerabilities in AI browsers allowing potential exploitation
New research shows that AI browsers can be manipulated into a false context, enabling malicious actions. This exposure underscores the risks of AI integration without addressing core vulnerabilities.
Microsoft Identifies Risks from Poisoned MCP Tool Descriptions for AI Agents
Microsoft research reveals that poisoned tool descriptions can enable attackers to coerce AI agents into leaking sensitive data without triggering alarms. This issue arises particularly as companies empower AI agents for more complex tasks, highlighting vulnerabilities in the Model Context Protocol (MCP).
RustDuck Botnet Targets Routers and Servers with Two-Stage Malware
The RustDuck botnet is hijacking devices like routers and cameras to execute DDoS attacks. Its significance lies in its rapid evolution and the transition from C to Rust, making analysis more difficult.
Silent Swap Crypto Clipper Targets Users via Fake Google Notes Extension
Cybersecurity researchers identified the Silent Swap crypto clipper campaign, which uses a fake 'Google Notes' extension to steal cryptocurrency. The campaign replaces wallet addresses during transactions, leading to irreversible financial losses for victims.
Study Reveals 282 iOS AI Apps Expose API Keys and Access Tokens
A study found that 282 of 444 tested iOS AI chatbot apps leaked API keys through network traffic, enabling unauthorized access. This exposes developers to financial risks and highlights security vulnerabilities amidst the growing reliance on AI applications.
Cyber Risks Identified Ahead of FIFA World Cup 2026
A recent report reveals significant cyber threats targeting the FIFA World Cup 2026, including email spoofing risks and a surge in fake sportsbook apps. With many partners lacking sufficient protections, this exposes critical vulnerabilities within the event's supply chain, posing a major risk to financial transactions.
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
An exploit of the critical authentication bypass vulnerability CVE-2026-48558 in SimpleHelp has allowed attackers to deploy TaskWeaver and Djinn Stealer malware. This intrusion showcases the importance of securing remote monitoring software, as compromised systems can lead to severe data theft.
GitHub Advisory Database Hits Record Vulnerability Reports Amid Increased Complexity
In May 2026, the GitHub Advisory Database published a record 1,560 reviewed advisories, indicating a significant rise in vulnerability reporting. This surge is prompting longer review times but maintains quality as advisories are still human-validated.
Malicious Chrome Extension Logged User Searches Under Perplexity Name
Microsoft discovered a malicious Chrome extension pretending to be Perplexity that intercepted user searches and address bar input. This extension logged every search query and typed character before redirecting users to legitimate search engines, posing a significant data privacy risk.
Apple Releases Security Updates for 30+ iOS, macOS, Safari Vulnerabilities
Apple released security updates for iOS, macOS, and Safari fixing over 30 vulnerabilities, including four WebKit flaws uncovered using AI tools. This marks a proactive approach from Apple in response to potential AI-enhanced exploitation techniques.
Over 236,000 DCloud Sites Linked to Cryptocurrency Scams and Phishing
Infoblox reports that over 236,000 websites employing DCloud Uni-App templates are involved in scams. These include cryptocurrency exchanges, phishing networks, and wallet drainers, raising significant security concerns.
Urgency Grows for Quantum-Resistant Cryptography Amid Quantum Threats
Organizations must adapt to post-quantum cryptography as public-key systems will be vulnerable to quantum computers. With cryptographically relevant quantum computers potentially available within 15 years, industries face pressures to upgrade security protocols before major deadlines set by agencies like the NSA and NIST.
Gamaredon Intensifies Cyber Attacks on Ukraine with New Malware Techniques
Gamaredon, a Russian APT group, has expanded its cyber attacks against Ukraine with new malware and tactics throughout 2025. The group has conducted 35 spear-phishing campaigns aimed at Ukrainian governmental and military institutions, focusing on exfiltrating sensitive data that could serve Russian interests in the ongoing conflict.
Flock cameras expand beyond license plate tracking in the U.S.
Flock Security's surveillance cameras, primarily known for tracking license plates, are increasingly used for broader monitoring, raising privacy concerns. With over 100,000 units installed, these cameras pose significant implications for public surveillance and law enforcement practices.
Ukraine and FBI Uncover Russian Intelligence Messaging Credential Theft Campaign
The Security Service of Ukraine, in collaboration with the FBI, revealed a Russian intelligence operation targeting messaging accounts of officials and civilians. The attackers used fake support messages to coax victims into revealing sensitive credentials.
New SharkLoader Malware Used to Deploy Cobalt Strike in Global Cyberattacks
Kaspersky reports a new malware called SharkLoader is being used to deploy Cobalt Strike in cyber attack campaigns. Targeting various sectors in multiple countries, the campaign reveals a significant and global threat landscape potentially linked to a Chinese-speaking threat actor.
Chinese APT CL-STA-1062 Uses TinyRCT Backdoor in Southeast Asia Cyber Campaign
A Chinese-speaking APT known as CL-STA-1062 has been linked to a new backdoor, TinyRCT, targeting government and critical infrastructure in Southeast Asia. This development highlights a sustained threat environment for state entities in the region.
Amazon Q Developer Flaw Allows Code Execution via Malicious Repos
A high-severity flaw in Amazon Q Developer permitted malicious repositories to execute code and steal developer credentials. The issue stemmed from the way Amazon's AI coding assistant handled Model Context Protocol servers, which has now been patched by Amazon.
Microsoft Alerts on Phishing Campaign Targeting Hotels with Node.js Implant
Microsoft identified a phishing campaign targeting hotels across Europe and Asia that leverages ZIP files containing a Node.js implant. The campaign uses specialized email tactics to bypass security measures and exploit hotel operational themes, highlighting a significant security concern in the hospitality sector.
Russia Used Cellebrite Tools on Activist's iPhone Post-Sales Cutoff
Russian authorities accessed the iPhone of detained activist Andrey Pivovarov using Cellebrite's forensic tools in June 2021, despite the company's pledge to cease sales to Russia. This incident raises serious ethical concerns regarding the use of forensic technology in political prosecutions and reflects ongoing state repression efforts against opposition figures.
Google Reveals Details on Turla's STOCKSTAY Backdoor Targeting Ukraine
Google's Threat Intelligence Group announced the discovery of the STOCKSTAY backdoor, attributed to the Russian cyber espionage group Turla. This malware has been used to target Ukrainian government and military organizations, showcasing an evolution in Turla's cyber capabilities and tactics since its development traceable to late 2022.
Cloudflare Develops Privacy Protocol, curl Bug Discovered, Critical Hoppscotch Vulnerability
Cloudflare, alongside major web browsers, introduced a protocol using Private Access Control Tokens to enhance web privacy. AISLE reported six vulnerabilities in curl, the oldest dating back to 2001, while a critical security flaw in Hoppscotch allows unauthenticated attackers to compromise API instances.