Security · Top stories
Claude for Chrome Vulnerability Exposes User Data to Rogue Extensions
A vulnerability in Claude for Chrome allows rogue extensions to trigger sensitive tasks without user consent. Discovered by Manifold Security, the flaw enables malicious extensions to access Gmail, Google Docs, Calendar, and Salesforce, posing a significant security risk. This issue persists in version 1.0.80, with no current patch.
Zoom Patches Critical Vulnerability Allowing Account Takeovers
Zoom has patched a critical vulnerability (CVE-2026-53412) in its Windows applications, rated 9.8 on the CVSS scale, which enabled potential account takeovers. The flaw affected Zoom Workplace, Zoom VDI Client, and Zoom Meeting SDK for Windows prior to version 7.0.0. This vulnerability impacts user security and necessitates immediate updates to prevent unauthorized account access.
Microsoft Revokes Vulnerable UEFI Shims Allowing Secure Boot Bypass
Microsoft has revoked the signatures of 11 old UEFI shims signed by them, which could bypass Secure Boot on Windows and Linux systems. This security flaw, discovered by ESET, existed due to old firmware remaining signed and trusted despite vulnerabilities. Addressing this issue is critical for preventing the unauthorized execution of code during the system boot process.
Critical Vulnerability in Cursor IDE Allows Arbitrary Code Execution on Windows
A vulnerability in Cursor IDE enables arbitrary code execution by executing malicious git binaries in project roots. Reported by Mindgard in December 2025, the issue remains unpatched, affecting over 7 million users. The flaw involves Cursor executing 'git.exe' files in repository roots without user interaction, posing significant security risks.
Progress Software Confirms Zero-Day Vulnerability in ShareFile Storage Zone Controllers
Progress Software advised ShareFile users to shut down Storage Zone Controllers due to a zero-day vulnerability. The high-severity path traversal flaw, affecting versions 5.x and 6.x, led to precautionary account access suspension and patches release. No customer data compromise has been reported.
xAI's Grok CLI Tool Exposed for Uploading Entire Repositories Without Consent
xAI's Grok Build CLI tool was found transmitting entire code repositories, including sensitive files, to its cloud storage, causing privacy concerns. After researcher cereblab's disclosure, xAI altered the tool silently. Elon Musk said all uploaded data would be deleted to maintain privacy standards.
Microsoft 365 Users Targeted in Voice Phishing Campaign for Fake Entra Passkey Enrollment
A voice phishing campaign is exploiting Microsoft 365 users to unwittingly enroll fake Entra passkeys, giving attackers unauthorized account access and facilitating potential data extortion. Initiated by the group O-UNC-066, the campaign began in April and spans multiple industries, highlighting vulnerabilities in the passkey adoption process Microsoft implemented. Okta reported the attacks, which utilize convincing phishing kits mimicking Microsoft's passkey enrollment portal.
US and Allied Nations Warn of Russian Router-Based Cyberattacks on Critical Infrastructure
US and several allied nations have issued a warning regarding Russian state-backed attempts to exploit poorly secured routers to breach critical infrastructure. The FSB's hacking groups target sectors including energy, healthcare, and communications by using known vulnerabilities and SNMP exploits. The warning underscores the need for immediate security enhancements in affected sectors.
U.S. Sanctions VPN and Malware Providers for Ransomware Support
The U.S. Treasury sanctioned First VPN Service and its administrator for aiding ransomware activities against American infrastructure. Ukrainian Dmytro Rashevskyi, associated with the VPN, and Belarusian Yegeniy Silayev, a cryptor seller, were named in the sanctions. The sanctions prevent U.S. entities from transacting with them, underscoring a broader crackdown on cybercriminal support networks.
UK and EU Sanction Russia's FSB and GRU for Cyberattacks Involving Critical Infrastructure
The UK and EU have imposed joint cyber sanctions targeting Russia's FSB and GRU following a cyberattack on Poland's energy grid that nearly caused a major blackout last winter. The coordinated sanctions, the first of their kind, address ongoing Russian-led cyber espionage campaigns against EU member states. These actions reflect growing international concerns regarding Russia's capacity to destabilize Europe’s critical infrastructure.
China and India-Linked Hackers Infiltrate Balochistan Police Networks
Chinese and Indian cyberespionage groups targeted the Balochistan Police from February 2024 to April 2026. The attackers accessed sensitive systems, including biometric data and criminal records. This exposes significant regional security vulnerabilities tied to geopolitical tensions.
Critical Linux Kernel Vulnerabilities: DirtyClone, Bad Epoll, and GhostLock
Three critical Linux kernel vulnerabilities, DirtyClone (CVE-2026-43503), Bad Epoll (CVE-2026-46242), and GhostLock (CVE-2026-43499), have been disclosed, each allowing privilege escalation. DirtyClone targets cloned network packets, Bad Epoll exploits a race condition, while GhostLock leverages a 15-year-old use-after-free flaw. Each vulnerability has a patch available, emphasizing the need for prompt system updates to mitigate exploitation risks.
EU Parliament Revives Chat Control 1.0 Allowing CSAM Scans Until 2028
The European Parliament has approved a procedure to revive the expired 'Chat Control 1.0' regulation, permitting tech companies to scan digital communications for child sexual abuse material (CSAM) until 2028. Despite previous rejections, the law was reinstated through a legal maneuver requiring an absolute majority to block it. The regulation raises significant privacy concerns, but excludes encrypted messaging services.
Critical Gitea Docker Vulnerability CVE-2026-20896 Faces Active Exploitation
Gitea Docker images are subject to a critical authentication bypass vulnerability (CVE-2026-20896) now under active exploitation. The flaw allows attackers to impersonate any user, including administrators, via reverse proxy authentication with default configurations. It affects versions before 1.26.3 and about 6,200 instances globally.
Microsoft Utilizes AI to Enhance Windows Security Updates Frequency and Efficiency
Microsoft announced the integration of AI to improve the frequency and effectiveness of Windows security updates. Using advanced AI models, Microsoft seeks to accelerate the detection of vulnerabilities in its codebase. This change aims to improve protections against increasingly AI-driven cyber threats.
12 Million Affected in KDDI Data Breach, Exploiting Zero-Day Vulnerability
KDDI, a major Japanese telecom provider, confirmed a breach affecting 12.2 million email addresses and 7.6 million passwords via a compromised email system used by five ISPs. The breach exploited a zero-day vulnerability in third-party software. KDDI has implemented security measures and coordinated password resets to prevent future incidents.
DuckDuckGo Browser Now Blocks YouTube Video Ads Using Community Filters
DuckDuckGo has released a feature that blocks video ads, including those on YouTube, on its browser. This feature, based on community-maintained filter lists and additional rules for compatibility, is enabled by default on iOS, Windows, and Mac, with Android support to follow. Users can enjoy ad-free video playback while maintaining privacy, but may experience longer buffering times.
Chinese APT UAT-7810 Develops New Malware to Expand ORB Network
Chinese APT group UAT-7810 has advanced its Operational Relay Box (ORB) network with new malware, including LONGLEASH, DOGLEASH, and JARLEASH. These tools exploit known router vulnerabilities to enhance the group's cyber espionage capabilities, posing potential risks to critical infrastructure.
GitHub Agentic Workflows Vulnerable to Prompt Injection, Exposing Private Repos
Noma Labs identified a prompt injection vulnerability, named GitLost, in GitHub's Agentic Workflows, enabling data leaks from private repositories. Attackers can manipulate AI agents to disclose private content through crafted public issues. This highlights security concerns in using AI-driven workflows in GitHub's system.
Discord Bug Mistakenly Bans Over 8,000 Accounts for Harmless Images
Discord experienced a glitch in its AI moderation system that mistakenly banned over 8,000 users for posting harmless images since May 2026. The system inaccurately flagged grid-like images as harmful content, impacting accounts posting items like spreadsheets and game textures. Discord has resolved the issue and unbanned affected users.
Medtronic Hack Exposes Data of Nearly 4 Million People in ShinyHunters Breach
Medtronic suffered a data breach in April 2026, compromising the personal and medical information of over 3.8 million individuals, with some sources claiming 9 million records affected. The ShinyHunters group accessed Medtronic's corporate IT systems, despite the company's reassurance about device safety. Medtronic is offering credit monitoring and support services to those impacted, highlighting security vulnerabilities in healthcare technology.
FortiBleed Campaign Compromises Fortinet Devices, Linked to Ransomware Groups
The FortiBleed campaign has been connected to the INC and Lynx ransomware groups, compromising credentials from Fortinet devices. Researchers found the operation entailed scanning 11,250 FortiGate portals and compromised 354 targets, leading to 12 ransomware deployments. The breach highlights significant cybersecurity risks, affecting organizations globally.
Ubuntu LTS Kernels Remain Unpatched for Critical CVE-2026-98432 After Three Weeks
Ubuntu has not released patches for CVE-2026-98432, a critical vulnerability with a CVSS score of 9.8, affecting its 22.04, 24.04, and 26.04 LTS kernel releases. This leaves internet-facing and multi-tenant systems using these Ubuntu versions vulnerable to potential remote or local attacks.
Shai-Hulud Worm Evolves to Automate Package Registry Compromises and Credential Theft
A series of self-propagating worms, starting with Shai-Hulud in September 2025, have demonstrated the ability to automatically publish malicious package versions to registries like npm, steal credentials, and bypass security measures. The latest variant, ChainDrop, compromised over 400 packages in hours by exploiting legitimate, cryptographically signed release pipelines, highlighting a critical vulnerability in software supply chain security.
AI Technology Reduces Vulnerability Exploitation Time, Increasing Security Concerns
The rapid increase in newly reported vulnerabilities, and the use of AI in exploit development, has significantly reduced the time it takes for cyber threats to be operationalised. This has created a larger 'exposure window' between vulnerability discovery and remediation, placing pressure on security teams. With CVEs published at an unprecedented rate, prompt response times are becoming crucial to mitigate potential breaches.
Azure API Connections Vulnerabilities Lead to Five Cross-Tenant Compromises
Multiple vulnerabilities in Azure API Connections, a component of Azure Logic Apps, allowed for five distinct cross-tenant compromises. These flaws enabled attackers to gain full access to connected backend services, including Azure Key Vaults and SQL databases, across different tenants.
Backdoor Found in Claude Code for VS Code Extension on Cursor Marketplace
Phorion detected a persistent SSH backdoor in versions 2.1.312 and 2.1.313 of the official Claude Code for VS Code extension distributed through the Cursor Marketplace. The backdoor affects macOS, Linux, and Windows, allowing unauthorized access to developer environments. Cursor has removed the compromised versions from its marketplace.
AI-enabled hacking raises alarm after critical PHP vulnerability discovery
Cybersecurity leaders warn of a "vulnerability tsunami" due to AI's ability to find and exploit security flaws at an unprecedented scale, following the discovery of a critical vulnerability in PHP. This development signals a new era where patching efforts may not keep pace with AI-driven exploitation, potentially impacting millions of websites.
Critical PHP Vulnerabilities Lead to Global Website Shutdowns and Urgent Patching
Two critical cybersecurity flaws in the PHP programming language, which powers 70% of the internet, were discovered and a fix was issued. Governments and organizations, including the Finnish government and parts of Wikipedia, took websites offline as a precautionary measure while applying the update. The vulnerabilities were found by AI tools from OpenAI's "Patch the Planet" program, highlighting the severity and the rapid response required.
Linux Kernel Flaw Vghost (CVE-2026-74580) Allows Local Root and VM Escape
A critical flaw, Vghost (CVE-2026-74580), in the Linux vhost subsystem allows local users to achieve root privileges and, in specific virtualization setups, enables virtual machines to escape to the host. The vulnerability affects nearly a decade of kernel versions and was discovered by Tencent Zhuque Lab, which released a fix and detailed write-up.
Oracle Health Data Breach Affects Nearly 20 Million Individuals
A cyberattack on Oracle Health's legacy Cerner systems compromised the personal and medical information of nearly 20 million people. This figure, reported by Bloomberg citing the Texas attorney general, is significantly higher than previously disclosed counts, making it one of the largest healthcare data breaches on record.
Epic pauses product development to address security flaws in MyChart software
Epic, developer of the MyChart software, has paused most product development for six weeks to fix security vulnerabilities. These flaws, discovered by Anthropic's Mythos AI, could allow unauthorized access to patient data without detection, impacting over 320 million patient records.
FBI Investigates Data Breach Exposing Medical Records of Thousands of Agents
Cyber-criminals breached FBI systems and stole sensitive medical and personal data belonging to thousands of special agents. The stolen information, including blood and urine test results and doctors' notes, could expose agents to blackmail, scams, and targeted attacks, and aid impersonation of law enforcement officers.
Second Circuit Rules Border Agents Can Search Electronic Devices Without Suspicion
The U.S. Court of Appeals for the Second Circuit ruled that border agents can search travelers' electronic devices without requiring suspicion. This decision allows the government to use evidence from warrantless phone searches at the border, impacting privacy and First Amendment rights for individuals, including journalists.
New Android Exploitation Strategy Achieves Root on Samsung, Xiaomi, and Other OEM Devices
A new exploitation strategy allows an unprivileged Android app to gain root access on devices from Samsung, Xiaomi, Oppo, OnePlus, and Realme. The method targets Use-After-Free vulnerabilities in OEM-specific kernel drivers, often combined with OEM-specific sandbox escapes, to bypass security measures.
AT&T's Room 641A: NSA Interception Facility Revealed by Former Technician
Room 641A, an AT&T facility used by the U.S. National Security Agency for mass surveillance, was publicly revealed in 2006 by former AT&T technician Mark Klein. This facility, equipped with a Narus STA 6400, intercepts and analyzes internet communications, leading to a class-action lawsuit by the Electronic Frontier Foundation against AT&T for privacy violations.
DHS Border Patrol Uses Secretive 'Predictive Intelligence Targeting Teams' for Surveillance
404 Media revealed that Border Patrol operates "Predictive Intelligence Targeting Teams" (PITT) that analyze Americans' financial activity and other data to identify individuals for law enforcement stops without specific crime suspicion. This practice raises concerns about privacy, due process, and the potential for "parallel construction" to obscure the true reasons for stops.
220 Million Traveler Records Exposed in Vietnam-Linked APIS Leak
An Advance Passenger Information System (APIS) database, containing over 220 million passenger and crew records, was publicly accessible due to security misconfigurations. This exposure includes passport numbers and flight details for travelers to, from, or through Vietnam from 2017 to 2026, posing a significant privacy risk for a large number of individuals.
Security Researchers Discover Three Backdoor Implants in ZBT Routers Sold Globally
Security firm VulnCheck identified three distinct backdoor-like implants, named ENDLESSDOORS, DARKLANTERN, and SPEAKINGSTONE, embedded in the firmware of routers manufactured by Shenzhen Zhibotong Electronics (ZBT), which are sold worldwide under various brands. These implants allow for remote command execution and information disclosure, posing significant security risks to users of affected devices. The discovery highlights a widespread supply chain vulnerability in networking hardware.
FBI disrupts proxy network used for Chinese cyber espionage against US critical infrastructure
The FBI has disrupted a proxy network infrastructure that facilitated Chinese cyber espionage operations targeting U.S. critical infrastructure. This infrastructure, tracked by Black Lotus Labs, provided reconnaissance, proxy management, and operational routing capabilities for data theft from various U.S. organizations. The disruption impacts China-linked espionage actors who have increasingly used such networks since 2024.