May 2026
87 posts. Browse all months
- Iran’s president offers resignation, citing total takeover by IRGC commanders | Iran International
Iranian President Masoud Pezeshkian has submitted his resignation to the Office of the Supreme Leader, citing a total takeover of government affairs by IRGC …
- NEET-UG paper leak: How NTA plans to prevent another breach — key reforms told to SC | India News - The Times of India
The National Testing Agency has introduced rigorous security reforms and oversight measures, including mandatory CCTV monitoring and forensic analysis, to …
- Used Pick n Pay’s old delivery service? Your address and card info may have been leaked | News24
A data breach involving the old Pick n Pay Bottles delivery service has potentially exposed customer personal information, including addresses and partial card …
- Charter Communications data breach affects 4.9 million accounts
The ShinyHunters extortion gang breached Charter Communications in April, resulting in the theft of personal information from 4.9 million accounts. While the …
- AI Agents Are the New Insiders - GovInfoSecurity
AI agents are emerging as a significant insider threat because their autonomy, scale, and speed allow them to bypass traditional human-centric security …
- Carnival Cruise confirms data breach affecting nearly 6 million people
Carnival Cruise confirmed a data breach caused by a social engineering attack that exposed the personal information of nearly 6 million individuals. The …
- UK Visa Portal exposed thousands of applicants’ passports and selfies — then called the lawyers on us | TechCrunch
The UK Visa Portal exposed the passports, selfies, and location data of thousands of applicants due to a misconfigured Amazon-hosted storage server. The …
- Vaultjacking: One Captured PIN, the Entire Google Password Manager Vault | PhishU Blog
Vaultjacking is an attack technique that exploits Google Password Manager by using a captured 6-digit PIN to decrypt and steal a user’s entire synced vault of …
- Inside CrowdStrike’s Takedown of a Developer-Targeting Botnet
CrowdStrike successfully dismantled the Glassworm botnet, a sophisticated threat that targeted software developers through malicious extensions and compromised …
- Interac’s New Identity Tools Can Tell a Real Person From an AI Fake | iPhone in Canada
Interac is partnering with Incode Technologies to integrate advanced passive liveness detection and AI-fraud prevention tools into its Interac Verified suite. …
- Hacker claims to leak massive WhatsApp database before vanishing from forums | Cybernews
A newly circulating report claims a threat actor released a massive dataset allegedly tied to WhatsApp users. At this stage, there is not enough evidence to …
- 7-Eleven data breach exposes personal information of 185,000 people
A data breach at 7-Eleven orchestrated by the ShinyHunters extortion gang has exposed the personal information of 185,300 individuals. The attackers gained …
- Cyber Brief: APT Backdoors, CDN Evasion and Software Supply Chain Risk
Chinese APTs share Linux backdoor in Central Asia telco attacks — China-aligned threat clusters are using the Showboat/kworker Linux post-exploitation framework …
- Verus Hacker Returns $8.5M After Bridge Exploit Deal - DataBreaches.Net
A hacker returned $8.5 million in Ethereum to the Verus team following a cross-chain bridge exploit and subsequent negotiations. The attacker retained $2.8 …
- Radiology Associates of Richmond discloses second data breach; 266k people affected - DataBreaches.Net
Radiology Associates of Richmond has disclosed a second data breach affecting 266,183 people, following a larger incident in 2024 that impacted 1.4 million …
- Station Casinos starts informing customers after data breach | Cybernews
The Las Vegas casino giant Station Casinos has officially confirmed a cybersecurity breach that occurred on March 5, 2026, following an unauthorized system …
- Indian Student Data Weaponized for Phishing, Social Engineering, and Financial Fraud
Indian education sector data is being weaponized by threat actors to conduct highly targeted phishing, social engineering, and financial fraud against …
- Google accidentally exposed details of unfixed Chromium flaw
Google inadvertently exposed details of a Chromium vulnerability that allows for remote code execution by keeping malicious JavaScript running in the …
- CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox - VoidSec
CVE-2026-40369 is a critical 12-byte kernel write vulnerability in nt!ExpGetProcessInformation that enables attackers to escape browser sandboxes and escalate …
- Bugcrowd launches reinforcement learning environments to train AI on real software vulnerabilities - SiliconANGLE
Bugcrowd has launched Reinforcement Learning Environments to enable AI models to train on real software vulnerabilities rather than synthetic data. The …
- Deleted Google API Keys Remain Active up to 23 Minutes, Study Finds
A study by Aikido Security reveals that deleted Google API keys remain active for up to 23 minutes due to eventual consistency in the company’s authentication …
- Anthropic Mythos helped Calif build a macOS exploit in five days - 9to5Mac
The security team at Calif successfully developed a macOS kernel memory corruption exploit for M5 silicon in just five days by leveraging Anthropic Mythos to …
- 3,800 GitHub Repos Breached via Poisoned VS Code Extension by TeamPCP
The threat actor TeamPCP successfully breached approximately 3,800 internal GitHub repositories by utilizing a poisoned VS Code extension. The group is …
- Microsoft warns of new Defender zero-days exploited in attacks
Microsoft has released security patches to address two Microsoft Defender zero-day vulnerabilities that allow for privilege escalation and denial-of-service …
- Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit
Microsoft has released a mitigation for the YellowKey BitLocker bypass vulnerability, tracked as CVE-2026-45585, which allows attackers with physical access to …
- Exclusive: Qilin ransomware group claims responsibility for Generation Life hack - Cyber Daily
The Qilin ransomware group has claimed responsibility for a cyber attack on the Australian financial firm Generation Life, though no sensitive data has been …
- Shai-Hulud worm copycats emerge after source code leak
The Shai-Hulud worm has sparked a wave of supply chain attacks on NPM developers following the public leak of its source code. Threat actors are now utilizing …
- 7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand - SecurityWeek
7-Eleven has confirmed a data breach involving franchisee documents after the ShinyHunters hacker group claimed to have stolen personal information. The …
- Operation Ramz Dismantles 53 Servers Used in Scam and Malware Campaigns
Operation Ramz, an international initiative led by INTERPOL, resulted in 201 arrests and the dismantling of 53 malicious servers used for phishing, malware, …
- macOS Malware Abuses Fake Google Update for Persistence
The Reaper variant of the SHub macOS infostealer achieves persistence by masquerading as a legitimate Google software update and utilizing a LaunchAgent to …
- Fast16: Pre-Stuxnet Sabotage Tool Was Built to Subvert Nuclear Weapons Simulations | SECURITY.COM
Fast16 is a sophisticated sabotage framework designed to covertly tamper with LS-DYNA and AUTODYN simulations of nuclear detonations. By manipulating material …
- Microsoft confirms patching issues in restricted Windows networks
Microsoft confirms that restricted Windows networks are experiencing Windows Update failures due to recent download timeout changes. Administrators can resolve …
- Grafana GitHub Token Breach Led to Codebase Download and Extortion Attempt
Grafana recently suffered a GitHub token breach that allowed attackers to download its codebase and attempt extortion. The company refused to pay the ransom, …
- Iran hackers: Hackers have breached tank readers at gas stations; officials suspect Iran is responsible | CNN Politics
US officials suspect Iranian hackers are exploiting unprotected automatic tank gauge systems at gas stations to manipulate display readings. These cyber …
- Huge data breach as major travel site is hacked - here’s what you need to do now
The travel platform Booking.com has confirmed a data breach that exposed customer information, including names, emails, and booking details, to an unauthorized …
- ANC hit by data breach: 2 million private member records exposed – MyBroadband
The ANC hit by data breach article reports that the cybercriminal group Black X exposed 2 million records containing sensitive private member information …
- Identity security firm SailPoint discloses GitHub repository breach
Identity security firm SailPoint disclosed a GitHub repository breach that occurred on April 20 due to a third-party application vulnerability. The company …
- TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack
The cybercrime group TeamPCP compromised the Checkmarx Jenkins AST plugin by exploiting credentials obtained from a previous supply chain attack. Checkmarx has …
- China-Linked Twill Typhoon Uses Fake Apple and Yahoo Sites for Espionage
The China-linked group Twill Typhoon conducts espionage by utilizing fake Apple and Yahoo websites and the FDMTP malware framework to maintain long-term access …
- nitrogen group: Who is Nitrogen group, what does Foxconn do and what data was hacked? Ransomware hackers claim breach at Foxconn - The Economic Times
The Nitrogen ransomware group has claimed responsibility for a cyberattack on Foxconn, asserting they exfiltrated over eight terabytes of data including …
- Ransomware hackers claim breach at Foxconn, a major electronics manufacturer for Apple, Google, and Nvidia | TechCrunch
The ransomware gang Nitrogen has claimed responsibility for a cyberattack on Foxconn, asserting they stole over 11 million files from the electronics giant. …
- Your Data Was Leaked. Here’s What Hackers Hope You Don’t Do Next | PCMag
Your Data Was Leaked. Here’s What Hackers Hope You Don’t Do Next is a guide on mitigating data breaches and identity theft by using unique, strong passwords …
- Apple’s iOS 26.5 Update Patches More Than 50 Security Flaws - MacRumors
Apple’s iOS 26.5 and iPadOS 26.5 updates resolve over 50 security vulnerabilities, including issues related to WebKit, kernel performance, and system …
- Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas Leak
Instructure, the parent company of Canvas, has reached an agreement with the ShinyHunters extortion group to prevent the leak of 3.65TB of stolen data, which …
- Deadline set by cybercriminal group looms as some institutions regain Canvas access - ABC News
Some Australian universities and education departments are regaining access to the Canvas learning platform after a global outage caused by the ShinyHunters …
- Say Hello to the Internet of AI – On my Om
The “Internet of AI” is an emerging network architecture optimized for artificial intelligence, characterized by a shift in traffic patterns within data …
- WWE Star Will Not be Suspended For Lewd Photo Leaks
Despite a lewd photo leak of explicit images and videos shared online without her consent, WWE star Jordynne Grace will not be suspended. The private images …
- Hackers Leveraged Hugging Face and ClawHub With 575+ Malicious Skills to Deploy Malware
Hackers are exploiting Hugging Face and ClawHub, popular AI platforms, to distribute malware like trojans, cryptominers, and infostealers by disguising them as …
- Zara Data Breach: 197,000 Customers Exposed in Third-Party Security Incident
A third-party security incident involving a former technology provider exposed the data of nearly 197,000 Zara customers, including emails and purchase …
- New ZiChatBot Malware Uses Zulip REST APIs as Command and Control Server
A new malware named ZiChatBot is exploiting Zulip’s REST APIs for its command and control server, making it harder to detect. This malware was distributed …
- Anthropic’s Claude used in attempted compromise of Mexican water utility | Cybersecurity Dive
An unknown threat group abused Anthropic’s Claude AI to aid in a sophisticated takeover attempt against a Mexican water utility, highlighting how AI tools can …
- 60% of MD5 password hashes are crackable in under an hour
A recent study found that 60% of MD5 password hashes can be cracked in under an hour using a single GPU, with 48% cracked in under a minute, highlighting the …
- ‘The Biggest Student Data Privacy Disaster in History’: Canvas Hack Shows the Danger of Centralized EdTech
A Canvas hack by ransomware group ShinyHunters has resulted in the theft of billions of messages and the data of over 275 million individuals, including …
- Quacc++ | Open Source Vulnerability Research Tool Powered by Semgrep & Grep.app — Somerset Recon
Quacc++ is an automated bug hunting tool that combines grep.app for searching public GitHub repositories with Semgrep for static code analysis to discover …
- NVIDIA confirms GeForce NOW data breach affecting Armenian users
NVIDIA has confirmed a data breach affecting GeForce NOW users, specifically impacting those in Armenia. The breach was caused by a compromise of …
- U of T, OCAD among Ontario universities impacted by Canvas cyber breach | CBC News
Thousands of schools, including University of Toronto and OCAD University, were impacted by a cybersecurity incident involving the Canvas learning software. …
- Coinbase Cuts 700 Jobs Before Q1 Earnings in AI Pivot
Coinbase is cutting 700 employees, or 14% of its workforce, as CEO Brian Armstrong pivots the company towards AI and leaner management structures, citing cost …
- Enterprise AI deployment is rewriting the security rulebook - SiliconANGLE
Enterprise AI deployment significantly expands the cybersecurity attack surface, making traditional defenses inadequate for new targets like data pipelines and …
- Australia warns of ClickFix attacks pushing Vidar Stealer malware
The Australian Cyber Security Center (ACSC) has issued a warning about ClickFix attacks that are distributing the Vidar Stealer malware. These attacks trick …
- U.S. CISA adds a flaw in Ivanti Endpoint Manager Mobile (EPMM) to its Known Exploited Vulnerabilities catalog
The U.S. CISA has added a zero-day vulnerability (CVE-2026-6973) in Ivanti Endpoint Manager Mobile (EPMM) to its Known Exploited Vulnerabilities catalog, …
- New PCPJack worm steals credentials, cleans TeamPCP infections
A new malware framework named PCPJack is actively stealing credentials from exposed cloud infrastructure and is designed to remove TeamPCP infections. It …
- 80% of CEOs worry their job is at risk if AI fails this year - Fast Company
A new survey reveals that 80% of CEOs believe their job is at risk if AI initiatives fail this year, with 72% of U.S. CEOs feeling pressure from their boards …
- Backdoored PyTorch Lightning package drops credential stealer
A malicious version of the PyTorch Lightning package, version 2.6.3, was found to contain a credential stealer that targets browsers, environment files, and …
- Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools
A phishing campaign named VENOMOUS#HELPER has impacted over 80 organizations by using legitimate Remote Monitoring and Management (RMM) tools like SimpleHelp …
- Cisco Moves to Acquire Astrix Security to Tackle Non-Human Identity Risks - SecurityWeek
Cisco is acquiring Astrix Security to address the growing risks associated with non-human identities (NHIs) like API keys and service accounts, which are …
- Canvas Instructure Data Breach 2026: Confirmed
Instructure has confirmed a data breach affecting its Canvas platform, with the hacker group ShinyHunters claiming responsibility for exposing personal data …
- DigiCert hacked with a malicious screensaver file
A malicious screensaver file was used to hack DigiCert, resulting in the theft of 27 code signing certificates that were later used to sign malware, including …
- Edtech Firm Instructure Discloses Data Breach Amid Hacker Leak Threats - SecurityWeek
Education technology company Instructure experienced a data breach due to a cyberattack, impacting services that rely on API keys. The company confirmed that …
- Edu tech firm Instructure discloses cyber incident, probes impact
The edu tech firm Instructure, known for its Canvas learning platform, has disclosed a cybersecurity incident involving a criminal threat actor and is actively …
- Attackers Deploy AiTM Phishing Pages to Access SharePoint, HubSpot, and Google Workspace
Attackers are using AiTM phishing pages to steal credentials and session tokens for SharePoint, HubSpot, and Google Workspace. These attacks, conducted by …
- New Bluekit Phishing Kit Features AI Assistant - SecurityWeek
A new phishing kit called Bluekit has been discovered, offering miscreants a wide array of features including an AI assistant, automated domain registration, …
- ConsentFix v3 attacks target Azure with automated OAuth abuse
The ConsentFix v3 attack targets Microsoft Azure by automating OAuth abuse, tricking victims into granting access via a fake Microsoft login flow. This …
- Trellix Source Code Breach - Hackers Gain Unauthorized Access to Repository
Cybersecurity firm Trellix has reported a security incident where hackers gained unauthorized access to a portion of its source code repository. While …
- Google AppSheet Exploited in 30,000-User Facebook Phishing Operation
A massive phishing operation has been discovered that leverages Google AppSheet and Google Drive to bypass security measures and steal Facebook Business …
- Why ‘Emerging Threats’ Are Harder to Prioritize in the AI Era
The increasing speed, scale, and automation of cyberattacks due to artificial intelligence make it challenging for organizations to prioritize emerging …
- CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-31431, a Linux root access bug also known as Copy Fail, to its Known …
- US Military Reaches Deals With 7 Tech Companies to Use Their AI on Classified Systems - SecurityWeek
The Pentagon has partnered with seven tech companies, including Google, Microsoft, and Nvidia, to integrate their artificial intelligence capabilities into …
- Ask.com shuts down after nearly 30 years, marking the end of Ask Jeeves
After nearly 30 years, Ask.com, originally launched as Ask Jeeves in 1997, has shut down operations on May 1, 2026, as its parent company, IAC, pivots away …
- Alberta voter list breach flagged by journalist weeks ago
A Calgary journalist alerted Elections Alberta to a voter list breach weeks ago, but alleges the watchdog failed to act. The article also touches on various …
- Apple warns Mac mini and Mac Studio shortages could last for months — local AI boom and memory crunch drive demand beyond Apple’s manufacturing capacity | Tom’s Hardware
Apple CEO Tim Cook has warned that Mac mini and Mac Studio shortages may persist for months due to AI workloads driving demand beyond manufacturing capacity. …
- EtherRAT Uses SEO Poisoning and Fake GitHub Pages to Target Enterprise Admins
A new cyber campaign named EtherRAT is targeting enterprise administrators by using SEO poisoning and fake GitHub pages to impersonate legitimate …
- Two US Security Experts Sentenced to Prison for Helping Ransomware Gang - SecurityWeek
Two US cybersecurity experts, Ryan Goldberg and Kevin Martin, have been sentenced to 4 years in prison for their involvement in BlackCat and Alphv ransomware …
- China-Linked Hackers Target Asian Governments, NATO State, Journalists, and Activists
A new China-aligned espionage campaign, tracked as SHADOW-EARTH-053, has targeted government and defense sectors in Asia and one NATO state, Poland, by …
- Private Chats, Photos of Celebs Exposed in Suspected Stalkerware Leak
A suspected stalkerware leak exposed private chats and photos of a prominent European celebrity and several influencers, with 86,859 images found in an …
- Carding service Jerry’s Store leak exposes 345,000 stolen payment cards
The Jerrys Store carding service, used to validate stolen payment cards, inadvertently exposed 345,000 records after its server was left open due to …