Breaking cybersecurity news, vulnerability disclosures, and industry updates.
APT group targets government entities across Southeast Asia with enhanced malware featuring clipboard monitoring, browser credential theft, and kernel-mode rootkit capabilities.
CVE-2026-1483 rated CVSS 9.8 enables attackers with pod creation privileges to escape containers and seize control of entire clusters. CISA added to KEV catalog; exploitation observed within 48 hours of disclosure.
A WhatsApp vulnerability allows attackers to compromise devices by sending malicious PDF files to group chats without user interaction. Paragon Solutions' spyware exploited the flaw against 90+ targets including journalists and civil society members.
New additions include CVE-2026-21509 actively exploited by APT28, a Linux kernel flaw from 2018, and SmarterMail vulnerabilities. Federal agencies face February 16 remediation deadline.
The National Cybersecurity Alliance kicks off Data Privacy Week from January 26-30, focusing on empowering individuals and organizations to manage personal information amid growing AI and privacy law concerns.
CVE-2026-21509 bypasses OLE security mitigations in Microsoft Office. Russia-linked APT28 is exploiting it against targets in Ukraine and the EU. Emergency patches available.
ShinyHunters breached Crunchbase via Okta voice phishing, exfiltrating over 2 million records. The attack was part of a broader campaign targeting approximately 100 organizations using real-time SSO phishing kits.
The WorldLeaks extortion group published 1.4TB of Nike intellectual property including product designs, tech packs, and manufacturing documents spanning 2020-2026 after the company didn't pay.
Cybernews researchers discovered a massive Elasticsearch cluster containing national IDs, passwords, and personal data of hundreds of millions of Chinese citizens, hosted on bulletproof infrastructure and accessible for three weeks.
New NIST and CISA guidance establishes timelines for transitioning to quantum-resistant algorithms, with federal agencies required to inventory cryptographic assets by 2027 and complete migration by 2035.
The MLS standard (RFC 9420) drives enterprise E2EE adoption as Cisco, Google, and Apple integrate the protocol. EU DMA mandates force interoperability while organizations balance encryption with compliance requirements.
Security researchers detail LockBit 5.0's capabilities including ChaCha20-Poly1305 encryption, X25519 key exchange, modular two-stage deployment, and advanced anti-analysis techniques.