Latest CyberSec News by @thecyberpicker

Over 900 automatic tank gauge (ATG) systems across the United States, used to monitor fuel and chemical storage tanks across various critical infrastructure sectors, have been found exposed online and are vulnerable to ongoing attacks.

La Linux Foundation a annoncé son intention de lancer la Tokenomics Foundation, une nouvelle fondation dédiée à l'établissement de normes ouvertes pour l'économie de l'infrastructure IA. L'objectif affiché par le communiqué de la Linux Foundation du 3 juin 2026 est clair : définir des standards, des benchmarks et des

Phishing, shadow AI, malicious extensions, and credential theft increasingly happen inside the browser. Keep Aware explains what the 2026 Verizon DBIR reveals about browser-layer security gaps and modern attacks.

Cisco warns of CVE-2026-20245 in SD-WAN Manager, a flaw that can lead to root access via file upload command injection.

UNC3753 leverages vishing and social engineering to achieve remote access into corporate environments.

This week in cybersecurity from the editors at Cybercrime Magazine

Researchers have prototyped an AI-powered internet worm. The coolest thing about the prototype is that it carries its own LLM with it, and runs it on computers that have been broken into. This is the closest to John Brunner’s original 1975 conception of a computer worm that I’ve seen.

A newly identified China-linked threat cluster, OP-512, is targeting Microsoft IIS servers with a custom three-web-shell framework for espionage.

A secure-by-construction framework for agentic AI using ORCHIDEAS and MAESTRO, detailing nine pillars and threat modeling.

Only 10% of SOCs report excellent AI value in 2026 as fragmented tools and weak governance limit real security outcomes.

WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection. CVE-2026-3180 . webapps exploit for Multiple platform

Researchers uncovered a 230-node cloud-based email relay network after the actor PCPJack accidentally exposed tools, logs, and C2 files online

Public concern about AI is rising. We look at what's driving it, and why cybersecurity occupies a unique place in this debate.

Anthropic a publié un article de blog détaillant, chiffres internes à l'appui, les progrès de Claude dans le développement de ses propres modèles, et les implications que l'entreprise en tire pour l'avenir de l'IA. C'est un article de blog particulièrement dense qu'Anthropic vient de publier, signé de son

Threat actors are actively exploiting CVE-2026-3300, a critical RCE vulnerability (CVSS 9.8) in Everest Forms Pro WordPress plugin (4,000+ installs).

SafeBreach tricked Gemini into obeying attackers via WhatsApp notifications, using hidden foreign-language text to bypass Google's defenses.

Researchers and the FBI warn that fake FIFA domains, banking malware in streaming apps, and stolen logins are already hitting World Cup 2026 fans.

PCPJack built a 230-node SMTP relay from hijacked cloud servers, syncing verified proxies every five minutes for scalable abuse.

On Thursday, Cisco warned of a high-severity, unpatched zero-day in the Cisco Catalyst SD-WAN Manager (tracked as CVE-2026-20245) actively exploited in attacks enabling root privilege escalation.

Microsoft exposes a cryptojacking campaign using SEO poisoning and ScreenConnect to target high-performance PCs, with malicious sites also surfaced through AI chatbots.

The Windows version of the Hola Browser has been compromised in a supply chain attack that delivered an undeclared executable identified by researchers as a cryptocurrency miner.

Brave has announced the public release of Brave Origin, a paid minimalist version of its browser that strips out cryptocurrency, AI, rewards, and other monetization-focused features.

House Democrats criticized a draft Republican Department of Homeland Security spending bill Thursday that they said would cut funding for the Cybersecurity and Infrastructure Security Agency by $250 million.

A new Magecart campaign is using Stripe's API infrastructure to host the credit card-stealing payload and the data exfiltrated from checkout pages.

Joe’s on-the-ground report from Cisco Live U.S. is here, complete with therapy dog pictures and tips on handling conference overstimulation.

A surge in real-world attacks against agentic AI systems is reshaping how we think about risk. Based on 12 months of red teaming, this update introduces seven new failure modes, from supply chain compromise to goal hijacking, and the practical mitigations teams need now.

U.S. CISA adds Mirasvit Full Page Cache Warmer vulnerability to its Known Exploited Vulnerabilities catalog.

New research details how the increasing integration of AI agents into businesses is making it easier than ever for insiders - malicious or otherwise - to put sensitive data at risk.

A data breach at the dental benefits administrator DentaQuest has reportedly exposed the sensitive data of 2.6 million accounts.