Latest CyberSec News by @thecyberpicker

Posts about macOS malware, exploits, and tools

Russia's FSB claims foreign intelligence planted malware on senior officials' phones to intercept calls and activate cameras. No country named

Posts about macOS malware, exploits, and tools

A two-week penetration test can leave roughly 345 days of real-world exposure unvalidated. Sprocket Security explores why continuous testing is becoming critical as attack surfaces constantly change.

VS Code flaw exposes GitHub OAuth tokens via one-click attack on GitHub.dev, enabling private repo access and token theft.

This week in cybersecurity from the editors at Cybercrime Magazine

Attackers use AI to target Bedrock and SageMaker; learn why posture alone fails and how runtime detection and AI-powered response close the gap.

Scam Number Check lets you quickly check whether a number has been linked to scams before you call back, share information, or send money.

Your critical systems aren't as isolated as your diagram says. Metasploit creator HD Moore on the hidden bridges that break segmentation. Free webinar

Acer is working to address two maximum-severity zero-day vulnerabilities affecting its Wave 7 mesh routers.

Researchers are using machine learning algorithms to decrypt historical pencil-and-paper ciphers.

U.S. CISA adds Android and Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities catalog......

European and international law enforcement agencies have dismantled nine organized crime groups and arrested 29 suspects in a major crackdown on illegal streaming operations.

Unpatched Windows search: URI flaw leaks NTLMv2 hashes via SMB requests; disclosed April 2026, enabling relay attacks.

HTTP/2 Bomb exploits HPACK and flow control; a single client can hold 32GB memory in 20 seconds, causing server outages.

Google fixed 124 Android flaws, including CVE-2025-48595, an actively exploited privilege escalation bug linked to targeted attacks.

Cybercriminals prefer infostealers to traditional phishing techniques because they reduce friction, scale well, and are widely available.

Google is introducing a new Android security feature that will detect and flag phone calls in which scammers use artificial intelligence to impersonate a user's personal contacts.

Kaspersky researchers analyze new Argamal RAT distributed via infected hentai games and allowing the attacker to control the target machine.

Après plusieurs semaines de tractations entre Anthropic et les institutions européennes, l'agence de cybersécurité de l'UE devrait obtenir un accès à Claude Mythos, le modèle d'IA le plus puissant, et le plus restreint, jamais développé par la startup américaine. Une première pour un organisme européen. Ça y est.

A security researcher has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a link.

Weedhack malware targets Minecraft players via YouTube and SEO poisoning since Jan 2026, enabling credential theft and remote access.

A critical unauthenticated overflow in HP Poly VoIP phones can lead to root RCE, with patches available for affected models.

A large-scale npm supply chain attack compromised over 90 versions of @redhat-cloud-services packages, silently infecting CI/CD environments and developer systems. The malicious code steals credentials from GitHub, cloud platforms, and local machines, then spreads like a worm by republishing trusted packages. Discover how the attack works, what data is at risk, and the steps you can take to protect your organization.

A large-scale malware campaign dubbed WeedHack is targeting Minecraft players and has infected more than 116,000 systems since January.

Microsoft announced today at its Build 2026 developer conference the release of Coreutils for Windows, bringing many commonly used Linux command-line utilities to Windows as native applications.

OpenAI says it's rolling out a new update that improves the existing GPT-5.5 Instant model, and this move comes ahead of the scheduled retirement of multiple legacy models, including o3.

A large-scale malware campaign dubbed WeedHack is targeting Minecraft players and has infected more than 116,000 systems since January.

Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators.

MIAMI BEACH, Fla., June 2, 2026, CyberNewswire—Halo Security today announced that its attack surface management solution has been named a 2026 MSP Today Product of the Year Award winner by TMC, a leading global media company recognized for building communities in technology and business through live events and digital marketing platforms. This marks the second