Latest CyberSec News by @thecyberpicker

In the lead-up to the 2026 FIFA World Cup, Kaspersky GReAT experts conducted a wardriving assessment in Mexico City, Monterrey, and Guadalajara to evaluate Wi-Fi hotspot security configurations and potential exposure risks.

Posts about macOS malware, exploits, and tools

CISA has ordered government agencies to secure their systems against a high-severity Oracle WebLogic Server vulnerability that was patched two years ago and is now actively exploited in attacks.

AI-driven vulnerability discovery accelerates OT threats; CSA's IT playbook needs OT translation, outlining five OT-specific priorities for industrial security.

AI shrinks exploitation windows to hours while median critical patching time rose to 43 days, increasing exposure risk.

67% of organizations report more AI-powered attacks in 2025, driving demand for hardening and MDR to improve resilience.

Google has released the June 2026 Android security patches to address 124 vulnerabilities, including one zero-day flaw exploited in targeted attacks.

An anonymous security researcher called “Nightmare Eclipse” has been publishing a series of significant security exploits against Microsoft Windows—including one that breaks BitLocker. Microsoft has threatened legal action against the researcher. Lots of recriminations are being traded back and forth.

As part of their 20th Anniversary celebration, Dark Reading asked five cybersecurity industry leaders who wrote blogs or columns for them over the years to select their favorite piece and share their reflections on the topic today. This is my section. Renowned technologist and author Bruce Schneier contributed a column on June 20, 2010, warning about cryptography’s inability to secure modern networks, a point he says he has been trying to argue since 2000. “For a while now, I’ve pointed out that cryptography is singularly ill-suited to solve the major network security problems of today: denial-of-service attacks, website defacement, theft of credit card numbers, identity theft, viruses and worms, DNS attacks, network penetration, and so on...

AI accelerated tool development and testing, but humans drove the workflow

SideCopy targeted Afghanistan's Finance Ministry with Xeno RAT via Pashto phishing lures, enabling espionage and system compromise.

What began with stolen passwords ended with the exposure of nearly seven million users' DNA-related data, according to California's lawsuit.

"Your device is infected!" Fake account warnings and virus alerts are turning some in-game ads into malware traps.

Posts about macOS malware, exploits, and tools

ENISA NIS360 2026 shows cybersecurity improving across EU critical sectors, but health, water, rail, and space remain in the risk zone.

Un an après l'opération Spiderweb, Volodymyr Zelensky a décerné des décorations d'État aux artisans de l'attaque et publié des images inédites. L’occasion de revenir sur une opération marquante ayant frappé l’aviation stratégique russe en profondeur, ainsi que sur la doctrine qui en a découlé. « Nous ne sommes pas

Malware on approximately 2,000 WordPress sites hid C2 instructions in Steam profile comments using invisible Unicode.

Brute-force attacks bypassed 2FA on some Dashlane accounts on May 31, 2026, enabling fewer than 20 encrypted vault downloads.

The escalated threat posed by the defect showcases how quickly a seemingly mild vulnerability can turn into an urgent warning.

A threat actor tracked as DriveSurge has been operating large-scale malware distribution campaigns using ClickFix and FakeUpdates techniques on compromised sites.

More than 30 npm packages under Red Hat's '@redhat-cloud-services' namespace were compromised in a supply-chain attack that distributed a new variant of the Shai-Hulud credential-stealing malware, dubbed "Miasma."

The Spanish National Police has arrested an individual for leaking sensitive information related to members of various key state organizations, including the National Cybersecurity Institute (INCIBE).

Former Colorado election clerk Tina Peters remains unrepentant in her first interview since Gov. Polis commuted her sentence, sparking intense political fallout.

Drupal Core 10.5.5 - Error-Based SQL Injection. CVE-2026-9082 . webapps exploit for PHP platform

WordPress OrderConvo 14 - Path Traversal. CVE-2025-10162 . webapps exploit for Multiple platform

The USPS is advancing new mail-in ballot restrictions and tracking rules under a Trump executive order after a federal judge declined an immediate block.

Multiple Dashlane users have been locked out of their accounts following brute-force attacks that attempted logins from distant locations and unknown devices.

Compromised npm packages targeted Red Hat cloud services, enabling credential theft and expanding supply chain risks.

16,699 ransomware leak posts over 2 years show 84% drop Monday–Friday, peak at European afternoon hours. October spikes yearly.