Latest CyberSec News by @thecyberpicker

A look at how AI agents reshape security, governance, and risk, highlighting the enterprise attack surface and executive concerns.

Gitea flaw CVE-2026-27771 exposed private container images across 30,000 deployments, risking unauthorized access worldwide.

scramble - Remote Code Execution. CVE-2026-44262 . webapps exploit for PHP platform

Realtek rtl819x - Local Privilege. CVE-2026-36355 . local exploit for Linux platform

MeiG Smart FORGE_SLT711 - OS Command Injection. CVE-2026-36356 . hardware exploit for Linux platform

OpenCATS 0.9.7.4 - SQL Injection.. webapps exploit for Multiple platform

The FBI warned on Tuesday that the Silent Ransom Group (SRG) extortion gang is now targeting U.S.-based law firms in in-person data theft attacks.

EvidenceForge generates high-quality, realistic, and consistent datasets across multiple log formats, enabling teams to effectively train personnel and validate detection models without the need for complex manual simulations.

The FBI has warned that attackers are using a new phishing kit to gain long-term access to Microsoft Outlook, Teams, and OneDrive accounts.

Comparing AI Application Security Testing Platforms

Cox Media said it could spy on users through their devices and use the information for targeted advertising, except it wasn't true.

Phishers are stealing LinkedIn credentials while abusing Adobe Target to track victims and redirect them to real LinkedIn pages.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given U.S. federal agencies four days to secure their servers against a critical vulnerability in the LiteSpeed cPanel user-end plugin, which is actively being exploited in attacks.

The Dutch government blocked Kyndryl’s €100M bid for Solvinity, citing national security concerns over critical digital infrastructure.

The Dutch National Police arrested a 35-year-old man suspected of hacking the professional football club Ajax Amsterdam (AFC Ajax) earlier this year.

Microsoft has released the KB5089573 preview cumulative update for Windows 11 versions 25H2 and 24H2, which comes with 30 changes, including performance and reliability improvements.

A critical vulnerability (CVE-2026-45659) in Microsoft SharePoint can allow attackers to achieve remote code execution with little effort.

Microsoft exposes a cryptojacking campaign using SEO poisoning and ScreenConnect to target high-performance PCs, with malicious sites also surfaced through AI chatbots.

For the past two decades, enterprise security teams have gotten good at one thing: keeping sensitive data where it belongs. Related: Leaked secrets no. 1 exposure Production data stays in production. Test environments get masked or synthetic data. Access is controlled. Ownership is defined. The system, while imperfect, largely works. Then AI arrived — and

U.S. telecommunications giant Charter Communications has confirmed it suffered a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom is paid.

The White House issues memo M-26-14, updating federal cybersecurity logging rules to cut red tape, though critics warn of a temporary guidance gap.

Apple has open-sourced its quantum-resistant encryption code and verification tools, revealing how mathematical proofs caught critical, hidden security bugs.

Hackers exploited a critical zero-day vulnerability in a server running the KnowledgeDeliver learning management system (LMS) to deploy the Godzilla web shell.

A 5-year study on Ransomware Economy found 30,515 exposed DBs hit by ransom attacks, causing massive damage despite victims never paying.

MuddyWater targeted 9 organizations in 9 countries during Q1 2026, using DLL side-loading to steal data and evade detection.

Anthropic’s Mythos model uncovers over 10,000 critical software flaws in its first month, shifting the cyber challenge from finding bugs to patching them.

Device code phishing enabled hackers to bypass multifactor authentication without credentials.