Latest CyberSec News by @thecyberpicker

Grav CMS 2.0.0-beta.2 - Remote Code Execution. CVE-2026-42607 . webapps exploit for PHP platform

Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service. CVE-2026-23918 . webapps exploit for Multiple platform

D-Link DSL2600U - 'rom-0' Admin Password Disclosure.. hardware exploit for Multiple platform

Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover. CVE-2026-7567 . webapps exploit for Multiple platform

cPanel - CRLF Injection. CVE-2026-41940 . webapps exploit for PHP platform

Linux Kernel 6.8 - Local Privilege Escalation.. local exploit for Linux platform

Not identifying people based on their use of Wi-Fi routers, but identifying people using Wi-Fi signals. This is accomplished through what is known as WiFi sensing, or the use of WiFi signals to infer information about a physical environment. When radio signals like WiFi travel through a space, they interact with the objects and people around them. Those signals can be reflected, scattered, or absorbed. By analyzing how the signal is expected to behave compared with how it is actually received, researchers can infer details about the surrounding environment...

CERT-In ordered 12-hour patching for critical internet-facing flaws as AI-driven attacks accelerate cyber exploitation.

Learn how to fight back against AI-powered cyber attacks. Register for our free 45-minute live webinar and protect your business today.

Analyzes why AI regulation hinges on identity and access controls to close the accountability gap across global frameworks.

AI governance requires visibility into how AI tools interact with enterprise data. Varonis explains how its Atlas platform uses Claude Compliance API data to help monitor usage, investigate risk, and support compliance.

We found fake installers and plugins for ChatGPT, Claude, AutoTune, and other popular software that can give attackers full control over your device.

Microsoft is testing a new Defender for Endpoint capability that will automatically isolate compromised endpoints to thwart attackers' attempts to move laterally across the network.

Attackers have poisoned four Laravel-Lang Composer packages by rewriting hundreds of Git tags, putting many Laravel apps at risk.

This article shows how shadow AI agents bypass controls, gain enterprise access, and why governance for visibility and runtime enforcement matters.

This week in cybersecurity from the editors at Cybercrime Magazine

Microsoft released fixes for SharePoint remote code execution vulnerability CVE-2026-45659 with a CVSS score of 8.8.

Learn how to fight back against AI-powered cyber attacks. Register for our free 45-minute live webinar and protect your business today.

Hackers are abusing a Ghost CMS website flaw to serve fake Cloudflare verification pages that pressure users into infecting their own PCs.

MFA prompt bombing enabled Cisco attackers to steal 2.8GB in 2022, exposing push MFA weaknesses and account takeover risks.

Court documents reveal how tech support scammers relied on infrastructure supplied by a US business.

CERT-In ordered 12-hour patching for critical internet-facing flaws as AI-driven attacks accelerate cyber exploitation.

Sansec found an unauthenticated PHP object injection flaw in Mirasvit Cache Warmer, a popular Magento full-page cache extension. A single crafted cookie on a...

Posts about macOS malware, exploits, and tools

Une vulnérabilité critique dans Ghost CMS, signalée et corrigée en février 2026, est toujours activement exploitée par des cybercriminels pour transformer des sites légitimes en pièges à visiteurs. La faille est connue, mais les correctifs semblent avoir été largement ignorés. L'affaire concerne Ghost CMS, logiciel

Nimbus Manticore accelerated cyberattacks during wartime, using AI-assisted malware, fake Zoom installers, and SEO poisoning.

CISA has given U.S. government agencies until Wednesday evening to secure their servers against an SQL injection vulnerability in the Drupal content management system (CMS) that it flagged as actively exploited.

Posts about macOS malware, exploits, and tools

Nimbus Manticore used AI-assisted MiniFast malware in 2026 campaigns, expanding espionage through SEO poisoning and phishing.