Latest CyberSec News by @thecyberpicker

Rapid patching of Claude Code security vulnerabilities highlights a new dilemma for developers managing the breakneck pace of frontier AI software updates.

Lawmakers question the Trump administration's export controls on Anthropic AI models, citing concerns over political motives and national security strategy.

LAS VEGAS, June 16, 2026, CyberNewswire–Aembit on Tuesday announced support for Copilot Studio, extending its identity and access management capabilities to Microsoft's enterprise AI agent platform. The integration, unveiled at Identiverse 2026, gives security teams the tools to manage what Copilot Studio agents can access, under what conditions, and with a complete record of every

NEW YORK, June 16, 2026, CyberNewswire–GitGuardian announced today that it is introducing Developer Endpoint Protection, extending its secrets and non-human identity (NHI) security platform coverage to developer workstations. After 12 months of supply-chain campaigns harvesting credentials from developer machines, CISOs and IT leaders are reopening a question many considered settled: what does endpoint protection have

iRhythm disclosed a cyberattack via third-party apps where patient and proprietary data was stolen, followed by a ransom demand.

ClickFix attacks are delivering BabaDeda, Lorem Ipsum, and Potemkin loaders to deploy stealers, RATs, and ransomware-linked tooling.

Google fixed a Vertex AI SDK flaw in v1.148.0 after Unit 42 showed bucket squatting could enable model hijacking and code execution.

A new Android banking trojan named Rokarolla is targeting 217 banking and cryptocurrency applications using an extensive set of 137 commands.

Threat actors are abusing Steam Workshop, Valve's community hub for downloading game-related content, to push various malware hidden in wallpaper packages.

A large-scale npm supply chain attack compromised over 90 versions of @redhat-cloud-services packages, silently infecting CI/CD environments and developer systems. The malicious code steals credentials from GitHub, cloud platforms, and local machines, then spreads like a worm by republishing trusted packages. Discover how the attack works, what data is at risk, and the steps you can take to protect your organization.

A new policy paper outlines a roadmap for AI Bill of Materials (AIBOM) policy, urging standard frameworks to curb cyber risks and boost supply chain transparency.

Healthcare organizations can satisfy cybersecurity and HIPAA compliance obligations while upholding patient safety. Read on to learn how.

Chief information security officers and prominent researchers called a recent export-control ban “dangerous.”

Even organizations that haven’t yet been breached expect an AI-related incident in the near future, a new survey found.

Three FortiSandbox flaws, including one patched last week, are being actively exploited, highlighting the shrinking window for defenders.

Opening a new social media account in the UK will soon mean proving you're over 16 with an ID upload or a facial age scan, under a government ban on under-16s taking effect in spring 2027. Security experts warn the age checks are easy to circumvent and create new data-breach risks.

GhostTree uses recursive NTFS junctions to generate vast numbers of valid Windows file paths. Varonis explains how the technique could cause Microsoft Defender folder scans to never complete, leaving malware undetected.

Explains why modern attackers beat patch cycles and how enterprises can shrink MTTP to reduce breaches.

L'entreprise française vient d'être désignée pour porter le projet OTDH, censé doter la France d'une alternative souveraine à Palantir. Mais la bascule s'annonce longue. Le nom était attendu depuis des mois, le voilà enfin officiel. ChapsVision a été retenue pour déployer sa plateforme ArgonOS dans le cadre de

The U.S. Federal Trade Commission (FTC) warned that Americans lost $3.5 billion to imposter scams in 2025, with reported losses nearly tripling since 2020.

Rokarolla targets 217 banking and crypto apps with 137 commands, enabling PIN, SMS code, and crypto payment theft.

Cardiac monitoring provider iRhythm was hit through social engineering by a data theft followed by an extortion attempt

We found dozens of fake World Cup streaming sites using football as bait to funnel visitors through a malicious advertising network.

This week in cybersecurity from the editors at Cybercrime Magazine

Les équipes de chercheurs en sécurité de Varonis Threat Labs ont trouvé comment transformer l'assistant IA de Microsoft en complice silencieux d'un vol de données, sans plugin, en un seul clic, et sans que la victime ne s'en aperçoive. Il a fallu attendre que trois vulnérabilités prises isolément, et plutôt banales,

Spur study finds VPNs and residential proxies now appear in nearly every security incident, exposing gaps in IP-based decisions.

There are over a dozen cases around the country where police officers are using the Flock surveillance camera system to obsessively and illegally stalk people. Alternate link.

Cisco warned that CVE-2026-20262, a Catalyst SD-WAN Manager vulnerability allowing arbitrary file writes, is being actively exploited.

Thanks to Uncle Sam, anyone trying to find nonconsensual intimate deepfakes on CFake.com and SOCFake.com will be disappointed.