Latest CyberSec News by @thecyberpicker

A group used Anthropic’s Mythos AI model to help find a kernel memory corruption vulnerability and exploit on Apple’s M5. News article.

The company behind the widely used observability platform refused an extortion demand and has since taken steps to harden its security.

The agency wants to ensure that its public catalog of actively exploited flaws is as comprehensive as possible.

Detecting and deceiving attackers with AI honeypots, detect supply chain attacks with GitHub Action canaries, the latest from Microsoft's new "Autonomous Code Security" team

Une alliance internationale de 18 pays, menée par la France et les Pays-Bas, a démantelé First VPN, le réseau d’anonymisation fétiche des cybercriminels. En saisissant l'intégralité de sa base de données, la police a d'ores et déjà identifié des milliers de pirates à travers le monde, mettant fin à des années

The attack is the latest example of hackers’ intense focus on open-source packages.

The Fox Tempest malware-signing-as-a-service operation was linked to numerous ransomware attacks.

Showboat targets Linux telecom systems since mid-2022, enabling C2 access, proxying, and file theft across multiple countries.

Apple revealed that it blocked over $11 billion in fraudulent App Store transactions over the last six years, more than $2.2 billion in potentially fraudulent App Store transactions in 2025 alone.

Attackers bypassed MFA on patched SonicWall Gen6 VPNs because admins missed extra manual steps required to fully fix the flaw.

Cyber threats this week: AI-assisted attacks, supply chain risks, cloud abuse, phishing, malware, and old flaws still causing damage.

Cockpit 359 - RCE. CVE-2026-4631 . webapps exploit for Multiple platform

Lenovo LegionSpace 1.7.11.2 - 'DAService' Unquoted Service Path.. local exploit for Windows platform

solaredge - (CSRF-OOB-Injection).. webapps exploit for Multiple platform

FUXA 1.2.9 - RCE. CVE-2026-25895 . webapps exploit for Multiple platform

BookStack 25.12.1 - Denial of Service.. webapps exploit for Multiple platform

Cisco has released security updates to address a maximum-severity vulnerability in Secure Workload that allows attackers to gain Site Admin privileges.

A Chinese cyber-espionage campaign has been targeting telecommunications providers with newly discovered Linux and Windows malware dubbed Showboat and JFMBackdoor, respectively.

Modern crypto drainers don't hack wallets. They trick users into approving malicious transactions. Flare explores how the Lucifer DaaS platform scales wallet theft through phishing and automation.

A malicious VS Code extension led to cloned private repositories, reportedly offered for sale on a criminal forum

This article shows how AI-driven threats and MCP risks elevate security needs, and how penetration testing strengthens ISO 42001 and builds trust.

Cisco fixed a critical Secure Workload flaw (CVE-2026-20223) that could let attackers gain Site Admin privileges through crafted API requests

A virtual private network service called 'First VPN,' used in ransomware and data theft attacks, has been taken offline in a joint international law enforcement operation.

Active Defender exploits hit CVE-2026-41091 and CVE-2026-45498; June 3 fixes reduce SYSTEM and DoS risk.

Call for Trainers: DEF CON Training Middle East 2026 Event Description Dates: November 8-10, 2026Location: Bahrain (venue TBD) Submission Deadline: May 9, 2026 Apply Now! DEF CON has been one of the world’s leading cybersecurity communities for more than three decades, known for convening industry, government, and inde

Police robots, drones and electronic car systems are at the mercy o...

Wynn and Encore Las Vegas