Latest CyberSec News by @thecyberpicker

The Texas AG sued Netflix, accusing the company of secretly tracking viewers, selling user data, and using addictive features targeted at minors.

Cybersecurity experts suggest that Instructure appears to have made a ransomware payment, which the FBI highly discourages.

Ninja Forms Uploads - Unauthenticated PHP File Upload. CVE-2026-0740 . webapps exploit for Multiple platform

glances 4.5.2 - command injection. CVE-2026-33641 . webapps exploit for Multiple platform

coreruleset 4.21.0 - Firewall Bypass. CVE-2026-21876 . webapps exploit for Multiple platform

Flowise < 3.0.5 - Missing Authentication for Critical Function. CVE-2025-58434 . webapps exploit for TypeScript platform

Examines how AI agents moving from output to action reshape enterprise security, governance, and risk.

Foxconn, the world's largest electronics manufacturer, says some of its North American factories are now working to resume normal operations after a cyberattack.

This week in cybersecurity from the editors at Cybercrime Magazine

Microsoft patched 138 flaws, including 30 Critical bugs, as AI discovery expands Patch Tuesday risk.

AI-driven exploitation outpaces 32-day edge remediation, leaving closed tickets with unresolved risk.

Learn AppSec secrets from industry veterans Mike McGuire (Wiz) and Salman Ladha (ex-Okta). Discover why your tools miss the real attack paths.

By design. Two words that have done an awful lot of heavy lifting in the cybersecurity industry over the years. They tend to surface whenever a vendor wants to wave off a serious finding without fixing it. Related: The unending password problem Microsoft just deployed them again. This time in response to a Norwegian researcher

Attackers can compromise systems in minutes while patching and response still take hours or days. Picus Security breaks down why autonomous validation is becoming critical for modern defense strategies.

Microsoft says some customers are experiencing issues downloading and installing Office on their Windows 365 devices.

Philippe shares his unique journey from French engineering school to the front lines of cybersecurity, explaining how his lifelong love for solving puzzles helps him uncover critical security flaws before they can be exploited.

Educational tech firm Instructure reached a deal with hackers after a major Canvas breach exposed data stolen from schools and universities.

The UK’s AI Security Institute evaluated GPT-5.5’s ability to find security vulnerabilities, and found that it is comparable to Claude Mythos. Note that the OpenAI model is generally available. Here is the Institute’s evaluation of Mythos. And here is an analysis of a smaller, cheaper model. It requires more scaffolding from the prompter, but it is also just as good.

May’s Patch Tuesday may not be the giant release many expected, but there are still plenty of important fixes that shouldn’t be ignored.

Le gouvernement veut-il sacrifier les VPN sur l'autel de la vérification de l'âge ? Face aux menaces sur le télétravail et la sécurité, le député Philippe Latombe somme la ministre de clarifier sa position. « Les VPN, c'est le prochain sujet sur ma liste ». Voilà ce que déclarait en début d'année Anne Le Hénanff, la

Posts about macOS malware, exploits, and tools

GemStuffer used 150+ RubyGems to scrape U.K. council portals, turning the registry into a data exfiltration channel.

Posts about macOS malware, exploits, and tools

Première visite officielle d'un président américain en Chine depuis 2017, Donald Trump arrive à Pékin avec une délégation de 17 patrons, dont Tim Cook, Elo

Android Intrusion Logging stores encrypted forensic logs for 12 months, helping experts investigate spyware attacks on high-risk users.

Fortinet patched critical flaws in FortiSandbox and FortiAuthenticator that could let attackers remotely execute code on unpatched systems.

What if you could generate realistic attack telemetry on demand? Explore research methods that translate attacker behaviors (TTPs) into synthetic logs that can trigger detections at scale and without sensitive data.

Today Microsoft is announcing a major step forward in AI-powered cyber defense: a new multi-model agentic scanning harness (codenamed MDASH).

The U.S. House Committee on Homeland Security is calling on Instructure executives to testify about two cyberattacks by the ShinyHunters extortion group that targeted the company's Canvas platform, allowing threat actors to steal student data and disrupt schools during final exams.

Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of the…