Latest CyberSec News by @thecyberpicker

Instagram removes DM end-to-end encryption starting from May 8, 2026, letting Meta access user private chats.

Fake OpenAI Privacy Filter hit #1 on Hugging Face with 244,000 downloads, spreading infostealer malware to Windows users.

A list of topics we covered in the week of May 4 to May 10 of 2026

Attackers are abusing Google Ads and legitimate Claude.ai shared chats in an active malvertising campaign. Users searching for "Claude mac download" may come across sponsored search results that list claude.ai as the target website, but lead to instructions that install malware on their Mac.

Posts about macOS malware, exploits, and tools

Posts about macOS malware, exploits, and tools

cPanel fixed three flaws that could allow file reads, code execution, and privilege escalation. No active exploitation has been reported yet.

German authorities have shut down a relaunch version of the criminal marketplace 'Crimenetwork' that generated more than 3.6 million euros, and arrested its operator.

Critical out-of-bounds read in Ollama before 0.17.1 leaks process memory including API keys from over 300000 servers via crafted GGUF files.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Posts about macOS malware, exploits, and tools

Posts about macOS malware, exploits, and tools

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs.

The website for the popular JDownloader download manager was compromised earlier this week to distribute malicious Windows and Linux installers, with the Windows payload found deploying a Python-based remote access trojan.

A malicious Hugging Face repository that reached the platform's trending list impersonated OpenAI's "Privacy Filter" project to deliver information-stealing malware to Windows users.

Braintrust warned customers to rotate API keys after hackers breached an AWS account, exposing secrets tied to cloud-based AI models.

cPanel patched three vulnerabilities, including two 8.8 CVSS flaws, reducing risks of code execution and privilege escalation.

RansomHouse claimed responsibility for the Trellix breach, adding the firm to its data leak site and sharing screenshots of internal systems

Evidence of them has been found by analyzing DNA in the seawater. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

TCLBANKER targets 59 financial platforms using WhatsApp worms and Outlook phishing, increasing banking credential theft risks. (

Poland's ABW confirmed hackers breached ICS at five water plants, gaining ability to alter equipment settings. Russia-linked APTs suspected.

The Senate’s top Democrat called on the Department of Homeland Security Friday to work closely with state and local governments to defend against artificial intelligence-strengthened hacks.

Dirty Frag is a newly disclosed Linux local privilege escalation vulnerability affecting kernel networking and memory-fragment handling components including esp4, esp6, and rxrpc. The vulnerability enables reliable escalation from an unprivileged user to root and may be leveraged after initial compromise through SSH access, web shells, containers, or low-privileged accounts. Microsoft Defender is actively monitoring related activity and provides detection coverage for exploitation attempts.

Insider trading is rife on Polymarket: Analysis by the Anti-Corruption Data Collective, a non-profit research and advocacy group, found that long-shot bets—­defined as wagers of $2,500 or more at odds of 35 percent or less—­on the platform had an average win rate of around 52 percent in markets on military and defense actions. That compares with a win rate of 25 percent across all politics-focused markets and just 14 percent for all markets on the platform as a whole. It is absolutely insane that this is legal. We already know how insider betting warps sports. Insider betting warping politics—and military actions—is orders of magnitude worse...

NVIDIA has confirmed in a statement for BleepingComputer that GeForce NOW user information has been exposed in a data breach.

28 fake Google Play apps gained 7.3 million downloads, charging users for fake call data and causing financial losses.

Researchers warn the incident highlights how AI tools can help untrained threat actors develop complex cyberattack capabilities.