From Android TVs to routers: the xlabs_v1 Mirai-based botnet built for DDoS attacks
A new Mirai‑based botnet, xlabs_v1, hijacks ADB‑exposed IoT devices for powerful DDoS attacks, with 21 flooding methods and DDoS‑for‑hire use.
Palo Alto Networks firewall zero-day exploited for nearly a month
Palo Alto Networks warned customers that suspected state-sponsored hackers have been exploiting a critical-severity PAN-OS firewall zero-day vulnerability for nearly a month.
Smart Glasses for the Authorities - Schneier on Security
ICE is developing its own version of smart glasses, with facial recognition tied to various databases.
If a fake moustache can fool age checks, is the Online Safety Act working?
A UK report finds modest gains in child safety online, but easy workarounds and ongoing risks remain.
One House Democrat is pressing Commerce on the government’s spyware use | CyberScoop
Rep. Summer Lee is demanding a Commerce Department briefing following reports that the Trump administration may lift sanctions on NSO Group. As ICE admits to using commercial spyware, Lee warns of "close ties" between the administration and the controversial Israeli firm.
If a fake moustache can fool age checks, is the Online Safety Act working? | Malwarebytes
A UK report finds modest gains in child safety online, but easy workarounds and ongoing risks remain.
Fake Claude AI website delivers new 'Beagle' Windows malware
A fake version for the Claude AI website offers a malicious Claude-Pro Relay download that pushes a previously undocumented backdoor for Windows named Beagle.
Exploits and vulnerabilities in Q1 2026
This report provides statistical data on published vulnerabilities and exploits we researched during Q1 2026. It also includes summary data on the use of C2 frameworks in APT attacks.
PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux
ZiChatBot malware spread via 3 PyPI packages in July 2025 uses Zulip APIs as C2, enabling stealthy attacks across systems
U.S. CISA adds a flaw in Palo Alto Networks PAN-OS to its Known Exploited Vulnerabilities catalog
The U.S. CISA adds a vulnerability in Palo Alto Networks PAN-OS to its Known Exploited Vulnerabilities catalog.
vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution
12 vm2 flaws (CVSS up to 10.0) enable sandbox escape in ≤3.11.1, causing remote code execution risk; patched in 3.11.2.
Iran-sponsored threat group behind false flag social engineering campaign
The state-linked actor has been masquerading as a criminal ransomware group in attacks targeting U.S. organizations.
Taiwan High-Speed Rail Emergency Braking Hack: How a Student Stopped the Trains and Exposed a Major Security Gap
Taiwan high‑speed rail was disrupted after a 23‑year‑old student spoofed signals and triggered an emergency alarm, stopping four trains.
Palo Alto warns of critical software bug used in firewall attacks
Hackers abuse Google ads for GoDaddy ManageWP login phishing
A phishing campaign delivered through Google sponsored search results is targeting credentials for ManageWP, GoDaddy's platform for managing fleets of WordPress websites.
A DOD contractor’s API flaw exposed military course data and service member records | CyberScoop
A basic API flaw in Schemata’s AI training platform exposed U.S. service member records and confidential military manuals. Researchers at Strix detail a 150-day disclosure struggle before the DOD contractor patched the vulnerability.
Mirai-Based xlabs_v1 Botnet Exploits ADB to Hijack IoT Devices for DDoS Attacks
xlabs_v1 botnet exploits ADB port 5555 to recruit IoT devices, enabling 21 DDoS methods and bandwidth-tiered attacks on gaming servers
After 17 years, Gavril Sandu extradited to U.S. for hacking scheme
Romanian citizen Gavril Sandu was extradited to the U.S. nearly 17 years after a hacking scheme. He was indicted in 2017 and arrested in 2026.
A critical Palo Alto PAN-OS zero-day is being exploited in the wild | CyberScoop
The vendor hasn’t released a patch for the vulnerability or described the scope and objective of confirmed attacks.
Critical vm2 sandbox bug lets attackers execute code on hosts
A critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitrary code on the host system.
New Cisco DoS flaw requires manual reboot to revive devices
Cisco patched a Crosswork Network Controller and Network Services Orchestrator denial-of-service vulnerability that requires manually rebooting targeted systems for recovery.
ClickFix campaign uses fake macOS utilities lures to deliver infostealers | Microsoft Security Blog
Threat actors are targeting macOS users with fake utility fixes that trick them into running malicious Terminal commands. This campaign evades traditional defenses by stealing credentials, wallets, and sensitive data.
Microsoft named an overall leader in KuppingerCole Analyst’s 2026 Emerging AI Security Operations Center (SOC) report | Microsoft Security Blog
Microsoft is excited to be named an Overall Leader, and the Market Leader in the Kuppinger Cole Analyst’s 2026 Emerging AI Security Operations Center (SOC) report, as we see automation and AI as core components of the future of cybersecurity.
New CISA initiative aims for critical infrastructure to operate offline during cyberattacks
DAEMON Tools devs confirm breach, release malware-free version
Disc Soft Limited, the maker of DAEMON Tools Lite, confirmed that the software had been trojanized in a supply chain attack and released a new, malware-free version.
Google Chrome's silent 4GB AI download problem | Malwarebytes
Google Chrome writes a 4GB AI model to users’ devices without asking, and reinstalls it if you delete it.
Iranian cyber espionage disguised as a Chaos Ransomware attack
Iran-linked APT MuddyWater used ransomware-style tactics to mask espionage, combining phishing, credential theft, and data exfiltration.
NIST will test three major tech firms’ frontier AI models for cybersecurity risks
After Anthropic’s announcement of Claude Mythos, agencies across the government are racing to get ahead of new AI models’ potential dangers.
Businesses eager but unprepared for AI to transform their security strategies
Meanwhile, a new report found, companies are neglecting other basic security tools.
MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack
MuddyWater used Teams phishing in 2026 to steal credentials, enabling stealthy data exfiltration and persistence without encryption.