Latest CyberSec News by @thecyberpicker

Cybersecurity AI (CAI) Framework 0.5.10 - Command Injection.. webapps exploit for Multiple platform

Gemini CLI CVSS 10.0 flaw in versions below 0.39.1 enabled RCE in CI workflows, forcing Google to mandate explicit workspace trust.

Multiple official SAP npm packages were compromised in what is believed to be a TeamPCP supply-chain attack to steal credentials and authentication tokens from developers' systems.

Read Microsoft expert tips for CISOs on embracing strong proactive security to mitigate increased exposure to security threats.

Hackers are exploiting two authentication bypass vulnerabilities in the Qinglong open-source task scheduling tool to deploy cryptominers on developers' servers.

What happens when you strip the internet out of AI? Researchers built a chatbot that only knows the world before 1931.

Attackers quickly exploited a critical LiteLLM flaw (CVE-2026-42208) to access and modify sensitive database data via SQL injection.

The growth of data centers — and adversaries’ targeting of them — left lawmakers at a hearing Wednesday contemplating whether the federal government has the right setup for defending them.

The Ukrainian police have arrested three individuals who hacked more than 610,000 Roblox gaming accounts and sold them for a profit of $225,000.

SAP npm packages poisoned on April 29, 2026 + AES-256-GCM encrypted credential theft + AI coding tools abused for spread.

Read Microsoft expert tips for CISOs on embracing strong proactive security to mitigate increased exposure to security threats.

SAP npm packages poisoned on April 29, 2026 + AES-256-GCM encrypted credential theft + AI coding tools abused for spread.

A critical vulnerability affecting all but the latest versions of cPanel and the WebHost Manager (WHM) dashboard could be exploited to obtain access to the control panel without authentication.

Claude Opus commit added malicious npm dependency in Feb 2026, enabling crypto theft and persistent RAT access.

Le 1er mai tombe un vendredi en 2026. Une aubaine pour avoir trois jours de repos, mais moins pour faire des virements : attendez-vous à du retard pour certaines transactions, notamment les salaires. Comme à l'accoutumée à cette période de l'année, le calendrier 2026 nous offre un week-end prolongé avec la Fête du

Global study shows targeted internet censorship worldwide, with Russia leading; VPNs, news, and adult content are most frequently blocked

Explore how the CSAI Foundation is securing autonomous AI agents with new frameworks, certifications, and global assurance for the agentic era.

Russia has used one of the flaws, security experts said, while North Korea has used the other.

Austrian and Albanian authorities dismantled a criminal ring accused of running a large-scale cryptocurrency investment fraud operation that caused estimated losses of over €50 million ($58.5 million) to victims worldwide.

Dans les instructions internes de Codex CLI, l’agent de programmation d’OpenAI, une consigne inattendue revient à plusieurs reprises : ne jamais mentionner de gobelins, gremlins, ratons laveurs, trolls, ogres ou pigeons. Cette interdiction, devenue virale, alimente débats et théories en ligne. Les instructions de

cPanel fixed a critical authentication flaw that could let attackers access servers. The issue affects all supported versions.

A researcher has detailed five ways to exploit PhantomRPC, which Microsoft rates “moderate” and does not plan to fix.

Deloitte-NASCIO study shows AI, budget pressures are forcing states to make tough decisions.

Cloud misconfigurations enable worm-like attacks; exposed interfaces fuel scale, highlighting the need for continuous visibility and secure cloud configurations.

This week in cybersecurity from the editors at Cybercrime Magazine

A single third-party OAuth integration can become a direct path into your environment. Push explains how the Vercel breach shows a compromised OAuth app can lead to widespread impact across downstream customers.