Latest CyberSec News by @thecyberpicker

Microsoft fixed a Microsoft Entra ID flaw where the Agent ID Administrator role could enable privilege escalation and account takeover.

CVE-2026-25874 (CVSS 9.3) in LeRobot 0.4.3 allows unauthenticated RCE via pickle over gRPC, risking AI systems and sensitive data.

Explores how shadow AI agents erode governance in enterprises, why visibility isn't assurance, and practical steps to close the governance gap.

AI models like Claude Mythos find vulnerabilities in minutes, collapsing patch windows and forcing assume-breach defenses to contain threats.

Scammers are using fake CAPTCHA pages to rack up international SMS charges on victims’ phone bills, and then take a cut.

Two weeks ago, Anthropic announced that its new model, Claude Mythos Preview, can autonomously find and weaponize software vulnerabilities, turning them into working exploits without expert guidance. These were vulnerabilities in key software like operating systems and internet infrastructure that thousands of software developers working on those systems failed to find. This capability will have major security implications, compromising the devices and services we use every day. As a result, Anthropic is not releasing the model to the general public, but instead to a ...

Osservatorio Nessuno uncovered Morpheus spyware spreading via fake Android apps to steal data, highlighting rising covert surveillance tools.

Microsoft has confirmed a new issue causing newly introduced Windows security warnings to display incorrectly when opening Remote Desktop (.rdp) files.

Every major building in America has three things: a physical address, a legal owner, and an unmonitored attack surface. Related: Sam Altman's quest to usurp the browswer That surface extends from the ground up through every floor, every facade, and into the airspace above — invisible, commercially exploited, and almost entirely ungoverned. It is the

Depuis le 25 avril 2026 et la publication de son témoignage sur X, Jer Crane est au cœur d'un débat qui embrase la communauté tech. Le fondateur de PocketOS a vu trois mois de données clients s'évaporer en 9 secondes, la faute à un agent IA. L'entrepreneur tient pour responsables Cursor, Claude Opus et son

He created Gmail accounts, impersonated real US researchers, and convinced NASA, the military, and universities to hand over sensitive code.

Chinese hacker extradited after 2020–2021 Exchange zero-day attacks on U.S. vaccine research, intensifying DOJ crackdown.

After addressing a widespread outage that affected Outlook.com users worldwide on Monday, Microsoft has asked iPhone users to re-enter their credentials to regain access to their Outlook and Hotmail accounts via the default Mail app.

NCSC’s SilentGlass blocks malicious HDMI/DisplayPort links, protecting monitors from hardware attacks. Now commercialized for global use.

The increase is being driven by powerful privacy laws in states like California, new interstate partnerships and a renewed focus on the privacy impacts of AI and automation.

CVE-2026-32202 actively exploited after April 27 advisory fix, exposing NTLMv2 hashes via zero-click SMB authentication.

Agent ID Administrator enabled service principal takeover before April 9, 2026 patch, exposing privilege escalation risk in Entra ID tenants.

Xu Zewei was allegedly directed by China’s intelligence services to conduct a sweeping espionage campaign to steal data on COVID-19 research and other U.S. policy interests.

Online trading platform Robinhood's account creation process was exploited by threat actors to inject phishing messages into legitimate emails, tricking users into believing their accounts had suspicious activity.

Supreme Court justices weigh the constitutionality of geofence warrants during oral arguments in Chatrie v. United States, a landmark digital privacy case.

A new wave of the Glassworm campaign is targeting the OpenVSX ecosystem with 73 "sleeper" extensions that turn malicious after an update.

A Chinese national accused of carrying out cyberespionage operations for China's intelligence services has been extradited from Italy to the United States to face criminal charges.

Medtronic confirmed a breach of its IT systems after ShinyHunters claimed the theft of over 9 million records.

Canadian authorities have arrested three men for operating an "SMS blaster" device that pretends to be a cellular tower to send phishing texts to nearby phones.

Sens. Hassan and Banks demand answers from Navigate360 following a cyberattack that allegedly compromised sensitive student data from school safety tip lines.

The U.S. Federal Trade Commission (FTC) warned of a massive increase in losses from social media scams since 2020, exceeding $2.1 billion in 2025.

An attacker pushed a malicious version of the popular elementary-data package Python Package Index (PyPI) to steal sensitive developer data and cryptocurrency wallets.