New ‘Pack2TheRoot’ flaw gives hackers root Linux access
A new vulnerability dubbed Pack2TheRoot could be exploited in the PackageKit daemon to allow local Linux users to install or remove system packages and gain root permissions.
Hasbro expects March cyberattack to impact second-quarter revenue
The toy maker is reviewing files and working to fully bring certain systems back online. The company will incur some costs related to the investigation.
NASA Employees Duped in Chinese Phishing Scheme Targeting U.S. Defense Software
NASA OIG exposed a 2017–2021 spear-phishing campaign by Song Wu, leading to DOJ charges and export control violations.
DORA and operational resilience: Credential management as a financial risk control
Article 9 of DORA makes authentication and access control a legal obligation for EU financial entities. Here is what the regulation requires, and what a breach looks like when those controls are missing.
Toronto police arrest three in Canada’s first mobile SMS blaster case
Your Guide to CompTIA SecAI+ Performance Based Questions
Want to excel in SecAI+ performance based questions, but don't know where to start? Read this article for all the tips and tricks you need for success!
Over 10,000 Zimbra servers vulnerable to ongoing XSS attacks
Over 10,000 Zimbra Collaboration Suite (ZCS) instances exposed online are vulnerable to ongoing attacks exploiting a cross-site scripting (XSS) security flaw.
Iran-nexus threat groups refine attacks against critical infrastructure
State-sponsored and hacktivist groups have shown greater determination to damage or disable energy, water and other key sectors.
One CISO For 10,000 companies: Cybersecurity On Too Few Shoulders
This week in cybersecurity from the editors at Cybercrime Magazine
Medical data of 500,000 UK volunteers listed for sale on Alibaba | Malwarebytes
Despite strict access controls, medical data from half a million UK Biobank volunteers ended up listed for sale on Alibaba.
Microsoft now lets admins uninstall Copilot on enterprise devices
Microsoft says IT administrators can now uninstall the AI-powered Copilot digital assistant from enterprise devices using a new policy setting, which has become broadly available after the April 2026 Patch Tuesday.
26 FakeWallet Apps Found on Apple App Store Targeting Crypto Seed Phrases
26 FakeWallet apps since fall 2025 hijack crypto recovery phrases via Apple App Store China accounts, enabling wallet theft.
Bridging the AI Agent Authority Gap: Continuous Observability as the Decision Engine
AI agents inherit hidden authority from fragmented identities, creating a delegation gap that demands real-time governance.
Cloud to AI: Building Secure Programs | CSA
Overview of CSA's AI Security Maturity Model and a scalable Enterprise Membership roadmap turning research into actionable cloud and AI security.
Hiding Bluetooth Trackers in Mail - Schneier on Security
It was used to track a Dutch naval ship: Dutch journalist Just Vervaart, working for regional media network Omroep Gelderland, followed the directions posted on the Dutch government website and mailed a postcard with a hidden tracker inside. Because of this, they were able to track the ship for about a day, watching it sail from Heraklion, Crete, before it turned towards Cyprus. While it only showed the location of that one vessel, knowing that it was part of a carrier strike group sailing in the Mediterranean could potentially put the entire fleet at risk...
UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy SNOW Malware
UNC6692 targeted 77% senior employees between March 1–April 1, 2026, via Teams impersonation, enabling malware, data theft.
Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2
Tropic Trooper used trojanized SumatraPDF and GitHub C2 in 2024 to deploy AdaptixC2, enabling covert VS Code tunnel access.
LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure
CVE-2026-33626 exploited within 13 hours of disclosure, enabling SSRF-based cloud credential theft and internal scanning.
PhantomRPC: A new privilege escalation technique in Windows RPC
Kaspersky researcher discovered a vulnerability in RPC architecture that enables an attacker to create a fake RPC server and escalate their privileges.
China-linked threat actors use consumer device botnets to evade detection, warn UK and partners
UK NCSC warns China-linked hackers use hijacked devices as proxy networks to hide activity and evade detection.
Vercel attack fallout expands to more customers and third-party systems | CyberScoop
The company said it found more evidence of compromise across its customer base. Exposure, which has yet to be defined, poses significant downstream risk.
Hackers exploit file upload bug in Breeze Cache WordPress plugin
Hackers are actively exploiting a critical vulnerability in the Breeze Cache plugin for WordPress that allows uploading arbitrary files on the server without authentication.
US sanctions Cambodian senator for millions earned through scam compounds
Dragos: Despite AI use, new malware targeting water plants is ‘hype’ | CyberScoop
ZionSiphon was designed to find and sabotage Israelis’ water supply. An OT expert said it appears to be ineffective and the work of amateurs using AI.
US, UK agencies warn hackers were hiding on Cisco firewalls long after patches were applied | CyberScoop
"CISA and the NCSC warn of 'Firestarter,' a persistent Cisco firewall backdoor that survives patches. Authorities mandate hard reboots and device reimaging to eliminate the threat."
CISA: US agency breached through Cisco vulnerability, FIRESTARTER backdoor allowed access through March
Anthropic’s Mythos Preview Just Changed The Threat Landscape In Ways The Security Industry Isn’t Fully Prepared For
Learn how to optimize your SIEM solution with key strategies and practices.
Surveillance campaigns use commercial surveillance tools to exploit long-known telecom vulnerabilities | CyberScoop
Citizen Lab reveals how surveillance vendors exploit mobile network signaling protocols like SS7 and Diameter to track targets, highlighting severe global telecom risks.
Trigona ransomware attacks use custom exfiltration tool to steal data
Recently observed Trigona ransomware attacks are using a custom, command-line tool to steal data from compromised environments faster and more efficiently.
Surveillance companies exploiting telecom system to spy on targets’ locations, research shows