Latest CyberSec News by @thecyberpicker

The Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli package to npm containing a credential-stealing payload capable of spreading to other projects.

In this newsletter, Joe discusses why understanding other disciplines can often flow back into the macro and micro of cybersecurity, especially in a world of AI.

UNC6692 targeted 77% senior employees between March 1–April 1, 2026, via Teams impersonation, enabling malware, data theft.

Rituals disclosed a breach where hackers accessed and downloaded some My Rituals members’ data, including names and addresses.

Global agencies issue a major warning on China-nexus covert networks, as hackers shift tactics to exploit SOHO routers and IoT devices to target infrastructure.

Cisco Talos is aware of UAT-4356's continued active targeting of Cisco Firepower devices’ Firepower eXtensible Operating System (FXOS). UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.

Hackers have compromised Docker images, VSCode and Open VSX extensions for the Checkmarx KICS analysis tool to harvest sensitive data from developer environments.

A new report explains what cybersecurity practitioners need to see before they trust AI coding tools.

We look at how cybercrime targeting companies affects all of us, especially their customers.

En octobre 2025, un attaquant a exfiltré les données personnelles de centaines de milliers de candidats inscrits sur Parcoursup en Occitanie. Le ministère de l'Enseignement supérieur n'en a été informé que cinq mois plus tard. Le calendrier fait mal. Un mois après le piratage de la plateforme COMPAS, et moins de deux

A new security advisory highlights Beijing’s stealthy techniques.

ThreatsDay Bulletin: active exploits, supply chain attacks, AI abuse, and stealth data risks observed this week.

Bitwarden CLI 2026.4.0 was compromised via GitHub Actions in Checkmarx campaign, exposing secrets and distributing malicious npm code

Replicating Mythos bugs with public models and more, building a useful security program for free, new post-exploitation framework for CI/CD pipelines that can replicate the full TeamPCP attack kill chain

Apple fixed an iOS flaw that kept deleted notifications on devices, allowing recovery of messages, including from apps like Signal.

UNC6692 uses social engineering via email spamming and Microsoft Teams phishing to deploy a modular malware suite.

Password resets are one of the easiest ways for attackers to bypass security controls. Specops Software shows how helpdesk social engineering turns a seemingly legitimate reset request into full account compromise.

Dutch cosmetics giant Rituals disclosed a data breach after attackers stole the personal information of an undisclosed number of customers from its "My Rituals" membership database.

Treat incident response as an engineering system—from asset-aware detection to repeatable analysis and post-incident learning—driving measurable improvements.

Microsoft confirmed that a recent Microsoft Edge browser update introduced a bug that prevents Windows users from joining Teams meetings.

The United Kingdom's National Cyber Security Centre (NCSC-UK) and international partners warned that China-nexus hackers are increasingly using large-scale proxy networks of hijacked consumer devices to evade detection and disguise their malicious activity.

This week in cybersecurity from the editors at Cybercrime Magazine

Avec la mise à jour iOS 26.4.2, Apple modifie la façon dont le contenu des notifications est conservé sur l'appareil. Une décision prise en réaction à une affaire dans laquelle le FBI avait pu accéder aux informations d'une utilisatrice d'iPhone et de Signal sans son consentement. « Nous remercions Apple pour sa

Mythos found decades-old vulnerabilities, yet fewer than 1% were patched, exposing a remediation gap.

AI-driven attacks collapse exploit windows, widening the patch gap and forcing faster vulnerability prioritization strategies.

A previously undocumented state-backed threat actor named GopherWhisper is using a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord in attacks against government entities.

Machine identities are the primary attack surface; governance must shift from user-centric models to trust-based, behavior-driven controls.