Latest CyberSec News by @thecyberpicker

404 Media reports (alternate site): The FBI was able to forensically extract copies of incoming Signal messages from a defendant’s iPhone, even after the app was deleted, because copies of the content were saved in the device’s push notification database…. The news shows how forensic extraction—­when someone has physical access to a device and is able to run specialized software on it—­can yield sensitive data derived from secure messaging apps in unexpected places. Signal already has a setting that blocks message content from displaying in push notifications; the case highlights why such a feature might be important for some users to turn on...

CISA has ordered U.S. federal agencies to patch a Microsoft Defender privilege escalation flaw (dubbed BlueHammer) that has been exploited in zero-day attacks.

Apple fixes CVE-2026-28950 in iOS 26.4.2 after deleted notifications were retained, mitigating forensic data exposure.

Depuis plusieurs jours, le détroit d'Ormuz, l'un des points les plus surveillés du globe en ce moment, est le théâtre d'arnaques cyber mêlant cryptomonnaies, confusion administrative et tensions militaires. Nous sommes le 22 avril 2026, à 6 h 55 du matin, 15 milles nautiques au nord-est d'Oman : le cargo Epaminondas,

A vulnerability in iPhones and iPads allowed law enforcement to recover deleted notifications, including Signal message previews.

The U.S. CISA adds a vulnerability (CVE-2026-33825) in Microsoft Defender to its Known Exploited Vulnerabilities catalog

GopherWhisper infected 12 Mongolian government systems in January 2025, abusing Slack and Discord for C2, exposing wider espionage risks.

Apple fixes CVE-2026-28950 in iOS 26.4.2 after deleted notifications were retained, mitigating forensic data exposure.

Roblox is paying millions to settle child safety claims while rolling out strict age checks and chat limits that could reshape how kids use the platform.

Il s'appelait « HexDex » sur les forums du dark web, et son nom est devenu familier des équipes de sécurité informatique françaises au fil des mois. Lundi 20 avril 2026, ce hacker de 21 ans a été interpellé en Vendée par la Brigade de lutte contre la cybercriminalité (BL2C), alors qu'il s'apprêtait à publier de

After RSAC 2026 Conference, Tony Sager shares his reflections on the patterns and questions that stayed with him after the rush faded.

Download our three Companion Guides to learn how to stay aligned to the CIS Controls in your real-world AI environments.

Our passkey rollout took three tries. Here's a playbook to make your implementation smoother.

Apple has released out-of-band security updates for iPhone and iPad devices to fix a Notification Services flaw that could allow notifications marked for deletion to remain stored on the device.

CISA has been without a permanent director for more than a year, imperiling its efforts to establish a strategic direction.

Experts say the federal legislation takes inspiration from states laws in Virginia and Kentucky, but a lack of bipartisan support could spell trouble.

Sean Plankey, the long-sidelined nominee to lead the Cybersecurity and Infrastructure Security Agency, asked President Donald Trump on Wednesday to withdraw his nomination.

A new Mirai-based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability affecting D-Link DIR-823X routers, to enlist devices into the botnet.

Mastodon suffered a major DDoS attack shortly after a similar incident hit Bluesky. The outage was resolved within a few hours.

Malicious KICS Docker tags and VS Code versions 1.17.0, 1.19.0 enabled data exfiltration, risking exposed infrastructure secrets.

Mirai botnet is targeting old D-Link routers using CVE-2025-29635, a command injection flaw exploitable via crafted POST requests.

A new Kyber ransomware operation is targeting Windows systems and VMware ESXi endpoints in recent attacks, with one variant implementing Kyber1024 post-quantum encryption.

Self-propagating npm worm steals tokens via postinstall hooks, impacting six packages and expanding supply chain attacks.

Read how Microsoft is partnering with Anthropic and broader industry to use leading models, paired with our platforms and expertise, to turn AI-driven discovery into protection at scale.

The Supreme Court will hear arguments in Chatrie v. United States, a landmark case examining whether geofence warrants violate Fourth Amendment digital privacy rights.

The disclosure comes just weeks after a prior SharePoint flaw was discovered.

Selon Bloomberg, un petit groupe d’utilisateurs issus d’un groupe Discord aurait eu accès à Claude Mythos, le modèle hyper‑restreint d’Anthropic, contournant ainsi les protections du modèle d'IA le plus scruté du moment. La faille aurait eu lieu le jour même du lancement. Le 7 avril 2026, Anthropic dévoilait