Latest CyberSec News by @thecyberpicker

Attackers hijacked 400+ Arch Linux AUR packages to run a Rust credential stealer, with optional eBPF rootkit support on root systems.

Maine has taken its public data breach reporting portal offline after fraudulent breach disclosures were published on the state's website, prompting a review of procedures to prevent abuse in the future.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Sentry flaw to its Known Exploited Vulnerabilities catalog.

U.S. and international authorities have shut down massive deepfake porn sites CFAKE and SOCFAKE, marking a major seizure under the new TAKE IT DOWN Act.

Attackers exploited CVE-2026-10520 flaw in Ivanti Sentry, compromising many internet-exposed gateways shortly after patches were released

A Ukrainian national extradited from Ireland to the United States last year has pleaded guilty to conspiracy charges tied to the Conti ransomware operation.

Oleksii Lytvynenko, a 44-year-old Ukrainian national, admitted to joining the prolific cybercrime group in 2021. Officials said he engaged in cybercrime up until his arrest in Ireland in 2023.

A 10-year-old authentication bypass vulnerability discovered in the phpBB forum software allows an attacker to log in as any user, including administrators.

More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens.

Oracle still hasn't patched the vulnerability the group has been using in its attacks since late May.

One-fifth of firms aren’t even sure if they’ve been hacked through their AI tools, according to a new report.

Anthropic's powerful model raises difficult questions about how government and industry should work together to safeguard systems in the AI era.

Face aux frappes américaines, Téhéran réplique sur le terrain de la cyber-guerre asymétrique. Accusé de complicité tactique avec le Pentagone et de briser la censure locale, le réseau satellitaire Starlink de SpaceX est désormais dans le viseur des Gardiens de la révolution. Les récents échanges de tirs entre les

Apple and the Met Police are working together to make stolen iPhones harder to reset, resell, and profit from.

An unauthenticated arbitrary file upload flaw in Amasty Order Attributes (CVE-2026-53787) lets attackers write executable files to a Magento store without lo...

GitHub access sales, leaked repositories, and stolen API keys can all become supply-chain attack footholds. Flare explores how underground forums expose early signals tied to software supply-chain risk.

AI-driven FinOps and governance strategies to optimize cloud spend, efficiency, and ROI in 2026.

This week in cybersecurity from the editors at Cybercrime Magazine

Researchers warn Agentjacking can abuse Sentry errors to make AI coding agents run malicious code on developer machines.

Analysis of 25M alerts shows MDR leaves many alerts unreviewed, while AI SOCs can investigate every alert with faster triage.

Researchers warn that thousands of malicious domains are already in place, as fans and tournament organizers face potential attacks.

CyberCorps is evolving to tackle AI threats. But budget cuts could derail it before the work even starts.

AI accelerates cloud attacks, widening defender gaps. Learn how threat actors use AI to chain risks in the cloud and how to respond with AI-speed security.

ShinyHunters exploited a critical Oracle PeopleSoft zero-day to breach over 100 orgs, mostly universities, before a patch was available.

Microsoft has fixed a known issue that caused Windows updates released since May 2025 to fail when installed via the Windows Update Standalone Installer (WUSA) from a network share.

Let no one accuse Bernie Sanders of ducking the big questions. Writing in the New York Times last week, the senator asked: “Will the future of humanity be determined by a handful of billionaires who have promoted and developed AI, with virtually no democratic input, who stand to become even richer and more powerful than they are today?” We agree entirely that this is one of the most potent questions facing global democracy today. Our book, Rewiring Democracy, surveys the emerging uses for and impacts of AI in democracy around the world and reaches the same conclusion: that the most urgent risk posed by AI is the ...

INTERPOL-led Operation Ramz disrupted Sniper Dz, a free phishing-as-a-service platform active since 2015 with 45,000 victim records and 20,000+ domain

Three patched LangGraph flaws could let attackers chain SQL injection and unsafe deserialization for RCE in self-hosted deployments.