Latest CyberSec News by @thecyberpicker

A convincing fake FACEIT verification page is stealing Steam accounts by using a fake login window that looks completely legitimate.

Danish pharmaceutical giant Novo Nordisk, the world's largest producer of insulin, disclosed a data breach affecting patient information from some clinical trials.

Face aux frappes américaines, Téhéran réplique sur le terrain de la cyber-guerre asymétrique. Accusé de complicité tactique avec le Pentagone et de briser la censure locale, le réseau satellitaire Starlink de SpaceX est désormais dans le viseur des Gardiens de la révolution. Les récents échanges de tirs entre les

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch an actively exploited Ivanti Sentry flaw within three days, as mandated by the newly issued Binding Operational Directive (BOD) 26-04.

21,786 live cameras stream with zero authentication. Cheap gear is the real risk, webcamXP open 46% of the time.

Europol dismantled AudiA6, a crypto laundering service that washed €336M for ransomware gangs and cybercrime networks since 2021.

A CVSS 9.3 flaw in Check Point Remote Access VPN let unauthenticated attackers bypass certificate validation by supplying a crafted IKEv1 VendorID payload — exploited for 32 days before a patch, with one confirmed Qilin ransomware post-compromise chain.

The French government revealed that a recent breach of its Tchap encrypted messaging platform affects the accounts of over 73,000 employees in the French public sector.

A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and detection opportunities to help organizations identify and disrupt related activity.

Posts about macOS malware, exploits, and tools

Posts about macOS malware, exploits, and tools

Kyushu Electric Power Co., Inc. has disclosed a physical security incident that affects private data of more than 10 million customers.

In an unusual misinformation campaign, fraudulent data breach disclosures were submitted to Maine's official breach portal and publicly posted before their legitimacy could be verified, prompting companies to deny the claims.

Oracle PeopleSoft zero-day CVE-2026-35273 was exploited before Oracle's June 10 advisory, exposing data and triggering extortion attacks.

An active compromise and extortion campaign attributed to ShinyHunters targeting Oracle PeopleSoft with a zero-day exploit.

Oracle is warning about a critical PeopleSoft Suite zero-day vulnerability tracked as CVE-2026-35273 that allows unauthenticated remote code execution, with the flaw actively exploited in ShinyHunter data theft attacks.

In this week’s newsletter, Amy reminisces on the tech toys of their childhood, inspired by a hilarious lesson about why your digital privacy shouldn't be left on an open channel.

CVE-2026-5027 lets attackers abuse Langflow path traversal, exposing 7,000 AI app instances to file-write attacks.

GreatXML can bypass BitLocker on Windows systems where Defender Offline Scan was used, exposing encrypted drive data.

OpenClaw input flaws let hidden contacts and phishing emails trigger code execution and data leaks, exposing agent trust risks.

A Russian national has been charged for facilitating the Void Blizzard cyber-espionage campaign targeting U.S. companies and international allies.

Cybersecurity roundup: supply chain threats, AI agent risks, browser-cloning malware, mule networks, endpoint bypasses, and key security updates.

The Gentlemen ransomware claims 478 victims as its AI-assisted RaaS operation adds worm-like spread capability.

"AI can make mistakes" isn't a good enough legal defense for defamatory or incorrect AI Overviews, a German court has ruled.

Law enforcement has dismantled the “AudiA6” cryptocurrency service allegedly used by ransomware actors and other cybercriminals to launder more than $380 million.

Finding the time to train employees remains the biggest impediment to programs’ success, according to a new report.

CERT-In’s blueprint points toward a cybersecurity model that is continuous, threat-informed, and evidence-led. Here is what that means in practice, and how adversarial exposure validation helps organisations test whether their controls actually work against AI-assisted threats.

Why I joined OpenAI to lead Cyber efforts, playlist of the latest cloud security talks, AWS' supply chain best practices