Latest CyberSec News by @thecyberpicker

In the SOC of the future, autonomous defense moves at machine speed, agents add context and coordination, and humans focus on judgment, risk, and outcomes.

We found a convincing fake site that installs a trojanized Claude app while quietly deploying PlugX malware.

The attack surface targeted by Iranian-linked hackers in cyberattacks against U.S. critical infrastructure networks includes thousands of Internet-exposed programmable logic controllers (PLCs) manufactured by Rockwell Automation.

A research firm tallied the internet-exposed devices Iran is targeting and recommended mitigations for any infrastructure operator using them.

ClickFix campaigns have found a way around macOS Tahoe's warnings against pasting commands in the Terminal. They're using Script Editor instead.

The medtech company was targeted in a wiper attack linked to an Iran-sponsored threat group.

NetBT e-Fatura - Privilege Escalation. CVE-2025-14018 . local exploit for Multiple platform

D-Link DIR-650IN - Authenticated Command Injection.. webapps exploit for Multiple platform

Dutch healthcare IT firm ChipSoft suffered a ransomware attack, forcing services and its HiX platform offline, impacting hospitals

GlassWorm uses a fake WakaTime VS Code extension to infect IDEs, deploy RATs, and steal data, prompting urgent credential rotation.

Analysis of 1 billion CISA KEV remediation records reveal a breaking point for human-scale security. Qualys shows most critical flaws are exploited before defenders can patch them.

Hackers gained access to an API for the CPUID project and changed the download links on the official website to serve malicious executables for the popular CPU-Z and HWMonitor tools.

Depuis le 9 avril 2026, Google déploie une protection cryptographique dans Chrome 146 sur Windows, conçue pour neutraliser l'une des techniques les plus répandues dans l'arsenal des cybercriminels : le vol de cookies de session. Google s’attaque frontalement à l’un des butins les plus convoités par les

Overview of CCMv4.1, new controls, timelines, and transition guidance for cloud providers.

LucidRook is Lua malware used in phishing attacks on NGOs and universities in Taiwan, linked to UAT-10362.

This week in cybersecurity from the editors at Cybercrime Magazine

A financially motivated threat actor tracked as Storm-2755 is stealing Canadian employees' salary payments after hijacking their accounts in payroll pirate attacks.

Google says Gmail end-to-end encryption (E2EE) is now available on all Android and iOS devices, allowing enterprise users to read and compose emails without additional tools.

Claude is actually pretty good on the issues.

Marimo CVE-2026-39987 exploited within 10 hours of disclosure, enabling unauthenticated RCE and credential theft, emphasizing urgent patching needs.

AI browser extensions increase enterprise risk with 60% higher vulnerabilities, bypassing DLP controls and exposing sensitive data.

Dans un article publié le 9 avril 2026, le site américain 404 Media révèle comment le FBI est parvenu à récupérer des messages Signal effacés depuis un iPhone, alors même que l’application n’était plus installée sur l’appareil. Tout commence le 4 juillet 2024, à Alvarado, au Texas, autour du centre de rétention ICE

A flaw in EngageLab SDK exposed up to 50M Android users, including 30M crypto wallets, letting apps bypass security and access private data.

Google releases DBSC in Chrome 146 for Windows, binding cookies to devices to reduce session theft and prevent unauthorized access.

Backdoored Smart Slider 3 Pro v3.5.1.35 update distributed for 6 hours via compromised infrastructure, enabling RCE and data theft.

Hackers breached Bitcoin Depot, stole credentials, and took about 50 BTC worth $3.6M from its wallets after a March 23 intrusion.

EngageLab SDK flaw exposed 50M+ Android installs after April 2025 disclosure, risking crypto wallet data until November 2025 patch.

AUSTIN, Texas, Apr. 9, 2026, CyberNewswire—Mallory is launching a AI-native threat intelligence platform, purpose-built to answer the questions CISOs and their teams are asking every day: •What are the real threat vectors for our organization? •What’s actually exploitable in our environment right now? •What should we proactively fix? The platform monitors thousands of threat sources,

The code injection flaw is similar to a prior vulnerability that was immediately flagged in January.