Latest CyberSec News by @thecyberpicker

Iranian-linked hackers are targeting Internet-exposed Rockwell/Allen-Bradley programmable logic controllers (PLCs) on the networks of U.S. critical infrastructure organizations.

APT28 exploits SOHO routers for global DNS hijacking and adversary-in-the-middle attacks, enabling credential theft and espionage.

Researchers said the hackers are compromising business process outsourcers and targeting help desk support.

The president is proposing to shrink the agency by nearly 900 positions.

The FBI’s annual report on digital crimes exposes a worsening environment. Yet, an unknown number of victims still suffer in the shadows never reporting the crimes they endure.

Hackers are exploiting a maximum-severity vulnerability, tracked as CVE-2025-59528, in the open-source platform Flowise for building custom LLM apps and agentic systems to execute arbitrary code.

AI is rapidly changing how software is written, deployed, and used. Trends point to a future where AIs can write custom software quickly and easily: “instant software.” Taken to an extreme, it might become easier for a user to have an AI write an application on demand—a spreadsheet, for example—and delete it when you’re done using it than to buy one commercially. Future systems could include a mix: both traditional long-term software and ephemeral instant software that is constantly being written, deployed, modified, and deleted. AI is changing cybersecurity as well. In particular, AI systems are getting better at finding and patching vulnerabilities in code. This has implications for both attackers and defenders, depending on the ways this and related technologies improve...

Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens…

An international operation from law enforcement authorities in partnership with private companies has disrupted FrostArmada, an APT28 campaign hijacking local traffic from MikroTik and TP-Link routers to steal Microsoft account credentials.

Cookie-gated PHP webshells use obfuscation, php-fpm execution, and cron-based persistence to evade detection in Linux hosting environments. This post examines how this tradecraft conceals execution behind specially crafted HTTP cookies.

Executive summary Forest Blizzard, a threat actor linked to the Russian military, has been compromising insecure home and small-office internet equipment like routers, then modifying their settings in ways that turn them into part of the actor’s malicious infrastructure.

Le 6 avril 2026, Microsoft a publié un article de blog révélant les nouvelles capacités de frappe de Storm-1175. Ce groupe cybermalveillant affilié à la Chine, aux motivations financières, est au cœur des récentes paralysies d’acteurs économiques sensibles aux États-Unis. Parmi ses armes de prédilection : le

Docker CVE-2026-34040 enables AuthZ bypass via padded requests, risking host compromise; fixed in version 29.3.1.

Acheter sur internet est inévitable de nos jours. Les arnaques pullulant sur la toile, voici comment détecter en un clin d'œil un site frauduleux et éviter de voir son numéro de carte bancaire tomber entre les mains de cybercriminels. Avoir l’âme d’un détective et l'œil affûté est devenu indispensable pour naviguer

The stolen information could help the hackers plan follow-up attacks and breach more organizations, Cisco researchers said.

Noma Security researchers disclosed GrafanaGhost, a Grafana vulnerability that uses indirect prompt injection to silently exfiltrate sensitive enterprise data — bypassing AI guardrails without a login or user interaction. Grafana has issued a fix.

Automated pentesting tools deliver strong early results, then quickly plateau. Picus Security explains how the "PoC cliff" leaves major attack surfaces untested and creates a dangerous validation gap.

China-based actor Storm-1175 runs fast ransomware attacks, exploiting new flaws to breach systems and quickly deploy Medusa ransomware.

A major outage hit Russian banking apps and payments, blocking card use, cash withdrawals, and mobile access for hours.

Posts about macOS malware, exploits, and tools

A public S3 bucket exposed AWS keys allowed attackers to map the environment and seize administrative control in minutes.

Over 1,000 exposed ComfyUI instances exploited via unauthenticated code execution, enabling Monero mining and botnet expansion.

Phishers are using QR codes on official-looking notices to level up their traffic and toll scams.

In this episode of Talos Takes, Amy and Pierre Cadieux unpack the ransomware and vulnerability trends that defined 2025.

This week in cybersecurity from the editors at Cybercrime Magazine

Posts about macOS malware, exploits, and tools