Latest CyberSec News by @thecyberpicker

Reverse Engineering Apple's ClickFix Protections

...or how I became threat hunter by accident

The trio of Democrats weren’t satisfied with Immigration and Customs Enforcement answers, and criticized the spyware’s use.

766 hosts breached via CVE-2025-55182 in Next.js apps, enabling mass credential theft and targeted follow-on attacks.

Threat actors are exploiting the recent Claude Code source code leak by using fake GitHub repositories to deliver Vidar information-stealing malware.

Coming up on the post we see what "alternative data" looks like when your budget is zero, an AI that spent 80k tokens explaining Middle East dynamics only to conclude "XLE remains a hold", and Raspberry Pi that trades better than I do. TL;DR I gave an AI agent trading authority on a $10k Alpaca paper account and watched what happened. Behind it sits a real-time alternative & stock data platform I built, deployed on a Raspberry Pi 4 alongside OpenClaw. The agent has instruction files defining i

This week, Martin tells the story of a crime he encountered and how it shows that the threat landscape is changing.

Hasbro suffers a cyberattack, disrupting some operations; the company is probing the scope and potential data compromise.

The Drift Protocol lost at least $280 million after a threat actor took control of its Security Council administrative powers in a planned, sophisticated operation.

Cisco fixed critical flaws that could allow attackers to bypass authentication, run code, and gain access to sensitive data.

This is for new routers; you don’t have to throw away your existing ones: The Executive Branch determination noted that foreign-produced routers (1) introduce “a supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defense” and (2) pose “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.” More information: Any new router made outside the US will now need to be approved by the FCC before it can be imported, marketed, or sold in the country...

Cisco patches two 9.8 CVSS flaws (CVE-2026-20093, CVE-2026-20160), preventing authentication bypass and root access.

Cookie-gated PHP webshells use obfuscation, php-fpm execution, and cron-based persistence to evade detection in Linux hosting environments. This post examines how this tradecraft conceals execution behind specially crafted HTTP cookies.

Generative AI is upgrading cyberattacks, from 450% higher phishing click‑through rates to industrialized MFA bypass. Learn more.

The bipartisan, bicameral Cyber Ready Workforce Act aims to cut into the country’s deficit of cybersecurity professionals.

A new report from Halcyon finds that the group also puts more effort than usual into developing working decryptors, likely to incentivize businesses to pay up.

The company revised a security advisory as newly disclosed information heightens the potential impact.

Threat actors impersonated CERT-UA to send phishing emails with AGEWHEEZE malware, tricking victims into installing a fake “security tool.”

More than eight in 10 security leaders in the sector say they’ve rolled out an AI governance framework to some degree, a new survey found.

GitHub's plan to harden GitHub Actions and supply chain security, automating and scaling SAST and SCA vuln management, OSS tool that uses AI agents to reason about vulns across repos

Researchers warn that residential proxies used to route malicious traffic are a big problem for IP reputation systems, as there is no clear distinction between attackers and legitimate users.

The Handala group claimed responsibility for hitting the company with a wiper attack last month.

An episode of the Talos Threat Perspective on the 2025 Year in Review trends. We explore how identity is being used to gain, extend, and maintain access inside environments.

Apple has quietly expanded patches against the vulnerabilities in the DarkSword exploit kit to include iOS and iPadOS 18.7.7

A detailed guide for hardening vSphere Virtual Center with a focus on the BRICKSTORM backdoor and associated malware activity.

A 2026 snapshot of how AI reshapes the attack surface, cyber threats, and security operations, based on insights from 1,500 security leaders.

Cybersecurity roundup: ShareFile RCE, Android rootkit, ImageMagick 0-days, XLoader, phishing, and supply chain threats.

Threat actors are exploiting vacant homes as "drop addresses" to intercept mail and enable fraud. Flare shows how postal services and fake identities are abused to turn mail into a fraud vector.

This week in cybersecurity from the editors at Cybercrime Magazine