The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-48282 (CVSS score: 10.0) - A pa…
5 Security Mistakes That Kill Healthcare AI Startups HackerNoon
The phishing campaign uses several tactics, including nested redirects, to evade detection and steal credentials from unsuspecting targets.
Varonis reported the flaw to Google in late 2025 and it has been addressed, but it reminds defenders to take a fresh look at their AI Infrastructure security.
Atacantes estão explorando ativamente a vulnerabilidade CVE-2026-20896 (CVSS 9.8) no Gitea, plataforma de desenvolvimento auto-hospedada, para contornar a autenticação e acessar repositórios e segredos de código. A falha, específica das imagens oficiais Docker do Gitea, permite q…
Chinese hackers tracked as 'UAT-7810' are actively evolving their malware to expand their Operational Relay Box (ORB) network by compromising internet-facing networking devices, primarily unpatched Ruckus routers. [...]
Atores de ameaça estão abusando de chamadas de voz no Microsoft Teams, se passando por funcionários do suporte de TI corporativo para enganar funcionários e instalar o malware EtherRAT, conforme alertou ontem a Unit 42, da Palo Alto Networks. A campanha combina e-mails de phishin…
A BeyondTrust alertou ontem seus clientes sobre duas vulnerabilidades críticas em suas plataformas Remote Support (RS) e Privileged Remote Access (PRA), que poderiam permitir que atacantes não autenticados contornassem controles de acesso. As falhas, registradas como CVE-2026-401…
A hidden authentication backdoor has been found in multiple Tenda router firmware versions, potentially allowing an attacker to gain administrative access to the device's web management panel. [...]
O Departamento de Justiça dos EUA, com auxílio do FBI e da polícia finlandesa, prendeu na semana passada um jovem de 19 anos, suspeito de integrar o grupo de extorsão Scattered Spider. O preso é Peter Stokes, que tem dupla cidadania americana e estoniana, e foi detido em Helsinqu…
A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service. It lets even low-skill criminals take over a victim's phone, steal their banking logins, and capture the one-time codes that protect their accounts. Zimperium's zLa…
A critical flaw in Google's Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-enabled agents in the same Google Cloud project. From there, they could read live conversations, steal the data users shared, and mak…
The National Police in Spain have arrested a man who is suspected of being an active member of the CyberArmy of Russia Reborn (CARR) and Z-Pentest, both pro-Russian hacktivist groups. [...]
The medical device supplier said that a threat actor accessed company systems through a social engineering attack.
A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between the last week of June 2026 and into early July, per findings from ZeroBEC. "The campaign did not depend on a fake Microsoft password p…
A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization's private repositories, researchers at Noma Security have shown. The attacker needs only to open a normal-looking issue on a public repository, with no stolen credentials and no access…
U.S. prosecutors linked an alleged Scattered Spider hacker to a break-in at a luxury jewelry retailer using a persistent Windows device ID, according to a newly unsealed federal complaint. Microsoft records tied that ID first to the account the attackers used to keep access duri…
Pesquisadores da Sysdig identificaram um dos primeiros ataques de ransomware conduzidos por um agente de IA. Atribuído ao operador JadePuffer, o ataque automatiza etapas do golpe que “sequestra” dados de um sistema, mas ainda depende de uma pessoa por trás da operação. Neste cas…
Noma Labs details GitLost, a prompt injection flaw that made GitHub's AI agent expose private repo data through a crafted public issue and guardrail failures.
Tomorrow's webinar explores how behavioral AI can help organizations detect sophisticated phishing, business email compromise, and account takeover attacks while reducing alert fatigue through automated investigation and response workflows. [...]
