Tennessee has become the second state in the U.S. to ban cryptocurrency ATMs, following Indiana's lead, due to rising concerns over scams linked to these kiosks. Governor Bill Lee signed the legislation aimed at curbing the exploitation of these machines, which have increasingly been used in fraudulent activities. This move reflects a broader trend among lawmakers to regulate cryptocurrency operations amid fears of financial fraud. As scammers often use ATMs to facilitate quick and anonymous transactions, this ban may help protect consumers from losing money to these schemes. The legislation is an effort to enhance consumer safety in the evolving landscape of digital currencies.
A report from Cybernews reveals that over 80 browser extensions have been selling user data, impacting more than 6.5 million users. These extensions, which are meant to enhance web browsing experiences, have been found to collect and monetize information without clear consent from users. This situation raises significant privacy concerns, as individuals may not be aware that their personal information is being sold for profit. Users of these extensions need to be vigilant about the tools they install and the permissions they grant, as this incident illustrates the potential risks associated with seemingly harmless browser add-ons. The broader implications for digital privacy and security are significant, prompting a need for stricter regulations on data collection practices.
A new multi-stage malware campaign is targeting employees of Pakistan's Punjab Safe Cities Authority and the Punjab Police Integrated Command, Control & Communication Centre. Researchers have noted that the attackers are using sophisticated obfuscation tactics to evade detection. This level of complexity suggests that the attackers are well-resourced and may have specific goals in mind, which could include espionage or disruption of services. The campaign's focus on law enforcement and public safety agencies raises concerns about the potential for serious consequences, including compromised security operations and sensitive data breaches. As these entities play crucial roles in maintaining public safety, any successful infiltration could have far-reaching implications for security in the region.
Researchers at KELA have identified a staggering 2.9 billion compromised credentials that are being circulated in the cybercriminal underground. Infostealers, which are malicious programs designed to extract sensitive information like usernames and passwords, are the primary method attackers are using to gain unauthorized access to accounts. This situation poses significant risks for individuals and organizations alike, as compromised credentials can lead to identity theft, financial loss, and data breaches. The sheer volume of stolen credentials emphasizes the need for stronger security measures, such as enabling two-factor authentication and regularly updating passwords. Companies and users must remain vigilant to protect their sensitive information from ongoing cyber threats.
Forescout has discovered a significant number of exposed VNC and RDP servers that are accessible over the internet, particularly affecting industries that rely on Industrial Control Systems (ICS) and Operational Technology (OT). Researchers found that tens of thousands of these servers could be targeted, raising concerns about potential unauthorized access to critical infrastructure. The exposure of these systems could allow attackers to disrupt operations, steal sensitive data, or compromise safety systems. Companies in sectors such as manufacturing, energy, and transportation need to assess their network security and ensure that these remote access protocols are properly secured. Failure to address these vulnerabilities could lead to severe operational and financial consequences.
The Claude Mythos incident has raised alarms in Japan's financial services sector, as it appears to be a sophisticated cybersecurity threat that could disrupt operations. Financial institutions are particularly vulnerable because of the sensitive data they handle and the potential for significant financial loss. The emergence of this threat has prompted companies to reassess their security protocols and bolster their defenses against potential attacks. Experts are urging organizations to enhance employee training and increase their monitoring of unusual activities to mitigate risks. As the situation develops, the financial sector must remain vigilant to protect against these emerging threats.
Hackread – Cybersecurity News, Data Breaches, AI and More
Peter Stokes, a dual US-Estonian national, was arrested in Finland due to his alleged involvement with the cybercriminal group known as Scattered Spider. He faces multiple charges in the United States, including cyberattacks, fraud, and data breaches. This group has been linked to various high-profile attacks that compromise sensitive data and disrupt services. Stokes' arrest highlights the ongoing international efforts to combat cybercrime and the increasing collaboration between law enforcement agencies across borders. The case also raises awareness about the risks posed by cybercriminal organizations that operate globally, affecting both individuals and businesses alike.
A cyber group from Iran, known as Handala, has reportedly targeted U.S. service members stationed in Bahrain. The group sent threatening messages via WhatsApp, warning troops that they would be attacked with drones and missiles. This incident raises concerns about the safety and security of military personnel in the region, especially given the increasing frequency of cyber threats aimed at U.S. forces. The nature of the messages suggests a deliberate attempt to instill fear and disrupt operations. Authorities are likely to investigate the source and intent behind these communications to ensure the safety of service members and assess any potential risks.
CISA and Microsoft have issued a warning about the exploitation of a Windows Shell vulnerability identified as CVE-2026-32202. This zero-click vulnerability allows attackers to trick victims' systems into authenticating with the attacker's server, potentially exposing sensitive information. CVE-2026-32202 is linked to an incomplete fix for a previous vulnerability (CVE-2026-21510), which was targeted by the APT28 group using malicious LNK files. Microsoft had released patches for these vulnerabilities in February 2026, but the new exploit indicates that attackers have found ways to bypass these security measures. Users and organizations running affected systems need to be vigilant and apply available updates to safeguard against these kinds of attacks.
A recent report from RunSafe has found that about 25% of healthcare organizations have experienced cyber-attacks targeting their medical devices. These attacks often disrupt patient care, raising serious concerns about the security of devices such as infusion pumps and imaging systems. The report emphasizes that many healthcare providers are unprepared for these threats, which can lead to delays in treatment and pose risks to patient safety. As medical devices become more interconnected, the potential for cyber incidents increases, making it crucial for healthcare organizations to prioritize their cybersecurity measures. This situation underscores the urgent need for better security protocols in the healthcare sector to protect both patients and medical systems.
A recent security assessment has identified 38 vulnerabilities in OpenEMR, a widely used medical software platform. Some of these vulnerabilities could allow attackers to access and modify sensitive patient information, raising significant concerns for healthcare providers that rely on this software to manage patient records. Given the critical nature of health data, these vulnerabilities pose a serious risk to patient privacy and safety. OpenEMR users, including medical practices and clinics, should take immediate action to secure their systems. The findings emphasize the need for regular security audits and timely updates to safeguard against potential breaches.
Hackread – Cybersecurity News, Data Breaches, AI and More
Researchers at Novee have identified a serious vulnerability in Cursor AI, designated as CVE-2026-26268. This flaw could allow attackers to execute malicious code when developers clone repositories, potentially compromising their systems. The vulnerability is particularly concerning for those using Cursor AI in their development workflows, as it opens up a pathway for exploitation that could lead to data breaches or the introduction of harmful code. Developers and organizations using this integrated development environment should take immediate action to assess their systems for this vulnerability and understand the risks involved. Awareness and prompt remediation are crucial to maintaining security in software development processes.
A significant vulnerability, identified as CVE-2026-3854, has been discovered in GitHub.com and GitHub Enterprise Server, potentially allowing remote code execution. This flaw poses a risk to millions of repositories hosted on these platforms, which are widely used by developers and organizations for version control and collaboration. If exploited, attackers could execute arbitrary code, leading to unauthorized access and manipulation of sensitive codebases. The discovery emphasizes the need for users to remain vigilant and update their systems promptly to mitigate potential risks. GitHub has urged users to apply the latest patches to safeguard their repositories against this vulnerability.
A serious SQL injection vulnerability, identified as CVE-2026-42208, has been discovered in BerriAI's LiteLLM Python package, with a high CVSS score of 9.3. Remarkably, this flaw has already been actively exploited within just 36 hours of its public disclosure. Attackers can use this vulnerability to modify the database underlying the application, posing significant risks to any systems using LiteLLM. Organizations that rely on this package need to act quickly to protect their data and systems from potential breaches. Users should remain vigilant and apply necessary updates or patches as soon as they are available to mitigate these risks.
In a recent interview, Scott Schnoll, a Microsoft MVP for Exchange, discussed common mistakes organizations make regarding security controls in Exchange Online. He emphasized the importance of understanding the Shared Responsibility Model, where Microsoft manages cloud security while organizations are responsible for their data and configurations. Schnoll pointed out that legacy protocols like SMTP AUTH often remain enabled due to dependencies on older systems, which can create vulnerabilities. He also identified critical controls that are frequently overlooked, such as Conditional Access and Privileged Identity Management (PIM), and noted the gaps in audit logs that can hinder effective monitoring. Organizations need to take immediate action to adjust default settings and implement better security practices to protect their environments.