The European Union has imposed sanctions on two Chinese individuals, two Chinese companies, and one Iranian firm for their involvement in hacking operations targeting EU member states. This action reflects ongoing concerns about cyber threats linked to state-sponsored actors and their impact on national security and digital infrastructure. The sanctioned entities are believed to have contributed to cyber activities that undermine the stability and security of EU countries. By taking these measures, the EU aims to deter further malicious cyber operations and hold accountable those involved in such activities. This situation underscores the increasing vigilance by international bodies in combating cybercrime and protecting digital sovereignty.
Latest Cybersecurity Threats
Real-time threat intelligence from trusted sources
A malicious Chrome extension called ShieldGuard was discovered to be a crypto scam masquerading as a security tool. This extension primarily targeted users looking to protect their cryptocurrency wallets but instead siphoned off sensitive wallet information and drained user data. Researchers found that once installed, the extension would exploit its permissions to access and transfer funds from users' crypto wallets. This incident affects anyone who installed the ShieldGuard extension, highlighting the ongoing risks of using unverified browser extensions in the cryptocurrency space. Users are urged to be cautious and only download extensions from reputable sources to safeguard their assets.
A new exploit kit called 'Darksword' is being used to target iPhones, particularly affecting users of cryptocurrency wallet applications. This exploit allows attackers to steal various personal information from compromised devices. The existence of Darksword raises significant concerns, especially for those who handle sensitive financial data on their mobile devices. As users increasingly rely on their phones for managing cryptocurrencies, the risk of falling victim to such attacks is growing. It’s crucial for iPhone users to stay vigilant and ensure their devices are updated to protect against these vulnerabilities.
SCM feed for Latest
A recent analysis has revealed that MCP (Machine Control Protocol) introduces a hidden attack surface that can jeopardize zero-trust security frameworks. Researchers have identified that this backdoor can be exploited by attackers, creating vulnerabilities in systems that rely on zero-trust architectures to secure sensitive data. Companies using MCP in their infrastructure may find themselves at risk, as the protocol's design leaves gaps that could be targeted. This situation raises significant concerns for organizations aiming to implement stringent security measures, as it highlights the need for a thorough review of their security protocols. Addressing these vulnerabilities is crucial to maintaining trust and security in digital environments.
Apple has rolled out new WebKit patches to enhance security protections for its users. These updates aim to fill the gaps between regular security updates, addressing vulnerabilities that could potentially be exploited by attackers. While specific details about the vulnerabilities have not been disclosed, the updates are essential for users of Apple's web browsing technologies, which are integral to Safari and other applications. Keeping WebKit up to date is crucial as it helps protect against possible security risks that could compromise user data and privacy. Users are encouraged to ensure their devices are running the latest version to benefit from these improvements.
A significant rise in hardcoded secrets found in public GitHub commits has raised concerns among cybersecurity experts. In 2025, researchers identified 28.65 million instances of sensitive data, such as API keys and passwords, embedded directly in code. The alarming trend shows that AI coding assistants are twice as likely to contribute to these leaks compared to traditional coding methods. This increase in exposed secrets, which rose by 34% from previous years, poses a serious risk to organizations, potentially leading to unauthorized access and data breaches. Companies and developers must be vigilant in managing their code and ensuring that sensitive information is not inadvertently shared in public repositories.
The Hacker News
Cybersecurity researchers have identified nine significant vulnerabilities in low-cost IP KVM devices from four vendors: GL-iNet Comet RM-1, Angeet/Yeeso ES3 KVM, Sipeed NanoKVM, and JetKVM. These flaws can allow unauthorized users to gain root access, giving them extensive control over affected systems. The most critical vulnerabilities could enable attackers to execute commands and manipulate the devices without authentication. This poses a serious risk, especially for organizations relying on these devices for remote management of their IT infrastructure. Users of these products are urged to take immediate action to secure their systems and monitor for any suspicious activity.
Infosecurity Magazine
Researchers have identified a new version of the Vidar Stealer malware, known as Vidar 2.0, which is being distributed through fake game cheats on platforms like GitHub and Reddit. This malware targets users looking for free cheats for popular games, tricking them into downloading malicious software instead. Once installed, Vidar 2.0 can steal sensitive information, including passwords, credit card details, and other personal data. This method of delivery raises concerns as it exploits trusted platforms, making it harder for users to recognize the threat. Gamers and users of these platforms should be particularly cautious when downloading software that claims to be free game cheats, as it could lead to serious security breaches.
Kaspersky's Security Operations Center has identified a new Horabot campaign targeting users in Mexico. This campaign involves sophisticated tactics that aim to compromise systems and steal sensitive information. Researchers have provided insights into how the attack is carried out, which can help security teams identify and respond to the threat effectively. The focus on Mexico suggests that local businesses and individuals may be particularly vulnerable, highlighting the need for increased awareness and protective measures. Understanding the methods used in this campaign can assist in preventing future attacks and safeguarding valuable data.
A security researcher has discovered a vulnerability in WhatsApp that allows users to bypass the app's 'View Once' feature, which is designed to make images and videos disappear after being viewed. This issue arises from the use of a modified client application, and Meta, the parent company of WhatsApp, has stated it will not release a patch for this vulnerability. The decision not to address the flaw raises concerns about user privacy, as it undermines the security feature intended to protect sensitive media. Users who rely on this feature for confidential communications may be at risk of having their private content saved and shared without consent. The vulnerability's existence highlights the potential for modified applications to exploit weaknesses in popular messaging platforms.
Infosecurity Magazine
According to a recent report by Gartner, security teams should prioritize their involvement in artificial intelligence (AI) projects to prevent expensive incident response efforts in the future. The research suggests that by 2028, AI-related issues will account for half of all incident response activities. This shift highlights the growing intersection between cybersecurity and AI, emphasizing that companies need to integrate security considerations from the outset of AI development. Failing to do so could lead to significant vulnerabilities and costly breaches. As AI technology becomes more prevalent in various sectors, understanding its risks and preparing for potential security incidents will be crucial for organizations.
The ongoing conflict in Iran is expected to extend, leading to an increase in cyber threats and potential disruptions in energy supply across the region. Companies operating in the Middle East may face heightened risks as tensions escalate. Cybersecurity experts are warning that this situation could result in more frequent and severe cyberattacks aimed at critical infrastructure and private enterprises. The implications of such attacks could be wide-ranging, impacting not just local businesses but also global markets and energy prices. Stakeholders in the region are advised to bolster their cybersecurity measures to mitigate potential risks.
The Hacker News
A significant security vulnerability, identified as CVE-2026-3888, has been discovered in default installations of Ubuntu Desktop versions 24.04 and later. This flaw allows unprivileged local attackers to escalate their privileges to root access, potentially giving them complete control over the affected systems. With a CVSS score of 7.8, this high-severity issue poses a serious risk to users who have not applied necessary security measures. It is crucial for Ubuntu users to be aware of this vulnerability, as it could lead to unauthorized access and manipulation of sensitive data. Immediate action is recommended to safeguard systems against potential exploitation.
Help Net Security
Online fraud is becoming a significant issue globally, with losses reaching $442 billion, according to INTERPOL's latest report. The increase is attributed to the rise of digital tools and organized crime networks that operate internationally. Between 2024 and 2025, there was a 54% increase in fraud-related notices, indicating a growing number of victims affected by these scams. The report categorizes financial fraud as one of the top five global crime threats, emphasizing the need for better security measures and awareness. The surge in fraud impacts individuals and businesses alike, highlighting the urgency for enhanced protective strategies in the digital space.
The Hacker News
Researchers have identified a severe vulnerability in the GNU InetUtils telnet daemon, known by its CVE identifier CVE-2026-32746. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges through Telnet connections on port 23. With a CVSS score of 9.8, this vulnerability poses a significant risk to systems using the affected telnetd. The issue arises from an out-of-bounds write in the LINEMODE Set, which could be exploited easily by attackers. Organizations using this software need to take immediate action to secure their systems, as the implications of this flaw could lead to unauthorized access and control over critical infrastructure.