Attackers are increasingly purchasing expired domain names to take advantage of their established online reputation and traffic. These domains, referred to as dropcatch domains, can be exploited for malicious purposes, including distributing malware, conducting scams, and setting up command-and-control (C2) infrastructure. Each day, around 65,000 domain names that have lapsed are re-registered by new owners, which presents a significant risk. This trend poses dangers to users and organizations as they may unwittingly interact with these compromised domains, leading to potential security breaches. Awareness of this tactic is crucial for internet users and companies to mitigate risks associated with these expired domains.
Intel has announced the discovery of several high-severity vulnerabilities that could allow attackers to escalate privileges and execute arbitrary code on affected systems. The vulnerabilities affect a range of Intel products, posing significant risks to users and organizations relying on these technologies. In total, both Intel and AMD have fixed over 80 vulnerabilities combined, indicating a widespread issue within the chipmaking industry. Users are urged to apply the latest patches to safeguard their systems against potential exploitation. This situation underscores the need for continuous vigilance and prompt action in maintaining cybersecurity.
Senator Tom Cotton, chair of the Senate Intelligence Committee, has reached out to Treasury Secretary Scott Bessent to advocate for tax code changes aimed at modernizing operational technology (OT). The proposed adjustments are intended to encourage investment in outdated technology, which is crucial for improving defenses against cyberattacks. Cotton's initiative comes in light of increasing vulnerabilities in critical infrastructure that rely on older systems. By making these tax modifications, the senator hopes to bolster security measures and reduce the risk of future cyber incidents that could impact essential services. This effort highlights the ongoing need for government and private sector collaboration to protect vital infrastructure from evolving cyber threats.
The House Intelligence Committee has advanced its fiscal 2027 authorization bill, which includes significant provisions aimed at enhancing state and local threat intelligence and improving election security. This legislation acknowledges the growing risks posed by cyber threats, particularly as they relate to elections and the use of artificial intelligence. By focusing on state and local levels, the bill seeks to bolster resources and support for agencies that are often on the front lines of cybersecurity. The implications of this bill are important, as it aims to create a more coordinated response to potential threats and ensure that local governments have the necessary tools to protect their systems and data. The advancements in election security are particularly timely, given the ongoing concerns about election integrity in the digital age.
A serious vulnerability in the Linux Kernel-based Virtual Machine (KVM) has been discovered, allowing attackers to potentially escape from a virtual machine (VM) to the host system. This flaw, which is 16 years old, affects both Intel and AMD systems. Security researcher Hyunwoo Kim reported that the issue is a use-after-free vulnerability, enabling malicious code running in a guest VM to corrupt the memory of the host kernel. The implications are significant, as it could allow unauthorized access to sensitive data or control over the host. Organizations using affected systems should take immediate action to assess their vulnerability and apply necessary patches to safeguard their environments.
A vulnerability in the Linux KVM hypervisor has been discovered, allowing guest virtual machines (VMs) to escape and potentially compromise the host system. This flaw, identified as CVE-2026-53359 and nicknamed 'Januscape,' arises from a use-after-free bug within the shadow MMU code that is utilized by both Intel and AMD x86 architectures. Researchers have demonstrated a proof-of-concept that can crash the host machine, raising concerns about the security of virtualized environments. The existence of an unreleased exploit that could further exploit this vulnerability has also been claimed, suggesting that the risk is significant. Organizations using Linux KVM on affected systems should take immediate precautions to secure their environments.
A recent warning from the intelligence agencies of the Five Eyes alliance—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—indicates that advanced AI models are set to transform the field of cybersecurity at an accelerated pace. Experts believe that these frontier AI technologies could change how cybersecurity threats are identified and mitigated. The rapid evolution of AI capabilities may outstrip current defenses, making organizations more vulnerable to attacks. This shift is concerning for businesses and individuals alike, as it could lead to more sophisticated cyber threats that are harder to detect and counter. Stakeholders in cybersecurity need to adapt quickly to these changes to protect sensitive information effectively.
A new threat group, referred to as Operation Escaneo, has emerged in Latin America, displaying a unique approach to cyberattacks. This group appears to blend opportunistic monetization with intelligence gathering, often without coordinated efforts between the two activities. This dual focus raises concerns about the potential for more disruptive attacks, as the group may exploit vulnerabilities for financial gain while simultaneously collecting valuable information. The implications of this strategy could affect various sectors in the region, particularly as attackers may target organizations without prior notice. Companies need to be vigilant and enhance their cybersecurity measures to defend against such evolving threats.
Google's threat intelligence team has identified a new extortion group known as UNC6783, which appears to be linked to the Raccoon persona. This group is specifically targeting Business Process Outsourcing (BPO) companies and helpdesk services, indicating a shift in focus towards sectors that handle sensitive customer data. The group's tactics may involve ransomware or other extortion methods, which poses significant risks to affected organizations. Companies in the BPO sector should be vigilant and enhance their security measures to protect against potential breaches and data leaks. As this threat evolves, understanding the methods and motivations behind it will be crucial for businesses in these industries.
Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
Dutch intelligence agencies have issued a warning about Russian hackers who are targeting Signal and WhatsApp accounts. These attackers are using fake support bots and scams that trick users into providing verification codes. The primary targets of these scams are officials and journalists, raising concerns about the potential for unauthorized access to sensitive communications. This incident highlights the ongoing risks posed by cybercriminals and the need for users to be vigilant when managing their online accounts. As these platforms are commonly used for secure communication, any compromise could have serious implications for privacy and security.
A recent security audit conducted by Google and Intel has uncovered a serious vulnerability in the Trusted Execution Environment (TDX) that could allow attackers to fully compromise affected systems. This issue affects various products utilizing TDX technology, which is designed to enhance security by isolating sensitive data. The discovery of this vulnerability raises significant concerns for organizations relying on TDX for data protection, as it could lead to unauthorized access and data breaches. Companies using affected systems should prioritize investigation and remediation efforts to safeguard their environments. As of now, there is no indication of this vulnerability being actively exploited in the wild, but the potential for future attacks remains a pressing concern.
Threat intelligence experts have issued a warning that cybercriminals are actively seeking out misconfigured proxy servers to exploit access to application programming interfaces (APIs) used by various large language models (LLMs). This tactic allows attackers to manipulate these models for malicious purposes, potentially leading to unauthorized data access or the generation of harmful content. Organizations that utilize LLMs need to ensure their proxy servers are correctly configured to prevent exploitation. If left unchecked, these vulnerabilities could allow attackers to compromise sensitive information or disrupt services. It's crucial for companies to take proactive measures to secure their systems against this emerging threat.
The React2Shell vulnerability is currently being exploited by cybercriminals to install malware on Linux systems. Researchers from Palo Alto Networks and NTT Security have identified that this vulnerability facilitates the deployment of malicious tools like KSwapDoor and ZnDoor. KSwapDoor is particularly concerning as it is a sophisticated remote access tool designed to operate stealthily, allowing attackers to maintain control over compromised systems without detection. This ongoing threat affects organizations running vulnerable Linux environments, making it crucial for them to take immediate action to secure their systems. Users need to be aware of the risks and ensure their defenses are updated to mitigate potential attacks.
Hackread – Cybersecurity News, Data Breaches, Tech, AI, Crypto and More
Actively Exploited
A phishing campaign utilizing the Evilginx kit has targeted 18 US universities, successfully bypassing Multi-Factor Authentication (MFA) to steal credentials over a period from April to November 2025. The severity of the threat highlights the vulnerabilities in MFA systems and the need for enhanced security measures in educational institutions.
The article reports on a joint investigation revealing a remote IT worker infiltration scheme linked to North Korea's Lazarus Group. This scheme highlights the persistent threat posed by state-sponsored cyber actors, emphasizing the need for heightened awareness and security measures against such infiltration tactics.