Cybersecurity

New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks

A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise…

Hackers compromise 4,800 GitHub accounts to steal cloud credentials

A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware.

New N-able "4EverAble2Shell" zero-day exploited hours after PoC released

Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed "4EverAble2Shell" to compromise servers and deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, including…

ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories

A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it. Simple things to remember.

New Windows SignDrop zero-day gives hackers SYSTEM privileges

Security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) has released a new Windows zero-day exploit that can let attackers gain SYSTEM privileges.

Also: The Hacker News

Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass

Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass.

186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers

Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches.

Police dismantle Gootloader, CastleRAT, StealC malware infrastructure

Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations.

Your Endpoint Management Platform Could Be Your Biggest Security Risk

Endpoint management platforms can become powerful attack tools when compromised, allowing hackers to deploy malware, execute commands, and disrupt thousands of devices.

Apify rotates API tokens, prompts 2FA resets after breach

Apify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems.

Chrome, Firefox Updates Patch Over 180 Vulnerabilities

Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.

European tech buyers add digital sovereignty to cyber shopping list

Sales from EU HQ'd vendor rocket in two years. The Trump affect? Yes but NIS2 and DORA are factors too

Hackers Deploy Malware in Fresh ScreenConnect Campaign

The attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication.

Critical Red Hat Quay Vulnerability Could Expose Private Container Images

Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.

Also: The Hacker News

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday.

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access.

Baker Tilly notifies clients of data breach at third-party provider

The Baker Tilly Advisory Group is notifying clients that a data breach has compromised certain personal information about them and their dependents.

Active ScreenConnect attacks breach MSPs, impact dozens of organizations

ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.

Notion says Fireworks breach exposed customer AI chat transcripts

Notion, the digital workspace platform, disclosed that a security breach at its AI infrastructure provider, Fireworks AI, exposed Notion AI chat transcripts in a small number of workspaces.

Today: CISO Forum Virtual Summit 2026 Day 2 – Join Cybersecurity Leaders Online

Designed for cybersecurity leaders, this immersive two-day virtual event is your premier destination to discuss, share, and learn innovative risk management and defense strategies defining the modern enterprise.

Maersk confirms data breach as WhiteArmor ransomware demands $5 million

Maersk announced that a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisition and extracted data from it.

Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation

Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems.

Hackers use AntiFox AI agents in AWS credential-theft attacks

Attackers are using Alibaba Cloud to host self-managed instances of AntiFox, an open-source agentic penetration testing platform, to target web services and AWS environments.

eBPF Rootkits: Why Underground Actors Are Taking Notice

Linux eBPF rootkits can hide malicious activity and evade traditional detection methods without loading kernel modules.