Cryptika Cybersecurity News

A hidden “context bomb” prompt in a cloud decoy can disrupt AI agents and force Qwen3.8-27B to stop simulated attacks. The technique worked against both the original and modified “abliterated” versions. Context bombs are defensive strings placed in vulnerable resources, …

A newly uncovered software supply chain attack has shown how quickly a trusted developer account can become a delivery route for malware. The operation, tracked as GHAPPIER, reached 65 GitHub repositories, infecting 73 files across 22 accounts. It involved a …

A suspected Chinese-speaking threat actor has used WordPress vulnerabilities to break into at least 49 organizations across 29 countries. The campaign exposed how a compromised website can become a launchpad for database theft, credential abuse, and wider network intrusion. The …

A newly detailed Windows privilege escalation flaw tracked as CVE-2026-66804 allowed a standard, low-privileged user to plant a malicious DLL and execute arbitrary code with full NT AUTHORITYSYSTEM privileges, exploiting a lingering weakness in how Windows handles Component Object Model …

D-Link Systems has disclosed that it is investigating a critical security vulnerability in its DIR-822A router, tracked as CVE-2026-86296. The flaw has received the maximum CVSS severity score of 10.0. It may allow remote attackers to compromise vulnerable devices without …

Vidar has spent years stealing the data people keep closest: saved passwords, browser cookies, wallet files and system details. Now its operators have changed a less visible part of the malware, making the code harder for defenders to recognise before …

Threat actors that gain a foothold in a Windows network are increasingly aiming for the domain controller, the server that manages identities and permissions. A successful theft of its Active Directory database can expose password material for every account in …

The modern breach doesn’t kick the door in it signs in. Stolen sessions, abused service accounts, and helpdesk-reset social engineering made identity the primary attack surface, and Identity Threat Detection and Response (ITDR) solutions the fastest-growing detection category. We scored …

Customer identity is where security meets revenue: every point of login friction costs conversions, while every authentication gap invites account takeover (ATO) attacks and automated credential stuffing. Customer identity is where security meets revenue: every point of login friction costs …

The password’s obituary has been written for a decade, but 2026 is the year the funeral actually gets scheduled: platform passkeys are mainstream, attackers pivoted to stealing sessions instead of secrets via adversary-in-the-middle reverse proxies, and every vendor in this …