Cryptika Cybersecurity News

Security researcher MSNightmare, also known as Nightmare-Eclipse, has released BigDiskBuster, a proof-of-concept denial-of-service technique designed to stop Microsoft Defender Antivirus from completing platform and security-intelligence updates. The project is presented as a successor to UnDefend. The researcher claims it works …

Hackers are exploiting a critical cPanel and WHM flaw to place Mirai malware on exposed servers, extending a botnet threat normally associated with connected devices. The activity produced a sharp rise in suspicious Telnet traffic and exposed a wider Internet …

North Korean-linked WaterPlum operators have turned job hunting into a route for theft. By posing as recruiters, they persuaded software developers to run harmful files during apparently normal online interviews. The campaign, also known as Contagious Interview, reached at least …

A newly identified Android banking Trojan called RatHat uses phone features for account theft. The malware can guide itself through an infected device, capture banking logins, intercept verification codes and reconstruct a victim’s screen-lock PIN or pattern. The campaign begins …

Push-bombing, real-time phishing kits, and helpdesk social engineering broke “any MFA is fine.” The 2026 question is which MFA survives an attacker who can relay codes and spam approvals so we scored ten leading solutions against a weighted rubric that …

Quick Answer: Microsoft Entra ID is the bundled default for M365 estates; Okta leads neutral catalog breadth; Ping Identity owns complex enterprise; JumpCloud wins SMB directory+SSO (free tier); Cisco Duo pairs SSO with best-in-class MFA. Ownership note: Auth0 belongs to …

Quick Answer: SailPoint remains the IGA benchmark with AI-driven certifications; Saviynt leads cloud-native converged governance; Microsoft Entra ID Governance wins bundled economics in M365 estates; Omada owns the configurable mid-enterprise; One Identity rules AD-heavy shops. IGA answers the question auditors …

OpenAI Codex recently faced two significant security vulnerabilities that allowed malicious repositories to potentially execute commands on a developer’s local system. These vulnerabilities, identified as Overpatch and Heapjack, were reported to OpenAI on August 12, 2026, and were addressed in …

Quick Answer: CyberArk remains the enterprise PAM benchmark; BeyondTrust and Delinea complete the leader trio; ManageEngine PAM360 wins value; HashiCorp Vault owns machine/secrets privilege; and Microsoft Entra PIM covers Azure-role JIT for E5 estates. Ransomware crews hunt privileged credentials first …

A web cache poisoning technique called cache key injection could let attackers access restricted data, disrupt websites, or poison cached pages with malicious content. Alex Brumen’s research shows attackers don’t always need to exploit unkeyed HTTP request values, the usual …