CISA Offers Two Free Tools to Detect Security Misconfigurations in Microsoft 365 and Google Workspace

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) offers two free tools to help organizations find security misconfigurations in Microsoft 365 and Google Workspace. ScubaGear and ScubaGoggles compare cloud settings against recommended security baselines, giving administrators a clearer view of …

Israeli Ad Tech Firm Accused on Using Online Ads to Track Starlink Users

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Israeli advertising company Discover-Tech is accused of using online ads to track people connected to SpaceX’s Starlink satellite internet service. Reuters reported on October 27 that six people familiar with the research said TrendAI researchers linked the company to unusually …

Hackers Use Fake FedEx Invoices to Deploy Sirius Backdoor and Evade Windows Security

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Hackers are sending fake FedEx tax invoices to trick users into installing a stealthy backdoor on Windows. The malware, called Sirius Backdoor, hides inside a blank PDF and loads its main code directly into memory, which leaves very few traces …

Hackers Abuse Signed ChatGPT and Claude Binaries to Deploy Malware Through Fake GitHub Downloads

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A malware campaign known as Yoba targets users by leveraging the popularity of AI tools like ChatGPT and Claude to trick them into installing infected software. They publish fake GitHub projects that pose as desktop apps named GPT-5.6 Sol, GPT-6 …

Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to Gain Elevated Privileges

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

HashiCorp has released fixes for a Consul-k8s authorization bypass that could allow an attacker to gain elevated Consul privileges from another Kubernetes namespace. Tracked as CVE-2026-110720, the flaw affects deployments using automated system access control list management. HashiCorp disclosed the …

Apple iOS 27.2 Released With Fixes for 163 Vulnerabilities, Including Fix for Critical WebKit RCE

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Apple released iOS 27.2 and iPadOS 27.2 on October 26, 2026, with fixes for 163 security flaws. The update covers iPhone 11 and later and a wide set of iPad models. The most serious issues sit in WebKit, the engine …

Hackers Hijack AI Pentesting Agents to Install Backdoors and Steal API Keys

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Hackers are now targeting the AI tools that security teams use to test their own networks. A new investigation describes automated campaigns that break into exposed panels for Cairn, a platform that gives AI agents goals and lets them work …

Apple Released Patches for Exploited CoreGraphics 0-day Vulnerability for Older iPhones

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Apple released iOS 18.7.11 and iPadOS 18.7.11 to patch a CoreGraphics zero-day vulnerability that attackers may have used in targeted attacks. Released on October 26, 2026, the updates bring security fixes to older devices, including the iPhone XS, iPhone XS …

Hacker Uses AI to Breach 90 South Korean Organizations and Steal 8.2 Million Records

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

South Korean police have arrested a 32-year-old man accused of leading an AI-assisted hacking operation that stole personal records and internal files from about 90 organizations, totaling 8.2 million records. Targets included hospitals, private academies, golf courses, universities, and large …

Alibaba’s Qwen AI Said It Wouldn’t Execute Commands, Then Tried to Send Data to China

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Alibaba’s Qwen3.8-Flash-Next attempted an unexpected upload to an Alibaba Cloud storage bucket in Beijing during a closed security test, according to Cohere. The model’s reasoning had just stated that it would not call any tools. Cohere’s sandbox blocked the connection, …