Exposed WordPress Backups Became a Gold Mine of AWS and Email Credentials

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Exposed WordPress backups have become a valuable source of cloud and email credentials for attackers using a toolkit called TIKTOUK. Rather than relying on one technique, its components search websites for sensitive files, recover stored passwords, and collect secrets from …

Zammad 0-Day Vulnerabilities Exploited to Gain Remote Code Execution and Root Access

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Two critical Zammad zero-day flaws, reportedly exploited against the Dutch Institute for Vulnerability Disclosure (DIVD), could allow session hijacking, remote command execution as the Zammad service user, and potential root privilege escalation. The vulnerabilities are tracked as CVE-2026-102489 and CVE-2026-102490. …

Free iCloud Account Could Let Attackers Spoof Any @icloud.com Address and Pass Email Security Checks

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Security researcher Timo Longin, working with the SEC Consult Vulnerability Lab, disclosed two email spoofing flaws in Apple’s iCloud mail infrastructure that could have let someone with a free iCloud account send messages that appeared to come from any @icloud.com …

Sony Rolls Out PS5 Security Update Following the Release of Relapse Jailbreak

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Sony has moved to protect PlayStation 5 consoles with its latest system software update, as the newly released Relapse jailbreak draws attention to a broad set of older PS5 firmware versions. The update matters for console owners because the public …

Session Cookie Vulnerability Lets Attackers Bypass Entra ID MFA and Impersonate Users

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A flaw in a custom session-cookie system allowed an unauthenticated attacker to pose as employees and administrators in a yard management platform. The issue did not break Microsoft Entra ID itself. Instead, it let a weak application-side session layer accept …

Critical Capacitor Flaw Lets Malicious Links Access App Data and Native Features

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A critical vulnerability in Capacitor for Android and iOS could let a malicious link opened inside an affected mobile app load attacker-controlled web content at the application’s trusted origin. The issue, tracked as CVE-2026-103922, can expose app data stored in …

Safari History Database Tags Can Reveal What Users Were Browsing on macOS

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A little-known Safari database feature could give digital forensic investigators another way to understand browsing activity on macOS. Safari’s History database can store automatically generated topic tags for some webpages, potentially revealing themes a user explored even when the original …

Milk Dragon AiTM Kit Uses Real-Time OTP Relay and WebSocket Keylogging to Bypass MFA

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Milk Dragon is a phishing kit designed to turn an attractive online bargain into a fast-moving payment fraud attempt. The operation, also known as NaiLong, has been active since October 2025 and uses fake retail offers to draw shoppers toward …

Kiteworks Patches 126 Vulnerabilities in Massive Security Update

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Kiteworks has released a major security update that addresses 126 vulnerabilities across its secure data transfer platform and associated applications. The update includes fixes for critical account takeover flaws, high-severity code execution bugs, security bypass issues, unauthorized data modification, privilege …

Cloudflare Launches Free Certificate Authority for the Whole Internet

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Cloudflare has announced plans to become a public Certificate Authority, expanding its role in securing the global web. The company aims to offer free, automated digital certificates for websites while also preparing the Internet for post-quantum cryptography. A Certificate Authority, …