Critical NEXT.JS Flaw Allows Remote Code Execution Via Weaponized SVG File

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A critical Next.js vulnerability, tracked as CVE-2026-94545, affects the Node.js ImageResponse implementation in the next/og package and could allow remote code execution by exploiting malicious SVG content during image generation. The issue affects Next.js versions 16.2.0 through versions before 16.3.6. …

Fake Crypto Wallet App Spreads PamStealer Malware to Steal Mac Passwords

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A fake cryptocurrency wallet download is delivering a new version of PamStealer to Mac users. The attack starts with a convincing website whose installer asks visitors to follow instructions. Running the disguised file starts a hidden chain that can capture …

The Domains Keep Disappearing, but the Malware Infrastructure Behind Them Never Moves

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Fake verification pages are steering people toward malware, but the web addresses behind the lures keep changing. Over five months, investigators tracked four different attack chains that began with the same hosting network, even as domains, downloads and command servers …

NVIDIA Fixes Linux Component Flaws That Could Expose Sensitive System Information

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

NVIDIA released a security update for its Infrastructure Controller software for Linux, addressing 14 vulnerabilities that could let attackers access sensitive system information, execute code, alter data, or disrupt affected environments. The update, published in NVIDIA’s September 2026 Infrastructure Controller …

The Phishing Kit That Turned Microsoft’s Login Flow Into an AI-Powered Fraud Machine

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

EvilTokens turns a Microsoft sign-in into a route to corporate email fraud. The phishing kit, first seen in February 2026, tricks people into approving an attacker’s login through a real device code process without handing over a password. The lure …

The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Malware has moved into tools developers use to build and manage cloud infrastructure. A campaign linked to Graphalgo planted a remote access program in Terraform providers and Go software packages, turning routine development work into a possible route onto valuable …

AI-Driven Cyberattacks Enter New Phase With Autonomous Fraud and Digital Trust Abuse

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Cyberattacks are increasingly built around familiar actions: signing in, approving a payment, or using a trusted app. Artificial intelligence can help attackers repeat those actions at speed, making financial fraud and network intrusion harder to spot before damage is done. …

A Fake Streaming App Turned Android Phones Into Remote-Controlled Devices

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A free television offer led Android users to a dangerous download. Ads for a streaming service urged them to install an app that could give criminals control of their phones, rather than access to shows. The malware behind the campaign …

Critical SolarWinds Flaws Let Attackers Remotely Execute Code on Observability Servers

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

SolarWinds released Observability Self-Hosted 2026.2.3 to fix two serious vulnerabilities that could let unauthenticated attackers remotely execute code on affected observability servers. The flaws, tracked as CVE-2026-28324 and CVE-2026-28325, affect specific non-default configurations and communication modes. The update was released …

Top 10 Best Decentralized Identity Solutions in 2026 [Ranked & Scored]

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

EU digital identity and GDPR compliance mandates, deepfake-driven fraud in authentication and verification, and credential-reuse fatigue pushed decentralized identity from conference-talk to contract. We scored ten players on standards depth, production evidence, and enterprise readiness and flagged the market’s churn …