Uncategorized

Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery 2026-07-01 at 08:32 By ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake “prove you’re human” pages are now handed out by API-driven servers that give each visitor […]

Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service 2026-07-01 at 08:22 By Citrix on Tuesday released security updates to address multiple flaws in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that could be exploited by an attacker to facilitate arbitrary file reads or trigger a denial-of-service (DoS) condition. The

Nearly Half of Organizations Lack “Full” Visibility Into Employee AI Usage 2026-07-01 at 07:00 By A recent report by Bitdefender analyzed employee AI tool usage.  This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

Trump administration lifts export controls on Anthropic’s most powerful AI models, ending bitter standoff 2026-07-01 at 03:15 By James Franey Because the San Francisco-based startup could not reliably filter out foreign users in real time, it had disabled the cutting-edge software worldwide. This article is an excerpt from Latest Technology News | New York Post

Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data 2026-06-30 at 20:46 By New Microsoft research shows how attackers can hijack AI agents that act on a user’s behalf, using nothing more than a poisoned tool description to make the agent quietly hand over company data to an outsider. The trick is that the

RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS 2026-06-30 at 20:45 By A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline. Researchers at QiAnXin’s XLab have tracked it since

Mark Zuckerberg’s Meta loses bid to toss lawsuit alleging Facebook and Instagram addict children 2026-06-30 at 19:08 By Reuters Meta said attorneys general had no evidence it misled consumers about its platforms’ alleged addictiveness, including in congressional testimony by Mark Zuckerberg. This article is an excerpt from Latest Technology News | New York Post View

Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints 2026-06-30 at 18:47 By Threat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero cryptocurrency miner. The activity has been found to weaponize CVE-2026-33017 (CVSS score: 9.3), an unauthenticated remote code execution (RCE)

Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses 2026-06-30 at 18:40 By Cybersecurity researchers have flagged an active browser extension campaign that is designed to steal cryptocurrency by stealthily replacing wallet addresses when unsuspecting users initiate a transaction. The cryptocurrency clipper activity has been codenamed Silent Swap by McAfee Labs.

What the Numbers Say About FIFA 2026 Cyber Risk 2026-06-30 at 17:48 By The FIFA World Cup 2026 opened on June 11. By that date, according to Check Point Research, the fraud infrastructure targeting it had already been built, staged, and partially deployed. Threat actor activity was pre-planned, months out, across three sectors and at

GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks 2026-06-30 at 17:26 By The safety check that is supposed to stop an AI coding agent from running a dangerous command can be walked straight past using a shell trick that has been public for decades. New research from Adversa AI, which is named the

282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study 2026-06-30 at 16:49 By Researchers tested 444 AI chatbot apps for iPhone and found that 282 of them, nearly two-thirds, exposed paid AI access through their network traffic. In many cases, the path in was visible just by watching

Security Organizations Reveal Threat Management Fails to Match Visibility 2026-06-30 at 16:31 By A recent report by Filigran analyzes the gap between threat visibility and threat management.  This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

AirDrop and Quick Share Flaws Let Nearby Attackers Trigger Crashes and Bypass Checks 2026-06-30 at 15:39 By Two researchers have found six security flaws in AirDrop and Quick Share, the wireless features that beam files between nearby devices with no cables or shared network. An attacker within wireless range, with just a laptop and no

Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer 2026-06-30 at 14:18 By An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer. The intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0), a critical authentication bypass

The BYOVD Epidemic: How Attackers Are Weaponizing Trusted Windows Drivers to Kill Security 2026-06-30 at 13:00 By Threat Hunter Team Bring Your Own Vulnerable Driver (BYOVD) has gone from a niche tactic to a standard part of the ransomware playbook and Windows’ own kernel hardening does little to stop it. This article is an excerpt

Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth 2026-06-30 at 12:45 By A critical vulnerability in Progress Kemp LoadMaster can let an unauthenticated attacker execute arbitrary commands as root on the appliance by sending a crafted request to its API. The flaw, tracked as CVE-2026-8037, carries a CVSS score of 9.8 according to ZDI.

New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials 2026-06-30 at 11:37 By Convince an AI browser that it is playing a game, and it can hand over your login details. That is the finding behind BioShocking, a technique from security firm LayerX that tricked six AI browsers and assistants into copying a user’s credentials

Ransomware Is About Leverage: Return on Risk Takes It Away 2026-06-30 at 11:00 By Return on Risk offers an alternative way to think about resilience.  This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs 2026-06-30 at 10:15 By Apple on Monday released security updates for iOS, macOS, and the Safari web browser to address over three dozen flaws, including four vulnerabilities in WebKit that were discovered using artificial intelligence (AI) tools like Anthropic Claude and OpenAI Codex Security.