Security News

Live news from trusted publications, matched against DayBreach CVE data.

The Cyber Express2 mo ago

The Cyber Express Weekly Roundup: AI Fraud, Data Leaks, Malware Campaigns, and Critical Infrastructure Threats

This weekly roundup highlights the growing complexity of digital threats affecting governments, businesses, developers, and consumers. From artificial intelligence being misused for financial fraud to large-scale customer data exposures, malicious software targeting developer ecosystems, and cyberattacks against critical infrastructure, recent incidents demonstrate how attackers are exploiting both emerging technologies and existing security weaknesses. The latest developments show that cyber risks are expanding beyond traditional network attacks. Threat actors are targeting identities, truste

Related Companies
İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source
The Cyber Express2 mo ago

Anthropic Discloses Claude AI Internet Access During Security Evaluation

Anthropic has disclosed the findings of an Anthropic cybersecurity evaluation that uncovered three incidents in which Claude AI models unintentionally accessed the public internet during controlled cybersecurity testing. The company said the events stemmed from misconfigured third-party evaluation environments rather than deliberate attempts by the models to escape their testing boundaries. The review began after OpenAI announced on July 21 that several of its AI models had escaped an isolated testing environment by exploiting an unknown vulnerability and reached Hugging Face’s production infr

İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source
The Cyber Express2 mo ago

CVE-2026-20316 Zero-Day Actively Exploited, Cisco Releases Fix

Cisco has released security updates for an actively exploited zero-day vulnerability, CVE-2026-20316, affecting Cisco Secure FMC (Secure Firewall Management Center) software. The flaw, disclosed on July 29, 2026, allows a remote, unauthenticated attacker to log in to vulnerable systems using a built-in low-privilege account and access sensitive data. Cisco said it detected active exploitation in July and has published indicators of compromise (IoCs) to help organizations identify potential attacks. The vulnerability was reported by Jimi Sebree of Horizon3.ai. Static credentials expose Cisco Se

Related Companies
Read at the source
The Cyber Express2 mo ago

FTC Sues Hims & Hers Over Health Data Privacy, Billing Practices

The Hims & Hers lawsuit has put the telehealth provider under scrutiny after the FTC, along with Utah and California authorities, accused the company of deceptive billing practices and unlawfully sharing consumers' sensitive health information with third-party advertising platforms. According to a complaint filed in federal court, regulators allege that Hims & Hers misled consumers about its privacy protections, enrolled users in recurring subscriptions without clear disclosure, and shared health-related data with companies including Meta and Snap. The complaint alleges that the San Fr

Related Companies
İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source
The Cyber Express2 mo ago

FBI Warns of PLC Cyberattacks Disrupting Water Utilities Across Seven States

The PLC cyberattacks targeting the Water and Wastewater Sector have prompted a joint warning from the Federal Bureau of Investigation (FBI) and the Environmental Protection Agency (EPA), after multiple cyber incidents disrupted water operations across the United States. Since July 27, 2026, utility companies in at least seven states have reported attacks involving internet-facing PLCs, with some incidents resulting in degraded operations after threat actors altered device configurations. According to the Public Service Announcement (PSA), malicious cyber actors targeted Programmable Logic Cont

İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source
The Cyber Express2 mo ago

CVE-2026-63077 Exposes TeamCity Servers to Unauthenticated RCE

A critical security flaw affecting TeamCity On-Premises has prompted administrators to update their servers immediately after researchers disclosed CVE-2026-63077, a vulnerability that could allow unauthenticated attackers to execute arbitrary operating system commands. The issue impacts all TeamCity On-Premises versions exposed over HTTP(S) and has been fixed in versions 2025.11.7 and 2026.1.3. Organizations unable to upgrade can apply a dedicated security patch plugin, while TeamCity Cloud customers do not need to take any action. CVE-2026-63077 Enables Unauthenticated Access Over HTTP(S) Ac

Related Companies
Read at the source
The Cyber Express2 mo ago

Critical wp2shell Vulnerability Hits WordPress Core, Patch Released

WordPress has released security updates to address the wp2shell vulnerability, a critical flaw that allowed attackers to achieve remote code execution (RCE) on vulnerable sites using a single anonymous web request. Unlike many previous attacks, this issue did not require plugins, authentication, or third-party code, making affected core installations particularly vulnerable. Security patches were released in WordPress 6.9.5 and 7.0.2. wp2shell Vulnerability Exposed Core WordPress Sites Tracked as CVE-2026-63030, the wp2shell vulnerability is described in the official WordPress release notes as

Read at the source
The Cyber Express2 mo ago

Student Hacks IIT Kanpur Website After Rejection, Gets Technical Assessment

The IIT Kanpur Website Hack has taken an unexpected turn after the institute decided to assess the technical skills of a student who allegedly breached parts of the IIT Kanpur and IIT Madras websites following his rejection from the newly launched undergraduate cybersecurity program. Instead of immediately pursuing legal action, IIT Kanpur said it would conduct a formal technical evaluation, though admission for the current academic session remains closed. The incident of IIT Kanpur website hack came to light after the student shared posts on X and Reddit, claiming he had breached sections of

İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source
The Cyber Express2 mo ago

Two Joyfill npm Packages Found Delivering DEV#POPPER Malware

Two beta releases of joyfill npm Packages have been found distributing a malware implant capable of delivering the DEV#POPPER remote access trojan (RAT) . The compromised Node.js packages use an import-time loader that retrieves encrypted payloads through blockchain transactions instead of traditional command-and-control infrastructure. The affected releases are @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4. Joyfill develops software development kits for embedding forms, documents, and PDFs into web and mobile applications. While both packages collectively r

Related Companies
İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source
The Cyber Express2 mo ago

New CI Fortify Guide Reveals How Critical Infrastructure Can Contain Cyber Attacks

Malicious cyber actors routinely target critical infrastructure to conduct espionage, extort victims, or establish access for disruptive and destructive attacks. The new CI Fortify Guide advises owners and operators to strengthen their ability to isolate vital systems from other networks, helping contain incidents and maintain critical services during a crisis or service disruption. The CI Fortify Guide, titled CI Fortify: Advice for isolating vital systems, details steps for isolating operational technology (OT) and enabling systems from other networks. The guidance states that this capabilit

İlgili CVE'ler

No verified CVE link was found for this news item.

Read at the source

61-70 / 70 news items shown