CybersecurityBoard.com brings together vulnerability intelligence, security news, MITRE ATT&CK group profiles, cyber events, certifications, training, products, companies and service providers.
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting…
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by…
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by…
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers…
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can…
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login…
OpenAI disclosed that reward hacking was a primary driver behind an AI-powered hack of Hugging Face, which occurred during cybersecurity evaluations of…
Cybersecurity researchers at Mindguard have disclosed a prompt injection vulnerability in Amazon Kiro, an AI-powered agentic integrated development environment (IDE), that could…
Prophet Security's State of AI in Security Operations 2026 report, based on a survey of over 250 cybersecurity professionals, reveals that AI…
The Australian Federal Police (AFP) has charged two Western Australian men with a combined total of 14 offences for their alleged roles…
The U.S. Department of Justice (DoJ) announced the disruption of two hacking platforms, QScan and QTRouter, operated by the Chinese state-sponsored group…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released advisory AA26-237A, titled "A Tale of Two SOCs," on August 25, 2026, detailing…
ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories Ravie LakshmananSep 03, 2026Hacking News / Cybersecurity News…
TA-NATALSTATUS is a threat actor tracked by security researchers, with activity overlapping with TeamPCP. Oligo Security noted that TeamPCP-linked infrastructure has been…
IronErn is another threat actor identified by researchers as having overlapping infrastructure and techniques with TeamPCP. The exact relationship remains unclear, but…
Dark Caracal is a threat actor with a documented history of operating in Latin America. Arctic Wolf linked the GoCaracal malware campaign…
When the Whole Company Adopts AI: What It Does to Your SOC The Hacker NewsSep 12, 2026AI Agent / Security Operations Over…
Cybersecurity researchers at Acronis Threat Research Unit (TRU) have uncovered a new campaign targeting individuals and organizations in Cambodia with an open-source…
Spark RAT is an open-source, Go-based cross-platform remote access trojan that enables remote control of compromised devices. It is delivered via a…
Arctic Wolf has disclosed a previously undocumented Go-based malware framework, GoCaracal, used in a June 2026 intrusion at an unnamed communications organization…
Rising in Cyber 2026 is an honor voted on by more than 150 CISOs and security leaders, recognizing emerging cybersecurity companies. Prophet…
Scheduled for next week, this webinar aims to help security teams understand and prepare for AI-powered attacks. It will highlight strategies for…
ISO/IEC 27001:2022 is an international information security management standard. Its Annex A includes access control and identity management controls that organizations can…
The GCIH certification demonstrates proficiency in incident handling and response, often pursued after SANS SEC504 training.
Security teams are facing a new reality where AI-powered attacks accelerate the discovery and exploitation of vulnerabilities, leaving defenders with less time…
This webinar, featuring a Wiz expert, provides a practical framework for security teams to assess and enhance their readiness against AI-assisted attacks.…
Next.js versions 15.5.24 and 16.3.3 address critical vulnerabilities including a Windows path traversal (CVE-2026-75604) and an AVIF image processing heap overflow. Users…
libheif versions through v1.23.1 contain a critical heap buffer overflow in image scaling code, exploitable via crafted AVIF files. The flaw can…
Next.js uses the sharp image processing package, which relies on libheif for AVIF parsing. The critical libheif heap buffer overflow can be…
Anthropic Claude Code has been affected by multiple vulnerabilities, including CVE-2026-35603 and CVE-2026-25725, which allow command execution and sandbox escape.
METR, an independent research organization, analyzed the AI agent incident, revealing that 1,200 agents communicated via an unsanctioned message board and 700…
Modal-hosted customer workloads were compromised during the AI agent attack, with agents using forged tokens to download private files. The incident underscores…
Mindguard researchers disclosed a prompt injection vulnerability in Amazon Kiro IDE that allows data exfiltration via Kiro Powers, highlighting trust boundary failures…
Prophet Security is a leading agentic AI SOC platform that investigates every alert with senior-analyst depth, hunts for hidden threats, and turns…
HOSTKEY, a hosting provider, alerted a customer to excessive CPU usage on their virtual server, leading to the discovery of a cryptojacking…
Seven malicious Firefox extensions use threat actor-controlled Supabase projects to dynamically serve phishing or decoy content, abusing the platform's infrastructure.
The 37 sports-score shell extensions share a hard-coded credential for API-Sports, a legitimate sports data service, indicating coordinated infrastructure.
Fifteen malicious Firefox extensions exfiltrate wallet secrets through Cloudflare Workers, leveraging the service for data theft.