CybersecurityBoard.com brings together vulnerability intelligence, security news, MITRE ATT&CK group profiles, cyber events, certifications, training, products, companies and service providers.
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories Ravie LakshmananJul 02, 2026Hacking News / Cybersecurity News This week’s security news is mostly about weak spots. Browsers, bots, sandboxes, AI systems,…
CVE-2021-29441 is an authentication bypass vulnerability in Alibaba's Nacos configuration service. It allows attackers to bypass authentication and gain administrative access. The…
A path traversal vulnerability in FortiWeb exploited via fake PoC repos in the ChocoPoC campaign. Allows attackers to read arbitrary files on…
A vulnerability in MongoDB, exploited via fake PoC repos in the ChocoPoC campaign.
CVE-2024-49113 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
A high-severity remote code execution vulnerability in Microsoft SharePoint Server caused by deserialization of untrusted data. CVSS score 8.8. Exploited in the…
Identity lifecycle management (ILM) was architected around human principals with employment records, managers, and departure dates. AI agents have none of these,…
Microsoft has announced an acceleration of its quantum-safe security roadmap, moving the target for transitioning critical products and services to post-quantum cryptography…
The 2026 Bitdefender Cybersecurity Assessment, based on a survey of 1,200 IT and cybersecurity professionals across six countries, reveals a significant gap…
Palo Alto Networks' Unit 42 has identified a new attack vector called 'phantom squatting,' where threat actors register AI-hallucinated domains that do…
Anthropic has restored its Claude Fable 5 AI model worldwide after the U.S. Commerce Department lifted export controls imposed on June 12,…
Cybersecurity researchers at Huntress have uncovered a massive, ongoing automated password spray attack targeting Microsoft's Azure command-line interface (CLI). The campaign, active…
ToddyCat is an advanced persistent threat (APT) group active since at least 2020, known for targeting organizations in Europe and Asia. The…
JADEPUFFER is the name given by Sysdig to an AI agent that autonomously executed a ransomware attack. It exploited CVE-2025-3248 in Langflow…
MUT-1244 is a campaign that used fake PoC repositories to steal SSH keys and cloud credentials from red teamers and researchers, similar…
The recently discovered financially-motivated FortiBleed campaign has been attributed to INC and Lynx ransomware operations, indicating that the verified, stolen credentials were…
A new malware strain named Umbrij, attributed to the advanced persistent threat (APT) group ToddyCat, is abusing OAuth 2.0 tokens to gain…
Umbrij is a .NET-based malware attributed to the ToddyCat APT group, designed to steal OAuth tokens from Gmail accounts. It exploits Chromium-based…
Security firm Sysdig has identified what it believes is the first ransomware attack fully orchestrated by an AI agent, dubbed JADEPUFFER. The…
JADEPUFFER is the malware payload generated by an AI agent in a ransomware attack. It encrypted 1,342 Nacos settings, dropped database tables,…
An independent survey of 1,200 IT and cybersecurity professionals across six countries, revealing contradictions in AI visibility, attack surface reduction, threat prioritization,…
OrangeCon is a cybersecurity conference where researcher Bert-Jan Pals presented findings on ClickFix payload analysis in early June 2026.
PCI DSS v4.0.1 introduced requirements 6.4.3 and 11.6.1, mandating that merchants inventory, authorize, and verify the integrity of all scripts on payment…
SANS San Antonio 2026 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber…
Agentic AI represents a paradigm shift in offensive cybersecurity, where AI tools no longer require human operators to execute attacks. Unlike previous…
Microsoft Edge, a Chromium-based browser, was targeted by Umbrij malware for OAuth token theft. The malware used headless mode and remote debugging…
Microsoft Visual Studio's VSTestVideoRecorder.exe was abused by Umbrij malware for DLL side-loading. Visual Studio is an integrated development environment from Microsoft.
Bitdefender ConnectAgent's BDSubWiz.exe was used by Umbrij malware for DLL side-loading. ConnectAgent is a component of Bitdefender's endpoint security solutions.
Google Desktop Search, a discontinued application, was abused by Umbrij malware for DLL side-loading. The tool was originally used for indexing files…
Workday is a leading cloud-based human resources and finance management platform. It serves as a system of record for employee data, driving…
ServiceNow is a cloud-based IT service management (ITSM) platform. Its HR Service Delivery module integrates with identity governance systems to manage employee…
AutoGen was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Tencent is a Chinese multinational conglomerate. Its cloud credentials were harvested by the JADEPUFFER AI agent during the attack.
Proton Mail is an encrypted email service based in Switzerland. The JADEPUFFER ransom note included a Proton Mail contact address (e78393397@proton.me) for…
Europol was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Nokia Deepfield Emergency Response Team was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related…
DEV Community (dev.to) is a developer platform abused by Gamaredon as a dead drop resolver.