Recent Posts
News•Feb 23, 2026
Spain Arrests Suspected Hacktivists for DDoSing Govt Sites
Spanish Civil Guard arrested four alleged members of the hacktivist group Anonymous Fénix, accused of orchestrating DDoS attacks on government ministries, political parties, and public institutions in Spain and South America. The campaign intensified after the October 2024 Valencia floods, with the group blaming authorities for the disaster. Arrests occurred in Alcalá de Henares, Oviedo, Ibiza, and Móstoles, and led to the seizure of the group’s X, YouTube, and Telegram accounts. The operation is part of a wider Spanish crackdown on cybercrime, including recent dismantling of AI‑phishing platforms and large fraud networks.
By BleepingComputer
News•Feb 23, 2026
Ad Tech Firm Optimizely Confirms Data Breach After Vishing Attack
Optimizely, a New York‑based ad‑tech firm, disclosed a data breach after a sophisticated voice‑phishing (vishing) attack on February 11. Threat actors accessed the company’s CRM and other internal business systems, extracting only basic contact information and not sensitive customer data. The...
By BleepingComputer
News•Feb 21, 2026
Predator Spyware Hooks iOS SpringBoard to Hide Mic, Camera Activity
Intellexa’s Predator spyware can silently record iPhone camera and microphone feeds by hijacking iOS 14’s SpringBoard UI layer. Using a kernel‑level hook called HiddenDot::setupHook, the malware nullifies the SBSensorActivityDataProvider, preventing the green and orange privacy dots from ever lighting up. Jamf’s...
By BleepingComputer
News•Feb 21, 2026
Amazon: AI-Assisted Hacker Breached 600 Fortinet Firewalls in 5 Weeks
Amazon’s Integrated Security team warned that a Russian‑speaking threat actor leveraged generative AI services to automate a campaign that compromised more than 600 FortiGate firewalls in 55 countries between Jan 11 and Feb 18, 2026. The attackers scanned for internet‑exposed management ports,...
By BleepingComputer
News•Feb 20, 2026
Why the Shift Left Dream Has Become a Nightmare for Security and Developers
The article argues that the long‑standing "shift‑left" mantra has backfired, overloading developers with security tasks while business demands prioritize speed. Qualys analyzed 34,000 public container images and found 7.3% malicious, many containing cryptomining code or exposed secrets. This risk stems...
By BleepingComputer
News•Feb 20, 2026
PayPal Discloses Data Breach that Exposed User Info for 6 Months
PayPal disclosed a data breach affecting its Working Capital loan application, where personal information—including Social Security numbers—was exposed from July 1 to December 13, 2025. The company identified the issue on December 12, 2025, rolled back the faulty code, and halted unauthorized access within a...
By BleepingComputer
News•Feb 19, 2026
Flaw in Grandstream VoIP Phones Allows Stealthy Eavesdropping
A critical stack‑buffer overflow (CVE‑2026‑2329) was discovered in six Grandstream GXP1600 series VoIP phones, receiving a CVSS score of 9.3. The flaw resides in an unauthenticated web API endpoint that lets attackers overflow a 64‑byte buffer, gain root privileges, and...
By BleepingComputer
News•Feb 19, 2026
Google Blocked over 1.75 Million Play Store App Submissions in 2025
Google reported that in 2025 it blocked more than 1.75 million app submissions and denied 255,000 apps access to sensitive user data on the Play Store. The company also banned over 80,000 developer accounts and added 10,000 new safety checks powered...
By BleepingComputer
News•Feb 17, 2026
Flaws in Popular VSCode Extensions Expose Developers to Attacks
Security researchers at Ox Security uncovered critical and high‑severity vulnerabilities in four widely used Visual Studio Code extensions, collectively downloaded over 128 million times. The flaws—affecting Code Runner, Markdown Preview Enhanced, Live Server, and Microsoft Live Preview—allow attackers to execute remote...
By BleepingComputer
News•Feb 17, 2026
What 5 Million Apps Revealed About Secrets in JavaScript
Intruder scanned five million JavaScript bundles and uncovered more than 42,000 exposed secrets, including active GitHub, GitLab, and SaaS API tokens. The research revealed 688 repository tokens that granted full access to private code and CI/CD pipelines. Traditional static and...
By BleepingComputer
News•Feb 17, 2026
New Keenadu Backdoor Found in Android Firmware, Google Play Apps
Kaspersky has uncovered a sophisticated Android backdoor named Keenadu, embedded in firmware of multiple device brands and distributed through compromised OTA updates, system apps, and even Google Play applications. The malware can infiltrate every installed app, grant attackers unrestricted control,...
By BleepingComputer
News•Feb 17, 2026
Poland Arrests Suspect Linked to Phobos Ransomware Operation
Polish authorities detained a 47‑year‑old man suspected of collaborating with the Phobos ransomware group during a joint operation in the Małopolska region. The arrest, part of Europol‑coordinated Operation Aether, yielded computers and phones loaded with stolen credentials, credit‑card data, and server‑access...
By BleepingComputer
News•Feb 16, 2026
Washington Hotel in Japan Discloses Ransomware Infection Incident
Washington Hotel, a Japanese hospitality chain with 30 properties and 11,000 rooms, disclosed a ransomware breach on February 13, 2026 that compromised business data on its servers. The hotel immediately isolated the affected systems, formed an internal task force and enlisted police,...
By BleepingComputer
News•Feb 16, 2026
Eurail Says Stolen Traveler Data Now up for Sale on Dark Web
Eurail B.V., the Dutch operator of European rail passes, confirmed that data stolen in a breach earlier this year is now being offered for sale on the dark web. A threat actor also posted a sample of the compromised records...
By BleepingComputer
News•Feb 16, 2026
Infostealer Malware Found Stealing OpenClaw Secrets for First Time
Hudson Rock reported the first in‑the‑wild incident of an infostealer stealing OpenClaw configuration files. The malware, identified as a Vidar variant, exfiltrated files such as openclaw.json, device.json, and soul.md on February 13, 2026, revealing API tokens, private keys, and personal data. These...
By BleepingComputer
News•Feb 16, 2026
Passwords to Passkeys: Staying ISO 27001 Compliant in a Passwordless Era
Organizations are rapidly replacing passwords with passkey authentication to curb the 49% of security incidents tied to compromised credentials. Passkeys, built on FIDO2 and WebAuthn, satisfy AAL2/AAL3 standards and are already deployed in billions of accounts, including Google’s 800 million users....
By BleepingComputer
News•Feb 16, 2026
CISA Gives Feds 3 Days to Patch Actively Exploited BeyondTrust Flaw
U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered all federal agencies to patch the actively exploited BeyondTrust Remote Support vulnerability (CVE‑2026‑1731) within three days. The flaw, an OS command‑injection that enables unauthenticated remote code execution, affects Remote Support 25.3.1...
By BleepingComputer
News•Feb 16, 2026
Google Patches First Chrome Zero-Day Exploited in Attacks This Year
Google has issued emergency updates to patch CVE‑2026‑2441, a high‑severity use‑after‑free flaw in Chrome’s CSSFontFeatureValuesMap implementation. The vulnerability, confirmed to be exploited in the wild, can cause crashes, rendering issues, or data corruption. Google back‑ported the fix to stable desktop...
By BleepingComputer
News•Feb 16, 2026
Canada Goose Investigating as Hackers Leak 600K Customer Records
Canada Goose disclosed that a 1.67 GB dataset containing over 600,000 customer records was posted by the ShinyHunters extortion group. The leak includes personal identifiers, shipping details, IP addresses and partial payment‑card information, but the company says it found no evidence...
By BleepingComputer
News•Feb 15, 2026
Windows 11 KB5077181 Fixes Boot Failures Linked to Failed Updates
Microsoft has released Windows 11 update KB5077181, fully fixing the UNMOUNTABLE_BOOT_VOLUME boot failure that struck some enterprise machines after recent security patches. The bug, linked to a failed December 2025 update and exacerbated by the January 13, 2026 KB5074109 rollout, affected devices running 25H2...
By BleepingComputer
News•Feb 15, 2026
CTM360: Lumma Stealer and Ninja Browser Malware Campaign Abusing Google Groups
CTM360 uncovered an active campaign that hijacks more than 4,000 Google Groups and 3,500 Google‑hosted URLs to distribute credential‑stealing malware. The threat actors deliver Lumma Info‑Stealer to Windows devices and a trojanized “Ninja Browser” to Linux systems, embedding organization‑specific keywords to boost...
By BleepingComputer
News•Feb 14, 2026
Snail Mail Letters Target Trezor and Ledger Users in Crypto-Theft Attacks
Physical letters masquerading as official communications from Trezor and Ledger are being used to lure hardware‑wallet owners into scanning QR codes that lead to counterfeit setup sites. The sites prompt victims to enter their 12‑, 20‑, or 24‑word recovery phrases...
By BleepingComputer
News•Feb 10, 2026
Volvo Group North America Customer Data Exposed in Conduent Hack
Volvo Group North America announced that an indirect data breach exposed personal information of about 17,000 customers and staff. The breach stemmed from Conduent, a U.S. business‑process‑outsourcing firm, whose systems were compromised between October 21, 2024 and January 13, 2025. Threat actors accessed names,...
By BleepingComputer
News•Feb 10, 2026
Microsoft Rolls Out New Secure Boot Certificates Before June Expiration
Microsoft has begun distributing updated Secure Boot certificates through the regular monthly Windows updates, replacing the original 2011 certificates that will expire in late June 2026. The refresh targets Windows 11 24H2 and 25H2 devices, with many newer PCs already shipping the...
By BleepingComputer
News•Feb 10, 2026
Microsoft 365 Outage Takes Down Admin Center in North America
Microsoft confirmed a service outage affecting the Microsoft 365 admin center for some business and enterprise administrators in North America. The disruption also extends to the M365 app, with users experiencing degraded functionality and inability to raise support tickets. Thousands...
By BleepingComputer
News•Feb 10, 2026
How to Automate AWS Incident Investigation with Tines and AI
The article details a pre‑built Tines workflow that automates AWS incident investigation by running CLI commands through secure Tines agents. Instead of analysts manually logging into the AWS console and crafting commands, the workflow pulls the required data directly into...
By BleepingComputer
News•Feb 10, 2026
Microsoft Announces New Mobile-Style Windows Security Controls
Microsoft announced that Windows 11 will adopt smartphone‑style permission prompts, requiring user consent before apps can access files, cameras, microphones or install software. The rollout introduces a Baseline Security Mode that enforces runtime integrity by allowing only signed code to run,...
By BleepingComputer
News•Feb 10, 2026
Fugitive Behind $73M 'Pig Butchering' Scheme Gets 20 Years in Prison
A dual Chinese‑St. Kitts and Nevis national, Daren Li, was sentenced in absentia to 20 years in prison for his role in an international cryptocurrency pig‑butchering scheme that stole over $73 million from U.S. victims. The fraud operated through a network of 74...
By BleepingComputer
News•Feb 9, 2026
Password Guessing without AI: How Attackers Build Targeted Wordlists
Password attacks increasingly rely on targeted wordlists harvested from an organization’s public‑facing content rather than generic dictionaries or AI models. Tools like the open‑source CeWL crawler extract company‑specific terminology, which attackers mutate with common patterns to generate plausible passwords that...
By BleepingComputer
News•Feb 9, 2026
Men Charged in FanDuel Scheme Fueled by Thousands of Stolen Identities
Two Connecticut men, Amitoj Kapoor and Siddharth Lillaney, were indicted on 45 federal counts for a multi‑year scheme that used roughly 3,000 stolen identities to open fraudulent accounts on FanDuel, DraftKings, BetMGM and other online gambling platforms. They purchased personal...
By BleepingComputer
News•Feb 9, 2026
Microsoft: Exchange Online Flags Legitimate Emails as Phishing
Microsoft is investigating a fault in Exchange Online that began on February 5, causing legitimate emails to be flagged as phishing and quarantined. The problem stems from a newly deployed URL rule that incorrectly labels benign links as malicious. The issue...
By BleepingComputer
News•Feb 9, 2026
European Commission Discloses Breach that Exposed Staff Data
The European Commission disclosed a cyber‑attack on its mobile‑device‑management platform on 30 January, where attackers accessed staff names and phone numbers but did not compromise the devices themselves. The breach was contained within nine hours after detection and traced to two...
By BleepingComputer
News•Feb 8, 2026
New Tool Blocks Imposter Attacks Disguised as Safe Commands
Tirith is a new open‑source, cross‑platform utility that monitors shell input to detect and block homoglyph‑based URL attacks and other deceptive command‑line tricks. It hooks into popular shells such as zsh, bash, fish, and PowerShell, inspecting every pasted command for...
By BleepingComputer
News•Feb 7, 2026
Payments Platform BridgePay Confirms Ransomware Attack Behind Outage
BridgePay Network Solutions confirmed a ransomware attack knocked its payment gateway offline, triggering a nationwide outage across core APIs, virtual terminals, and hosted pages. The breach began early Friday, prompting the company to involve the FBI, U.S. Secret Service, and...
By BleepingComputer
News•Feb 6, 2026
CISA Warns of SmarterMail RCE Flaw Used in Ransomware Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a critical remote code execution vulnerability, CVE‑2026‑24423, in SmarterMail versions prior to build 9511. The flaw, exploitable via the ConnectToHub API, is being leveraged in active ransomware campaigns. SmarterTools patched the...
By BleepingComputer
News•Feb 6, 2026
EDR, Email, and SASE Miss This Entire Class of Browser Attacks
Keep Aware warns that enterprise security tools—EDR, email gateways, and SASE—systematically miss a growing class of browser‑only attacks, including click‑fix UI social engineering, malicious extensions, man‑in‑the‑browser manipulations, and HTML smuggling. These techniques leave little forensic evidence because they exploit user...
By BleepingComputer
News•Feb 6, 2026
Man Pleads Guilty to Hacking Nearly 600 Women’s Snapchat Accounts
Illinois resident Kyle Svara pleaded guilty in Boston federal court to phishing Snapchat access codes from roughly 570 women between May 2020 and February 2021, successfully infiltrating at least 59 accounts to steal nude photos. He marketed the stolen content...
By BleepingComputer
News•Feb 6, 2026
Flickr Discloses Potential Data Breach Exposing Users' Names, Emails
Flickr disclosed a potential data breach after a vulnerability in a third‑party email service provider exposed user names, email addresses, IP locations and activity logs. The company acted quickly, shutting down the affected system within hours on February 5, 2026. While...
By BleepingComputer
News•Feb 5, 2026
Spain's Ministry of Science Shuts Down Systems After Breach Claims
Spain's Ministry of Science, Innovation and Universities announced a partial shutdown of its electronic services after a technical incident that appears to be a cyberattack. A hacker using the alias “GordonFreeman” claimed to have exploited an IDOR flaw to gain...
By BleepingComputer
News•Feb 5, 2026
Ransomware Gang Uses ISPsystem VMs for Stealthy Payload Delivery
Ransomware operators are exploiting ISPsystem’s VMmanager by deploying default Windows virtual machines that reuse identical hostnames and system identifiers. Sophos discovered the same hostnames across VMs used by multiple ransomware groups, including LockBit, Conti, BlackCat/ALPHV and Ursnif, as well as...
By BleepingComputer
News•Feb 5, 2026
Microsoft to Shut Down Exchange Online EWS in April 2027
Microsoft announced that the Exchange Web Services (EWS) API for Exchange Online will be blocked on October 1, 2026 and fully retired on April 1, 2027. Administrators can create an allow‑list by August 2026 to bypass the October block, after which Microsoft will pre‑populate allow...
By BleepingComputer
News•Feb 5, 2026
Italian University La Sapienza Goes Offline After Cyberattack
Rome’s La Sapienza, Europe’s largest university, suffered a cyberattack that forced a complete shutdown of its IT network. Authorities and the university’s technical task force identified the incident as a ransomware operation attributed to the pro‑Russian group Femwar02, using the...
By BleepingComputer
News•Feb 5, 2026
Romanian Oil Pipeline Operator Conpet Discloses Cyberattack
Romanian pipeline operator Conpet disclosed a ransomware attack that crippled its corporate IT systems and took its public website offline, while its core transport operations remained unaffected. The Qilin gang claimed responsibility, alleging the theft of nearly 1 TB of internal...
By BleepingComputer
News•Feb 5, 2026
When Cloud Logs Fall Short, the Network Tells the Truth
Cloud migrations create fragmented logs that leave blind spots, making real‑time visibility essential for security. Network telemetry provides a consistent, provider‑agnostic signal that overcomes log inconsistencies across multi‑cloud environments. By integrating traffic mirroring, flow logs, and TLS/DNS metadata, organizations can...
By BleepingComputer
News•Feb 5, 2026
Data Breach at Fintech Firm Betterment Exposes 1.4 Million Accounts
Fintech platform Betterment disclosed a data breach affecting roughly 1.435 million accounts, exposing email addresses, names, birth dates, physical addresses, phone numbers, and employment details. Threat actors also launched a social‑engineering campaign, sending fraudulent cryptocurrency reward emails to compromised contacts....
By BleepingComputer
News•Feb 5, 2026
Zendesk Spam Wave Returns, Floods Users with 'Activate Account' Emails
A fresh wave of spam is exploiting unsecured Zendesk support portals, flooding users worldwide with fake “Activate account” emails. Attackers submit tickets through open Zendesk forms, triggering automatic confirmation messages to large address lists. The campaign mirrors a January incident,...
By BleepingComputer