SecurityWeek

Significant cybersecurity M&A deals announced by Dragos, IBM, Palo Alto Networks, Kiteworks, and Upwind.

Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign.

Hackers abused a company’s lawful access to the CPR system to steal the personal information of registered citizens.

Companies are pouring time and dollars into security awareness training, but little evidence shows it actually works against social engineering.

Google has temporarily stopped accepting product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP).

ClingSTUN operates as a back-connect proxy backdoor, sets up persistence, and contains exploits for self-propagation.

Hackers stole patient information from Clover Health Investments and AngMar Management Services in July.

CVE-2026-61500 allows attackers to recover the session-cookie signing key and gain administrative access and RCE.

More than 730 cyber breaches affected over 270 million Americans last year, costing an average of $10 million per breach.

Known as Rey, the suspect is reportedly helping the FBI identify and locate other members of the extortion group.

Citrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched.

The announcement comes after Trump hosted top executives of AI companies at the White House last week.

doxx.net’s new ADN platform prevents agentic misadventure while the agent is operating under the user’s authority.

The bugs could lead to authentication bypass, shell command execution, and memory corruption.

Noteworthy stories that might have slipped under the radar: Kiteworks patches over 100 vulnerabilities, Microsoft publishes 2026 Digital Defense Report, AI finds 24 Android app flaws.

The dropper “carries a complete universal Mach-O inside itself, roughly 756 KB in the development build, and extracts it at runtime.

Hackers used the account, which has 13 million followers, to amplify a Clippy-themed cryptocurrency account.

Amir Barati, an alleged member of the Mabna Institute, was indicted for targeting universities, private organizations, and government entities in the US and abroad.

The China-based hacking group has been exploiting SharePoint vulnerabilities since July 2025.

The attacks targeted the US Department of Education and Library and Archives Canada, and researchers linked some agents to OpenAI.