Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Latest Cybersecurity News

CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.

The startup maps how identities, assets and vulnerabilities connect, and uses AI agents to find and fix risky combinations of issues.

A US court sentenced Syrian hacker Ahmad Umar Agha to 42 months for pro-Assad attacks on media, businesses, and government entities.

Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.

Noteworthy stories that might have slipped under the radar: Iran eyed in military freezer hacks, Copenhagen University breach, AI-powered malware.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.

It allowed customers to host hack-for-hire services, supported ransomware and infostealer operators, and accepted crypto payments.

Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.

Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.

Malicious code linked to a website monitoring tool was designed to hijack logged-in Polymarket sessions and siphon user funds.

Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.

An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.

Blockchain analysts link the record crypto theft to North Korean hackers, as Binance probes a possibly compromised engineer laptop.

Ivanti vulnerability exploited Ivanti vulnerability exploited

CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.

Hacker Hacker

A US court sentenced Syrian hacker Ahmad Umar Agha to 42 months for pro-Assad attacks on media, businesses, and government entities.

PHP2Shell PHP exploited PHP2Shell PHP exploited

Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.

Top Cybersecurity Headlines

Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.

Malicious code linked to a website monitoring tool was designed to hijack logged-in Polymarket sessions and siphon user funds.

Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.

SecurityWeek Industry Experts

More Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Register

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

Upcoming Cybersecurity Events

SecurityWeek’s CodeSecCon 2026 will bring together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained.
[Originally August 19, 2026]

Learn More
Zero Trust Summit Now On-Demand

SecurityWeek’s 2026 Zero Trust Summit will deep-dive into the world of digital identity management and the role of zero-trust principles and associated technologies
[Originally October 14, 2026]

Read More
CISO Forum Virtual Summit

The 2026 Virtual CISO Forum brings together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
[November 10 & 11, 2026 | Virtual]

Read More
Cyber AI and Automation Summit 2026

SecurityWeek’s Cyber AI & Automation Summit pushes the boundaries of security discussions by exploring the implications and applications of predictive AI, machine learning, and automation in modern cybersecurity programs.
[December 8 & 9, 2026 | Virtual]

Read More

Vulnerabilities

Cybercrime

Ask a management team if cyber security is important to them and you’ll get an immediate affirmative. In fact, many will tell you that security is one of their top priorities as an organization. Most can back up these claims by stating how much they’ve invested in security solutions in recent years and by what percentage of their IT teams are dedicated to improving cyber awareness and security across the enterprise.

Researchers from Trend Micro have discovered a new attack that leverages a combination of exploits to infect systems and target FTP credentials and other information on Windows-based systems. The threat is a file infector malware that is part of the PE_EXPIRO family; malware that Trend says was first discovered in 2010.

SEOUL - South Korea's defense ministry said Monday it has ordered its staff to install a smartphone application that restricts key functions like the camera in an attempt to prevent military leaks. The ministry said that, from Monday, its 1,500 staff are no longer allowed to bring smartphones into their offices without installing the app, called "Mobile Management Device".

GENEVA - The international community must wake up to the reality of cyberwar and strive to find ways to stem it, the head of the UN's telecommunications agency said Monday. "There is a cyberwar going on," Hamadoun Toure, secretary general of the International Telecommunication Union, said during a cybersecurity debate at the Geneva Press Club.

While many organizations today are looking to build private cloud infrastructures in-house, the reality is that the majority will end up with a hybrid cloud environment. A hybrid cloud consists of a mixed IT infrastructure -- an internal private cloud infrastructure and one or multiple public cloud infrastructures. If you’re already using some type of SaaS application, you have a simple form of a hybrid cloud.

LA PAZ - Bolivia's leftist president Evo Morales on Saturday accused US intelligence of hacking into the email accounts of top Bolivian officials, saying he had shut his own account down. Latin American leaders have lashed out at Washington over recent revelations of vast surveillance programs, some of which allegedly targeted regional allies and adversaries alike.

MONTEVIDEO - Leaders of a South American trade bloc that includes Brazil and Venezuela meet Friday for a summit that will focus on allegations of US spying that have outraged US allies and rivals alike.

PARIS - Twitter handed over data to French authorities on Friday to help identify the authors of anti-Semitic and racist tweets after a months-long legal battle launched by Jewish and anti-racism groups. A French court in January ordered the US-based company to provide the data following legal action by France's Union of Jewish Students (UEJF) and four anti-racism groups.

Event image poster

The leading global conference series for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Learn More

Application Security

Application Security

OSS Scanner sends unreviewed, model-generated vulnerability reports to open source maintainers that opt in.

Cloud Security

Artificial Intelligence

Microsoft fixed vulnerabilities across Azure and AI-branded products, with privilege escalation flaws accounting for the majority.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.