Cybersecurity News and Updates

Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts.

The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have

Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, Google said on October 6.

Google’s own systems were not breached, but any domain ending in .gh (Ghana), .sl (Sierra Leone) or .as (American Samoa) was put at risk. With such a certificate, an attacker could pose as the real site over an encrypted

How a recent Supreme Court decision on geofencing influenced a federal judge to toss a sheriff’s Flock camera evidence in a drug trafficking case.

The investigation into the incident revealed cybercriminals were able to breach the Fines/Fees and Restitution Enforcement (FARE) Program, a statewide program that helps the court collect outstanding debts tied to traffic and criminal violations.

Lawmakers who oversee military cyber policy as well as the Fort Meade, Maryland, hub for those agencies say an $11 million mental health program should be locked in to defense spending legislation.

U.S. officials say Zhang Yu was a prominent figure in the Hafnium campaign, which saw hackers breach thousands of computers and steal troves of documents.

Hackers compromised a third-party communication platform and sent rogue notifications to ASOS users.

The post ASOS Confirms Cyberattack, Data Breach appeared first on SecurityWeek.

Anthropic is integrating the CVP and Project Glasswing into a single offering, with three levels of access to its most capable AI models.

The post Anthropic Introduces 3-Tier Cyber Verification Program for AI Access appeared first on SecurityWeek.

Four critical-severity use-after-free defects were fixed in Chromecast, Browser, Navigation, and Track.

The post Chrome 155 Update Patches 247 Vulnerabilities appeared first on SecurityWeek.

The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer (aka Psychedelic Stealer).

The activity, which was observed by the agency in September 2026, has been attributed to a threat cluster dubbed UAC-0277. It did not disclose who the