Cybersecurity News and Updates

JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution.

The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already

Confidence in autonomous security tools is declining, and here’s why.

An FBI agent explains how the mulitnational law-enforcement Operation Cronos was successful in disrupting the largest ransomware group of its time.

This category of vulnerabilities allows an attacker to easily acquire administrative level permissions and bypass cloud providers’ access controls.

The malware-as-a-service operation launches legitimate browsers on an invisible desktop, giving attackers persistent and covert remote access to compromised Windows systems.

The post MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection appeared first on SecurityWeek.

The critical unsafe deserialization flaw allows attackers to execute arbitrary code remotely, without authentication.

The post PTC Windchill Vulnerability Exploited in Ransomware Campaign appeared first on SecurityWeek.

Dependabot gets a three-day cooldown window before opening pull requests, and PyPI rejects file uploads to releases older than 14 days.

The post New GitHub, PyPI Policies Boost Supply Chain Security appeared first on SecurityWeek.

Monday starts with the usual promise that everything is under control. Then the logs wake up.

This week, trusted tools crossed lines, old flaws found new work, exposed systems stayed exposed, and attackers kept hiding inside normal-looking services. Nothing looked strange at first. That helped.

That is the mood. Here is the full recap.

⚡ Threat of the Week

OpenAI Says Its AI Agent Went Rogue

Public exploit details released on July 27 show how an unauthenticated request can reach PHP’s eval() function inside vBulletin and execute code on an unpatched forum server. The attack requires no account, administrative access, or interaction from another user.

SSD Secure Disclosure lists vBulletin 6.2.1 and earlier, and 6.1.6 and earlier, as affected, but does not give a lower version

Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt.

CNCERT, China’s national computer emergency response team, and XLab, the threat-intelligence lab of Chinese