Other noteworthy stories that might have slipped under the radar: Threema DDoS attack, Evooo1Bot Linux botnet, Crypto4A secures top-tier NIST certification. The post In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug appeared first on SecurityWeek.
Sen. Ron Wyden and Rep. Greg Casar want a GAO probe on the government’s use of spyware and other sophisticated hacking tools and authorities. The post Lawmakers seek watchdog review of federal hacking of Americans appeared first on CyberScoop.
Canada's Hospital for Sick Children has suffered another cybersecurity incident involving theft of employee data, reportedly linked to a vulnerability in a third-party software application. This marks the second significant attack on the institution, following a 2022 ransomware incident that disrupted hospital systems.
Attackers have compromised popular Rust package repositories by injecting malicious code into legitimate crates, transforming standard build processes into vehicles for distributing infostealer malware. The poisoned packages targeted developer credentials, leveraging the trust developers place in established Rust dependencies to compromise their systems and sensitive authentication data.
Microsoft has confirmed a maximum severity remote-code execution vulnerability in Entra ID that is being actively exploited in the wild. The company states the flaw has been fully mitigated and requires no further action from customers.
Researchers have identified a new attack technique called Cryptographic Context Injection that encrypts malicious instructions to evade safety guardrails in AI models including Grok and Gemini. The method works by concealing harmful prompts until they are decrypted within a trusted execution environment, effectively bypassing existing content filtering mechanisms. This vulnerability highlights a novel attack vector against popular large language models that defenders should monitor.
Microsoft disclosed a maximum-severity unauthenticated remote code execution vulnerability in Entra ID (CVE-2026-69836, CVSS 10.0) that was exploited in the wild before the company applied a server-side fix to its infrastructure; the flaw stems from unsafe deserialization of untrusted data and affects the identity service underlying Microsoft 365, Azure, and Dynamics 365. Because Entra ID is a managed cloud service, Microsoft says remediation is complete with no customer action needed, but the advisory omits critical details including attribution, the exploitation window, affected tenant count, post-exploitation activity, and indicators of compromise—leaving security teams without independent means to verify exposure or review their own logs for signs of compromise.
A “confidence disconnect” is plaguing the industry, a consulting firm said.
Researchers have identified iAuthFlow V2, a phishing toolkit that exploits passkey authentication by registering attacker-controlled passkeys to maintain persistent access to compromised accounts. This capability allows attackers to retain access even after victims reset their passwords or revoke active sessions, representing a significant evolution in phishing attack sophistication that targets modern authentication mechanisms.
Researchers have discovered that expiration dates on certain Visa credit cards can be manipulated to enable fraudulent transactions with expired cards, a vulnerability termed "Zombie Card" attacks. This finding demonstrates a potential weakness in Visa's payment validation mechanisms that could allow attackers to reactivate cards that should no longer be functional for purchases.
Government agencies with smaller budgets need support — and here's how you can help.
Russian network monitoring firm Microolap has confirmed a cyberattack claimed by pro-Ukraine hacking group Black Spark, which alleged it maintained access to the company's network for over a month. The attackers claimed to have compromised internal systems including EtherSensor, Microolap's network traffic analysis platform, according to statements made by the threat group.
The new AI security controls follow the Hugging Face incident last month, though many of these additions perhaps should have been in place prior to the frontier models escaping.
This week's cybersecurity landscape spans government agencies, retailers, and software platforms, with France's tax authority confirming a breach affecting 678,000 individuals' tax and property information, Ukraine's asset recovery agency facing a suspected coordinated cyberattack ahead of a critical tender, and a critical GitLab vulnerability allowing unauthenticated attackers to delete public projects. Enterprise AI adoption is simultaneously expanding the threat surface through shadow AI, data leakage, insecure integrations, and prompt injection risks, while incidents like the Oz Hair and Beauty breach underscore ongoing risks to customer data across sectors.
The coming threat of super-powerful computers capable of cracking today’s algorithms requires upgrading encryption now. Tech companies have begun building defenses.
The U.S. has indicted Iranian cyber espionage operations while Medusa ransomware has compromised over 500 organizations, highlighting active threats across state-sponsored and criminal landscapes. Attackers are actively exploiting a critical Windows protocol vulnerability, demonstrating how legacy systems remain prime targets for threat actors.
An unauthenticated attacker can exploit CVE-2026-8452 to corrupt memory in Citrix NetScaler's SAML parser through a single request, creating a potential remote code execution vector without requiring a system crash. Bishop Fox provides technical analysis of the patch, methods for verifying its deployment across multiple systems, and guidance on identifying exploitation attempts in security logs.
Cybersecurity researchers have attributed a malicious backdoor discovered in compromised Rust packages to North Korean threat actors, connecting it to their historical supply chain attack campaigns. This incident demonstrates continued efforts by the nation-state group to infiltrate software dependencies and gain access to downstream users and organizations.
A critical type confusion vulnerability in isolated-vm enables V8 sandbox escape and allows attackers to hijack the control flow of the host process, ultimately achieving remote code execution. This vulnerability demonstrates how memory safety issues in JavaScript engines can be exploited to break out of isolation boundaries and compromise the underlying system.
Microsoft has patched a critical remote code execution vulnerability (CVE-2026-69836) in Entra ID, its cloud identity service that manages authentication and access controls for Microsoft 365, Azure, and third-party applications. The flaw carries a maximum CVSS score of 10.0 and has been exploited in active attacks, allowing unauthenticated attackers to execute code remotely. The vulnerability was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick.