-
The White House has directed the National Coordination Center to create a programme that could allow vetted private cybersecurity firms to carry out limited offensive cyber operations against foreign criminal groups. The new private hack-back program would operate under US government authority and target transnational organisations linked to ransomware, phishing, fraud, sextortion and impersonation scams.…
-
WhatsApp has started testing Scam Alert, a new optional security feature that warns users when an incoming message may be part of a scam. The tool runs directly on a user’s device and does not send message content to WhatsApp or Meta for analysis. The WhatsApp Scam Alert feature is currently available to a limited…
-
Security researchers have disclosed Plug and Pwn, a new attack technique that abuses Windows Plug and Play to install vulnerable vendor software and gain SYSTEM-level access. The attacks can use emulated USB devices, while one demonstration works remotely through RDP USB redirection without connecting physical hardware to the target. Windows can install vendor software as…
-
North Korean-linked Lazarus hackers exploited a Windows zero-day vulnerability to target defence, aerospace and aviation organisations in Europe and India. Microsoft patched the flaw in its August 2026 security updates after confirming that attackers had already used it in the wild. Lazarus used a Windows privilege-escalation flaw The vulnerability, tracked as CVE-2026-68820, affects the Windows…
-
The FBI has warned that cybercriminals are targeting social-media and other online accounts to steal private images and videos. Attackers may use the stolen material for blackmail, harassment or online sextortion, and they may share victims’ personal information with other criminals. Stolen content can lead to repeated abuse According to the FBI, attackers target both…
-
A proof-of-concept exploit for a critical Microsoft SharePoint vulnerability is already being used in attacks, only a day after Rapid7 published technical details and exploit code. The flaw allows unauthenticated attackers to impersonate SharePoint users or administrators and access or modify data. Exploit code targets SharePoint authentication bypass The vulnerability, tracked as CVE-2026-55040, affects the…
-
Signal has introduced Automatic Key Verification, a new security feature designed to help users confirm that their encrypted conversations have not been intercepted or manipulated. The feature adds automated checks to Signal’s existing safety-number system and aims to make secure verification easier for everyday users. Signal adds a key transparency system Automatic Key Verification is…
-
A newly disclosed Microsoft Defender vulnerability, dubbed ShieldBreak, reportedly allows attackers to gain SYSTEM-level privileges on fully patched Windows devices. The proof-of-concept exploit was released after Microsoft’s August 2026 Patch Tuesday updates and is described as a bypass for an earlier Defender flaw. ShieldBreak targets Microsoft Defender scans Security researcher Nightmare Eclipse released the ShieldBreak…
-
Google says Chrome’s anti-abuse systems blocked more than 7 billion unwanted notifications on Android each day during the first quarter of 2026. The browser is targeting a growing source of scams, phishing attempts, malware delivery and fraudulent payment requests. Notification abuse has become a major threat Website notifications can be useful for news alerts, order…
-
DeadLock ransomware is making it harder for authorities and security teams to disrupt its operations by moving key parts of its infrastructure onto decentralized services. The group uses Polygon blockchain smart contracts, encrypted messaging and cloud storage to keep communicating with victims and publishing stolen data. DeadLock uses blockchain-backed infrastructure DeadLock ransomware emerged in mid-2025…