Targeted
Threat Intelligence

Arista patches VeloCloud Orchestrator zero-day exploited in attacks

Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in atta...

Agentic Browsers Rewind Web Security by 20 years

PleaseFix class of flaws makes it easy to socially engineer agentic browsers and highlights weaknesses in how they handle cross-origin requests....

New Dysphoria DDoS botnet spreads to 200k devices worldwide

A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic...

New Certighost PoC exploit lets attackers hijack Windows domains

A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attac...

'Confused Deputy' Flaws Persist in Google Cloud, Microsoft Azure

This category of vulnerabilities allows an attacker to easily acquire administrative level permissions and bypass cloud providers' access controls....

FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown

An FBI agent explains how the mulitnational law-enforcement Operation Cronos was successful in disrupting the largest ransomware group of its time....

Why Resetting Passwords No Longer Stops Attackers

As attackers shift from password theft to session and token theft to bypass multifactor authentication controls, organizations must move beyond login security a...

NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework

NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software an...

Adversaries Don't Need a Zero-Day — They Read Your Rulebook

Confidence in autonomous security tools is declining, and here's why....

Apple sued over fake App Store crypto wallet app stealing $1.8M in Bitcoin

Apple is being sued by three people who claim approximately $1.8 million in Bitcoin was stolen after downloading and using a fraudulent Sparrow Wallet applicati...

Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption

Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a Mar...

Microsoft Defender for Endpoint Update Leaves Few Linux Servers Unprotected After Reboot

A recent Microsoft Defender for Endpoint update briefly disabled antivirus protection on Linux servers following an upgrade and reboot, exposing affected machin...

Critical vBulletin Flaw Lets Unauthenticated Attackers Execute PHP Code Remotely

vBulletin has patched CVE-2026-61511, a critical remote code execution flaw that could let unauthenticated attackers execute arbitrary PHP code and compromise v...

Coca-Cola confirms data theft in Fairlife ransomware attack

The Coca-Cola Company has confirmed that hackers stole data from its dairy subsidiary, Fairlife, during a ransomware attack earlier this month. [...]...

EY Data Breach Claimed by ShinyHunters Hacker Group

The notorious ShinyHunters extortion gang has publicly claimed responsibility for the Ernst & Young (EY) data breach, alleging it stole employee credentials...

GitHub Adds 3-Day Dependabot Cooldown to Block Malicious Package Updates

GitHub has introduced a default three-day cooldown period for Dependabot version updates to reduce the risk of projects automatically adopting new malicious pac...

Ernst & Young data breach claimed by ShinyHunters extortion gang

The ShinyHunters extortion gang has claimed responsibility for a recently disclosed Ernst & Young data breach, saying it obtained credentials for some of the co...

A Fake Teams Update Can Give Hackers Two Separate Ways to Control Your PC

A new phishing operation, tracked as Operation BlueDash, is tricking users into installing a fake Microsoft Teams update that silently hands attackers not one b...

Security Risk Advisors Named a Finalist in CRN’s 2026 Best of the Channel Awards

Philadelphia, Pennsylvania, July 27th, 2026, CyberNewswire Security Risk Advisors is proud to share that CRN, a brand of The Channel Company, has recognized Joe...

Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval() function inside vBulletin and execute code on an unpatched...