The CyberSignal | Cybersecurity News

Editorial illustration of an OT switch with three chained keys reaching a root terminal, marking Unit 42's Siemens ROX II zero-day trilogy analysis.

Unit 42 Publishes “Three Steps to the Terminal” Analysis of Chained Siemens ROX II Zero-Day Vulnerabilities

Three chained OT zero-days in Siemens ROX II — a defender review for industrial operators this week, with Unit 42's analysis and Siemens's fixed firmware as the anchors.

Editorial illustration of a coiled serpent slipping into a government building's document tray, marking Kaspersky's GoSerpent espionage malware in Southeast Asia.

Kaspersky Documents "GoSerpent" Malware Targeting Southeast Asian Governments and Diplomats

Another Southeast-Asia-focused espionage cluster documented by Kaspersky — a defender research review this week for government and diplomatic entities in the region.

Editorial illustration of a phone lock screen with a gesture sending an SMS past the PIN, marking Google's patch for the Android Gemini lock-screen bug.

Google Publishes Patch for Android Lock Screen Bug That Reportedly Let Gemini Send SMS Without a PIN

A mobile lock-screen bypass involving Gemini — defender verification across managed Android fleets this week.

Editorial illustration of a FaceTime call bubble wearing a bank mask, marking Apple's warning on FaceTime-based social engineering targeting iPhone and iPad users.

Apple Publishes Warning on FaceTime-Based Social Engineering Targeting iPhone and iPad Users

An Apple advisory on FaceTime-based social engineering — defender-team end-user awareness this week.

Editorial illustration of an airport departure gate holding a passport with a mismatched photo, marking Armenia's detention of Aleksandr Ermakov on a US REvil request.

Armenia Detains Russian National Aleksandr Ermakov on US REvil Extradition Request; Family Disputes Identity

A cross-border REvil extradition drama - an identity dispute and the Armenian judicial process take center stage this week, with a Russian tourist detained on a US warrant his lawyers say names a different man.

Editorial illustration of a fake fix-it prompt piping browser tokens and documents into a stealer, marking Microsoft's ACR Stealer ClickFix analysis.

Microsoft Defender Experts Documents ACR Stealer Delivered via ClickFix Lures Targeting Browsers and Microsoft 365

Another named stealer joins the ClickFix pattern — a defender posture review across Microsoft 365 environments after Microsoft's published analysis this week.

Editorial illustration of a state-emblem shield adopting a fake fix-it prompt, marking Ars Technica's report of Russia's Sandworm cluster using ClickFix.

Ars Technica Reports Russia's Sandworm Cluster Now Using ClickFix Technique

ClickFix migrates from financially motivated crime to nation-state activity, according to Ars Technica's report on Russia's Sandworm cluster - a defender-awareness read for this week.

Editorial illustration of a spiral lock closing over a server within a single day's clock, marking Symantec's Spirals ransomware that locks systems in under 24 hours.

Symantec Documents "Spirals" Ransomware Reportedly Locking Systems in Under 24 Hours

A fast-moving Rust-based ransomware family — defender detection-engineering review this week.

Editorial illustration of a case folder fanning into many attack markers, marking US authorities attributing 120-plus attacks to Scattered Spider's Thalha Jubair.

CyberScoop Reports US Authorities Attribute 120+ Attacks to Scattered Spider Defendant Thalha Jubair

More detail on Scattered Spider's TfL leaders: US authorities have Jubair on the record for 120 attacks, and defender pattern-tracking continues this week.

Editorial illustration of a shared-document portal beside a two-day calendar countdown, marking CISA's KEV listing of SharePoint zero-day CVE-2026-58644.

CISA Adds SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog With July 19 Patch Deadline

A CVSS 9.8 SharePoint zero-day joins CISA's KEV catalog with a two-day patch deadline — defender teams accelerate verification this week.

Editorial illustration of a top-hat ransomware badge rising above a fading rival crown, marking The Gentlemen overtaking Qilin as the most prolific operation.

ReliaQuest: “The Gentlemen” Overtakes Qilin as Most Prolific Ransomware Operation

The ransomware leaderboard shifts — The Gentlemen tops the chart in ReliaQuest’s latest tracking, and defender-team pattern-watching continues this week from the analyst’s chair, not the attacker’s.

Editorial illustration of a sandbox tray cracked open beside a two-day calendar, marking CISA's urgent-patch order for exploited Fortinet FortiSandbox flaws.

CISA Mandates Urgent Patching for Actively Exploited Fortinet FortiSandbox Vulnerabilities (July 19 Deadline)

Two FortiSandbox flaws under active attack — CISA's July 19 deadline puts defender teams on the clock this week.

See all

FBI Arrests 21-Year-Old Zyaire Wilkins Over Steam-Game Malware Campaign Draining Crypto Wallets

Researchers Document “NadMesh” Go Botnet Hunting Exposed AI Services for Cloud Keys and Kubernetes Tokens

Okta Red Team Publishes "HollowByte" OpenSSL Memory-Freeze Vulnerability Detail After Silent June Fix

Expel Attributes April 2026 DigiCert Breach to “CylindricalCanine” GoldenEyeDog Subgroup

'wp2shell' WordPress Core Unauthenticated RCE Patched in 6.9.5 and 7.0.2 (CVE-2026-63030)

Dark Reading Attributes SonicWall SMA Zero-Day Exploitation to INC Ransomware Operation

Checkmarx Documents “ViteVenom” Campaign Compromising Seven Vite npm Packages With Blockchain C2

Rapid7 Publishes Deep-Dive on Exploited SharePoint CVE-2026-58644

Types of Threat Actors: From Cybercriminals to Nation-States

Researchers Document "Text Salting" — Hidden-Text Technique Reportedly Bypasses AI-Based Email Security Filters at Scale

Latest