The CyberSignal | Cybersecurity News

Editorial illustration of a game controller tipping coins from a crypto wallet beside handcuffs, marking the FBI arrest over a Steam-game malware campaign.

FBI Arrests 21-Year-Old Zyaire Wilkins Over Steam-Game Malware Campaign Draining Crypto Wallets

A cryptocurrency-user targeting arrest via a novel Steam-games vector — law-enforcement coverage this weekend.

Editorial illustration of a mesh net trawling exposed AI service panels for key tags, marking the NadMesh Go botnet hunting cloud keys and Kubernetes tokens.

Researchers Document “NadMesh” Go Botnet Hunting Exposed AI Services for Cloud Keys and Kubernetes Tokens

A botnet targeting self-hosted AI tooling for cloud keys — defender review for organizations exposing AI services this weekend.

Illustration of a tiny key inflating a huge balloon beside a server, marking Okta's HollowByte OpenSSL memory-freeze disclosure after a silent June fix.

Okta Red Team Publishes "HollowByte" OpenSSL Memory-Freeze Vulnerability Detail After Silent June Fix

A silent OpenSSL fix gets belated technical detail: eleven bytes of TLS request data can reportedly strand up to 131 KB of server memory. Defender review is warranted across OpenSSL-dependent infrastructure this weekend.

Editorial illustration of a signing seal lifted from a certificate vault, marking Expel's attribution of the DigiCert breach to the CylindricalCanine subgroup.

Expel Attributes April 2026 DigiCert Breach to “CylindricalCanine” GoldenEyeDog Subgroup

A code-signing-integrity attribution against a Chinese cybercrime subgroup — and a prompt for supply-chain defenders to review how much trust their pipelines place in a valid signature.

Editorial illustration of a website building block with an open back door and a blueprint beside it, marking the wp2shell WordPress Core unauthenticated RCE.

'wp2shell' WordPress Core Unauthenticated RCE Patched in 6.9.5 and 7.0.2 (CVE-2026-63030)

An unauthenticated remote-code-execution flaw in WordPress Core, disclosed as wp2shell, affects the 6.9 and 7.0 branches. Fixes shipped July 17 in 6.9.5 and 7.0.2 — defender teams and hosting providers should verify patch status rather than assume forced updates landed.

Editorial illustration of a banner planted on a breached gateway appliance, marking attribution of SonicWall SMA zero-day exploitation to INC Ransomware.

Dark Reading Attributes SonicWall SMA Zero-Day Exploitation to INC Ransomware Operation

INC Ransomware named as the SonicWall SMA zero-day exploiter — defender teams stay in accelerated verification posture this weekend.

Editorial illustration of seven npm package boxes wired to a blockchain-link control node, marking the ViteVenom campaign against Vite frontend tooling.

Checkmarx Documents “ViteVenom” Campaign Compromising Seven Vite npm Packages With Blockchain C2

Another JavaScript-ecosystem compromise with a novel blockchain-C2 angle — seven scoped npm packages impersonating the Vite tooling namespace, and defender inventory work this weekend.

Editorial illustration of a magnifying glass over a cracked shared-document portal, marking Rapid7's deep-dive on the exploited SharePoint flaw CVE-2026-58644.

Rapid7 Publishes Deep-Dive on Exploited SharePoint CVE-2026-58644

Rapid7 goes deep on the SharePoint CVSS-9.8 RCE — defender-team detection-engineering review this weekend.

Editorial science-poster illustration of the six major threat actor categories, shown as silhouette portraits each marked with a small identifying icon.

Types of Threat Actors: From Cybercriminals to Nation-States

The major categories of cyber threat actors explained — nation-states, cybercriminals, hacktivists, insiders, and script kiddies — with motivations and defense implications.

Editorial illustration of an email with hidden salt grains slipping past an AI filter lens, marking the text-salting technique seen in over a million phishing emails.

Researchers Document "Text Salting" — Hidden-Text Technique Reportedly Bypasses AI-Based Email Security Filters at Scale

A scale-significant AI-filter-bypass research beat — defender review for AI-heavy email-security stacks this week.

Editorial illustration of an OT switch with three chained keys reaching a root terminal, marking Unit 42's Siemens ROX II zero-day trilogy analysis.

Unit 42 Publishes “Three Steps to the Terminal” Analysis of Chained Siemens ROX II Zero-Day Vulnerabilities

Three chained OT zero-days in Siemens ROX II — a defender review for industrial operators this week, with Unit 42's analysis and Siemens's fixed firmware as the anchors.

Editorial illustration of a coiled serpent slipping into a government building's document tray, marking Kaspersky's GoSerpent espionage malware in Southeast Asia.

Kaspersky Documents "GoSerpent" Malware Targeting Southeast Asian Governments and Diplomats

Another Southeast-Asia-focused espionage cluster documented by Kaspersky — a defender research review this week for government and diplomatic entities in the region.

See all

Researchers Document "SleeperGem" RubyGems Supply-Chain Attack Targeting Developer Machines

F5 Publishes Critical NGINX Patch for Heap Buffer Overflow (CVE-2026-42533) That Could Enable Denial of Service or RCE

Hugging Face Confirms Production Infrastructure Breach Reportedly Perpetrated by Autonomous AI Agent

wp2shell WordPress Vulnerabilities (CVE-2026-60137 and CVE-2026-63030) Confirmed Exploited in the Wild

WordPress Ships 7.0.2 Security Release Patching Two High-Severity Vulnerabilities

UC Berkeley Researchers Publish “Context Bombing” Defensive Prompt-Injection Technique via Prismata System

Volexity Attributes SonicWall SMA Zero-Day Exploitation to Previously Undocumented UTA0533 Actor Since June 22

OpenAI Publishes "GPT-Red" Automated Red-Teaming Model to Harden GPT-5.6 Sol Against Prompt Injection

CERT-UA Names Sandworm Subgroup UAC-0145 Behind ClickFix CAPTCHA Campaign Against Ukrainian Devices

AI Security: The Complete Guide

Latest