The CyberSignal (Page 58)

Latest

An SD-WAN controller node with an unauthenticated peer slipping past a certificate gate.

Cyber Attacks

A CVSS 10.0 Cisco SD-WAN Auth Bypass Is Under Active Attack — and UAT-8616 Has Been in This Code Since 2023

Cisco disclosed a maximum-severity authentication bypass in Catalyst SD-WAN, actively exploited as a zero-day by UAT-8616 — the same actor that has targeted this service since 2023. CISA added it to KEV, and there are no workarounds.

A telehealth platform server with patient record cards pulled out over a two-day window.

Cyber Attacks

A Telehealth Platform Lost 716,000 People's Health Data in Two Days — and Took Four Months to Say So

OpenLoop Health confirmed a January 2026 intrusion that exposed the names, birth dates, and medical information of 716,000 telehealth users. A threat actor called Stuckin2019 claims to hold data on 1.6 million. Disclosure came roughly four months after the breach.

A backdoor code window with emoji-marked comments, three target pins on Brazil, Germany, South Korea.

Threat Intelligence

Kimsuky's PebbleDash Now Hits Defense Sectors in Three Countries — And Its New Backdoor Was Coded With AI

Kaspersky found something unusual in a North Korean backdoor: comments that look written by an LLM, not a human. Combined with Kimsuky's expansion into defense targets across three countries, it is documented evidence that state malware development is borrowing AI.

A laptop with a Signal message database file being siphoned out, a backdoor injected into a system process.

Threat Intelligence

Microsoft's Kazuar Analysis Shows Russia's Secret Blizzard Wants Your Signal Desktop Files

Microsoft's new Kazuar analysis names one capability that ties it to the other Russian Signal operation in the news: Kazuar steals Signal Desktop message files. Encryption protects the conversation in transit — not the database on a compromised laptop.

NGINX server block with an exposed crack running through the rewrite module, an AI scanner beam crossing it.

Application Security

An AI Found an 18-Year-Old NGINX RCE in Six Hours — CVE-2026-42945 'NGINX Rift'

An autonomous AI was pointed at the NGINX source code and found a critical RCE that survived 18 years of human review — plus three more CVEs in the same six-hour session. NGINX runs a third of the internet's top sites. The discovery method is the bigger story.

A PDF document splitting into two paths over a map of Ukraine — one benign, one malicious RAR archive.

Cyber Attacks

Ghostwriter Now Geofences Its Phishing Lures — Only Ukrainian IPs Get the Malware

Ghostwriter built operational security into its phishing lure. Send the campaign's malicious PDF to a Ukrainian IP and it triggers the attack chain. Send it anywhere else — including to the analysts investigating it — and they get a harmless document.

Oil derrick and pipeline overlaid on a map of the Caspian region, three intrusion-wave arrows.

Threat Intelligence

Salt Typhoon Just Pivoted to Azerbaijani Oil and Gas — Chinese APT Targeting Now Follows Energy Geopolitics

Salt Typhoon spent three months inside an Azerbaijani oil and gas company — a target type it normally ignores. Bitdefender's assessment of why is the part that matters: Chinese APT targeting now follows energy geopolitics in real time.

Smartphone with a fake support chat bubble, a snowballing chain of contact nodes expanding outward.

Cyber Attacks

A Spyware Investigator Turned a Signal Hijack Attempt Into a 13,500-Target Russian Campaign Map

Russian government hackers tried to hijack the Signal account of the wrong person. Donncha Ó Cearbhaill investigates spyware for a living — so he reverse-engineered the campaign and found himself one of 13,500+ targets. The 'snowball' methodology is the lesson.

Supply Chain Attack

RubyGems Just Shut Down New Signups After 'Hundreds' of Malicious Packages Hit the Registry

RubyGems temporarily turned off new signups after what its security partner called a major malicious attack — hundreds of packages, DDoS, spam, and exploits hitting at once. The halt is the response model defenders should remember.

Server with neural-net glow, government silhouette, globe with tension lines.

AI Security

Germany Warns China Is Close to an AI 'Superhacker' — and Building It in Secret

Germany's top cybersecurity official told lawmakers that China is close to building an AI model with superhacking capabilities — developed in secret. The warning lands a month after Anthropic gated Mythos. AI cyber capability is now great-power competition.

Masked operative removing a ransomware mask, Teams chat window, credentials text file.

Cyber Attacks

Iranian Spies Are Pretending to Be Ransomware Operators — Inside MuddyWater's Chaos False Flag

An Iranian state-sponsored APT spent early 2026 conducting espionage while wearing the Chaos ransomware brand as a costume. Rapid7 pulled back the curtain. The Microsoft Teams screen-sharing tradecraft is why IR triage needs updating.

Dev workstation with code monitor, three converging attacker arrows, deployment pipeline.

Application Security

Three Unrelated Threat Actors Just Arrived at the Same Conclusion — Your Developers Are the Beachhead

Three unrelated threat actors arrived at the same conclusion in March and April: the developer workstation is the best ROI beachhead. CSO Online's framing — the Developer Credential Economy — is the editorial line CISOs should adopt this quarter.

See all