Cybersecurity News, Threats & Vulnerability Alerts

Microsoft Patches 161 CVEs in Record-Breaking April Update

Microsoft's April 2026 Patch Tuesday addresses 161 vulnerabilities including an actively exploited SharePoint zero-day, marking the second-largest patch release ever.

McGraw-Hill Confirms Data Breach via Salesforce Exploit

Education giant McGraw-Hill disclosed hackers exploited a Salesforce misconfiguration to access internal company data in confirmed security incident.

Adobe Patches 55 Flaws Across 11 Products in April 2026

Adobe released security updates fixing 55 vulnerabilities across 11 products, with critical ColdFusion flaws posing the highest exploitation risk.

108 Chrome Extensions Hijack Browsers via Shared C2 Network

Security researchers uncovered 108 malicious Chrome extensions using shared command-and-control infrastructure to steal user data and inject ads.

Basic-Fit Data Breach Exposes 1 Million Customer Records

Dutch fitness chain Basic-Fit confirms hackers accessed personal information of one million customers in major security incident.

Rockstar Games Hit by ShinyHunters Data Breach via Anodot

Rockstar Games suffered a data breach through compromised analytics provider Anodot, with ShinyHunters gang now leaking stolen data publicly.

wolfSSL Critical Flaw Weakens ECDSA Signature Verification

A critical vulnerability in wolfSSL's SSL/TLS library allows attackers to bypass ECDSA signature verification through improper hash algorithm validation.

FBI Dismantles W3LL Phishing Platform in Global Operation

FBI and Indonesian authorities shut down the W3LL phishing-as-a-service platform, arresting its developer in the first US-Indonesia cybercrime enforcement action.

OpenAI Rotates macOS Certificates After Supply Chain Attack

OpenAI revoked macOS code-signing certificates following a malicious Axios package compromise that targeted GitHub Actions workflows.

Booking.com Confirms Data Breach Exposing User Reservations

Booking.com detected unauthorized system access that compromised sensitive reservation data and personal information of platform users.

Adobe Patches Zero-Day CVE-2026-34621 in Emergency Update

Adobe released an emergency Acrobat Reader security update fixing CVE-2026-34621, actively exploited since December 2025.

Booking.com Confirms Data Breach Exposed Customer Info

Booking.com disclosed hackers accessed customer booking information in a security incident the travel platform says it has contained.

Fake Claude AI Site Spreads PlugX RAT via DLL Sideloading

Cybercriminals are distributing PlugX remote access trojan through fake Anthropic Claude AI websites using sophisticated DLL sideloading techniques.

APT37 Deploys RokRAT via Facebook Social Engineering

North Korean APT37 hackers use Facebook friend requests to deliver RokRAT malware through sophisticated social engineering attacks.

Marimo RCE Flaw Under Active Attack Hours After Disclosure

Critical pre-authentication remote code execution vulnerability in Marimo notebook platform exploited for credential theft within hours of public disclosure.

Adobe Patches Critical Acrobat Reader Zero-Day Under Attack

Adobe released emergency patches for CVE-2026-34621, a critical Acrobat Reader vulnerability actively exploited by attackers worldwide.

UK-Led Operation Exposes 20,000 Crypto Fraud Victims

International law enforcement operation coordinated by UK's National Crime Agency identifies over 20,000 cryptocurrency fraud victims across three countries.

Iranian Hackers Target Thousands of Rockwell PLCs in US Grid

Iranian-linked threat groups are actively targeting thousands of exposed Rockwell Automation programmable logic controllers across US critical infrastructure networks.

CPUID Website Compromised: CPU-Z Downloads Serve Malware

Attackers compromised CPUID's API to replace legitimate CPU-Z and HWMonitor downloads with malicious executables on the official website.

Storm-2755 Hackers Target Canadian Payroll Systems

Storm-2755 threat group hijacks Canadian employee accounts to steal salary payments through sophisticated payroll system attacks.

LucidRook Malware Targets Taiwan NGOs in Spear-Phishing Attacks

Chinese threat actors deploy new Lua-based LucidRook malware against Taiwanese NGOs and universities through sophisticated spear-phishing campaigns.