5+ hour, 14+ min ago  (488+ words) Jet Brains has released patches for several critical vulnerabilities in Jet Brains Hub that could allow for full authentication bypass, account takeover, and unauthorized privilege escalation across integrated Jet Brains services. Administrators are urged to update their Hub instances immediately....

5+ hour, 45+ min ago  (535+ words) First named by Proofpoint in 2023, Valley RAT continues to evolve: Level Blue's telemetry shows a marked increase in successful detections beginning May 2025 and accelerating into 2026. The threat now presents through two primary vectors fake installers and malicious email campaigns each…...

7+ hour, 37+ min ago  (383+ words) The actor gained execution on an internet-facing Langflow instance via CVE-2025-3248, used the AI-host environment to harvest cloud and API credentials, and pivoted into a production My SQL/Nacos deployment to carry out a destructive, database-focused extortion playbook without a…...

4+ hour, 59+ min ago  (546+ words) A targeted phishing campaign delivering the Ousaban banking Trojan to users in Spain and Portugal, notable for its use of geofenced webpages, layered evasion techniques, and a modular delivery chain. The threat actor repurposes a playbook seen previously in Brazil…...

3+ hour, 6+ min ago  (448+ words) A sophisticated phishing campaign that uses a fake invoice PDF to mask the delivery of multiple remote access trojans primarily Async RAT, but also Venom RAT and XWorm via layered shortcuts. Try Cloudflare quick tunnels, and disguised Python packages. The…...

9+ hour, 29+ min ago  (617+ words) A large-scale password spray campaign linked to the infrastructure provider LSHIY LLC has targeted Microsoft 365 environments, resulting in over 81 million login attempts. This campaign has led to at least 78 confirmed account compromises across 64 organizations between June 12 and June 26, 2026. According to…...

10+ hour, 24+ min ago  (458+ words) U. S. authorities have announced federal charges against an alleged member of the notorious cybercriminal group Scattered Spider, following his arrest in Finland and extradition to the United States. The defendant, identified as 19-year-old Peter Stokes, a dual national of the U. S. and…...

9+ hour, 51+ min ago  (500+ words) A novel, practical ransomware technique that runs entirely inside the browser by abusing the File System Access API, demonstrating how AI can turn high-level malicious ideas into operational attack chains without any native payload. The proof-of-concept leverages a social engineering…...

23+ hour, 27+ min ago  (307+ words) Torrance, California, USA, July 1st, 2026, Cyber Newswire Cyber threat intelligence becomes more valuable when indicators are enriched with context that supports investigation, correlation, and decision-making. Through the Criminal IP integration with Open CTI, security teams can transform IP addresses, domains, and…...

1+ day, 7+ hour ago  (331+ words) A sophisticated new botnet family dubbed Rust Duck emerged in early 2026, leveraging a two-stage Loader and Core architecture to compromise Io T devices, routers, and enterprise servers through brute-force credential attacks and remote code execution vulnerabilities. Rust Duck employs a…...