Silver Fox fake software installers impersonate Razer and Edge to disable Windows Defender and deploy malware. See how the campaign works.

Related Posts:

• PHP Web Server Rootkit Targets F5 BIG-IP Devices
• StreamRat Banking Trojan Targets Spanish Android Users
• The Gentlemen Ransomware Deploys in Under 24 Hours

The post Silver Fox Fake Software Installers Disable Windows Defender appeared first on Daily CyberSecurity.

The Linux Kernel 7.1 EOL has officially arrived. Discover the final updates and learn why you must upgrade to the latest stable LTS releases immediately.

Related Posts:

• CERN to Move 2,200 Accelerator Control Machines to Debian 13
• Debian 11 Reaches End of Long Term Support
• Linux Nears USB4 Support for Apple Silicon

The post Linux Kernel 7.1 Reaches End of Life appeared first on Daily CyberSecurity.

If you ever linked your Dropbox account to a Lenovo ID - perhaps to make life easier when logging in via a Lenovo laptop - you might want to take heed. Read more in my article on the Hot for Security blog.

A newly analyzed Linux malware sample, dubbed Tengu, combines Mirai-style botnet tradecraft with broad persistence, DDoS, SSH probing, and proxy capabilities. The stripped 32-bit ELF masquerades as a Linux kernel worker process while targeting servers, embedded devices, and IoT-adjacent systems. It has no symbols, uses NX protection and partial RELRO, and carries a SHA-256 hash […]

The post Tengu Mirai-Style Linux Bot Hides as Kernel Worker to Launch DDoS and Proxy Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A FreeSWITCH vulnerability in api-chat enables remote code execution and is exploited in the wild. Upgrade to 1.11.3 now to stay safe.

Related Posts:

• Linux Kernel Vulnerability CVE-2024-26582: Public PoC Reaches Root Shell
• NTLM Reflection Bypass CVE-2026-24294 Gets Public PoC Exploit
• Public Details Disclosed: MediaTek t7xx WWAN Flaw

The post FreeSWITCH api-chat RCE Exploited in the Wild, Patch Now appeared first on Daily CyberSecurity.

Security researchers released a Linux CVE-2026-52924 PoC exploit. Check flaw details and patch instructions to secure your systems against root takeovers.

Related Posts:

• MikroTik RouterOS Vulnerability Exploited in the Wild: Patch and Defense Blueprint
• StyleSmuggler: Magento Zero-Day RCE Exploited in the Wild
• CVE-2026-75754 (CVSS 10): ASUS Control Center Root RCE

The post CVE-2026-52924 PoC Exploit Disclosed: 9.8 CVSS Linux Root Privilege Escalation appeared first on Daily CyberSecurity.

Discover the new GPT-6 Astra Codex pricing policy. OpenAI now removes multiplier penalties for contexts exceeding 272K, offering flat rates up to 1M tokens.

Related Posts:

• Google Workspace Integrates Gemini Live Features
• Court Upholds Edge Gatekeeper Exemption
• Microsoft Defender Intercepts Legitimate Links

The post GPT-6 Astra Updates Codex Pricing appeared first on Daily CyberSecurity.

Plex urges an urgent security update to Media Server 1.43.3 and Desktop 1.115.0. NAS and Docker users may need to patch manually.

Related Posts:

• MikroTik RouterOS Vulnerability Exploited in the Wild: Patch and Defense Blueprint
• StyleSmuggler: Magento Zero-Day RCE Exploited in the Wild
• CVE-2026-75754 (CVSS 10): ASUS Control Center Root RCE

The post Plex Issues Urgent Security Update for Media Server and Desktop appeared first on Daily CyberSecurity.

CERN's Debian migration moves 2,200+ accelerator control machines off Red Hat, driven by RHEL's raised x86-64 CPU baseline.

Related Posts:

• Debian 11 Reaches End of Long Term Support
• Linux Nears USB4 Support for Apple Silicon
• Debian AI Policy: Responsible Generative AI Use Wins Vote

The post CERN to Move 2,200 Accelerator Control Machines to Debian 13 appeared first on Daily CyberSecurity.

SonicWall disclosed this week that attackers are chaining two previously unknown vulnerabilities in its SMA1000 secure access appliances to run commands on unpatched devices, and urged customers to install an emergency hotfix.

The more severe flaw, CVE-2026-83548, is a pre-authentication server-side request forgery weakness in the appliance's Appliance Work Place interface, rated 10.0 on the CVSS scale. It lets a remote attacker with no credentials reach sensitive internal functionality. The second, CVE-2026-83549, is an operating-system command injection bug in the Appliance Management Console rated 7.8; on its own it requires administrative authentication, but paired with the SSRF flaw it yields remote code execution.

The vendor said it found both issues internally and then observed them being used together in live attacks. SonicWall has not published indicators of compromise or described the attackers.

Affected products are the SMA1000 series 6210, 7210 and 8200v, in both hardware and virtual form. Fixed builds are 12.4.3-03526 and later, and 12.5.0-02952 and later. SonicWall firewalls running SSL-VPN and the separate SMA 100 line are not affected.

Remediation guidance goes beyond patching. SonicWall told customers to contact its support organization to review appliances for signs of intrusion and, where compromise is suspected, to re-image or redeploy the device, rotate all credentials and reset TOTP tokens — an acknowledgment that one-time-password seeds stored on a breached appliance survive a software update. The company said customers should move to the hotfix release as quickly as possible.

Shadowserver Foundation scanning has tracked more than 400 internet-exposed SMA1000 appliances, though an unknown share of those are already patched. The small install base belies the risk profile. These are remote-access gateways that sit at the network edge and hold credentials for the environments behind them.

The disclosure extends a difficult run for the product line. Attackers exploited a separate pair of SMA1000 zero-days in July 2026, tracked as CVE-2026-15409 and CVE-2026-15410, to deploy custom malware; CISA later confirmed ransomware operators were abusing that access.

Read: CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation

Another zero-day surfaced in December 2025. Seventeen SonicWall vulnerabilities across the company's product families currently sit in CISA's Known Exploited Vulnerabilities catalog. Edge appliances from SonicWall, Ivanti, Citrix and Fortinet have collectively become the preferred initial-access route for ransomware affiliates and espionage crews, because they are internet-facing by design and rarely instrumented with endpoint detection.

A cyberattack on X users that targeted hundreds of thousands of accounts has prompted an investigation by the US Department of Justice (DOJ), with Attorney General Todd Blanche saying sophisticated cybercriminals attempted to exploit the platform's password-recovery system. The DOJ is working with Elon Musk's X, formerly known as Twitter, to identify those responsible for the attempted attack, according to Blanche's statement on Wednesday. The incident involved hundreds of thousands of X users and was disrupted before the targeted accounts could be captured, Blanche said.

Blanche Says DOJ Is Tracking Those Behind Cyberattack on X Users 

In a statement posted on X, Blanche described the incident as a password-recovery attack carried out by "sophisticated cyber criminals." He said X managed to disrupt the effort and prevent user accounts from being taken over.  Blanche wrote: 

This week, sophisticated cyber criminals attempted a password-recovery attack on hundreds of thousands of X users. X disrupted the attack to prevent user accounts from being captured. But, as we’ve shown, the Justice Department will stop at nothing in its pursuit of cyber fraudsters and scammers. We are working closely with @X to track down the criminals behind this week’s attack. There is no refuge for those that perpetrate their criminal schemes from behind computer screens." 

The attorney general did not disclose additional technical details about the cyberattack on X users, including how the attackers attempted to exploit the recovery system, whether any individual accounts were compromised, or where the suspected criminals were operating from.  The DOJ investigation is intended to identify those responsible for the attempted intrusion, with Blanche emphasizing that authorities would pursue individuals involved in cyber fraud and scams even when those activities are conducted remotely. 

How the Password-Recovery Attack Works 

A password-recovery attack generally targets the systems users rely on when they have forgotten their login credentials. These processes can include "forgot password" features, account-recovery forms, and other mechanisms designed to help legitimate users regain access to their accounts. Attackers may attempt to exploit weaknesses in those processes to obtain access to accounts. In the incident involving X, the platform was able to disrupt the effort before the targeted accounts were captured, according to Blanche. The scale of the attempted cyberattack on X users—hundreds of thousands of accounts—makes the incident notable, although the attorney general did not provide a breakdown of how many accounts were actually affected or whether any users suffered losses. 

AI-Driven Cyberattacks Add to Growing Security Concerns 

The X incident comes against a wider backdrop of increasing cybersecurity threats facing companies and organizations around the world.  Businesses have been dealing with a rise in AI-driven cyberattacks as well as ransomware campaigns capable of stealing sensitive information, interrupting operations, and creating significant financial and operational damage.  The growing use of artificial intelligence in cyber operations has raised concerns that attackers can automate or accelerate parts of their campaigns. At the same time, organizations are exploring ways to use AI-based systems to identify vulnerabilities and strengthen their defenses.  The DOJ has also been pursuing cases involving sophisticated cyber operations. Days before news of the cyberattack on X users, the department announced an operation targeting QTFY, described by US authorities as a Chinese cyberespionage platform. 

DOJ Previously Targeted QTFY Cyberespionage Platform 

According to the Justice Department, QTFY had targeted several US institutions and organizations. Those named by the department included the US Senate, the Federal Reserve, and NASA, among others.  The action against QTFY highlights the broader range of cyber threats confronting US institutions, from espionage operations to attacks aimed at obtaining access to online accounts.  The latest investigation involving X therefore comes amid a broader push by US authorities to identify and disrupt cyber criminals and state-linked cyber operations. 

A new Amatera password stealer campaign abuses WordPress and EtherHiding. Learn how this Amatera password stealer infects browsers.

Related Posts:

• Malicious Browser Extensions Drain Crypto Wallets
• PackClient RAT: New C2 Framework Sold on Telegram
• Miraak Post Exploitation Framework Adopts Database C2

The post Amatera Password Stealer Abuses Service Workers and Smart Contracts appeared first on Daily CyberSecurity.

Debian 11 LTS ends on August 31, 2026. Discover upgrade options and extended paid support details for enterprises still running the older Linux version.

Related Posts:

• Linux Nears USB4 Support for Apple Silicon
• Debian AI Policy: Responsible Generative AI Use Wins Vote
• California Exempts Linux from Age Verification

The post Debian 11 Reaches End of Long Term Support appeared first on Daily CyberSecurity.

CVE-2026-9586, a critical Sangoma Switchvox vulnerability, is exploited in the wild, giving unauthenticated attackers SQL injection and remote code execution.

Related Posts:

• Critical Google Chrome Vulnerabilities Patched in New Update
• CVE-2026-80047: Hugging Face Transformers Library Vulnerability
• CVE-2026-68162: Linux Kernel Root Escalation PoC Public

The post CVE-2026-9586: Switchvox RCE Exploited in the Wild appeared first on Daily CyberSecurity.

A Cambodia malware campaign hides SparkRAT in PNG files and abuses a vulnerable driver to kill antivirus, Acronis TRU reports.

Related Posts:

• Dark Caracal Deploys New GoCaracal Malware Framework
• BREEZE COMET Threat Actor Attacks Brazilian Banks
• AnonyMousKIT Uses AI Voice Calls to Unlock Stolen iPhones

The post Cambodia Malware Campaign Uses PNG Files to Deliver SparkRAT appeared first on Daily CyberSecurity.

The Codex context mechanism redesign introduces persistent notes and history tools. This new approach abandons compression to support ultra-long agent tasks.

Related Posts:

• EU Classifies ChatGPT as Search Engine
• ChatGPT Advertising Revenue Soars
• Gemini Notebook Adopts Dynamic Quota System

The post Codex Modifies Long Task Management appeared first on Daily CyberSecurity.

Discover how the Asahi Linux project is successfully pushing vital USB4 protocol drivers for Apple Silicon directly into the mainline Linux kernel.

Related Posts:

• Debian AI Policy: Responsible Generative AI Use Wins Vote
• California Exempts Linux from Age Verification
• Ubuntu 26.04.1 LTS Released with Crucial Bug Fixes

The post Linux Nears USB4 Support for Apple Silicon appeared first on Daily CyberSecurity.

Debian's AI policy vote picked "Responsible Use of Generative AI": AI is neither banned nor endorsed, with full accountability left to contributors.

Related Posts:

• Linux Nears USB4 Support for Apple Silicon
• California Exempts Linux from Age Verification
• Ubuntu 26.04.1 LTS Released with Crucial Bug Fixes

The post Debian AI Policy: Responsible Generative AI Use Wins Vote appeared first on Daily CyberSecurity.

A public proof-of-concept for the CVE-2026-52933 privilege escalation flaw is available. This Linux kernel io_uring exploit carries a CVSS 7.8 score.

Related Posts:

• CVE-2026-81934: Redis RCE PoC Exploit Now Public
• CVE-2026-78319: SAUTER Controller RCE Flaw Disclosed
• CVE-2026-82329 Exploited: JFrog Artifactory Admin Takeover

The post PoC Published for Linux Kernel Privilege Escalation CVE-2026-52933 Flaw appeared first on Daily CyberSecurity.

Kaspersky uncovered a ValleyRAT backdoor adware campaign using signed wallpaper apps to drop malware. Learn how to protect your systems.

Related Posts:

• UAT-10147 Deploys SPECTRE Cross-Platform Implant
• Kimsuky Spear Phishing Abuses Remote Control Tools
• Fire Ant Threat Actor Targets Trusted Infrastructure

The post ValleyRAT Backdoor Spread via Signed Chinese Adware appeared first on Daily CyberSecurity.