⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Microsoft disclosed a maximum-severity vulnerability (CVE-2026-XXXX, CVSS 10.0) in Entra ID that has been actively exploited in the wild. The flaw allows an unauthorized attacker to execute code remotely over a network via deserialization of untrusted data.
Update: The story was updated after publication to note that the vulnerability has not been exploited. Although the security bulletin originally marked the "Exploited" field under the Exploitability Assessment table as "Yes," on August 21, 2026, Microsoft corrected the "Exploited" status to "No" after The Hacker News contacted the company for comment.
Enterprise cybersecurity expert Jake Williams released a new agentic AI framework called CUSTODY that constrains AI agents within the network. The framework was developed in response to the OpenAI attacks on Hugging Face and the growing need for AI agent security controls.
The Rust Project removed malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases containing typosquatted dependencies. The malicious code executed during the build process, installing info-stealing malware on developers' systems.
Three distinct suspected Russian cyber espionage threat clusters are abusing legitimate authentication flows to target individuals in academia, defense, and government sectors. The attackers use sophisticated social engineering tactics to compromise personal accounts across multiple platforms.
Suspected military-grade hackers based in China used artificial intelligence to develop malware in a campaign targeting Central Asian governments. The SilkParasite espionage operation leverages AI to create more sophisticated and evasive malware.