TECHZONE™

Microsoft Accelerates Post-Quantum Cryptography Shift to 2029 https://thehackernews.com/2026/07/microsoft-accelerates-post-quantum.html Microsoft on Tuesday said it's accelerating its quantum safe security roadmap, stating technology advances in quantum computing are making it essential to replace existing encryption standards sooner than previously expected. "Advances in quantum research and development have shifted the risk horizon," Mark Russinovich, chief technology officer of Microsoft Azure, said. "We believe

Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data https://thehackernews.com/2026/06/microsoft-warns-poisoned-mcp-tool.html New Microsoft research shows how attackers can hijack AI agents that act on a user's behalf, using nothing more than a poisoned tool description to make the agent quietly hand over company data to an outsider. The trick is that the agent never breaks a rule. Every step looks routine, so in a default setup no alarm may fire. The work comes from Microsoft Incident Response and its

RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline. Researchers at QiAnXin's XLab have tracked it since February 2026, and say the real story is not how big it is today, but how fast it is changing. The end goal is a

Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html Threat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero cryptocurrency miner. The activity has been found to weaponize CVE-2026-33017 (CVSS score: 9.3), an unauthenticated remote code execution (RCE) vulnerability in Langflow, indicating threat actors are scanning and targeting exposed artificial intelligence (AI)

Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses https://thehackernews.com/2026/06/silent-swap-crypto-clipper-uses-fake.html Cybersecurity researchers have flagged an active browser extension campaign that is designed to steal cryptocurrency by stealthily replacing wallet addresses when unsuspecting users initiate a transaction. The cryptocurrency clipper activity has been codenamed Silent Swap by McAfee Labs. "The campaign is delivered through unsigned installers – observed in both .NET and Golang variants – that

GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html The safety check that is supposed to stop an AI coding agent from running a dangerous command can be walked straight past using a shell trick that has been public for decades. New research from Adversa AI, which is named the bypass GuardFall, found it works against ten of the eleven popular open-source coding and computer-use agents the firm tested. Only one, "Continue," was built to

282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study https://thehackernews.com/2026/06/282-ios-apps-found-leaking-llm-api-keys.html Researchers tested 444 AI chatbot apps for iPhone and found that 282 of them, nearly two-thirds, exposed paid AI access through their network traffic. In many cases, the path in was visible just by watching what the app sent: a plaintext API key, a reusable token, or a backend server that accepted requests with no key at all. Whoever grabs it can send model requests on the developer's account,

What the Numbers Say About FIFA 2026 Cyber Risk https://thehackernews.com/2026/06/what-numbers-say-about-fifa-2026-cyber.html The FIFA World Cup 2026 opened on June 11. By that date, according to Check Point Research, the fraud infrastructure targeting it had already been built, staged, and partially deployed. Threat actor activity was pre-planned, months out, across three sectors and at least ten languages. Check Point Exposure Management published the FIFA World Cup 2026 Cyber Threat Report this month, covering

Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer. The intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0), a critical authentication bypass vulnerability impacting the OpenID Connect (OIDC) flow that an unauthenticated

AirDrop and Quick Share Flaws Let Nearby Attackers Trigger Crashes and Bypass Checks https://thehackernews.com/2026/06/airdrop-and-quick-share-flaws-let.html Two researchers have found six security flaws in AirDrop and Quick Share, the wireless features that beam files between nearby devices with no cables or shared network. An attacker within wireless range, with just a laptop and no prior connection, can crash the sharing service on a Mac or iPhone set to receive from anyone, with no tap or prompt. The same research found Quick Share flaws that

New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials https://thehackernews.com/2026/06/new-bioshocking-attack-tricks-ai.html Convince an AI browser that it is playing a game, and it can hand over your login details. That is the finding behind BioShocking, a technique from security firm LayerX that tricked six AI browsers and assistants into copying a user's credentials and sending them to an attacker. The targets included OpenAI's ChatGPT Atlas, Perplexity's Comet, and Anthropic's Claude browser extension. An

Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html A critical vulnerability in Progress Kemp LoadMaster can let an unauthenticated attacker execute arbitrary commands as root on the appliance by sending a crafted request to its API. The flaw, tracked as CVE-2026-8037, carries a CVSS score of 9.8 according to ZDI. A patch is available. If you run LoadMaster with the API enabled, update now. Progress published its advisory on June

Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs https://thehackernews.com/2026/06/apple-patches-30-ios-macos-safari-flaws.html Apple on Monday released security updates for iOS, macOS, and the Safari web browser to address over three dozen flaws, including four vulnerabilities in WebKit that were discovered using artificial intelligence (AI) tools like Anthropic Claude and OpenAI Codex Security. The WebKit vulnerabilities are listed below - CVE-2026-43707 - A memory corruption issue that could result in an

Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html A critical security flaw impacting Oracle E-Business Suite has come under active exploitation in the wild, according to Defused Cyber. The vulnerability, tracked as CVE-2026-46817 (CVSS score: 9.8), refers to an improper privilege management and authentication flaw in Oracle Payments that could be abused to take over susceptible instances. "Easily exploitable vulnerability allows

Inside the inbox: Why cybercriminals want to break into your email account https://www.welivesecurity.com/en/cybersecurity/inside-inbox-cybercriminals-want-break-email-account/ Your inbox is an identity system all of its own: whoever owns it may own a lot more

Why Post-Quantum Cryptography Starts With Credentials https://thehackernews.com/2026/06/why-post-quantum-cryptography-starts.html Today’s encrypted data, such as credentials, may no longer remain confidential in the future because the public-key cryptography protecting it will soon be broken by quantum computers. Although no machine today can break elliptic curve cryptography or RSA, quantum hardware is advancing rapidly and will inevitably change how organizations protect their data. Ciphertext and credentials captured by

Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse https://thehackernews.com/2026/06/gamaredon-expands-ukraine-attacks-with.html A Russian advanced persistent threat (APT) group has continued to evolve and expand its malware arsenal as part of its ongoing cyber onslaught against Ukraine throughout 2025. Slovakian cybersecurity company ESET said it observed 35 distinct spear-phishing campaigns mounted by Gamaredon against new targets, with most of them taking place in the second half of the year. Primary targets of these

Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts https://thehackernews.com/2026/06/microsoft-removes-119-edge-extensions.html Microsoft has shut down a long-running malicious extension operation on the Edge Add-ons store that hid its payloads inside ordinary image and font files, then woke up days after install to steal credentials and run ad fraud. The company calls it StegoAd, a mash-up of steganography and adware, and ties 119 extensions to a single threat actor it says has been active since at least 2021.

Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw https://thehackernews.com/2026/06/public-poc-released-for-critical.html A public proof-of-concept is now out for CVE-2026-55200, a critical flaw in libssh2 that lets a malicious or compromised SSH server trigger memory corruption on a connecting client, with possible code execution. No credentials, no user interaction. The bug affects every release up to and including 1.11.1 and carries a CVSS 4.0 score of 9.2. libssh2 is a client-side SSH library, not a server.

Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer https://thehackernews.com/2026/06/hijacked-npm-and-go-packages-use-vs.html Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts. "This attack avoids the most common npm execution paths through lifecycle scripts, perhaps in an attempt to remain 'compatible' with npm v12's security hardenings," JFrog said in a