TECHZONE™

What to Look for in an Exposure Management Platform (And What Most of Them Get Wrong) https://thehackernews.com/2026/04/what-to-look-for-in-exposure-management.html Every security team has a version of the same story. The quarter ends with hundreds of vulnerabilities closed. The dashboards are bursting with green. Then someone in a leadership meeting asks: "So, are we actually safer now?" Crickets. The room goes quiet because an honest answer requires context – which is something that patch counts and CVSS scores were never designed to provide. Exposure

Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately https://thehackernews.com/2026/04/critical-cpanel-authentication.html cPanel has released security updates to address a security issue impacting various authentication paths that could allow an attacker to obtain access to the control panel software. The problem affects all currently supported versions, according to an alert released by cPanel on Tuesday. The issue has been addressed in the following versions - 11.110.0.97 11.118.0.63 11.126.0.54 11.132.0.29

CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV https://thehackernews.com/2026/04/cisa-adds-actively-exploited.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting ConnectWise ScreenConnect and Microsoft Windows to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2024-1708 (CVSS score: 8.4) - A path traversal vulnerability in  ConnectWise ScreenConnect

LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html In yet another instance of threat actors quickly jumping on the exploitation bandwagon, a newly disclosed critical security flaw in BerriAI's LiteLLM Python package has come under active exploitation in the wild within 36 hours of the bug becoming public knowledge. The vulnerability, tracked as CVE-2026-42208 (CVSS score: 9.3), is an SQL injection that could be exploited to modify the underlying

Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push https://thehackernews.com/2026/04/researchers-discover-critical-github.html Cybersecurity researchers have disclosed details of a critical security vulnerability impacting GitHub.com and GitHub Enterprise Server that could allow an authenticated user to obtain remote code execution with a single "git push" command. The flaw, tracked as CVE-2026-3854 (CVSS score: 8.7), is a case of command injection that could allow an attacker with push access to a repository to achieve

Brazilian LofyGang Resurfaces After Three Years With Minecraft LofyStealer Campaign https://thehackernews.com/2026/04/brazilian-lofygang-resurfaces-after.html A cybercrime group of Brazilian origin has resurfaced after more than three years to orchestrate a campaign that targets Minecraft players with a new stealer called LofyStealer (aka GrabBot). "The malware disguises itself as a Minecraft hack called 'Slinky,'" Brazil-based cybersecurity company ZenoX said in a technical report. "It uses the official game icon to induce voluntary execution,

VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi https://thehackernews.com/2026/04/vect-20-ransomware-irreversibly.html Threat hunters are warning that the cybercriminal operation known as VECT 2.0 acts more like a wiper than a ransomware due to a critical flaw in its encryption implementation across Windows, Linux, and ESXi variants that renders recovery impossible even for the threat actors. The fact that VECT's locker permanently destroys large files rather than encrypting them means even victims who opt to

Why Secure Data Movement Is the Zero Trust Bottleneck Nobody Talks About https://thehackernews.com/2026/04/why-secure-data-movement-is-zero-trust.html Every security program is betting on the same assumption: once a system is connected, the problem is solved. Open a ticket, stand up a gateway, push the data through. Done. That assumption is wrong. It is also a major reason Zero Trust programs stall. New research my team just published puts numbers on it. The Cyber360: Defending the Digital Battlespace report, based on a survey of 500 security

Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE https://thehackernews.com/2026/04/critical-cve-2026-25874-leaves-hugging.html Cybersecurity researchers have disclosed details of a critical security flaw impacting LeRobot, Hugging Face's open-source robotics platform with nearly 24,000 GitHub stars, that could be exploited to achieve remote code execution. The vulnerability in question is CVE-2026-25874 (CVSS score: 9.3), which has been described as a case of untrusted data deserialization stemming from the use of the

After Mythos: New Playbooks For a Zero-Window Era https://thehackernews.com/2026/04/after-mythos-new-playbooks-for-zero.html When patching isn’t fast enough, NDR helps contain the next era of threats. If you’ve been tracking advancements in AI, you know the exploit window, the short buffer that organizations relied on to patch and protect after a vulnerability disclosure, is closing fast. Anthropic’s new model, Claude Mythos, and its Project Glasswing, showed that finding exploitable vulnerabilities and subtle cracks

Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks https://thehackernews.com/2026/04/chinese-silk-typhoon-hacker-extradited.html A Chinese national accused of being a member of the Silk Typhoon hacking group has been extradited to the U.S. from Italy.  Xu Zewei, 34, was arrested in July 2025 by Italian authorities for his alleged links to the Chinese state-sponsored threat group and for orchestrating cyber attacks against American organizations and government agencies between February 2020 and June 2021, including

Microsoft Patches Entra ID Role Flaw That Enabled Service Principal Takeover https://thehackernews.com/2026/04/microsoft-patches-entra-id-role-flaw.html An administrative role meant for artificial intelligence (AI) agents within Microsoft Entra ID could enable privilege escalation and identity takeover attacks, according to new findings from Silverfort. Agent ID Administrator is a privileged built-in role introduced by Microsoft as part of its agent identity platform to handle all aspects of an AI agent's identity lifecycle operations in a

Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202 https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html Microsoft on Monday revised its advisory for a now-patched, high-severity security flaw impacting Windows Shell to acknowledge that it has been actively exploited in the wild. The vulnerability in question is CVE-2026-32202 (CVSS score: 4.3), a spoofing vulnerability that could allow an attacker to access sensitive information. It was addressed as part of its Patch Tuesday update for this

Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack https://thehackernews.com/2026/04/checkmarx-confirms-github-repository.html Checkmarx has disclosed that its ongoing investigation tied to the supply chain security incident has revealed that a cybercriminal group published data related to the company on the dark web. "Based on current evidence, we believe this data originated from Checkmarx's GitHub repository, and that access to that repository was facilitated through the initial supply chain attack of March 23, 2026,

⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More https://thehackernews.com/2026/04/weekly-recap-fast16-malware-xchat.html Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back. New tools are doing shady crap. Supply chains got hit. Fake help desks worked. Weird research showed how easy some attacks still are. Most of it feels like stuff we should have fixed years ago. Bad extensions. Stolen creds. Remote tools are getting abused. Malware hides in places people trust. Same

Mythos Changed the Math on Vulnerability Discovery. Most Teams Aren't Ready for the Remediation Side https://thehackernews.com/2026/04/mythos-changed-math-on-vulnerability.html Anthropic’s Claude Mythos Preview has dominated security discussions since its April 7 announcement. Early reporting describes a powerful cybersecurity-focused AI system capable of identifying vulnerabilities at scale and raising serious questions about how quickly organizations can validate, prioritize, and remediate what it finds. The debate that followed has mostly focused on the right

PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks https://thehackernews.com/2026/04/phantomcore-exploits-trueconf.html A pro-Ukrainian hacktivist group called PhantomCore has been attributed to attacks actively targeting servers running TrueConf video conferencing software in Russia since September 2025. That's according to a report published by Positive Technologies, which found the threat actors to be leveraging an exploit chain comprising three vulnerabilities to execute commands remotely on susceptible

Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware https://thehackernews.com/2026/04/researchers-uncover-73-fake-vs-code.html Cybersecurity researchers have flagged dozens of Microsoft Visual Studio Code (VS Code) extensions on the Open VSX repository that are linked to a persistent information-stealing campaign dubbed GlassWorm. The cluster of 73 extensions has been identified as cloned versions of their legitimate counterparts. Of these, six have been confirmed to be malicious, with the remaining acting as seemingly

Fake CAPTCHA IRSF Scam and 120 Keitaro Campaigns Drive Global SMS, Crypto Fraud https://thehackernews.com/2026/04/fake-captcha-irsf-scam-and-120-keitaro.html Cybersecurity researchers have disclosed details of a telecommunications fraud campaign that uses fake CAPTCHA verification tricks to dupe unsuspecting users into sending international text messages that incur charges on their mobile bills, generating illicit revenue for the threat actors who lease the phone numbers. According to a new report published by Infoblox, the operation is believed to

The calm before the ransom: What you see is not all there is https://www.welivesecurity.com/en/ransomware/calm-ransom-what-you-see-is-not-all-there-is/ A breach claims the systems as well as the confidence that was, in retrospect, a major vulnerability