TECHZONE™

Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw https://thehackernews.com/2026/07/researchers-report-84-flaws-in-4g-and.html An academic study has disclosed a "widespread class" of security vulnerabilities impacting 4G and 5G core networks that, if successfully exploited, could trigger denial-of-service (DoS) attacks and even session hijacking, allowing an attacker to seize control of a user's network session. The findings have been released by a group of researchers from Singapore's Nanyang Technological University

6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026 https://thehackernews.com/2026/07/6-reasons-why-device-code-phishing-is.html Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved from a niche red-team technique to an industrial-scale threat in under six months. Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization login flow has been adopted by a wide range of apps and use-cases that it wasn't originally

Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks https://thehackernews.com/2026/07/chinese-hacker-commands-deepseek-via.html Palo Alto Networks' Unit 42 says a Chinese-speaking threat actor used DeepSeek through the open-source Hermes Agent framework to launch attacks autonomously. After an initial Telegram instruction, the agent found internet-facing systems and selected public exploits. The researchers recovered no further operator input in the session. The operator, tracked through the aliases knaithe and KnYuan,

Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations https://thehackernews.com/2026/07/anthropic-says-claude-mistook-open.html Anthropic on Thursday became the latest artificial intelligence (AI) company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, had breached three unnamed organizations during cybersecurity testing without its knowledge. The AI firm said the earliest incidents date back to April 2026, adding it made the discoveries after launching a "

Beyond the screenshot: Why you should verify what you see https://www.welivesecurity.com/en/cybersecurity/beyond-screenshot-why-verify-you-see/ The screenshot may look convincing, but it doesn’t necessarily prove that the payment, booking or conversation is genuine

DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware https://thehackernews.com/2026/07/dprk-linked-macos-malvertising-uses.html Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview campaign. The defining aspect of the attack is that bogus macOS software update screen stealthily

ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories https://thehackernews.com/2026/07/threatsday-ai-powered-hacking-370.html A lot of security still comes down to trusting the wrong screen. This week, that screen might be a login page, an install guide, a recruiter call, or a familiar service behaving slightly wrong. Behind it: reused credentials, exposed systems, quiet loaders, abused trust, and exploit paths that should have been harder. Some defenses improved. The loose parts still got found first. Anyway,

Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database https://thehackernews.com/2026/07/azure-cosmos-db-flaw-exposed-platform.html A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service's Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz. Wiz, which codenamed the chain CosmosEscape, said the exploit chain began with a crafted query against a Gremlin database controlled by the attacker. From there, code execution on a

Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents https://thehackernews.com/2026/07/microsoft-copilot-for-word-can-copy.html Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft. In his proof of concept, the internally generated file triggered the same behavior when it was used in a second Copilot drafting session. Måløy's

The Network Has Become the Control Plane for AI Security https://thehackernews.com/2026/07/the-network-has-become-control-plane.html Network firewalls are the workhorses of modern cybersecurity. They are trusted to protect the network, blocking malicious traffic and preventing intrusions and breaches. And for decades, network security teams have built controls around a relatively stable model: users connect to applications, applications exchange data, and security tools inspect packets, protocols, and destinations. Firewalls

Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts https://thehackernews.com/2026/07/hackers-exploit-anysign4pc-via-hacked.html South Korean authorities and four security firms have disclosed a state-sponsored campaign that compromised trusted domestic websites. The attackers used those sites to exploit locally installed financial-security software and infect targeted visitors with SIGNBT or COPPERHEDGE backdoors. A compromised page could infect a system running a vulnerable AnySign4PC version without a prompt or

SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT https://thehackernews.com/2026/07/silverfox-targets-japanese-manufacturer.html The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver (BYOVD) attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT (aka Winos 4.0) for persistent remote access. "In this campaign, the group combines new vulnerable-driver abuse, newly observed abuse of legitimate

Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation https://thehackernews.com/2026/07/russian-hackers-exploit-microsoft-owa.html The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access (OWA), to target U.S. and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors. The activity, which began on July 22, 2026, involves the

FCC Blocks New Foreign-Produced Robots and Power Inverters Over Cyber Risks https://thehackernews.com/2026/07/fcc-blocks-new-foreign-produced-robots.html The Federal Communications Commission (FCC) added foreign-produced mobile robots and networked power inverters to its Covered List on July 28. The move generally prevents new models from receiving the equipment authorization required for import, marketing, or sale in the US. Previously authorized models can still be sold, and devices people already own are unaffected. Federal purchases and use

Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet https://thehackernews.com/2026/07/amazon-links-debug-and-chalk-npm-hijack.html Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than 2 billion weekly downloads between them. The original Aikido and Wiz reports did not attribute the

Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data https://thehackernews.com/2026/07/cisco-fmc-zero-day-actively-exploited.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a newly disclosed security flaw impacting Cisco Secure Firewall Management Center (FMC) Software to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation. The vulnerability, assigned CVE-2026-20316 (CVSS score: 5.3), could permit an unauthenticated, remote attacker to log

Mythos Asks the Right Question. It Doesn't Answer It. https://thehackernews.com/2026/07/mythos-asks-right-question-it-doesnt.html AI is compressing exploit timelines. The real question isn't whether your vulnerability management playbook needs to change, it's which part of it you've been getting wrong all along. The conversation happening in security circles right now goes something like this: Mythos is here. Exploit timelines are collapsing. Does the vulnerability management playbook need to change? The honest answer is

Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser https://thehackernews.com/2026/07/researchers-show-single-malicious.html Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser. Tracked as CVE-2026-10702, the bug provides arbitrary code execution inside the browser's renderer process. Mozilla rated it High and fixed it in the Firefox 151.0.3 update. "No settings or additional user interaction are required," Eten Zou,

73% of Organizations Say They Are Not Fully Ready for a Major Cyberattack https://thehackernews.com/2026/07/73-of-organizations-say-they-are-not.html Most organizations have incident response plans, security tools, and technical teams in place. Yet new research suggests that many still lack the coordination, visibility, and executive alignment needed to withstand a serious cyberattack. According to The State of Incident Response Readiness 2026, based on a survey of 600 senior IT security decision makers conducted by Vanson Bourne in January

Russia Charges Telegram Founder Pavel Durov With Aiding Terrorist Activity https://thehackernews.com/2026/07/russia-charges-telegram-founder-pavel.html The Federal Security Service of the Russian Federation (FSB) on Wednesday said it charged Telegram founder Pavel Durov for allegedly facilitating terrorist activities and for failing to remove prohibited information in violation of Russian law. The principal security agency said the instant messaging platform "failed to remove numerous channels, chats, and bots on the platform that are