Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
Swati KhandelwalJun 26, 2026AI Security / Vulnerability A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer’s cloud…
Category: TheHackerNews
New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks
A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt…
FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys
Swati KhandelwalJun 26, 2026Secure Messaging / Social Engineering The FBI and CISA have updated their March warning about Russian intelligence phishing Signal accounts, and the operators have…
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
Ravie LakshmananJun 26, 2026Cyber Espionage / Malware A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new custom backdoor called TinyRCT as…
New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries
Swati KhandelwalJun 26, 2026Linux / Vulnerability A flaw in the Linux kernel’s traffic-control subsystem can let a local unprivileged user gain root on affected systems.…
Google Details Turla’s New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks
The Russian state-sponsored threat actor known as Turla has been attributed to a previously undocumented .NET backdoor called STOCKSTAY that has been deployed against government…
New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns
Ravie LakshmananJun 25, 2026Initial Access Broker / Ransomware A new, stealthy backdoor named Mistic has been deployed as part of suspected financially motivated attacks aimed…
New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis
Ravie LakshmananJun 25, 2026AI Security / Malware A previously undocumented Rust-based macOS implant and information stealer has been found to embed a prompt injection payload…
Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability
An analysis of a popular Google Chrome ad block extension for YouTube has uncovered the ability to execute arbitrary JavaScript code. According to Island, the…
Surviving the Mythos Era: Richard Bejtlich on the Case for NDR
Despite the abundance of telemetry at analysts’ disposal, many security operations teams struggle to answer a few basic questions during incident investigation: What happened? What…
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access
Ravie LakshmananJun 25, 2026Vulnerability / Threat Intelligence An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco Catalyst SD-WAN as a zero-day…
Dawn of the Apex Agentic Adversary
The Hacker NewsJun 24, 2026Network Security / Vulnerability Management We are standing at the end of an era we never thought to mourn: the era…