ZCyberNews — Cybersecurity & Tech Intelligence
Star Blizzard Scales Phishing Attacks on Ukraine Supporters
Microsoft says FSB-linked Star Blizzard hit 100+ orgs in the US and UK, using a new RedFlick delivery chain that needs one click to drop CosmicPulse.
See more updates →4 min read
Unit 42 Ties AI-Generated Payloads to Government Linux Espionage
Unit 42's CL-UNK-1211 campaign hit government Linux servers from October 2025 to April 2026, deploying AI-annotated PHP web shells and a custom RAT to dump databases and mailboxes.
CVE-2026-96951
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows
CVSS 8.8 · government, enterprise
Microsoft's October 2026 Patch Tuesday fixes 1,413 CVEs, led by CVE-2026-96951 (CVSS 8.8), a Windows Mark of the Web bypass exploited in the wild and added to CISA KEV.
Read →More from today
See all →- 3dMalwarePoland: NSO Group Had Access to Pegasus Data on 500+ Targets
- 5dIndustry NewsAhold Delhaize Cyber Incident Disrupts Grocery Chains
- 1wVulnerabilitiesCVE-2026-105278: openPDC Docker Image Ships Default Admin Login
- 1wVulnerabilitiesCISA Adds ProFTPD CVE-2015-3306 to KEV as Flax Typhoon Exploits Five
- 1wIndustry NewsFBI Arrests Ransomware Negotiator in ShinyHunters Probe
Threat Intel
Star Blizzard Scales Phishing Attacks on Ukraine Supporters
Microsoft says FSB-linked Star Blizzard hit 100+ orgs in the US and UK, using a new RedFlick delivery chain that needs one click to drop CosmicPulse.
NightEagle APT Hits Russian Firms With GhostContainer Backdoor
Kaspersky GERT ties NightEagle (APT-Q-95) to attacks on Russian firms, deploying the GhostContainer backdoor on Exchange via CVE-2020-0688 and BlueKeep CVE-2019-0708.
Mirage Kitten Deploys Node.js, JavaScript RATs in Aviation, FinTech
Mirage Kitten targets aviation and FinTech sectors across the Middle East and Africa with NodeRabbit and PollCat RATs, delivered via trojanized coding challenges on LinkedIn.
Vulnerabilities
8.8
high
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows
CVE-2026-96951
9.8
critical
CVE-2026-105278: openPDC Docker Image Ships Default Admin Login
CVE-2026-105278
10.0
critical
CISA Adds ProFTPD CVE-2015-3306 to KEV as Flax Typhoon Exploits Five
CVE-2015-3306
Malware
CL-UNK-1211
APT
Unit 42 Ties AI-Generated Payloads to Government Linux Espionage
Oct 16 · HIGH
NSO Group
MALWARE
Poland: NSO Group Had Access to Pegasus Data on 500+ Targets
Oct 15 · —
Midnight Mimosa
MALWARE
Midnight Mimosa Malware Found Preinstalled on Cheap Android Phones
Oct 8 · HIGH
Industry News
Ahold Delhaize Cyber
AHOLD DELHAIZE
Ahold Delhaize Cyber Incident Disrupts Grocery Chains
Oct 13 · INFO
FBI Arrests Ransomware
SHINYHUNTERS
FBI Arrests Ransomware Negotiator in ShinyHunters Probe
Oct 10 · INFO
Healthcare
DATA BREACH
iRhythm Breach Hits 360,000 After Social Engineering Attack
Oct 10 · INFO
Tools & Techniques
Metasploit Adds Vim Plugin Persistence, Exploits for Three CVEs
Rapid7's Metasploit Framework adds Vim plugin persistence, exploits for CVE-2025-6793 (Marvell QConvergeConsole), CVE-2024-48760 (GestioIP), and CVE-2023-30253 (Dolibarr).
Signal Adds In-App Warnings to Block Russian-Linked Phishing Attacks
Signal introduced new in-app confirmations and warnings to counter phishing attacks linked to Russian state hackers who abused the Linked Device feature to hijack high-profile...
Anthropic Launches Claude Security for AI-Driven Exploit Defense
Anthropic released Claude Security, a defensive AI suite to counter autonomous exploit tools like Mythos that weaponize zero-days in minutes. Targets enterprise SOCs.
AI Security
OpenAI
PROVIDER
Wikimedia: OpenAI Agents Tried to Breach Etherpad, Edit Wikipedia
Oct 6 · INFO
OpenAI
PROVIDER
OpenAI Apologizes as Agents Breached Australian Government Sites
Sep 29 · HIGH
OpenAI
PROVIDER
OpenAI Apologizes for Australian Government Site Incidents
Sep 29 · INFO
Stay Updated
Get the latest cybersecurity news delivered to your inbox.