ZCyberNews
中文

Articles

551 articles

Illustration of a Linux server terminal overlaid with PHP web shell code and AI chat-style annotationsHIGH
Malware

Unit 42 Ties AI-Generated Payloads to Government Linux Espionage

Unit 42's CL-UNK-1211 campaign hit government Linux servers from October 2025 to April 2026, deploying AI-annotated PHP web shells and a custom RAT to dump databases and mailboxes.

4 min readCL-UNK-1211
Polish Prime Minister Donald Tusk speaking at a podium, with a blurred smartphone displaying a spyware icon in the foreground.
Malware

Poland: NSO Group Had Access to Pegasus Data on 500+ Targets

Poland's ABW found NSO Group retained exclusive control of Pegasus servers, giving it technical access to surveillance data on 500+ targets, prosecutors say.

5 min readNSO Group
A Windows security update screen showing a long list of pending patches on a workstation.HIGH
Vulnerabilities

Microsoft Patches Record 1,413 Flaws, Including Exploited Windows

Microsoft's October 2026 Patch Tuesday fixes 1,413 CVEs, led by CVE-2026-96951 (CVSS 8.8), a Windows Mark of the Web bypass exploited in the wild and added to CISA KEV.

CVE-2026-96951CVE-2026-108398CVE-2026-92707
6 min read
Ahold Delhaize storefront signage outside a grocery retailer affected by the cyber incident.
Industry News

Ahold Delhaize Cyber Incident Disrupts Grocery Chains

Ahold Delhaize took systems offline after a cyber incident disrupted Food Lion, Stop & Shop, Albert Heijn and Delhaize stores across the US, Netherlands and Belgium.

3 min read
Illustration of a Docker container icon with an unlocked padlock overlaid on a grid representing an electric power utility control network.CRITICAL
Vulnerabilities

CVE-2026-105278: openPDC Docker Image Ships Default Admin Login

CVE-2026-105278 (CVSS 9.8) leaves the published openPDC Docker image with a fixed administrative credential and no forced rotation, giving network-adjacent attackers full control.

CVE-2026-105278
4 min read
Screenshot-style illustration of a CISA Known Exploited Vulnerabilities catalog entry for CVE-2015-3306 with a patch deadline countdown.CRITICAL
Vulnerabilities

CISA Adds ProFTPD CVE-2015-3306 to KEV as Flax Typhoon Exploits Five

CISA set an October 11 federal patch deadline after Flax Typhoon exploited CVE-2015-3306, a CVSS 10.0 ProFTPD flaw, plus four other bugs in its KEV batch.

CVE-2015-3306
3 min readFlax Typhoon
Federal courthouse building with FBI investigation context
Industry News

FBI Arrests Ransomware Negotiator in ShinyHunters Probe

FBI arrested CyberSteward co-founder Edward Dubrovsky on cyber extortion charges tied to ShinyHunters, the group that stole data on thousands of FBI agents.

3 min readShinyHunters
An iRhythm Zio cardiac monitoring patch sensor worn on a patient's chest.
Industry News

iRhythm Breach Hits 360,000 After Social Engineering Attack

iRhythm says a June social engineering attack exposed names, insurance numbers, and device serials for 360,000 patients across Texas, South Carolina, and California.

3 min read
FBI headquarters building with the bureau seal visible above the entranceHIGH
Industry News

FBI Arrests Third ShinyHunters Suspect Over FBI Breach

FBI arrested a Canadian national in Pennsylvania, its third ShinyHunters arrest in two weeks, after the group breached FBIjobs.gov and stole data on nearly every FBI employee.

3 min readShinyHunters
Japanese and German flags in front of a courthouse, representing the cross-border extradition of a ransomware suspect.
Industry News

Japan Extradites Russian Qilin Ransomware Suspect to Germany

Japan's NPA arrested a 28-year-old Russian national in Osaka in May and extradited him to Germany in June over a Qilin ransomware attack on a German company.

4 min readQilin
Department of Justice seal outside the Robert F. Kennedy Department of Justice Building in Washington, D.C.
Industry News

DOJ Charges MonsterCloud CEO Zohar Pinhasi in Ransomware Fraud

DOJ charged MonsterCloud CEO Zohar Pinhasi with wire fraud after he allegedly took $19M from ransomware victims while secretly paying $8M to the attackers.

4 min read
Stack of low-cost Android smartphones on a plain background, representing devices found shipping with preinstalled ad-fraud malware.HIGH
Malware

Midnight Mimosa Malware Found Preinstalled on Cheap Android Phones

Bitdefender found Midnight Mimosa ad-fraud malware preinstalled on thousands of MediaTek-based Android phones across 150+ countries, with 32 disguised payload apps.

4 min readMidnight Mimosa
Page 1 of 46Next →