ZCyberNews
中文

Articles

551 articles

Diagram of a Kubernetes node with a SPIRE agent issuing SVIDs to workloads, and an attacker-controlled process spoofing cgroup metadata to intercept them.
Malware

SPIFFE/SPIRE Identity Spoofing: Root on K8s Node Harvests SVIDs

Unit 42 shows root on a Kubernetes node lets attackers spoof cgroup metadata and harvest co-located SPIFFE/SPIRE workload SVIDs, with a new tool, Spooffe, to test exposure.

4 min read
Microsoft Patch Tuesday update screen on a Windows laptopCRITICAL
Vulnerabilities

Microsoft Patches 964 Flaws, Two Zero-Days Exploited in Wild

CVE-2026-81963 and CVE-2026-85880 are Windows EoP zero-days exploited before patch. Microsoft's Sept 2026 Patch Tuesday fixes a record 964 CVEs—patch now.

CVE-2026-81963CVE-2026-85880
3 min read
Berlin government building with a digital overlay representing a data breachHIGH
Malware

Berlin Probes New Data Leak After Hackers Post Login Credentials

Berlin investigates a fresh data leak after hackers published stolen login credentials, following a Rhysida-linked breach of two city ministries that exposed employee personal...

3 min readRhysida
WordPress admin dashboard with a security warning about a critical plugin vulnerabilityCRITICAL
Vulnerabilities

CVE-2026-82923: Unauthenticated RCE in AI Website Builder Plugin

CVE-2026-82923 (CVSS 9.8) lets unauthenticated attackers install plugins, write files, and achieve RCE in the AI Website Builder WordPress plugin 1.0.0. No patch yet.

CVE-2026-82923
5 min read
Quantum computer processor with glowing circuits, symbolizing future cyber threats
Industry News

G7 Urges Organizations to Prepare for Quantum Cyber Threats

G7 and CISA advisory urges organizations to start migrating to post-quantum cryptography now, citing 'harvest now, decrypt later' risks and a 2035 UK roadmap for completion.

2 min read
Technical diagram of Toy Ghouls backdoor infection chain via WinRM to Windows systemsHIGH
Malware

Toy Ghouls Debuts Custom Windows Backdoors in Russia Attacks

Kaspersky found Toy Ghouls using two new Windows backdoors — mqtt-bird-agent and matrix-bird-agent — delivered via WinRM against Russian orgs since July 2026.

3 min readToy Ghouls
Abstract digital representation of a ransomware attack targeting corporate networksHIGH
Malware

Pro-Ukraine VantaCore Ransomware Hits Russian Firms

Pro-Ukraine group VantaCore, a rebrand of Thor, has hit at least 7 Russian firms with custom ransomware and RATs, demanding millions in ransom, per F6.

4 min readVantaCore
ATM machine with a warning sign, illustrating the jackpotting attack vector discussed in the article.
Malware

Five Plead Guilty in Federal ATM Jackpotting Case

Five Venezuelan nationals pleaded guilty to bank larceny for ATM jackpotting in Kansas. FBI reports over $58M in losses since 2021 and 1,900 incidents since 2020.

3 min readTren de Aragua
Illustration of a laptop with a fake coding job offer and malware symbolsHIGH
Malware

Iranian cyber spies target aviation, fintech developers with new

Iran's Mirage Kitten lures aviation, fintech developers with fake coding tests, deploying new NodeRabbit and PollCat malware across Windows, Linux, and macOS.

4 min readMirage Kitten
Diagram showing the JSCeal infection flow from malvertising to Node.js executionHIGH
Malware

Breaking the Seal: Static Deobfuscation of JSCeal's Compiled V8

Check Point Research publishes a static deobfuscation pipeline for JSCeal, a V8 bytecode stealer targeting crypto apps since March 2024.

3 min readJSCeal
Microsoft Teams chat interface showing an external identity warning prompt, illustrating the vishing attack vector used in the Spring Ring campaign.HIGH
Malware

Spring Ring Vishing Campaign Targets Microsoft Teams Users

Spring Ring vishing hit 150+ employees across 10 firms via Microsoft Teams, pushing RMM tools and NTLM relay attacks against domain controllers.

4 min readSpring Ring
Diagram of ValleyRAT infection chain via adware installerHIGH
Malware

ValleyRAT Backdoor Disguised as Adware Hits Windows Users

Kaspersky found ValleyRAT delivered via fake adware installer that disables Defender and sideloads libcef.dll. Targets Chinese-speaking users.

6 min readValleyRAT
← PrevPage 5 of 46Next →