News

Incomplete patch for a Windows SmartScreen and Windows Shell security prompts bypass created a new bug enabling zero-click attacks, Akamai reports. The initial vulnerability, tracked as CVE-2026-21510 and patched in February, could be exploited for remote code execution (RCE) if the attacker could convince the victim to open a malicious shortcut file. Microsoft warned at the time that the flaw had been exploited as a zero-day, without providing details on the observed attacks. Now, Akamai…

Read More

A newly uncovered APT is relying on legitimate services for command-and-control (C&C) communication and data exfiltration, ESET warns. Tracked as GopherWhisper (PDF) and active since at least November 2023, the hacking group is operating out of China, as timestamp inspection of chat messages and emails has revealed. The APT came to the spotlight in January 2025, during the investigation into a Go-based backdoor found on the systems of a governmental entity in Mongolia, which led…

Read More

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage but remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers maintain a well-rounded awareness of the evolving cybersecurity environment. Here are this week’s highlights: Tennessee hacker gets probation for Supreme Court breaches Nicholas Moore, 25,…

Read More

President Donald Trump said Friday he was ordering all federal agencies to phase out use of Anthropic technology after the company’s unusually public dispute with the Pentagon over artificial intelligence safety. Trump’s comments came just over an hour before the Pentagon’s deadline for Anthropic to allow unrestricted military use of its AI technology or face consequences — and nearly 24 hours after CEO Dario Amodei said his company “cannot in good conscience accede” to the…

Read More

Vulnerability intelligence company VulnCheck announced on Tuesday that it has raised $25 million to meet demand for its solutions. The Series B funding round, which brings the total raised by the company to $45 million, was led by Sorenson Capital, with participation from National Grid Partners, Ten Eleven Ventures, and In-Q-Tel. The money will be used to expand product development and scale growth. VulnCheck provides a platform for tracking the lifecycle of vulnerabilities and their…

Read More

US and UK government agencies this week warned of the risks posed by discontinued edge devices, urging organizations to replace them as soon as possible. Edge devices include firewalls, IoT, load balancers, network security appliances, routers, switches, wireless access points, and other software and hardware appliances that route network traffic. Edge devices that have reached end-of-support (EOS) status and no longer receive security updates pose a significant risk to federal networks and enterprise environments, as…

Read More

SecurityWeek’s Cyber Insights 2026 examines expert opinions on the expected evolution of more than a dozen areas of cybersecurity interest over the next 12 months. We spoke to hundreds of individual experts to gain their expert opinions. Here we explore offensive security; where it is today, and where it is going. Cyber red teaming will change more in the next 24 months than it has in the past ten years. Malicious attacks are increasing in…

Read More