Latest CyberSec News by @thecyberpicker

Find out where and how victims can report online scams to prevent more victims and possibly recover funds.

Over 84,000 instances of the Roundcube webmail software are vulnerable to CVE-2025-49113, a critical remote code execution (RCE) vulnerability with a publicly available exploit.

A vulnerability allowed researchers to brute-force any Google account's recovery phone number simply by knowing a their profile name and an easily retrieved partial phone number, creating a massive risk for phishing and SIM-swapping attacks.

SentinelOne has shared more details on an attempted supply chain attack by Chinese hackers through an IT services and logistics firm that manages hardware logistics for the cybersecurity firm.

A collective of former WordPress developers and contributors backed by the Linux Foundation has launched the FAIR Package Manager, a new and independent distribution system for trusted WordPress plugins and themes.

Leatherman, a 22-year FBI veteran, has been heavily involved in cyber investigations as section chief and deputy assistant director over the past three years.

Blue Team playbooks are essential—but tools like Wazuh take them to the next level. From credential dumping to web shells and brute-force attacks, see how Wazuh strengthens real-time detection and automated response.

Focus on financial impact, efficiency and risk management to ensure informed cybersecurity investment decisions.

The same group is believed to be behind a wave of attacks against retailers in the UK, the US and elsewhere.

Sensata Technologies is warning former and current employees it suffered a data breach after concluding an investigation into an April ransomware attack.

Reconnaissance and cyberattacks from July 2024 to March 2025 hit 70+ firms, including SentinelOne, linked to Chinese threat actors.

The statement said the Rhode Island-based company identified unauthorized activity on its systems on Thursday, prompting officials to take systems offline. The action “has temporarily impacted the Company’s ability to fulfill and distribute customer orders.”

Unit 221B’s Allison Nixon said crackdowns have effectively shown the group that their actions carry real consequences.

New PathWiper malware targeted Ukrainian critical infrastructure, using legitimate tools for cyber-attacks

Vulnerability in PayU CommercePro plugin allows account hijacking on thousands of WordPress sites

Mirai botnets exploit Wazuh Server flaw CVE-2025-24016 to conduct DDoS and infect IoT devices worldwide.

In its latest campaign this spring, DarkGaboon was observed deploying LockBit 3.0 ransomware against victims in Russia, Positive Technologies said in a report last week.

Blue Team playbooks are essential—but tools like Wazuh take them to the next level. From credential dumping to web shells and brute-force attacks, see how Wazuh strengthens real-time detection and automated response.

Cyber threats to the U.S. electric grid are mounting. Attackers—from nation-state actors to ransomware gangs—are growing more creative and persistent in probing utility networks and operational technology systems that underpin modern life. Related: The evolution of OT security And yet, many utility companies remain trapped in a compliance-first model that often obscures real risks rather

United Natural Foods (UNFI), North America's largest publicly traded wholesale distributor, was forced to shut down some systems following a recent cyberattack.

This week in cybersecurity from the editors at Cybercrime Magazine

Authorities said they busted a ring responsible for illegally extracting citizens' data from Kazakhstan's government networks and distributing it through Telegram and other ways.

A string of cyberattacks have targeted retailers like Adidas and North Face. Incidents like these can weaken customer trust and lead to lost business, experts say.

OpenAI banned ChatGPT accounts tied to Russian, Chinese, and Iranian hackers using AI for malware and influence campaigns.

The Football Australia 2024 breach resulted from developers misconfiguring their AWS S3 buckets (an example of Misconfiguration and Inadequate Change Control).

OpenAI annonce avoir identifié et fermé les comptes ChatGPT de plusieurs groupes liés à des puissances étrangères. L’outil d’IA générative servait à orchestrer des opérations d’influence et de désinformation sur les réseaux sociaux. Leur objectif est clair : polariser les débats publics, diffuser des contenus

A cyberattack on London hospitals last year led to the depletion of stocks of crucial O-type blood, and the U.K.'s National Health Service is calling for a nationwide effort to shore up supplies.

In 2024, dormant accounts, unmanaged SaaS access, and GenAI permissions expose enterprises to data breaches and insider threats.

This week’s recap tracks how trust is being quietly exploited at scale.

Congress and federal agencies can take some simple steps to better protect open-source software, writes Chainguard CEO Dan Lorenc.