Latest CyberSec News by @thecyberpicker

Sens. Bill Cassidy and Maggie Hassan sent a letter to UnitedHealth, the owner of medical tech company Episource, demanding more information about a major data breach in January.

According to the research published Tuesday, it is possible for an attacker to break into the ControlVault chip used in many laptops owned by security professionals and modify the firmware inside.

A broad range of personal and health data was exposed in an April ransomware attack on dialysis provider DaVita, the company said in notices filed in several states.

ClickFix malware replaced ClearFake in 2024, infecting users via fake CAPTCHAs and trusted platforms.

Your supply chain is the lifeline of your business. However, with rising geopolitical tensions, regulatory pressures, economic volatility and tariff whiplash, l

Experts, including Allan Friedman, CISA's leading voice on SBOMs until July 2025, emphasized that AI BOMs should be standardized before being implemented

SecAlliance highlighted the evolution in smishing campaigns orchestrated by Chinese syndicates, which exploit digital wallet tokenization

Uncertain tariff policies and fluctuating inflation and interest rates are leading to stagnant or reduced budgets, according to an IANS Research report.

Cursor patched a critical RCE flaw in its AI code editor that exposed devs to silent attacks.

Google fixed 6 Android flaws, including 3 exploited Qualcomm bugs, raising spyware concerns. Users urged to update.

Critical vulnerabilities in NVIDIA's Triton Inference Server, discovered by researchers, could allow unauthenticated attackers to gain full server control through remote code execution

Google has patched 6 vulnerabilities in Android including two critical ones, one of which can compromise a device without the user needing to do anything.

This week in cybersecurity from the editors at Cybercrime Magazine

L’avenir de la chasse aux bugs pourrait bien appartenir aussi aux intelligences artificielles (IA). Google vient d’affirmer qu’un de ses systèmes avait été plutôt bon pour déceler plusieurs vulnérabilités au cours des derniers mois. Repérer les failles de sécurité est une opération coûteuse, mais qui fait partie du

A combination of phishing lures, a previously spotted infostealer and Telegram bots are fueling a campaign by apparent Vietnamese-speaking hackers to capture and sell sensitive data globally.

Can your defenses withstand the biggest attacks of Summer 2025? From Interlock's FileFix to Qilin, Scattered Spider, and ToolShell exploits—simulate them all against your organization's defenses with Picus Security Validation Platform to find gaps before attackers do.

A 24-year-old woman who allegedly advertised her services on social media has been arrested for her part in a "tap-in" scam.

The promise of AI in cybersecurity has been loudly heralded—yet quietly limited. Related: What is IaC? Machine learning has proven effective at spotting anomalies and flagging misconfigurations. But resolving those issues remains largely manual, slow, and labor-intensive. A recent Cloud Security Alliance survey found: •75% of teams spend at least one-fifth of their time manually

The two engineers, alongside a third suspect, have since been arrested in what is the first trade secrets case brought under Taiwan’s National Security Act, a law that intends to protect the country’s advantage in producing pioneering semiconductors.

Infrastructure as Code (IaC) promises consistency and control. But no matter how pristine your IaC is, your actual cloud environment will start to drift.

Talos reported 5 vulnerabilities to Broadcom and Dell affecting both the ControlVault3 Firmware and its associated Windows APIs that we are calling “ReVault”.

IANS found that stagnant budget growth rates have significantly impacted CISOs ability to increase their teams’ headcount

A ransomware attack on Curaçao's tax office and an email breach at Aruba's parliament have put the Dutch Caribbean islands on high alert for cybersecurity issues.

Cybersecurity attacks are rising sharply in 2025, and Microsoft has been one among many prominent targets. Research shows that 70 percent of M365 tenants have experienced account takeovers1 and 81 …

Cisco has disclosed that cybercriminals stole the basic profile information of users registered on Cisco.com following a voice phishing (vishing) attack targeting a company representative.

Overview Bumblebee malware has been an initial access tool used by threat actors since late 2021. In 2023 the malware was first reported as using SEO poisoning as a delivery mechanism. Recently in …

Most SaaS incidents come from misconfigurations or permission issues, not attacks—putting users at unseen risk.

Ever wondered how attackers can compromise modern websites by exploiting invisible cracks in HTTP infrastructure to win big bounties? In his latest video, NahamSec walks through the basics of request

SonicWall has warned customers to disable SSLVPN services due to ransomware gangs potentially exploiting an unknown security vulnerability in SonicWall Gen 7 firewalls to breach networks over the past few weeks.

These are in plain sight without a Breach. No ransomware. No compromise. Just misconfigured systems, overpermissioned users, silent access.