Dutch authorities arrested two men for operating IT infrastructure used by Russia to carry out cyberattacks and seized over 800 servers.
A state-sponsored group tracked as UAT-4356 implanted a custom backdoor called Firestarter on Cisco security devices that persists through firmware updates and software reboots, prompting a joint advisory from CISA and the UK's NCSC.
Attackers are actively exploiting CVE-2026-3844, a critical 9.8-severity vulnerability in the Breeze Cache WordPress plugin, enabling unauthenticated file uploads and potential remote code execution across hundreds of thousands of sites.
Vercel confirms that the fallout from an attack on its internal systems has reached more customers than initially disclosed, with ongoing forensic analysis revealing additional compromise tied to malware, stolen tokens, and trusted third-party relationships.
Industrial cybersecurity firm Dragos has labeled ZionSiphon, a piece of malware reportedly designed to sabotage Israeli water infrastructure, as little more than hype — riddled with logic errors, hallucinated code, and no genuine capability to harm operational technology environments.
Artifact management firm Cloudsmith has raised $72 million in a Series C round led by TCV, bringing its total funding to $124 million as it expands its secure software supply chain platform.
McLean, VA-based startup Rilian has closed $17.5 million in combined seed and seed extension funding to expand its agentic security orchestration platform, Caspian, targeting government, critical infrastructure, and law enforcement customers.
The Supreme Court is hearing oral arguments in Chatrie v. The United States, the first major Fourth Amendment digital privacy case since 2018, centering on whether geofence warrants violate constitutional protections against unreasonable searches.
A newly identified ransomware operation called Kyber is striking Windows servers and VMware ESXi hosts, with one variant deploying Kyber1024 post-quantum key protection. Rapid7 analyzed two distinct variants in March 2026 during an active incident response engagement.
A Mirai-based botnet campaign is actively exploiting CVE-2025-29635, a high-severity command-injection flaw in D-Link DIR-823X routers, more than a year after the vulnerability was first disclosed. The affected routers reached end of life in November 2024, making a vendor patch unlikely.