Domain Monitoring Software: CCleaner Attack Explained article | Spoofguard.io

✓ Domain monitoring software helps expose brand abuse, malicious domains, and browser spyware before they reach customers.

spoofguard.io

Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research

We already know AI can find vulnerabilities. James Kettle, PortSwigger's Director of Research, wanted to answer a harder question: can an autonomous system invent genuinely new attack techniques? To f

portswigger.net

DDoS attacks over 1 Tbps surged fivefold in the second quarter

Cloudflare says it mitigated more than 800 network-layer distributed denial-of-service (DDoS) attacks exceeding 1 Tbps in the second quarter of the year.

bleepingcomputer.com

Case study: How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years

"It feels like I get 10X the productivity on an engagement. The difference is night and day." Profile Ray H. is a Security Analyst at a managed security service provider with over 2500 employees world

portswigger.net

From capable AI models to trusted security testing

This week, we launched Burp AT in public beta for Burp Suite Professional users. Next week at Black Hat, PortSwigger Research will reveal more of the work that helped shape our direction. Burp AT is o

portswigger.net

Introducing Burp AT: agentic AI, built on two decades of Burp Suite

Burp AT brings agentic AI to human-led pentesting, with Burp Suite’s proven tools, your project context, and purpose-built skills. You decide how much work agents take on. Burp enforces the boundaries

portswigger.net

https://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.html

BlueNoroff uses fake Zoom and Teams meetings to profile crypto wallets, hijack Telegram accounts, and deliver Windows and macOS malware.

thehackernews.com

https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html

Certighost exploit lets a domain user obtain a Domain Controller certificate and reach DCSync through a vulnerable AD CS chase.

thehackernews.com

https://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html

Two Bing image search flaws let crafted SVGs run commands as SYSTEM on Windows workers & root on Linux before Microsoft fixed them server-side.

thehackernews.com

https://thehackernews.com/2026/07/chatgpt-agentforger-flaw-could-deploy.html

AgentForger could let a phishing link forge, publish, and schedule a rogue ChatGPT Workspace Agent with access to connected apps.

thehackernews.com

https://thehackernews.com/2026/07/seeing-ai-agents-is-not-enough-security.html

AI agent visibility alone cannot enforce least privilege, requiring identity-centric, intent-aware, platform-agnostic controls.

thehackernews.com

https://thehackernews.com/2026/07/golden-chickens-resurfaces-with-four.html

Golden Chickens returns with four malware families using ClickFix, modular implants, and live Chrome session control.

thehackernews.com

https://thehackernews.com/2026/07/hacker-runs-hermes-ai-agent-unattended.html

An operator ran the Hermes AI agent with approval prompts disabled during a Thai finance ministry intrusion, then left its logs on an open directory.

thehackernews.com

https://thehackernews.com/2026/07/kimi-k3-agents-found-redis-zero-days.html

Redis ships seven security releases after authenticated RESTORE RCE PoCs target versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0.

thehackernews.com

https://thehackernews.com/2026/07/nodebb-patches-eight-ai-found-flaws.html

NodeBB fixes eight flaws Aikido rates high severity, including bugs exposing admin pages, private messages, and federation content to outsiders.

thehackernews.com

https://thehackernews.com/2026/07/fake-notepad-plugin-delivers.html

CERT-UA links UAC-0099 to a fake Notepad++ plugin that deploys BURNYBEAR and MATCHBOIL.V2, with persistence running every three minutes on Windows.

thehackernews.com

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client. The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor recovery. Opening the message was enough to start it. The NSA, CISA and partner agencies published

thehackernews.com

https://thehackernews.com/2026/07/russian-espionage-group-exploited.html

Russian spies exploited CVE-2025-66376 in Zimbra to steal 90 days of mail, passwords, 2FA codes, and directories from Western targets.

thehackernews.com

Johnson Controls C-CURE 9000 and Victor application server

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. The following versions of Johnson Controls C-CURE 9000 and Victor application server are affected: * C-CURE 9000 and victor

cisa.gov

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

Most of this week's trouble came dressed as something useful. A package stole data. A fake extension opened remote access. A safety app became spyware. An image gave hidden orders to an AI agent. Other threats hid in open systems, weak code, and normal network traffic. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out. The danger was

thehackernews.com

https://thehackernews.com/2026/07/threatsday-android-spyware-plc-attacks.html

This week’s ThreatsDay Bulletin covers malicious packages, fake apps, AI prompt attacks, exposed systems, weak defaults, and stealthy malware traffic.

thehackernews.com

https://thehackernews.com/2026/07/chaos-ransomware-uses-msarat-to-route.html

Chaos-linked msaRAT drives headless Chrome or Edge over CDP, relaying encrypted C2 through Twilio TURN while its own process stays on loopback.

thehackernews.com

Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files

Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac. Accomplish AI, which shared details of the vulnerability with The Hacker News ahead of publication, said about 500,000 macOS users running

thehackernews.com

How Synthetic Identity Fraud is Coming for Machine Identities

Most people understand identity theft as an attacker stealing a real person's sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instead of stealing a real identity, the attacker manufactures a new one, frankensteining together several real data points with fabricated ones to create a person who doesn't exist. Since no real victim monitors misuse, a

thehackernews.com

Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs

RefluXFS, a new Linux kernel flaw disclosed on July 22 and tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access. Qualys said default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux can meet the conditions for exploitation. The company demonstrated the race

thehackernews.com

Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access

Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under active exploitation in the wild. The security flaw, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass affecting the Check Point SmartConsole login process that allows an

thehackernews.com

GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier

Beginning July 27, 2026, GitHub will cut public bug bounty payouts by at least half at every severity level. Critical findings will drop from $20,000-$30,000+ to a fixed $10,000, while its permanent invite-only VIP tier will pay $30,000 or more. Reports filed before that date, including those already in GitHub's growing triage queue, will retain the previous payout terms. GitHub said the

thehackernews.com

Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs

Cybersecurity researchers have disclosed details of a new local privilege escalation (LPE) vulnerability in snap-confine that an unprivileged user can trigger to obtain root access and gain complete control of a target environment. The high-severity flaw, tracked as CVE-2026-8933 (CVSS score: 7.8), impacts default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The disclosure comes as

thehackernews.com