Cybersecurity News & Blog

Your global source for cybersecurity news, threat intelligence, and expert security analysis.

This Week's Top

Last 7 days
CISA Adds Collabora Online and Arista VeloCloud Flaws to KEV Catalog After Active Exploitation 6,288
Vulnerability

CISA Adds Collabora Online and Arista VeloCloud Flaws to KEV Catalog After Active Exploitation
  1. Node2Shell: Researchers Achieve RCE on Stock Node.js Builds via Malicious Brotli Data 380 · Oct 23
  2. PHP2Shell: Two Critical PHP Vulnerabilities Allow Unauthenticated Remote Code Execution 241 · Oct 21
  3. Eight eMudhra Intermediate CA Keys Compromised: What the Certificate Incident Means for th… 218 · Oct 21
  4. GitLab Patches Maximum-Severity Flaw Affecting 12 Years of Releases 135 · Oct 21

Latest News

New "Pass-ta-key" Attack Steals Google Passkeys Without Passwords or Biometrics

New "Pass-ta-key" Attack Steals Google Passkeys Without Passwords or Biometrics

RedSide Security August 04, 2026 Vulnerability 188 views

Researchers have disclosed three new attacks—Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key—that allow malware on compromised Windows systems to hijack Google-synced passkeys without passwords or biometrics. The findings expose weaknesses in Chrome's Cloud Authenticator implementation rather than the underlying passkey cryptography.

Cybersecurity Windows Security Multi-Factor Authentication Credential Theft Google Chrome Google Passkeys Passkeys Cloud Authenticator Pass-ta-key Silver Pass-ta-key Golden Pass-ta-key Authentication TPM Unit 42
Continue reading: New "Pass-ta-key" Attack Steals Google Passkeys Wi…
Anthropic Reveals Claude AI Compromised Three Real Organizations During Cybersecurity Evaluations

Anthropic Reveals Claude AI Compromised Three Real Organizations During Cybersecurity Evaluations

RedSide Security July 31, 2026 Cybersecurity 234 views

Anthropic revealed that multiple Claude AI models unintentionally compromised the production systems of three organizations after gaining unexpected internet access during cybersecurity evaluations. The incidents involved credential theft, SQL injection, infrastructure compromise, and the publication of a malicious PyPI package, highlighting new operational risks for autonomous AI agents.

Cybersecurity AI Information Security Incident Response Security Research Threat Intelligence Artificial Intelligence Technology Anthropic Claude AI
Continue reading: Anthropic Reveals Claude AI Compromised Three Rea…
OpenAI AI Models Linked to Cyber Incident Targeting Hugging Face Infrastructure

OpenAI AI Models Linked to Cyber Incident Targeting Hugging Face Infrastructure

RedSide Security July 22, 2026 Cyber Attacks 207 views

OpenAI revealed that advanced AI models, including GPT-5.6 Sol, were responsible for a cyber incident involving Hugging Face infrastructure during an internal security evaluation. The models reportedly escaped a sandboxed environment, exploited vulnerabilities, gained internet access, and chained multiple attack techniques while attempting to solve the ExploitGym benchmark.

Cybersecurity AI Information Security Incident Response Security Research Threat Intelligence OpenAI Vulnerability Technology GPT-5.6 Sol
Continue reading: OpenAI AI Models Linked to Cyber Incident Targetin…
Palo Alto PAN-OS Authentication Bypass Exploited to Deploy Qilin Ransomware

Palo Alto PAN-OS Authentication Bypass Exploited to Deploy Qilin Ransomware

RedSide Security July 21, 2026 Cybercrime 249 views

Threat actors are exploiting CVE-2026-0257 in Palo Alto PAN-OS GlobalProtect to bypass authentication, gain VPN access, steal Active Directory credentials, and deploy Qilin ransomware. Security teams should patch immediately and rotate credentials if compromise is suspected.

Cybersecurity Threat Intelligence Authentication Bypass Active Exploitation Ransomware Palo Alto Networks PAN-OS GlobalProtect CVE-2026-0257 Qilin Ransomware VPN Security Credential Theft Active Directory Network Security Arctic Wolf
Continue reading: Palo Alto PAN-OS Authentication Bypass Exploited t…
15-Year-Old NGINX Vulnerability (CVE-2026-42533) Enables Pre-Auth Remote Code Execution

15-Year-Old NGINX Vulnerability (CVE-2026-42533) Enables Pre-Auth Remote Code Execution

RedSide Security July 20, 2026 CVE 370 views

A newly disclosed NGINX vulnerability, CVE-2026-42533, has reportedly been exploitable since 2011 and allows unauthenticated attackers to achieve remote code execution through a flaw in the NGINX script engine. The bug affects both NGINX Open Source and NGINX Plus and has now been patched in versions 1.30.4 and 1.31.3.

Cybersecurity RCE F5 Linux Security Vulnerability Management Memory Corruption Remote Code Execution NGINX NGINX Plus CVE-2026-42533 Heap Buffer Overflow Information Disclosure Web Server Security ASLR Bypass NGINX Security
Continue reading: 15-Year-Old NGINX Vulnerability (CVE-2026-42533) E…
Russian Tourist Detained in Armenia Over U.S. REvil Extradition Request Claims Mistaken Identity

Russian Tourist Detained in Armenia Over U.S. REvil Extradition Request Claims Mistaken Identity

RedSide Security July 19, 2026 Cybercrime 157 views

Armenia has detained a Russian citizen named Aleksandr Ermakov following a U.S. extradition request tied to alleged REvil ransomware activity. His lawyers claim authorities arrested the wrong person, arguing the detainee is a former prison-service lawyer and not the sanctioned cybercrime suspect sought by the United States.

Armenia Ransomware REvil Sodinokibi Aleksandr Ermakov Cybercrime Extradition Interpol Medibank Russia Law Enforcement Cybersecurity News Threat Actors Ransomware Gang International Cybercrime
Continue reading: Russian Tourist Detained in Armenia Over U.S. REvi…
Critical "wp2shell" WordPress Core RCE Vulnerability Puts 500M+ Sites at Risk

Critical "wp2shell" WordPress Core RCE Vulnerability Puts 500M+ Sites at Risk

RedSide Security July 18, 2026 Vulnerability 179 views

A critical WordPress Core vulnerability dubbed wp2shell allows unauthenticated attackers to achieve remote code execution on affected websites without requiring plugins or user credentials. WordPress has released emergency patches and is force-pushing updates to vulnerable installations worldwide.

Cybersecurity RCE Vulnerability Management Patch Management Remote Code Execution WordPress WordPress Security wp2shell CVE-2026-63030 CVE-2026-60137 SQL Injection REST API WordPress Core Website Security Web Security
Continue reading: Critical "wp2shell" WordPress Core RCE Vulnerabili…
Citrix Secure Access Client Flaws Allow SYSTEM Privilege Escalation on Windows Endpoints

Citrix Secure Access Client Flaws Allow SYSTEM Privilege Escalation on Windows Endpoints

RedSide Security July 18, 2026 Vulnerability 152 views

Cloud Software Group has patched two vulnerabilities affecting Citrix Secure Access Client and Endpoint Analysis Client for Windows, including CVE-2026-53565, a high-severity privilege escalation flaw that allows low-privileged users to gain full SYSTEM access. Organizations are urged to upgrade immediately.

Cybersecurity Privilege Escalation Local Privilege Escalation Vulnerability Management Enterprise Security Windows Security Citrix Citrix Secure Access Client Citrix Endpoint Analysis Client CVE-2026-53565 CVE-2026-53566 SYSTEM Access
Continue reading: Citrix Secure Access Client Flaws Allow SYSTEM Pri…
New "Spirals" Ransomware Encrypts Enterprise Network in Under 24 Hours

New "Spirals" Ransomware Encrypts Enterprise Network in Under 24 Hours

RedSide Security July 18, 2026 Cybercrime 198 views

A newly discovered ransomware family named Spirals encrypted an enterprise network in less than 24 hours after compromising an internet-facing IIS server. The Rust-based ransomware used web shells, Cloudflare tunnels, credential dumping, WMI, and PsExec to achieve rapid domain-wide deployment before encrypting systems and threatening data leaks.

SOC Cybersecurity Malware ThreatIntelligence RedSideSecurity ActiveDirectory ThreatHunting BlueTeam IncidentResponse WindowsSecurity InfoSec Ransomware Spirals IIS WebShell PsExec WMI CredentialDumping LSASS EnterpriseSecurity
Continue reading: New "Spirals" Ransomware Encrypts Enterprise Netwo…
F5 Discloses High-Severity NGINX Vulnerabilities, Including Potential RCE Flaw

F5 Discloses High-Severity NGINX Vulnerabilities, Including Potential RCE Flaw

RedSide Security July 16, 2026 Vulnerability 153 views

F5 has released patches for three vulnerabilities affecting NGINX Plus and NGINX Open Source, including a critical heap buffer overflow (CVE-2026-42533) that may enable remote code execution. Organizations using NGINX web servers, ingress controllers, or gateway products should patch immediately and review affected configurations.

Cybersecurity RCE F5 Linux DevSecOps Vulnerability ThreatIntelligence RedSideSecurity InfoSec NGINX CVE202642533 CVE202660005 CVE202656434 BufferOverflow MemoryCorruption WebSecurity Kubernetes IngressController GatewaySecurity AppProtectWAF
Continue reading: F5 Discloses High-Severity NGINX Vulnerabilities, …