NewsroomLatest briefings
Every security and AI story SECBORN has published, newest first.
CISA Confirms Active Exploitation of Critical TeamCity RCE Flaw CVE-2026-63077
JetBrains patched a critical deserialization vulnerability in on-premise TeamCity servers last week, and CISA has already added it to its Known Exploited…
Ransom Cartel Ransomware Creator Sentenced to 16 Years in US Prison
Maksim Silnikau, the Belarusian who built and administered the Ransom Cartel ransomware-as-a-service operation, was sentenced in Virginia after pleading guilty to wire…
Cisco Patches Two Dozen Flaws Including Critical FMC Auth Bypass and SD-WAN Bugs
Cisco's latest security update fixes critical vulnerabilities in Catalyst SD-WAN, IOS XE, and Secure Firewall Management Center, including a maximum-severity authentication bypass…
Meta Says Its AI Model Broke Out of Testing and Hacked a Real System
Meta disclosed that its Muse Spark 1.1 model exploited a misconfiguration to reach the internet during red-team testing and altered a third-party…
Researchers Chain Three Samsung Bugs to Turn Bixby Into a Root Shell
A Pwn2Own-winning exploit chain used Samsung Members, Samsung Account, and Bixby's hidden Capsule system to achieve system-level compromise on Galaxy phones, earning…
Attackers Hide Post-Exploitation Toolkit Inside Oracle Database Itself
Huntress uncovered a rare technique in which hackers used a SQL injection flaw to compile and run a custom post-exploitation toolkit called…
ChainDrop Worm Infects 400+ NPM Packages in New Shai-Hulud Wave
A compromised maintainer account touched off a self-propagating supply chain attack that republished over 2,200 malicious package versions across the NPM ecosystem,…
CISA Flags Active Exploitation of Langflow, N-central, and Tomcat Bugs
CISA has added four actively exploited vulnerabilities in IBM Langflow OSS, N-able N-central, and Apache Tomcat to its Known Exploited Vulnerabilities catalog,…
N-able Patches Second Auth Bypass Flaw Under Active Attack on N-central Servers
N-able rushed out a hotfix after discovering that attackers were exploiting an incomplete patch for a prior authentication bypass, granting administrator access…
DOUBLECUP LaaS Hides Malware in Cached PNGs via ClickFix Prompts
A new Russian loader-as-a-service called DOUBLECUP uses fake CAPTCHA lures to stash steganographic payloads in browser cache, delivering an updated CountLoader and…
Liechtenstein Breach Exposes 31,000 Beneficial Ownership Records
Attackers accessed Liechtenstein's Register of Beneficial Owners for two days in late July, exfiltrating data tied to companies, foundations, and trusts before…
New York Puts $9 Million Toward Securing 153 Water and Wastewater Systems
Governor Kathy Hochul announced the SECURE grant funding days after a coordinated attack campaign hit operational technology at water utilities across at…