Home

Click here to display content from VideoPress.
Learn more in VideoPress’s privacy policy (opens in a new tab).

Open "VideoPress Video Player" directly
  • Old Bar Beach
  • AI Generated Image – Awakening

CYBER SECURITY NEWS

  • DORA Year Two: Can Your SOC Actually See the Attack?
    When the Digital Operational Resilience Act (DORA) became enforceable across the European Union in January 2025, it triggered an administrative sprint. Financial entities spent the first year establishing risk governance, assessing third-party service providers, updating contract clauses, and documenting incident escalation workflows. Now in its second year, the harder part of DORA is
  • New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory
    A new flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled. The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the researcher who found it says it […]
  • SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
    A SharePoint Server vulnerability that Microsoft initially classified as a spoofing flaw with a CVSS score of 6.5 actually enables authenticated remote code execution, according to full technical details published today by Viettel Cyber Security researcher Dinh Ho Anh Khoa. The flaw, CVE-2026-65660, affects SharePoint Server 2016, 2019, and Subscription Edition. Patches have been
  • Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal
    A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. "Indexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree/indexing utility," Checkmarx said. "
  • SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
    The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. "SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers
  • One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor
    Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21. It works by changing a hidden setting so that when the user taps the microphone and dictates a prompt, the words […]
  • WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
    A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and called "Comment2Shell," on September 17 in version 7.1.1 and told site owners to […]

LATEST POSTS