The Trump administration wants U.S. intelligence agencies to create a single master database of all foreign espionage targets—including suspected spies, intelligence officers, #hackers, criminal groups, and potential CIA recruits.

Amazon fined $2.25M for withholding evidence from fraud victims.

Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware.

Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery.

Massive Password Spray Campaign Targeting Azure CLI.

Quebec water treatment plant attack gains access to control pumps and chlorine dosing.

RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS.

Norway plans to restrict AI use for students aged 6–13, shifting focus back to traditional learning tools amid concerns about developmental impact.

Poland warns Russia may be influencing AI outputs by flooding the internet with disinformation, highlighting a new front in hybrid warfare.

Reports suggest Claude Code may use hidden markers to identify certain users, raising new transparency and privacy concerns in AI tooling.

The U.S. lifts export restrictions on Anthropic’s advanced AI models after new security measures, restoring access for global users.

OECD releases a roadmap for AI in public governance, emphasizing citizen engagement and efficiency—but warns AI is not a standalone solution to democratic challenges.

The U.S. offers up to $10M for intel on hackers tied to Russian groups UNC5792 and UNC4221, linked to phishing attacks targeting Signal and WhatsApp users, including officials.

A former NSO executive is reportedly behind a new cyber project, signaling the next wave of offensive cyber tools as geopolitical tensions increasingly shift into digital battlegrounds.

90+ spoofed software domains are pushing AsyncRAT through ScreenConnect.

Kaspersky says the sites mimic OBS Studio, Bandicam, DNS Jumper, and DS4Windows, then use SEO to surface in Google and Bing.

PureLogs Stealer now hides behind Blogger pages and a fake PDF JavaScript file.

Experts say VEIL#DROP uses PowerShell, dynamic Blogspot URLs, fileless .NET loading, and Microsoft-signed LOLBins to evade detection.

Two Cursor vulnerabilities could let hidden prompt-injection instructions escape the editor’s terminal sandbox and run commands on a developer’s machine.

Tracked as CVE-2026-50548 and CVE-2026-50549, they affect versions before 3.0.

Attackers are trying to exploit CVE-2026-8037 in Progress Kemp LoadMaster.

The CVSS 9.6 flaw enables unauthenticated OS command injection and arbitrary code execution on vulnerable appliances.

Ousaban hides a ZIP payload inside an image after a fake “corrupted” PDF screens victims in Spain and Portugal.

The Windows banking trojan watches 24+ banks and can log keys, grab screenshots, tamper with the clipboard, and enable remote control.

Adobe patched 9 flaws in ColdFusion and Campaign Classic, 7 rated CVSS 10.0.

ColdFusion issues enable RCE, privilege escalation, file read, and bypass.

Campaign Classic CVE-2026-48286 impacts on-prem ACC v7 only.

Adobe patches 7 critical vulnerabilities, including multiple RCE flaws in ColdFusion. No active exploitation yet—but risk level is high. Immediate updates recommended.