US moves to strengthen cybersecurity for healthcare centers — A House subcommittee reviewed hospital threats and proposed bills on rural hospital support and HIPAA/CISA coordination.

Pakistan arrests six suspects in cyber harassment and extortion cases — The NCCIA detained suspects in Lahore, Faisalabad, and Multan and seized phones and WhatsApp accounts.

Nvidia CEO to attend Trump dinner for China’s president — Jensen Huang’s expected presence highlights Nvidia’s central role in AI chip geopolitics between the US and China.

Musk companies settle antitrust lawsuit against Apple — X Corp and SpaceXAI resolved their case over Apple-OpenAI ChatGPT integration, while claims against OpenAI continue.

European Commission president backs slowing advanced AI development — Ursula von der Leyen cited cyber abuse and hacking risks and called for model evaluations, verification, and stronger security.

UN calls for urgent oversight of artificial intelligence — Human rights chief Volker Türk urged countries and AI developers to align advanced AI with human rights obligations.

Oracle reportedly cuts thousands of jobs while increasing AI investment — Headcount fell by about 21,000 in the last fiscal year as quarterly capex rose from $8.5B to $28.5B for AI infrastructure.

Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts.

As Microsoft explained, this affects all supported Windows client and server versions, including the latest Windows 11 26H1 and Windows Server 2025 releases, and it triggers erroneous alerts in the Windows Security app that prompt users to "Tap or click to turn on Microsoft Defender Antivirus."

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage.

Fake LastPass downloads on GitHub pushed password-stealing malware.

Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE.

HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading, file cleanup, and persistence via Windows autorun registry keys.

The attacks typically involve the use of social engineering via messaging platforms like Telegram, WhatsApp, and Instagram to communicate with targets under the pretext of offering technical support or posing as trusted contacts, and then deliver malware dressed up as a seemingly harmless installer to trigger the infection. These applications masquerade as legitimate applications like Pictory, KeePass, and Telegram, and contain the second-stage implant.

A notable aspect of the Python-based malware is its use of Telegram for command-and-control (C2), allowing it to list running programs, take screenshots, capture web browser data, upload/download files, turn on the microphone, copy Telegram and WhatsApp data, steal saved passwords, download additional malware, and delete files.

CVE-2026-90999: A fabricated Sentry bug report can make Seer's coding agent run attacker code.

OpenAI Says Its Models Searched GitHub for Leaked API Keys During Training.

100,000+ WordPress sites infected via Brevo supply chain attack.

Four Linux kernel flaws now have public working exploits for local root.

DirtyAH6, TUNderflow, and PPPoEject require unprivileged user namespaces for an ordinary user. DiagSpill needs SCTP available but no special privileges.

New WordPress "Click2Shell" vulnerability can force a silent theme install from a crafted link.

Researchers chained the flaw with a separate theme bug to execute code on the server.

Transparent Tribe is targeting government and defense entities in India and Afghanistan with a new Rust backdoor.

RUSTYSHADE uses private GitHub repos for encrypted C2, while post-compromise activity includes Windows and Linux file stealers.