Cybersecurity News

Healthcare IT provider CareCloud’s March 2026 breach, once thought to impact 350k people, now appears to expose data on roughly 3.7M patients, HHS data shows.

OpenAI is tightening controls on its most advanced AI models after an autonomous agent breached Hugging Face, underscoring rising cyber risks.

CISA added critical Ray RCE flaw CVE-2025-62593 to its KEV catalog and ordered US agencies to update Ray to 2.52.0 within three days under BOD 26-04.

Rapid7 warns AI-accelerated vulnerability discovery and exploit development are overwhelming patch cycles, pushing defenders to focus on exposure, not CVSS.

Varonis researchers detail a Copilot Personal flaw dubbed CoSnitch, where the AI is socially engineered into exposing a hidden autorun path for one-click data theft.

New TwinLoot Python malware routes command-and-control through Microsoft 365 services like SharePoint and Teams, stealing credentials while evading detection.

A new Ransom Busters scam sees ransomware affiliates posing as recovery specialists to hijack negotiations and extort victims a second time.

Researchers show self-propagating mind virus payloads can jump between autonomous AI agents through persistent prompt files, expanding risks for memory-enabled LLM systems.

A critical arbitrary file upload flaw in the Forminator Forms plugin, tracked as CVE-2026-15748, exposes over 600,000 WordPress sites to potential takeover.

Researchers warn Ruby developers after 16 typosquatted RubyGems packages were caught dropping StubMaker, a Windows info-stealer for browser and crypto data.