Cyber ​​Security Hub

Researchers have uncovered ARToken, a phishing toolkit abusing Microsoft 365 OAuth Device Code Flow to steal access tokens without passwords. Learn how it works and how to stay protected

The rapid evolution of Artificial Intelligence (AI) is completely reshaping the cybersecurity landscape, bringing both unprecedented opportunities and challenges.

A vulnerability affecting Apple's Hide My Email feature could allow attackers to uncover the real email address behind an anonymized alias. According to reports, the issue was disclosed to Apple more than a year ago but remains unpatched. Independent testing by 404 Media also confirmed that the flaw was still exploitable at the time of publication.

Transferring images, videos, or documents between phones and computers has now become incredibly simple thanks to AirDrop on Apple devices or Quick Share on Android and Windows operating systems. However, this very convenience is inadvertently opening a loophole for cyberattacks, threatening the safety of more than 5 billion devices worldwide.

Instead of planting malware directly, the attacker cleverly inserts hidden instructions to trick autonomous AI assistants like Claude Code into automatically triggering remote destructive commands. This vulnerability is the clearest evidence of the dangers of Shadow AI.

Nissan has confirmed that current and former employee data may have been accessed after attackers exploited the Oracle PeopleSoft zero-day vulnerability, CVE-2026-35273. According to Oracle, the campaign affected hundreds of companies, while Mandiant said it notified more than 100 organizations impacted by the attacks.

The Apache Software Foundation (ASF) has recently identified and disclosed two notable security vulnerabilities within Apache Tomcat, a widely used web server component.

Một lỗ hổng CVE nghiêm trọng trong Microsoft Excel đang được cảnh báo vì có thể bị khai thác thông qua tệp bảng tính độc hại. Theo thông tin từ Microsoft và các nguồn cảnh báo bảo mật, lỗ hổng được định danh là CVE-2025-60727, thuộc nhóm thực thi mã từ xa trong hệ sinh thái Office.

The excitement of the World Cup 2026 finals is not only electrifying football pitches but has also become the focal point of large-scale cybersecurity operations.

The latest security reports show that international cybercrime organizations had quietly constructed, orchestrated, and deployed a massive phishing infrastructure months before the opening whistle blew.

The emergence of RedAmon, a new open-source cybersecurity platform, is bringing a fresh perspective to this workflow.

Does using a VPN make you impossible to hack? Learn about the protection VPN offers, its limitations against malware, phishing, and ransomware, and why businesses need Zero Trust, EDR, and SOC for comprehensive protection.

Security researchers from Mozilla's Zero Day Investigative Network (0DIN) have uncovered a sophisticated attack technique that targets AI coding agents through seemingly clean GitHub repositories.

Cybersecurity in Vietnam Q1/2026 recorded 165 data breaches, over 473 million leaked records, alongside surging DDoS and APT attacks. Complete overview of trends and enterprise recommendations.

A severe cyberattack targeting an Apple manufacturing partner in India has resulted in a massive breach of internal data.

Since April 2026, a sophisticated phishing campaign has been targeting hotels across Asia and Europe. The attackers abuse trusted services including Calendly and Google to distribute a ZIP archive containing the TonRAT malware, which is executed through the legitimate Node.js v24.13.0 runtime

Vietnam Electricity (EVN) has just issued an urgent warning regarding a newly emerged tech-based scam method. Malicious actors are exploiting the identity of the power sector to send fraudulent messages aimed at misappropriating citizens' data and assets.

Curl 8.21.0 addresses a record-breaking 18 security vulnerabilities (CVEs), the highest number ever fixed in a single Curl release. Among them is CVE-2026-8932, a flaw that originated in 2001 and remained undiscovered for more than 25 years before finally being patched.

Researchers at Zscaler ThreatLabz have discovered an Edgecution malware campaign that spreads through Microsoft Teams and a malicious Microsoft Edge browser extension. The malware uses a two-component architecture and abuses Chrome Native Messaging to escape the browser sandbox, allowing attackers to execute commands, run PowerShell scripts, and gain direct access to victims' systems.

In June 2026, security researchers identified a verification flaw on ClawHub that enabled 15 unauthorized accounts to publish 23 deceptive plugins using official OpenClaw namespaces.