# Cyber News Reports

> Concise articles to keep you updated, without the fluff.   https://cybernewsreports.com/about-us/


## Posts

- [ToxicPanda 2.0 Android Banking Trojan Expands Capabilities and Targeting](https://cybernewsreports.com/toxicpanda-20-android-banking-trojan-expands-capabilities/): Researchers have discovered ToxicPanda 2.0, a sophisticated Android banking Trojan leveraging ADB exploitation and on-device fraud techniques to target over 140 banking apps and 349 financial.
- [Hundreds of Zimbra Servers Exploited via Critical Code Execution Vulnerability (CVE-2026-73570)](https://cybernewsreports.com/zimbra-cve-2026-73570-exploitation-unpatched-servers/): Hundreds of internet-facing Zimbra Collaboration Suite servers have been compromised due to CVE-2026-73570, a remote code execution vulnerability. Patching is critical as exploitation has been.
- [CISA Warns: Ransomware Gangs Exploit Critical Microsoft SharePoint Vulnerability](https://cybernewsreports.com/cisa-microsoft-sharepoint-rce-vulnerability-exploited-in-ransomware/): CISA has confirmed that ransomware groups are actively exploiting a high-severity remote code execution (RCE) vulnerability in Microsoft SharePoint. The flaw, CVE-2026-45659, allows attackers with.
- [GeoServer Vulnerability (CVE-2024-36401) Exploited in U.S. Agency Breach and Earth Baxia Campaigns](https://cybernewsreports.com/geoserver-cve-2024-36401-exploitation-u-s-federal-breach-earth-baxia/): A critical remote code execution (RCE) vulnerability in GeoServer (CVE-2024-36401) is being actively exploited, impacting a U.S. federal agency and campaigns by the China-backed Earth Baxia APT.
- [Coordinated Cyberattacks Target U.S. Water Systems](https://cybernewsreports.com/coordinated-cyberattacks-on-us-water-systems-attributed-to-iranian-hackers/): Beginning July 26th, coordinated cyberattacks targeting U.S. water systems—attributed to Iranian hackers and other nation-state actors—have disrupted service in multiple states, exploiting weak.
- [CISA Flags Langflow RCE, Tomcat Encryption Bypass, and N-central Flaw as Actively Exploited](https://cybernewsreports.com/cisa-flags-langflow-tomcat-n-central-flaws-as-actively-exploited/): CISA has added three vulnerabilities – Langflow RCE, Apache Tomcat encryption bypass, and N-able N-central authentication bypass – to its KEV catalog due to active exploitation. Federal agencies must.
- [Cyberattacks Target U.S. Water Systems, Suspected Iran Involvement Prompts Federal Response](https://cybernewsreports.com/iran-cyberattacks-on-us-water-systems/): Coordinated cyberattacks targeting municipal water systems in at least seven U.S. states have prompted federal warnings and boil-water notices, with suspected Iranian involvement highlighting the.
- [Public Exploit Released for Patched vBulletin RCE Vulnerability (CVE-2026-61511)](https://cybernewsreports.com/public-exploit-released-for-patched-vbulletin-pre-auth-code-execution-flaw-cve-2/): A public exploit has been released for a pre-authentication remote code execution (RCE) vulnerability in vBulletin. Unauthenticated attackers can now execute arbitrary PHP code on vulnerable forums,.
- [Unpatched Fastjson Vulnerability Actively Exploited with No Fix Available](https://cybernewsreports.com/fastjson-rce-vulnerability-exploitation/): Attackers are actively exploiting a critical remote code execution (RCE) vulnerability in Alibaba’s Fastjson 1.x library, CVE-2026-16723. The unpatched flaw affects versions 1.2.68 through 1.2.83 and.
- [Malware Campaign Hijacks Chrome via Enterprise Policy Keys and DLL Side-Loading](https://cybernewsreports.com/chrome-enterprise-policy-hijacking-malware-campaign/): A sophisticated malware campaign has been discovered abusing legitimate Google Chrome enterprise policy keys to hijack user browsers, bypassing security measures with DLL side-loading techniques.
- [Klue Hack Impacts Salesforce, Gong Integrations via Icarus Threat Actor](https://cybernewsreports.com/klue-hack-incident-salesforce-breach-icarus/): A supply chain attack targeting Klue has exposed sensitive customer data and disrupted integrations with Salesforce and other platforms. The 'Icarus' threat actor exploited a compromised legacy.
- [Cisco Unified CM Flaw (CVE-2026-20230) Actively Exploited for Webshell Deployment and Root Access](https://cybernewsreports.com/cisco-unified-cm-flaw-cve-2026-20230-exploited-webshells-root-access/): A critical server-side request forgery (SSRF) vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager is being actively exploited to deploy webshells and achieve root access. Patches.
- [One Medical Faces Data Breach Claim: ShinyHunters Alleges Theft of 8.8TB of Healthcare Data](https://cybernewsreports.com/one-medical-data-breach-shinyhunters-8-8tb-stolen/): ShinyHunters claims to have stolen a massive 8.8TB of data from One Medical, Amazon's healthcare provider, threatening release unless negotiations begin by June 22nd. The breach reportedly involves.
- [WhatsApp Malware Campaign Delivers VBS Files, Enabling Remote Access on Windows Systems](https://cybernewsreports.com/whatsapp-vbs-malware-campaign-targeting-windows-users/): A sophisticated malware campaign is using WhatsApp to distribute malicious Visual Basic Script (VBS) files targeting Windows users across multiple countries. The attack, which began in late February.
- [Unpatchable BootROM Vulnerability Affects Apple A12 & A13 Devices](https://cybernewsreports.com/unpatchable-bootrom-vulnerability-a12-a13-chips/): A newly discovered, unpatchable vulnerability dubbed 'usbliter8' impacts Apple devices with A12 and A13 chips. The exploit leverages a hardware bug in the USB controller and firmware misconfiguration.
- [Crypto Clipper Malware Uses Tor, USB Propagation, and Worm-Like Behavior to Steal Cryptocurrency](https://cybernewsreports.com/crypto-clipper-tor-usb-worm-cryptocurrency-theft/): A sophisticated cryptocurrency clipper malware campaign has been active since February 2026, using Tor for command and control, spreading via malicious USB drives, and employing worm-like propagation.
- [Palo Alto GlobalProtect VPN Vulnerability Actively Exploited, CISA Issues Warning](https://cybernewsreports.com/palo-alto-globalprotect-vpn-authentication-bypass-cve-2026-0257/): Unauthenticated attackers are actively exploiting a high-severity authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' GlobalProtect VPN. CISA has added the flaw to its KEV.
- [Check Point VPN Authentication Bypass Exploited by Qilin Ransomware](https://cybernewsreports.com/check-point-cve-2026-50751-authentication-bypass-exploit/): A critical authentication bypass vulnerability (CVE-2026-50751) in Check Point VPN systems is being actively exploited by the Qilin ransomware affiliate. The flaw allows attackers to bypass user.
- [CISA Directs Federal Agencies to Prioritize Vulnerability Patching with New Directive](https://cybernewsreports.com/cisa-bod-26-04-risk-based-vulnerability-patching-directive/): CISA's Binding Operational Directive (BOD) 26-04 replaces BOD 22-01, mandating federal agencies to prioritize and patch vulnerabilities using a four-variable risk model with tiered timelines. The.
- [ShinyHunters Exploits Oracle PeopleSoft Zero-Day to Target Universities](https://cybernewsreports.com/shinyhunters-oracle-peoplesoft-zero-day-attack-universities/): Cybercriminal group ShinyHunters is exploiting a critical zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft to target universities and higher education institutions, stealing data and.
- [Novo Nordisk Discloses Cybersecurity Breach Affecting Clinical Trial Data](https://cybernewsreports.com/novo-nordisk-data-breach-clinical-trials/): Pharmaceutical giant Novo Nordisk recently confirmed a cybersecurity breach exposing personal data of clinical trial participants and healthcare professionals. The incident involved pseudonymized.
- [Over 1,500 Arch Linux AUR Packages Compromised in 'Atomic Arch' Malware Campaign](https://cybernewsreports.com/arch-linux-aur-malware-compromise-atomic-arch-campaign/): A widespread malware campaign dubbed 'Atomic Arch' has compromised over 1,500 packages within the Arch Linux AUR, distributing a rootkit and credential stealer. The incident highlights risks of.

## Pages

- [Subscribe to cybernewsreports.com](https://cybernewsreports.com/subscribe-to-cybernewsreports-com/)
- [About us](https://cybernewsreports.com/about-us/): The worlds of AI and cybersecurity move fast, and keeping up with every development is a challenge. Cyber News Reports exists to make that easier. We cover the latest in cybersecurity through concise, plain-language articles that get straight to the point. We monitor a wide range of news sources to surface what’s most relevant, and we cite our sources wherever possible. How We Work Our articles are produced with the assistance of AI, drawing on openly available information that we are not always able to independently verify. Our aim is simply to summarise, in our own words, what has already been […]
- [Privacy Policy](https://cybernewsreports.com/privacy-policy/): Who we are Suggested text: Our website address is: http://cybernewsreports.com. Comments Suggested text: When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection. An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment. Media Suggested text: […]

## Optional

- [Agent (MCP protocol)](websites-agents.hostinger.com/cybernewsreports.com/mcp)

[comment]: # (Generated by Hostinger Tools Plugin)