The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE identifier  CVE-2026-18963 , is rated 9.1 on the CVSS scoring system by Red Hat, which acts as the CVE Numbering Authority (CNA) for the flaw. It has been classified as a weak password recovery mechanism for a forgotten password (CWE-640). Users of upstream Keycloak are advised to update to version 26.7.2, released August 19, 2026, while customers running Red Hat build of Keycloak (RHBK) should apply the updates shipped for 26.4.15 and 26.6.6. There is no evidence that the flaw has been exploited, and no verified public exploit has been located as of August 24, 2026. Red Hat said in  its CVE advisory  that the root cause is "improper state validation within the reset-cred...

Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar that uses graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent. The campaign, codenamed Operation QUICSILVER , has been found to target government and information technology sectors, per Seqrite Labs. The activity is assessed to be the work of a China-nexus threat actor with moderate confidence. It was first observed in April 2026, when the attack was observed delivering a file named "HolidayNotice.pdf.exe" along with a lure that was a fabricated Belgian–Myanmar public holiday calendar. Two subsequent artifacts, each detected in June and July 2026, make use of a Virtual Hard Disk (VHD) file that activates the infection chain. Present within the VHD file is a Windows Shortcut (LNK) that mimics a PDF document. Opening the document displays a decoy PDF to the victim, an official graduation ceremony invitation that's written in Burmese and purports to be from t...

Big security risks come in small packages. While enterprise security teams focus on policing the proliferation of employees using ChatGPT and Claude for quick drafting tasks, a more urgent threat is posed by a handful of AI super-adopters who are quietly hardcoding unvetted tools into critical business operations. According to new research published by Akamai, the top 5% of enterprise power users interact with AI models at 12 times the rate of the bottom 50% of the workforce. The findings, published in Akamai’s State of the Internet: Enterprise AI Usage Risk Report 2026 , are based on real-world usage and telemetry data as well as research and threat analysis.  These AI super-adopters are creating a disproportionate security risk by expanding the use of shadow AI, increasing opportunities for data leakage, and introducing autonomous AI agents that operate within the enterprise but outside its established guardrails. “Small groups of AI power users are casting outsized shado...

Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam. Details of the threat activity came to light following the discovery of an open directory hosted at "139.180.197[.]150," which was observed communicating with one of the compromised machines. "The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale," Cisco Talos said in a two-part report published last week. The actor employed a mixture of open-source offensive frameworks, including Metasploit , ysoserial , PentestGPT , DeepAudit, and multiple privilege escalation exploits to automate intrusion operations and establish persistence." UAT-10147 has been described as a threat actor that conducts search engine op...

The U.S. Department of Justice (DoJ) announced on Friday that ByteDance-owned TikTok will pay $400 million to settle a 2024 lawsuit accusing the company of violating child privacy laws in the country. As part of the settlement, the social media platform will pay $300 million immediately, and an additional $100 million "upon entry of an order vacating a prior consent decree entered against TikTok’s predecessor, Musical.ly," the DoJ said in a press release. A complaint filed back in August 2024 alongside the Federal Trade Commission (FTC) accused the company of "massive-scale invasions of children's privacy" by knowingly allowing children under 13 to create TikTok accounts and unlawfully collecting data from those who used it in "Kids Mode." It further alleged TikTok and its parent company ByteDance failed to "comply with parents' requests to delete their children's accounts and information." At the time, the company disputed...