- Mythos: An AI tool too powerful for public release
April 20, 2026
Anthropic’s most capable model to date, Claude Mythos Preview (aka Mythos), has been described as a “step change” in AI performance, especially on cybersecurity tasks. Anthropic tried to keep Mythos a secret until a few weeks ago, when a data leak revealed the existence of what the company said was its most powerful artificial intelligence to ...
- Hackers are abusing Apple account notifications to distribute malware, steal money and data
April 20, 2026
Scammers have found a way to abuse Apple’s email notification system to deliver phishing messages and trick people into giving away sensitive data and system access. Recently, people started receiving emails from the email.apple.com domain, notifying them of a $899 iPhone purchase via PayPal. The email also shared a phone number for the victims to call, ...
- App host Vercel says it was hacked and customer data stolen
April 20, 2026
Cloud app hosting giant Vercel this weekend said hackers had breached its internal systems and accessed customer data. Hackers have claimed they have stolen sensitive customer credentials from Vercel’s systems and are selling the data online. In a statement on Sunday, Vercel said the breach originated from another software maker, Context AI. One of Vercel’s employees ...
- Microsoft releases Windows Server update fix to fix its April update fixes
April 20, 2026
Microsoft has pushed out an out-of-band update to address the restart loop that hit some Windows Server devices after its April update. The fix will spare administrators the headache of forced server restarts after installing the April 2026 update. (A reminder that deploying any Microsoft update directly to production without thorough testing is, to put it ...
- NIST changes enrichment process for National Vulnerability Database due to surge in CVE submissions
April 20, 2026
The number of reported vulnerabilities has surged so sharply that it forced the National Institute of Standards and Technology (NIST) to change how it ‘enriches’ each entry. Until now, NIST would take a basic CVE record and add structured analysis, to make it more useful in the National Vulnerability Database (NVD). That usually includes severity scoring ...
- UK: Military reviews Army’s use of Chinese technology to make weapons
April 18, 2026
The Defence Secretary has ordered an investigation after The Telegraph revealed that the British Army was using Chinese 3D printers to build weapons. Last year, it was revealed that British troops were taking the technology with them into the field and using it to make “suicide drones” for attack missions, despite national security concerns. Army officers said ...
- Tracking Mirai Variant Nexcorium: A Vulnerability-Driven IoT Botnet Campaign
April 17, 2026
IoT devices are increasingly prime targets for large-scale attacks due to their widespread use, lack of patching, and often weak security settings. Threat actors continue exploiting known vulnerabilities to gain initial access and deploy malware that can persist, spread, and cause distributed denial-of-service (DDoS) attacks. FortiGuard Labs has analyzed a recent campaign exploiting CVE-2024-3721 in TBK ...
- Personal data held by NHS Shetland is breached more than 160 times in three years
April 17, 2026
Personal and sensitive data held by NHS Shetland was breached more than 160 times over the last three years, it can be revealed. Information given to The Shetland Times through a Freedom of Information (FoI) request showed there was 161 occassions where confidential data was leaked. Data was shown to be lost, stolen or left insecure ...
- Cisco tells Webex users to patch critical security flaws immediately
April 17, 2026
Cisco has pushed a new patch to address four critical-severity vulnerabilities plaguing its cloud-based Webex Services platform – and has also warned Wi-Fi access points users of a bug in certain versions of IOS XE that could result in a device bootloop. Webex Services is a platform for communication and collaboration, letting people hold video meetings, ...
- Adapt or pay: an analysis of the AdaptixC2 framework
April 17, 2026
As highlighted in our previous post about the Mythic framework, threat actors are rapidly adopting emerging technologies and frameworks. A prime example of this trend is AdaptixC2, a relatively new open-source post-exploitation framework that has quickly captured the attention of the offensive security community. Its popularity stems from its open-source nature and high extensibility; the framework ...
- Disgruntled researcher releases second major Windows zero-day
April 17, 2026
The same disgruntled researcher who recently disclosed a zero-day vulnerability in Windows has now done it again, this time targeting Microsoft Defender, the operating system’s native antivirus solution. A researcher with the alias “Chaotic Eclipse” has posted a proof-of-concept (PoC) exploit for a vulnerability they named “RedSun”. It is a local privilege escalation flaw that allows ...