Security News

Morningstar Security News gathers all the most popular infosec and cyber security news headlines into a single page that auto-updates 24/7.

Most Popular

Exploits

Bug Bounties

Vulnerabilities

Tools

Exploit Dev

Reversing/I like ASM

Malware/APT

Crypto

Podcasts

Threat Intel

Privacy/VPNs

Help Wanted

Locks/Social Engineering

Security Blogs

Mainstream Media

Thirsty for more

Security Twitterverse

The Register
HMRC: Crooks broke into 100k accounts, stole £43M from British taxpayer in late 2024 new
China accuses Taiwan of running five feeble APT gangs, with US help new
IBM Cloud login breaks for second time this week and Big Blue isn't saying why new
Ransomware scum leak patient data after disrupting chemo treatments at Kettering new
UK CyberEM Command to spearhead new era of armed conflict
More
Reddit - NetSec
The state of cloud runtime security - 2025 edition new
Multiple CVEs in Infoblox NetMRI: RCE, Auth Bypass, SQLi, and File Read Vulnerabilities new
So you want to rapidly run a BOF? Let's look at this 'cli4bofs' thing then
How to build a high-performance network fuzzer with LibAFL and libdesock
Vulnerabilities Found in Preinstalled apps on Android Smartphones could perform factory reset of device, exfiltrate PIN code or inject an arbitrary intent with system-level privileges
More
Bleeping Computer
Germany fines Vodafone $51 million for privacy, security breaches new
ViLE gang members sentenced for extortion, DEA portal breach new
Ukraine claims it hacked Tupolev, Russia’s strategic warplane maker new
BidenCash carding market domains seized in international operation new
FBI warns of NFT airdrop scams targeting Hedera Hashgraph wallets new
The Hacker News
Redefining Cyber Value: Why Business Impact Should Lead the Security Conversation new
Iran-Linked BladedFeline Hits Iraqi and Kurdish Targets with Whisper and Spearal Malware new
DoJ Seizes 145 Domains Tied to BidenCash Carding Marketplace in Global Takedown new
Critical Cisco ISE Auth Bypass Flaw Impacts Cloud Deployments on AWS, Azure, and OCI new
Your SaaS Data Isn't Safe: Why Traditional DLP Solutions Fail in the Browser Era
More

Threat Wire

Bug Bounties

Vulnerabilities

Full Disclosure
Defense in depth -- the Microsoft way (part 89): user group policies don't deserve tamper protection
CVE-2025-45542: Time-Based Blind SQL Injection in CloudClassroom PHP Project v1.0
ERPNext v15.53.1 Stored XSS in bio Field Allows Arbitrary Script Execution in Profile Page
ERPNext v15.53.1 Stored XSS in user_image Field Allows Script Execution via Injected Image Path
Local information disclosure in apport and systemd-coredump
More
NIST National Vulnerability Database
Sixth PQC Standardization Conference new
CXSecurity
CloudClassroom PHP Project 1.0 SQL Injection
ERPNext 15.53.1 Cross Site Scripting
Windows Explorer - NTLM Hash Disclosure via .library-ms in ZIP Archive
ABB Cylon Aspect 3.08.03 Guest2Root Privilege Escalation
Campcodes Online Hospital Management System 1.0 SQL Injection
More

LiveOverflow

Exploit Dev

Reversing/I like ASM

Reddit - Reverse Engineering
iOS Activation Accepts Custom XML Provisioning – Configs Persist Across DFU, Plist Shows Bird Auth Mod
Deobfuscating JavaScript Code — Obfuscated With JScrambler — To Fix and Improve an HTML5 Port of a Classic Neopets Flash Game.
CVE 2025 31200
ECU analysis and diffing
GhidrAssist ❤️ GhidraMCP
More
Reddit - Game Hacks
Help me to get BigFoot Game Offsets !
CHEATER NINJA + CHEATER FUN
Get the BEST cheats in every game | Undetected | 1000+ Customers
Updated Dark Souls Remastered+PTDE
💎 Rocket League Full AI 💎 Project MA 💎
More
StackExchange - ReverseEngineering
Reverse Engineering an IR Signal from a Remote new
MCU processor name for MG5 instrument clustering
Format of I/Q signal for SDR
cpu rk3588 can ddr memory training blob get reverse engineered?
What does "bad sp value at call" warning mean in IDA?
More

Guided Hacking

Malware/APT

Crypto

Seytonic

Podcasts

Security Weekly
AI Is Oversharing and Leaking Data - Sounil Yu - PSW #865
Risky.Biz
Risky Business #794 -- Psychic Panda outgunned by Fluffy Lizard and UNC56728242
Risky Business #793 -- Scattered Spider is hijacking MX records
Risky Business #792 -- Beware, Coinbase users. Crypto thieves are taking fingers now
Risky Biz Soap Box: Push Security's browser-first twist on identity security
Risky Business #791 -- Woof! Copilot for Sharepoint coughs up creds and keys
More
The CyberWire
Appetite for tracking: A feast on private data. new
Zero-day déjà vu.
AVCheck goes dark in Operation Endgame.
Brandon Karpf: A sailor of the 21st century. [Transitioning service member] [Career Notes]
Triofox and the key to disaster. [Research Saturday]
More
ISC Daily Stormcast
SANS Stormcast Thursday, June 5th, 2025: Phishing Comment Trick; AWS default logging mode change; Cisco Backdoor Fixed; Infoblox Vulnerability Details Released new
SANS Stormcast Wednesday, June 4th, 2025: vBulletin Exploited; Chrome 0-Day Patch; Roundcube RCE Patch; Multiple HP StoreOnce Vulns Patched
SANS Stormcast Tuesday, June 3rd, 2025: Windows SSH C2; Google Removes CAs from trusted list; MSFT issues Emergency Patch to fix Crash issue; Qualcom Adreno…
SANS Stormcast Monday, June 2nd, 2025: PNG with RAT; Cisco IOS XE WLC Exploit; vBulletin Exploit
SANS Stormcast Friday, May 30th 2025: Alternate Data Streams; Connectwise Breach; Google Calendar C2;
More
Darknet Diaries
159: Vastaamo
158: MalwareTech
157: Grifter
156: Kill List
155: Kingpin
More

Threat Intel

Privacy/VPNs

Slashdot - Rights
New Spying Claims Emerge in Silicon Valley Corporate Espionage Scandal new
Apple's Attempt To Pause App Store Antitrust Order Fails new
Apple Gave Governments Data On Thousands of Push Notifications new
OpenAI Slams Court Order To Save All ChatGPT Logs, Including Deleted Chats new
Reddit Sues AI Startup Anthropic For Breach of Contract, 'Unfair Competition' new
More
Reddit - Privacy
Using Gmail in a web browser I now see Google's Gemini AI bot sitting at the top with a notification telling us its there now.… new
Question: Google Gemini is Replacing Google Assistant for Voice Command, how far reaching is it compared to Google Assistant in regard to privacy? new
What is the best anonymous free email provider in 2025 for western people? new
Still using Facebook? You really shouldn’t be. new
Deleting apps from android phone new
More
Reddit - VPN
Heavy advertise vpn worth it? new
Do owners of openvpn server see what I torrent? new
VPN not working new
Using VPN in China
Microsoft defender VPN Q
More
EFF
Statement on California State Senate Advancing Dangerous Surveillance Bill new
The Federal Government Demands Data from SNAP—But Says Nothing About Protecting It
The PERA and PREVAIL Acts Would Make Bad Patents Easier to Get—and Harder to Fight
The Defense Attorney’s Arsenal In Challenging Electronic Monitoring
CCTV Cambridge: Digital Equity in 2025
More
Reddit - PrivacyGuides
Recall Is Back, But You Still Shouldn't Use It
Sam Altman Wants Your Eyeball
When Code Became a Weapon - Crypto Wars Explained
A Flaw With the Security Level Slider in Tor Browser
Age Verification Wants Your Face, and Your Privacy

Help Wanted

Reddit - AskNetSec
Rats new
What’s your strategy to reduce false positives in vulnerability scans?
Is it safe to use LLM agents like CAI for internal pentesting?
Next-gen email for security & privacy. What are we still missing?
Security Automation in CI/CD Pipeline (Gitlab)
More
Reddit - Netsec Students
Criminology Law + IT Networking background new
Georgia Tech or WGU?-ms cybersecurity
Wireless Pivots: How Trusted Networks Become Invisible Threat Vectors
L0p4-Toolkit is a toolset for penetration testing and ethical hacking.
I’m 24 with a non-tech degree (BA in History), but I know Java and Android dev — is OSCP (PEN-200) realistic for someone like me?
More
Stackoverflow - Security
Is OpenSSH bound to Plesk version? / Does recent Plesk use an outdated OpenSSH version? new
Antibot solver blackbox testing fails after 200 runs new
Is bootstrap21.org related to the official Bootstrap framework? new
How to fix parameter tampering in oracle parameterized cursor
Need help understanding a Cortex XDR alert on DCSync/MSOL Account and a legitimate PowerShell block
More
Stack Exchange
Encrypting lookup IDs with AES-CTR, which nounce? new
How do you handle MFA during pentests?
Are there any risks when booting from the installation USB for a clean installation?

Locks/Social Engineering

Reddit - Lockpicking
Mail call new
Beginner... new
did i just make history? new
Special Locksport Spotlight on the McNally vs Proven Industries fiasco new
2nd Challenge Lock Ready 4 A Picker new
More
Reddit - Social Engineering
A hypothetical: How would one use social engineering to run a vigilante con operation on scammers and other predatory confidence tricksters from the internet? new
What high pressure situations shows someone's true colors?
is there any free college or online university in the world that i can enroll in just to get a .edu email address?
How can someone's actions be used to psychoanalyse them?
HELP NEEDED ASAP
More

Hak5

Security Blogs

Linux Security
New Chaos RAT Malware Targets Windows and Linux Systems new
Ubuntu 25.10 Will Introduce Rust-based Sudo
The Hidden Security Risks of Open-Source AI
Dark Reading
Cybersecurity Training in Africa Aims to Bolster Professionals' Ranks new
35K Solar Devices Vulnerable to Potential Hijacking new
How Neuroscience Can Help Us Battle 'Alert Fatigue' new
Researchers Bypass Deepfake Detection With Replay Attacks new
How to Approach Security in the Era of AI Agents
More
Securelist by Kaspersky
IT threat evolution in Q1 2025. Non-mobile statistics new
IT threat evolution in Q1 2025. Mobile statistics new
Host-based logs, container-based threats: How to tell where an attack began
Exploits and vulnerabilities in Q1 2025
Zanubis in motion: Tracing the active evolution of the Android banking malware
More
The RISKS Digest
Re: Deep Dive into Ronnie Dugger
Can we still tell what's real? 'Unsettling' new AI tech makes generating ultrarealistic videos easy
Insider Threat Insider Threat
For Some Recent Graduates, the AI Job Apocalypse May Already Be Here
LexisNexis leaked social security numbers and other personal data of over 364,000 people
Adam Shostack & friends
Andor: Insider Threats
Appsec Roundup - May 2025
Free Threat Modeling Training for Displaced Federal Workers
Blackhat Earlybird Prices End Friday
Cyber Hard Problems Report
More
Graham Cluley
3AM ransomware attack poses as a call from IT support to compromise networks
DOJ charges 12 more in $263 million crypto fraud takedown where money was hidden in squishmallow stuffed animals
Smashing Security podcast #418: Grid failures, Instagram scams, and Legal Aid leaks
SEC Twitter hack: Man imprisoned for role in attack that caused Bitcoin’s price to soar.
The AI Fix nominated for top podcast award. Vote now!
More
Rapid7
Rapid7 Q1 2025 Incident Response Findings
From Ideology to Financial Gain: Exploring the Convergence from Hacktivism to Cybercrime
Introducing AI Attack Coverage in Exposure Command: Secure what traditional AppSec Tools miss
Key Takeaways from the Take Command Summit 2025: Risk Revolution – Proactive Strategies for Exposure Management
Metasploit Wrap-Up 05/30/2025
More
Hacker Noon #Security
"Vibe Hacking" and the Rise of the AI-Augmented Attacker new
Why AI Still Struggles to Understand Financial Crime — And What That Means for Compliance Teams new
AR.IO Built ArNS So You Never Lose a Website — Ever new
Is MCP Overhyped? The Real Story About Agent Tools and Security new
Dr. Aryendra Dalal's Revolutionary SAP Security Framework Transforms Global Enterprise Standards new
More
Security Bloggers Network
Top Cybersecurity Tools for Higher Education: Protecting Institutions new
FIPS 140-3 and You, Part Three new
Pinterest Enhances Reliability and Quality Amid AI Content Flood new
Addressing API Security with NIST SP 800-228 new
What the Arc Browser Story Reveals About the Future of Browser Security new
More
Control C
File upload testing with Fuxploider
Wired - Security
What Really Happened in the Aftermath of the Lizard Squad Hacks new
ICE Quietly Scales Back Rules for Courthouse Raids new
The Race to Build Trump’s ‘Golden Dome’ Missile Defense System Is On
You're Not Ready
The Texting Network for the End of the World
More
Krebs on Security
U.S. Sanctions Cloud Provider ‘Funnull’ as Top Source of ‘Pig Butchering’ Scams
Pakistan Arrests 21 in ‘Heartsender’ Malware Service
Oops: DanaBot Malware Devs Infected Their Own PCs
KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS
Breachforums Boss to Pay $700k in Healthcare Breach
More
Naked Security
The strange tale of ischhfd83: When cybercriminals eat their own
Sophos Named a 2025 Gartner® Peer Insights™ Customers’ Choice for both Endpoint Protection Platforms and Extended Detection and Response
An industry first: Sophos Firewall and NDR Essentials
Sophos Firewall v21.5 is now available
DragonForce actors target SimpleHelp vulnerabilities to attack MSP, customers
More
Schneier on Security
New Linux Vulnerabilities
Australia Requires Ransomware Victims to Declare Payments
Why Take9 Won’t Improve Cybersecurity
Friday Squid Blogging: NGC 1068 Is the “Squid Galaxy”
Surveillance Via Smart Toothbrush
More

Security in Mainstream Media

Google News Hacking
New evidence links long-running hacking group to Indian government - The Record from Recorded Future News new
Hacked 5000 hosting clients and caused $4.5 million damage — Cyberpolice caught hacker - ITC.ua new
China issues arrest warrants for 20 Taiwanese accused of hacking missions - MSN new
Chinese issues arrest warrants for alleged Taiwanese hackers - Euronews.com new
Curve Founder Warns of 'For-Hire' Hackers Coordinating Cross-Platform Attacks - Decrypt new
More
Google Cyber Security
CrowdStrike faces probes after global IT outage - SC Media new
Dangerous Blind Spots Costing Enterprises Time, Trust, and - GlobeNewswire new
Sentar Honored with Two FORUM Innovation Awards for Groundbreaking Cybersecurity Initiatives - Business Wire new
Forescout Partners with Coalfire to Deliver FedRAMP-Authorized Cybersecurity Solutions for U.S. Public Sector Agencies - Business Wire new
Bitdefender Launches Powerful Compliance Management Solution Unified With Endpoint Security - Business Wire new
More

Thirsty for more

Hackaday
Piko, Your ESP32 Powered Fitness Buddy new
Running FreeDOS and 8086tiny on the Game Boy Advance Because You Can new
Passive Saturation Box is a Cheap Way To Distort Your Sound new
Slide Rule by Helix new
Making solder wick less painful new
More
Ars Technica
FDA rushed out agency-wide AI tool—it’s not going well new
US science is being wrecked, and its leadership is fighting the last war new
Jared Isaacman speaks out, and it’s clear that NASA lost a visionary leader new
Samsung teams up with Glance to use your face in AI-generated lock screen ads new
Two certificate authorities booted from the good graces of Chrome
More
Wired
OnePlus Pad 3 Review: Killer Tablet, High Price new
Meet the ‘Relationship Anarchists’ Ditching Romantic Norms new
8 Best Espresso Machines (2025), Tested and Reviewed new
What Really Happened in the Aftermath of the Lizard Squad Hacks new
How to Prepare for a Climate Disaster in Trump’s America new
More
Slashdot
Waymo Set To Double To 20 Million Rides As Self-Driving Reaches Tipping Point new
New Spying Claims Emerge in Silicon Valley Corporate Espionage Scandal new
Endangered Classic Mac Plastic Color Returns As 3D-Printer Filament new
Missions To Mars With Starship Could Only Take Three Months new
Meta's Push Into Defense Tech Reflects Cultural Shift, CTO Says new
More
DZone Security
Enterprise Data Loss Prevention (DLP) Security Policies and Tuning
Security by Design: Building Full-Stack Applications With DevSecOps
When Airflow Tasks Get Stuck in Queued: A Real-World Debugging Story
How GitHub Copilot Helps You Write More Secure Code
A Guide to Auto-Tagging and Lineage Tracking With OpenMetadata
More
DZone
It Costs That Much Because Observability Takes Hours
Domain-Centric Agile Modeling for Legacy Insurance Systems
AI-Powered Smart Contracts: The Future Of Automated Decision-Making
Revolutionizing KYC: Leveraging AI/ML for Regulatory Compliance
Observability Expenses: When ‘Pennies on the Dollar’ Add Up Quickly
More
Hacker News (YCombinator)
How I Use LLMs to Write new
Canadian Government Buries “Lawful Access” Provisions in New Border Bill new
Canadian Government Buries "Lawful Access" Provisions in New Border Bill new
AtoB (YC S20) – Stripe for Transportation – is hiring engineers new
Track Errors First new
More
Reddit - Cyberpunk
Visitor... new
by @KinoFabino - forget the promises of technology and science, of progress and understanding - in the drab boredom of the present day, Costco lets… new
Tonight on The Running Man new
Do you think cyberpunk fashion still connects with LGPTQ+ issues today, or has it becomes too commercial or disconnected? new
I drew this recently! new
More
Reddit - Security CTF
[CTF] Our new HackerDna lab 🧪 *FiPloit* is out! new
🚀 Nc{Cat} CTF Team Is Growing — Looking for Passionate Players to Join Us!
[CTF] New vulnerable VM at hackmyvm.eu
NEW TO CTF
Join Our Growing CTF Community! 🔐
More
Reddit - Sysadmin
SQL Monitor Recommendations new
365: Purview - Exported content (.PST) download is *very* slow new
🛡️ Step-by-Step Azure Front Door Setup & WAF Configuration — Any Gotchas I Should Watch Out For? new
Trainee to internal systems admin new
Microsoft 365 SSO for Office license asks for email new
More
Lobste.rs
APLearn: machine learning library new
Consumer Routers - Router Security new
Picking uncontested private IP subnets with usage data new
NVIDIA ISO-26262 SPARK Process new
A programming system new
More