Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.

The post Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network appeared first on SecurityWeek.

The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.

The post China-Linked Hackers Exploit PHP2Shell to Root Firewalls appeared first on SecurityWeek.

Xint says a flaw in OpenAI’s compaction process let researchers move reasoning traces between models, potentially making it cheaper to distill a rival AI.

The post Stolen AI Reasoning Could Help China Build Cheaper Rivals appeared first on SecurityWeek.

The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments.

The post China APT Uses AI Pentest Tool Artex in ConnectWise Attacks appeared first on SecurityWeek.

The DHS said agencies should remove DeepSeek products as well as third-party products and services developed using DeepSeek from their IT systems.

The post China Defends DeepSeek After US Ban of Its AI From Government Systems appeared first on SecurityWeek.

Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable.

The post Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor appeared first on SecurityWeek.

At least three threat actors have been abusing Cairn for persistent access and financial theft.

The post AI Platform Cairn Abused to Hack Over 100 Organizations appeared first on SecurityWeek.

Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts.

The post Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day appeared first on SecurityWeek.

Backed by a federal court order, Microsoft and Health-ISAC seized domains powering YAM Store, CoGUI, and Iron Man.

The post Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages appeared first on SecurityWeek.

Flax Typhoon and other APTs used MicroScan and FishHub to scan and hack US and foreign critical infrastructure.

The post US Disrupts Chinese State-Sponsored Hacking Tools appeared first on SecurityWeek.

Zhang Yu was charged alongside Xu Zewei, who was extradited from Italy to the US in April 2026.

The post US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward appeared first on SecurityWeek.

SEC Consult has published technical details on vulnerabilities mentioned in a complaint filed by several US states.

The post TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws appeared first on SecurityWeek.

The China-based hacking group has been exploiting SharePoint vulnerabilities since July 2025.

The post Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks appeared first on SecurityWeek.