Who we are:
Cybrfunk was created on January 17, 2021 with the intent of making reliable cyber security news and threat intelligence more accessible to the public. With this in mind, we aim to provide a central hub for all of the best cyber security news and threat intelligence. In an ever changing landscape we hope to make your trip a little easier and safer.
Latest Articles:
Friday Squid Blogging: Increasing Squid Populations
This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures. As usual, you can also use this squid…
Trust Is Not What It Seems — And Fraudsters Are Counting on It
Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a little…
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could…
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
Fixing the critical PHP flaws is not as simple as clicking "Update." Here's how to assess your risk, and what you can do to protect…
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026.
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations.
FCC bans two devices with surveillance chips linked to Huawei
The banned items — a wireless video transmitter and dashboard camera — are made with chips manufactured by Huawei subsidiary HiSilicon, which markets its products…
AI Tools Are Generating Massive Attacks for Little Cost
One campaign targets 105 sites using open-weight models; in another, public models gained full domain control for $12. Cyber-defense will have to change.
Microsoft: Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027.
Senators say targeted ads are a security risk. Ad groups say the critics are off base.
Citizen Lab’s AdFection findings have senators pushing for industry improvements, while IAB Europe and Google defend their vetting practices.
Built-In Weakness: Lawful Access and Encryption in the Age of AI-Powered Cyber Threats
Senior research associate Kate Robertson spoke about the legal concerns that Canada’s proposed Lawful Access Act poses with the Canadian Internet Society.
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch.
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe.
You gave your AI agent access, but who is giving it orders?
AI agents can be manipulated through malicious emails, websites, and plugins into executing commands, stealing data, or deleting files using their legitimate permissions. Gen Digital…