cybersecurity

Mozilla released Firefox 150 on April 21, 2026, fixing 271 vulnerabilities surfaced by Anthropic's Claude Mythos Preview in a security sweep Mozilla's CTO calls a turning point for defender-side AI.

ICE's acting director confirmed in an April letter that the agency deploys Paragon's zero-click Graphite spyware against fentanyl suspects, months after the same tool was linked to attacks on European journalists and civil society members.

Opus 4.7 lands across Claude, Bedrock, Vertex AI, and Foundry with unchanged pricing, while Anthropic uses it to trial new cyber safeguards before any broader Mythos rollout.

A week-long NCA-led operation with the US Secret Service and Canadian police disrupted approval phishing scams, freezing millions while identifying fraud wallets across more than 30 countries.

Cisco discloses four critical vulnerabilities across ISE and Webex, with the most severe allowing unauthenticated attackers to impersonate any user via a broken SSO certificate check.

NIST will now enrich only CVEs meeting federal priority criteria, leaving thousands of vulnerabilities without severity scores as AI-driven discovery overwhelms the 21-person NVD team.

A coalition of cybersecurity heavyweights warns that AI-driven vulnerability discovery has collapsed mean time-to-exploitation to under one day, urging CISOs to deploy AI agents against their own code immediately.

A pre-authentication SQL injection in Fortinet's endpoint management server has been exploited since late March, with federal agencies facing an April 16 remediation deadline.

Booking.com confirmed hackers accessed customer names, contact details, and reservation data, forcing PIN resets across the platform while declining to disclose how many users were affected.

Hackers accessed names, addresses, bank details, and dates of birth of roughly one million Basic-Fit members before monitoring systems cut off the intrusion.

April's update is Microsoft's second-largest Patch Tuesday on record, with 8 critical flaws, two zero-days, and privilege escalation bugs accounting for well over half of the patches.

OpenAI unveiled GPT-5.4-Cyber on April 14, a cyber-permissive variant with binary reverse engineering capabilities, limited to vetted defenders through an expanded Trusted Access for Cyber program.