General Medium 5 May
(The Hacker News) / The Hacker News:

MetInfo CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks

Threat actors are actively exploiting a critical security flaw impacting an open-source content management system (CMS) known as MetInfo, according to new findings from VulnCheck. The vulnerability in question is CVE-2026-29014 (CVSS score: 9.8), a code injection flaw that could result in arbitrary Source: The Hacker News

General High 5 May
Cybersecurity News:

pnpm 11 Enhances npm Supply Chain Security by Default

pnpm 11 introduces a new default security feature to combat supply chain attacks in the npm ecosystem. This update enables a minimum release age for packages, directly addressing the risk of malicious code injection into developer environments. The move aims to enhance security protections and reduce the overall attack surface for software development. Source: Cybersecurity […]

Why it matters: Indian organizations relying on npm for software development should ensure their teams are aware of and leverage such security enhancements to mitigate supply chain risks.
General High 5 May
Cybersecurity News:

Microsoft Edge Stores Passwords in Cleartext Memory at Launch

A security researcher has uncovered a critical vulnerability in Microsoft Edge, revealing that the browser decrypts and stores all saved passwords in cleartext process memory upon launch. This exposure occurs regardless of user activity, making credentials susceptible to memory scraping attacks. The flaw, disclosed by PaloAltoNtwks Norway, highlights a significant risk to user data. Source: […]

Why it matters: Indian organizations using Microsoft Edge should be aware of this vulnerability and consider advising users on alternative password management or browser usage until a patch is released.
General High 5 May
BleepingComputer:

Amazon SES Abuse for Phishing Bypasses Security Filters

Amazon's Simple Email Service (SES) is being exploited by threat actors to launch sophisticated phishing campaigns. These malicious emails are designed to bypass standard security filters and render traditional reputation-based blocking mechanisms ineffective. The technique allows attackers to deliver highly convincing phishing messages directly to inboxes, increasing the risk of compromise. Source: BleepingComputer

Why it matters: Indian organizations must enhance their email security defenses and user awareness training to counter phishing attacks leveraging Amazon SES, as these can bypass common security measures.
General High 5 May
Cityairnews:

CERT-In warns of rising AI-driven cyber threats, ‘Mythos’ concerns

India's CERT-In has issued a warning regarding the increasing prevalence of AI-driven cyber threats. The advisory specifically highlights concerns related to a potential threat named 'Mythos'. This alert underscores the evolving landscape of cyber risks powered by artificial intelligence. Source: Cityairnews

Why it matters: Indian organizations must enhance their cybersecurity defenses and threat intelligence capabilities to counter sophisticated AI-driven attacks warned by CERT-In.
General Low 5 May

IES Briefing: Trellix Discloses Data Breach After Source Code Repository Hack

Your browser does not support audio playback. About this briefing: AI-generated from the original story. Voices: Neerja & Prabhat. ▶ Read transcript Neerja: Cybersecurity firm Trellix has announced a data breach. Attackers gained unauthorized access to a part of its source code repository. This incident involved their internal development environment. Prabhat: This breach highlights significant […]

Telecom High 5 May
Cybersecurity News:

New MicroStealer Malware Targets Telecom, Education Sectors Globally

A new infostealer malware, MicroStealer, has emerged and is rapidly spreading across the threat landscape. First detected in December 2025, this malware quickly gained traction in sandbox environments. It is actively targeting organizations in the telecom and education sectors. Source: Cybersecurity News

Why it matters: Indian critical infrastructure operators, especially in the telecom sector, must update their threat intelligence and enhance detection mechanisms against this new infostealer.
General High 5 May
BleepingComputer:

Trellix Discloses Data Breach After Source Code Repository Hack

Cybersecurity firm Trellix has disclosed a data breach after attackers gained access to a portion of its source code repository. This incident involves unauthorized access to the company's internal development environment. The breach underscores the critical need for robust supply chain security and continuous monitoring of vendor risks. Source: BleepingComputer

Why it matters: Indian critical infrastructure organizations using Trellix products should monitor for further advisories and evaluate potential supply chain risks stemming from this incident.
Government High 4 May
The Hacker News:

Silver Fox Deploys ABCDoor Malware via Tax Phishing in India

China's Silver Fox cybercrime group is deploying ABCDoor malware against Indian organizations. The campaign uses tax-themed phishing emails impersonating the Income Tax Department of India. A similar operation also targeted Russian entities. Source: The Hacker News

Why it matters: Indian organizations, particularly government and financial entities, must enhance phishing detection and user awareness against tax-themed attacks.
Banking High 4 May
Currentaffairs Adda247:

Indian Banks, CERT-In Address Anthropic Mythos AI Risk to Financial Systems

The article addresses the potential risks of Anthropic Mythos AI to India's banking and financial systems. It emphasizes the necessity for financial institutions to report suspicious activities to CERT-In. Coordinated response mechanisms are being developed through the Indian Banks Association to manage these emerging AI threats. Source: Currentaffairs Adda247

Why it matters: Indian financial organizations must prioritize understanding and mitigating AI-driven risks, actively engaging with CERT-In and industry associations for robust collective defense.
General High 4 May
MediaNama:

CERT-In Issues High-Severity Advisory on ‘Mythos’ Threat

India's CERT-In has issued a high-severity advisory concerning the 'Mythos' threat, which officials deem unprecedented. The directive urges all organizations to treat this threat with extreme caution and implement robust security measures. This development occurs as Anthropic introduces its Claude Security offering, highlighting growing concerns around advanced threats. Source: MediaNama

Why it matters: Indian organizations must heed CERT-In's high-severity advisory on the unprecedented Mythos threat and implement necessary security measures promptly to protect critical infrastructure.
General High 4 May
Techinasia:

India Warns: AI Accelerates Software Flaw Exploitation

India's cybersecurity agency has issued a warning about emerging AI capabilities. Anthropic's Mythos AI is reportedly compressing the timeline between identifying software flaws and developing functional exploits. This acceleration poses a significant new challenge for cybersecurity defenses, potentially increasing the speed and impact of cyber attacks. Source: Techinasia

Why it matters: Indian organizations must prioritize rapid vulnerability patching and robust threat intelligence to mitigate risks from AI-accelerated exploit development.
General Critical 4 May
Thehawk:

Indian IT Firms See Critical Surge in Credential Theft Detections

A recent report indicates a significant surge in credential theft attempts targeting Indian IT firms. Over 265 million detections of credential theft were recorded, highlighting a widespread and persistent threat landscape. This increase emphasizes the urgent need for enhanced cybersecurity measures, particularly around remote access and identity management. Source: Thehawk

Why it matters: Indian organizations, especially those in the IT sector or relying on IT service providers, must prioritize robust identity and access management to counter this escalating threat.
General High 4 May
Digitalterminal:

ESET Establishes Dedicated India Entity Amidst Rising Cyber Threats

ESET has announced the establishment of a dedicated entity in India, aiming to bolster its long-term growth strategy across the APAC region. This move comes as India's cybersecurity landscape experiences a significant increase in complexity and threats, including ransomware. The new entity will enable ESET to better serve the growing demand for robust cybersecurity solutions […]

Why it matters: Indian organisations can expect enhanced local support and access to ESET's cybersecurity solutions as the company deepens its commitment to the region.