Sitemap
Full listing of everything on InfoSecDash — 2204 stories, 5 threat groups, 148 CVEs.
Vulnerabilities (676)
- Zyxel releases patch for critical zero-day affecting nearly 1,000 network switches
- Critical APT Flaw in Debian and Ubuntu Enables MITM Attackers to Execute Code as Root
- SonicWall Refuses Patches for End-of-Life GMS Vulnerabilities Exposing Files and Data
- Critical Rails Vulnerability Allows Unauthenticated File Write via Malicious ImageMagick Upload
- Critical Xen Hypervisor Flaws Allow Rogue VM to Access Memory of Other Virtual Machines
- Google Releases Patches for Critical Android Vulnerability Enabling Remote Code Execution
- CISA Alerts on Active Exploitation of Critical WordPress Core Vulnerability During Updates
- Chained Barracuda Vulnerabilities Enable Authentication Bypass and Root Access
- Barracuda Discloses Critical Vulnerabilities Allowing Root Access to Devices
- Red Hat Releases Patch for Critical Linux TCP Remote Code Execution Flaw
- Critical BTCPay Server Flaw Enables Theft of Cryptocurrency From Active Wallets
- Active Exploitation of Critical Siemens IoT2050 Vulnerability Used to Deploy Remote Access Backdoors
- Active exploitation of critical flaw in WordPress crypto payment plugin
- BTCPay Server Warns of Crypto Thefts from Hot Wallets on Outdated Versions
- Over 1,000 GitLab Servers Exposed to Active Remote Code Execution Attacks
- Langflow: Two Critical Flaws Allow Remote Code Execution Without Authentication
- Ivanti releases patches for two critical Connect Secure vulnerabilities exploited in chained attacks
- Ivanti Releases Patches for Two Zero-Day Flaws Chained in Active Connect Secure Attacks
- Alpine Linux rebuilds GitLab infrastructure following attempted remote code execution attack
- Critical LXD and MicroCloud Flaw Allows Attackers to Impersonate Trusted Clients Without Private Keys
- Critical Android Vulnerability Allows Remote Phone Crashes via Malicious Text Messages
- CISA warns of three chained Ivanti Connect Secure vulnerabilities actively exploited in the wild
- A Shared ChatGPT Link Could Execute Attacker Code in Your Session
- Critical Linux Kernel Vulnerability Enables Remote Root Attacks on MPTCP Servers
- TeamViewer Patches Vulnerability Allowing Controlled Machines to Attack Remote Controllers
- PHP2Shell Attacks Compromise Palo Alto Firewalls While Failing Against WordPress
- Abandoned Software Projects Continue to Present Major Security Threats
- Critical WordPress Vulnerability Triggers Nearly 63,000 Attack Attempts in 24 Hours
- Signaling Protocol Flaws in SS7 and Diameter Expose User Location and Call Data
- U.S. cybersecurity agency confirms active exploitation of critical GitLab flaw
- Trezor Alerts to Suspected Hardware Implant in Wallets Sold by Unauthorized Reseller
- WordPress Zero-Auth Flaw Targeted by Attackers Exploiting Critical Race Condition
- Critical Drupal Commerce Vulnerability Exploited to Bypass Access Controls on Online Stores
- Drupal alerts to critical Commerce Core vulnerability actively exploited in attacks
- Critical GitLab Vulnerability Under Active Exploitation Against Alpine Linux
- Active Exploitation of Critical Authorization Bypass in Drupal Commerce Core
- CISA Lists Critical GitLab and Cisco Vulnerabilities With Active Exploitation Confirmed
- APT Group Exploits Cisco SD-WAN Vulnerability to Deploy Custom KeyDrift Malware
- Critical TCP Flaw in Linux Kernel Impacts Ubuntu, Red Hat, and Other Distributions
- Microsoft Resolves Remote Desktop Connection Issues After Recent Windows Updates
- Telegram Android Vulnerability Allowed Code Execution During Incoming Voice Calls
- Cisco Releases Patches for Critical ASA and FTD Firewall Flaw Under Active Exploitation
- Attacker Attempted to Exploit Critical GitLab Vulnerability in Alpine Linux Project
- Attackers Exploited Critical Cisco SD-WAN Vulnerability to Deploy Encryption Key-Stealing Malware
- China-Linked Hackers Exploit VMware ESX Zero-Day to Reduce Audit Trail Visibility
- Attackers Actively Exploiting PHP2Shell Vulnerabilities in Internet-Exposed Palo Alto Networks Management Interfaces
- Researcher Demonstrates How Logic Flaws Alone Compromised Microsoft Edge in Pwn2Own Competition
- PHP2Shell Attack Compromises 25 Servers with AI Assistance, Breaches U.S. Government-Affiliated Network
- InfraTrust Report Highlights Active Exploitation of Critical Network Infrastructure Flaws
- Attackers Probe Critical Oracle E-Business Suite RCE Vulnerability Shortly After Patch Release
- Attackers actively scanning for unpatched Oracle vulnerability just released
- Critical 16-Year-Old UEFI Vulnerability Allows Code Execution Before Secure Boot on Network-Booting Servers
- Adobe Releases Patches for Eight Critical Campaign Classic Vulnerabilities
- CISA Alerts to Active Exploitation of Critical Node2Shell Vulnerability
- Tailscale Patches SSH Vulnerabilities That Could Enable Root Access on Other Servers
- Oracle PeopleSoft Critical Flaw Exploited by ShinyHunters Turns Out to Be Three Chained Vulnerabilities
- CISA Flags Critical Vulnerabilities in Adobe Commerce and Brotli Under Active Exploitation
- Microsoft releases emergency Windows updates to revoke compromised eMudhra certificates
- Tailscale Warns of SSH Flaws Enabling Root Privilege Escalation
- GoAhead Web Server Vulnerability Allows Revoked TLS Client Certificates to Pass Authentication
- Apple Backports Critical CoreGraphics Security Fix to Older iPhone and iPad Models
- Microsoft Patches Android Authenticator Flaw That Allowed Token Theft from Work Accounts
- Apple Extends Critical Security Patches to Older iPhone and iPad Models
- Researchers Discover OpenAI Conversation Compaction Feature Could Expose Model Reasoning
- CISA Confirms Active Exploitation of PHP2Shell Vulnerabilities
- Dahua IP Cameras Compromised in Ukraine Through Authentication Weaknesses
- CISA Confirms Active Exploitation of Critical PHP2Shell Vulnerabilities
- Attackers Abuse AI Agents' Trust in Markdown to Inject Malicious Prompts
- PHP Issues Second Security Update in Five Days to Patch Critical Brotli Code Execution Vulnerability
- Critical Brotli Flaw Allows Memory Corruption and Sensitive Data Access
- Microsoft Issues Emergency .NET Patches for Critical Brotli Vulnerability
- Critical week: multiple remote code execution vulnerabilities actively exploited
- Two Critical Wasmtime Vulnerabilities Allow WebAssembly Escape from Sandbox Isolation
- PHP2Shell Critical Flaws Under Active Exploitation
- Unpatched Tailscale SSH Flaws Enable Root Access from Compromised Devices
- PHP2Shell Exploitation Targets European Government Entity Using AI-Assisted Post-Exploitation
- Critical Brotli Decoder Vulnerability Impacts Node.js, Bun, Python, and Major Software Platforms
- CISA Alerts on Two Critical Flaws Actively Exploited in Collabora Online and Arista VeloCloud
- Researchers shut down critical flaw in abandoned Popcorn Time app affecting millions of devices
- Critical PHP Vulnerabilities: Practical Guide to Risk Assessment and Protective Measures
- Ruby Patches Three Regular Expression Engine Flaws Behind Critical GitLab RCE Vulnerabilities
- PHP releases mitigation guidance for unpatched RCE vulnerability
- HPE Releases Patches for Eight Critical ArubaOS Vulnerabilities
- PHP Alerts to New Remote Code Execution Vulnerability Days After Emergency Patches
- Third Arista VCO Critical Vulnerability Exploited in Four Months
- Critical Vulnerability in Python's Pillow Library Enables Remote Code Execution
- Researchers Expose Critical Remote Code Execution Vulnerability in Node.js via Crafted Brotli Data
- Critical x402 SDK Flaw Allows Malicious APIs to Drain AI Agent Token Balances
- Atlassian Releases Patches for 75 Third-Party Component Vulnerabilities
- Millions of PHP2Shell Exploit Attempts Fail as Attackers Struggle to Deploy Mirai Variant
- PHP2Shell Exploitation Attempts Rise as Experts Question Practical Viability of Exploits
- EU Supermarket Chains Face Millions in Losses Due to Unpatched Refrigeration Firmware
- Arista Issues Critical Alert on VeloCloud SQL Injection Actively Exploited in Attacks
- eMudhra Exits Global SSL/TLS Market After Intermediate CA Keys Found Easily Guessable
- Arista releases patch for critical VeloCloud Orchestrator zero-day under active attack
- Two Critical KSMBD Vulnerabilities Enable Remote Code Execution Without Available Patches
- Amazon reveals PHP2Shell attacks started days before security patches were released
- GitLab alerts users to critical remote code execution flaw
- OpenCode Vulnerability Allowed Malicious Code Execution During User Sign-In
- Critical Brotli Decompression Flaw in Node.js Allows Remote Code Execution
- QPACK Vulnerabilities Enable HTTP/3 Server Crashes with Extreme Memory Amplification
- PHP2Shell Vulnerabilities Exploited Four Days Before Public Disclosure
- Two Critical PHP Vulnerabilities Trigger Industry-Wide Security Alert
- Critical GitLab Vulnerability Allows Unauthenticated Remote Code Execution Across 12 Years of Releases
- CISA Warns of Active Exploitation of Chained Plex Media Server Vulnerabilities
- Critical PHP Vulnerability Affecting Millions of Websites with Active Exploits
- PHP Releases Emergency Patches for Critical PHP2Shell Vulnerabilities
- PHP Issues Emergency Patches for Two Critical Code Execution Flaws
- PHP2Shell: Critical Vulnerabilities Remain Unmitigated Until Official Patch Release
- CISA Mandates Federal Agencies to Patch Actively Exploited Vulnerabilities in Plex, Siemens, and SiteGuard
- PHP releases emergency patch for two critical remote code execution flaws
- Stolen UpdraftCentral Keys Leveraged to Compromise WordPress Installations
- Major browsers block compromised eMudhra certificate authority certificates
- Tech Giants Block eMudhra Certificates Following Compromise of Eight Private Keys
- PHP Releases Emergency Patches for Two Critical Vulnerabilities
- Eight eMudhra Certificate Authority Keys Compromised, Triggering Emergency Fixes Across Browsers
- Public Exploit Released for Critical FortiSIEM Unauthenticated Remote Code Execution Vulnerability
- Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
- Go Releases Emergency Update to Block Eight Certificate Authority Keys
- ClickFix Attackers Exploit DLL Loading Flaw in Siemens Software Center
- Attackers Exploit Plex Media Server Vulnerability Chain to Deploy Cryptocurrency Miners
- F5 Releases Emergency Patches for Critical NGINX Vulnerabilities
- October Windows Server Updates Causing Exchange Sign-In and Mail Flow Disruption
- Critical Broadcom Wi-Fi Flaw Enables Root-Level Code Execution on Routers Without Authentication
- Critical SiteGuard WAF Vulnerability Allows Command Execution with Administrator Privileges
- Drupal Releases Patches for Critical Remote Code Execution Vulnerabilities
- BeyondTrust Joins Growing List of Critical Edge Device Vulnerabilities
- Critical BlockStrap Vulnerability Allows Remote Code Execution on Magento Servers
- Researchers Chain 37-Year-Old Flaw With Modern Kernel Bug to Gain Root on OpenBSD
- Chinese-linked Group Exploits Critical BeyondTrust Remote Support Software Zero-Day
- F5 and Juniper Networks Release Patches for Critical Vulnerabilities
- October Windows Update May Disable Smart App Control Feature
- Microsoft Patches Two Dozen RCE Vulnerabilities in Office
- China-Linked Espionage Group Exploited Critical BeyondTrust Remote Support Zero-Day
- BeyondTrust Patches Critical Vulnerability Actively Exploited Since August
- PEERSTITCH Malware Deployed via FortiOS Flaw to Bypass VPN Session Checks
- Attackers Exploit Collabora RCE Vulnerability to Backdoor Nextcloud Servers
- Critical Linux Kernel Flaw Allows Guest VMs to Read Host Memory
- NGINX patches five flaws, including possible remote code execution and TLS validation bypass
- Next.js Releases Emergency Patch for Two Critical Remote Code Execution Vulnerabilities
- Drupal Releases Emergency Patches for Critical Remote Code Execution Flaw in Field UI
- Critical Langflow Vulnerability Exploited in Over 1,400 Documented Honeypot Attempts
- European Supermarket Chains Face Multimillion-Euro Losses from Unpatched Refrigeration Firmware
- Ahsay releases patches for actively exploited AhsayCBS vulnerabilities
- Palo Alto Networks Releases Patch for Critical Remote Code Execution Flaw in PAN-OS
- Palo Alto Networks Patches Critical PAN-OS Flaw Under Active Exploitation
- Critical Ivanti ICS Vulnerability Enables Authentication Bypass and Remote Code Execution
- Claude Code Desktop Flaw Enables Silent Zero-Click Credential Theft from Developers
- Cisco Alerts to Active Exploitation of Critical Secure Email Gateway Vulnerability
- Nextcloud Servers Backdoored Through Critical Flaw in Collabora CODE App
- Cisco releases emergency patch for critical Secure Email Gateway vulnerability
- CISA Issues Urgent Alert on Ivanti Connect Secure Flaw Under Active Exploitation
- CISA Urges Immediate Updates to Ivanti Connect Secure Against Actively Exploited Authentication Bypass
- curl Patches Critical HTTP/2 Upload Vulnerability Enabling Remote Code Execution
- Researchers Built $250,000 Chrome Full-Chain Exploit Using Public OpenAI Model in Six Days
- AI Agent Autonomously Discovers Critical Authentication Flaw at Insurance Firm During Security Assessment
- Recent Windows Updates May Prevent Remote Desktop Connections for Non-Admin Users
- Critical Linux Kernel Flaw Enables Root Escalation and Virtual Machine Escape
- Researchers Execute Code Inside Windows SmartScreen Protected Enclave
- Microsoft Releases Patches for Over 1,400 Vulnerabilities in Largest Security Update
- Microsoft Releases Patches for Over 1,400 Security Vulnerabilities
- Microsoft Releases Patches for Multiple Zero-Day Vulnerabilities in October
- Critical Ghostscript flaw enables remote code execution through malicious PDFs
- Microsoft October 2026 Updates Address Record 1,400-Plus Vulnerabilities Including Three Zero-Days
- Docker Patches Critical Two-Year Vulnerability in Hub Enabling User Impersonation
- Three Zero-Day Vulnerabilities in Ivanti Connect Secure Chained for Root Access; Only Two Fixes Released
- SAP Issues Critical Alert for Python SDK Vulnerability Exposing OAuth2 Credentials
- GitHub Strengthens npm Security After Flaw Exposed 1,500+ Packages to Hijacking
- Ivanti Alerts Users to Actively Exploited Zero-Day in Connect Secure Gateway
- Three Chained Vulnerabilities Enable Root Access to LG Smart TVs From Local Network
- Two Critical MarkLogic Vulnerabilities Enable Privilege Escalation to Administrator Level
- GitLab Patches Critical Vulnerability Allowing Unauthenticated Remote Code Execution
- Maximum-Severity SSRF Vulnerability in SonicWall SMA 1000 Devices Under Active Exploitation
- GitLab Alerts to Critical Remote Code Execution Vulnerability in Regular Expression Compiler
- SonicWall Logs 135+ Exploitation Attempts Against Critical SMA 1000 Flaw
- Active Exploitation of Critical Bricksforge WordPress Plugin Vulnerability
- Critical SonicWall Vulnerability Under Active Attack Days After Disclosure
- Unpatched AhsayCBS Vulnerabilities Exploited to Deploy Webshells and Cryptocurrency Miners
- Working Exploit Released for Critical Pre-Auth AnyDesk Linux Vulnerability Enabling Root Access
- Threat Actors Exploit AhsayCBS Vulnerabilities to Deploy XMRig Miners Disguised as Microsoft Edge
- Critical SonicWall SMA1000 Vulnerability Now Under Active Exploitation
- CISA Orders Patching of Five Vulnerabilities Actively Exploited by Flax Typhoon
- Critical AhsayCBS Vulnerabilities Under Active Exploitation Without Available Patches
- Critical GoBalance Flaw Exposes .onion Addresses to Hijacking Through Tor Key Recovery
- Citrix urges immediate patching of critical NetScaler vulnerability
- Researchers Successfully Hack Fully Patched Google Pixel 10 at Pwn2Own
- Citrix Releases Patches for Critical NetScaler Flaw Enabling Remote Code Execution
- Citrix Warns of Critical NetScaler Flaw Enabling Remote Code Execution
- Researchers Earn $560,000 for Google Pixel 10 Exploits at Pwn2Own 2026
- AWS Bedrock Vulnerability Allowed Complete Environment Takeover via Single Prompt
- Cisco Alerts to Critical Nexus Switch Flaws Enabling Full Device Takeover
- Samsung Galaxy S26 Compromised Multiple Times at Pwn2Own Ireland Competition
- FBI Warns FortiBleed Attacks Continue to Lock Out FortiGate VPN Administrators
- Attackers Compromise Country Domain Registries to Issue Fraudulent Google Certificates
- SonicWall Patches Critical Pre-Authentication SSRF Vulnerability in SMA1000 Devices
- Unpatched Critical LMCache Vulnerability Allows Unauthenticated Remote Code Execution
- Active exploitation of critical Atlassian flaw following public proof-of-concept disclosure
- Active Exploitation of Critical Atlassian Data Center Vulnerability Confirmed
- SonicWall Releases Critical Patches for Server-Side Request Forgery Flaw in SMA1000
- Google Releases October 2026 Security Updates for Android
- Atlassian Releases Patches for Critical Vulnerability Affecting Eight Products
- Flaw in Ninja Forms Plugin Exploited to Compromise WordPress Sites
- Researchers Uncover 32 Zero-Day Vulnerabilities on First Day of Pwn2Own Ireland
- Atlassian discloses critical file-access vulnerability in Jira and Confluence
- Critical Vulnerability in LibreOffice and OpenOffice Allows Malicious Code Execution Without Warning
- Security Research Uncovers Critical Vulnerabilities Across Thousands of Public MCP Servers
- Critical Atlassian Vulnerability Allows Unauthenticated File Access Across 8 Products
- Rejetto HFS Servers Actively Scanned for Critical Remote Code Execution Flaw
- Microsoft Patches Critical Exchange Vulnerability Allowing Unauthorized Mailbox Access
- Critical Dell System Update Vulnerability Discovered Allowing Root Access
- Critical Rejetto HFS Flaw Enables Admin Session Forgery and Remote Code Execution
- Citrix Releases Patch for Critical NetScaler Vulnerability Actively Exploited in Targeted Attacks
- Citrix NetScaler: New Zero-Day Vulnerability Exploited Days After Previous Patches Released
- Citrix releases emergency patches for NetScaler vulnerability actively exploited in attacks
- Forta Releases Patches for Critical BoKS Vulnerabilities
- GitLab Fixes Critical AI Gateway Vulnerability Allowing Remote Command Execution
- Dell discovers critical flaws in container storage modules enabling unauthorized admin access
- Kiteworks and Citrix incidents reveal challenges in zero-day vulnerability response
- Critical Vulnerability in SWIFT Middleware Exposes Banking Systems to Remote Code Execution
- GitLab Issues Critical Remote Code Execution Alert for AI Gateway Service
- Dell releases urgent patches for critical Container Storage Module vulnerabilities
- Critical Fortinet FortiMail Vulnerability Enables Arbitrary File Writing
- Fortinet Discloses Critical FortiMail Flaw Under Active Exploitation
- Fortinet Warns of Critical FortiMail Vulnerability Actively Exploited in Zero-Day Attacks
- Kiteworks patches critical code injection flaw in email protection gateway
- CISA Adds Exploited Cisco Catalyst SD-WAN Manager Authentication Bypass to KEV Catalog
- Apple CoreGraphics Vulnerability Proof-of-Concept Disclosed; Linked to Targeted Attacks
- Bitget Reveals $387.5 Million Theft Exploited Zero-Day in Third-Party Security Software
- Attackers Exploit Critical Citrix NetScaler Flaw to Create Superuser Accounts and Deploy Disguised Web Shells
- Dutch vulnerability disclosure institute reports unpatched Zammad zero-day security flaws
- Attackers Exploit Zimbra Vulnerability to Deploy Web Shells and Steal Mail Credentials
- CISA Alerts to Critical Pre-Auth Remote Code Execution Flaw in MikroTik RouterOS
- Cisco Alerts on Active Exploitation of Critical Authentication Bypass in SD-WAN Manager
- Cisco releases patches for critical SD-WAN Manager zero-day actively exploited in attacks
- TeamViewer Urges Users to Apply Patches for Critical Vulnerabilities
- Bitget Loses $387.5 Million After Attackers Exploit Zero-Day in Third-Party Security Tools
- Threat Actors Exploit NetScaler Flaw to Achieve Administrative Access
- OpenSSL Patches Critical DTLS Flaw Exposing Unencrypted Heap Memory
- Critical Citrix NetScaler Vulnerability Allows Unauthenticated Shellcode Execution
- Apple Zero-Day Actively Exploited in Sophisticated Targeted Attacks
- Unsloth Studio Vulnerability Enables Code Execution During Model Inspection
- Active exploitation of Citrix NetScaler zero-day for backdoor deployment
- New Spectre Variant Bypasses Existing Defenses in JIT Engines and Linux Kernels
- New Spectre v2 Attack Variant Extracts Linux Root Password Hashes in Minutes
- Two Critical NetScaler Zero-Days Compromise Default Configurations
- Kiteworks Patches Critical Vulnerability Discovered During Precautionary Security Shutdown
- Kiteworks Patches Critical Vulnerability, Restores Customer System Operations
- Apple Patches Critical CoreGraphics Zero-Day Exploited in Targeted Attacks
- Critical Flaw in Official MCP Python SDK Exposes OAuth Credentials to Malicious Servers
- Critical Vulnerability in TDengine Allows Attackers to Crash Servers with Single Packet
- Apple Releases Security Patches for Critical CoreGraphics Vulnerability
- Citrix Releases Patches for Two Critical NetScaler Zero-Day Vulnerabilities
- CISA Warns of Active Exploitation of Two Critical Citrix NetScaler Vulnerabilities
- CISA Mandates U.S. Federal Agencies to Patch Critical Citrix Flaws by Wednesday
- Citrix Alerts on Two Critical NetScaler Vulnerabilities Actively Exploited
- Cloudflare patches Containers cross-tenant isolation flaw exposing customer data
- Microsoft SharePoint Vulnerability CVE-2026-65660 Now Being Actively Exploited
- Two Unpatched Citrix NetScaler Zero-Days Allow Remote Code Execution
- Attackers Exploit Critical Oracle PeopleSoft Vulnerability Through WAF Evasion
- Critical CSRF Vulnerability in Elementor Exposes WordPress Sites to Remote Takeover
- Microsoft SharePoint and MikroTik RouterOS Vulnerabilities Actively Exploited in the Wild After CISA Listing
- Kiteworks Urges Customers to Shut Down Servers Over Potential Zero-Day Threat
- ShinyHunters Compromises Clop Leak Site Through Unpatched Grav CMS Path Traversal
- Elementor WordPress Plugin Flaw Allows Attackers to Create Administrator Accounts
- CISA Warns of Critical Flaws in SharePoint, WSO2, and Adobe Commerce Being Actively Exploited
- File Notification Systems in Windows, Linux, and Android Expose User Activity
- Critical SQL Injection Vulnerability in Roundcube Webmail Actively Exploited in the Wild
- Cloudflare Patches Vulnerability Exposing Residual Data from Other Customers' Containers
- CISA Adds Critical WSO2 and Adobe Commerce Flaws to Known Exploited Vulnerabilities Catalog
- Unpatched OxygenOS Vulnerabilities Allow Installed Apps to Gain Root Access Without Permissions
- Exposed GitLab project email addresses allow attackers to inject code into repositories
- Critical Roundcube Webmail Vulnerability Now Under Active Exploitation
- Agentic AI Platform Manus Hit by Prompt-Injection Vulnerability
- Federal agencies warned: ransomware gangs exploiting critical TeamCity vulnerability
- OpenAI AI Agent Bypassed Security Controls on Australian Medicare Portal
- Active Exploitation of Critical WordPress Vulnerability Hours After Disclosure
- GitLab Email Addresses Expose Privileged Tokens for Supply Chain Attacks
- Check Point Warns of Active Exploitation of Critical VPN Gateway Vulnerability
- WordPress Critical Flaw Under Active Exploitation for Remote Code Execution
- Leaked GitLab Issue Email Address Enables Unauthorized Code Commits and CI/CD Job Execution
- MikroTik Vulnerability Chain Enables Administrative Access Without Credentials or SSH Keys
- Single Kubernetes Configuration File Can Compromise Entire Google Cloud Organization
- Arista Releases Emergency Patch for Actively Exploited VeloCloud Orchestrator Zero-Day
- Critical cPanel Vulnerability Enables Root Code Execution and Full Server Compromise
- Critical Ubuntu Flaw Allows Container Escape and Root Access on Host System
- F5 Releases Emergency Patches for Critical BIG-IP APM Vulnerability Enabling Unauthenticated Remote Code Execution
- Chinese Threat Actor Exploits Chrome-Windows Zero-Day Chain to Distribute CLEANGULP Malware
- F5 releases emergency patches for critical BIG-IP APM zero-day flaw under active attack
- Critical Next.js ImageResponse Vulnerability Enables Server Code Execution via Crafted SVG Input
- Rogue MFA Providers Can Intercept Passwords During Legitimate Login Attempts
- Chinese Threat Actors Exploit Zyxel and WordPress Vulnerabilities to Steal Government Data
- Criminal gang claims FBI system access through Oracle PeopleSoft zero-day flaw
- Check Point Discloses Critical Zero-Day Exploitation in Management Server
- WordPress Patches Critical Flaw Enabling Code Execution on Some Servers
- Critical Bifrost AI Gateway Flaw Enables Unauthenticated Remote Command Execution
- Check Point releases emergency patches for critical management server vulnerability
- Researcher Publishes Tool That Disables Microsoft Defender Updates
- Critical VeloCloud Orchestrator Vulnerability With Maximum CVSS Score Actively Exploited
- Critical ARM64 KVM Flaw Allows Guest Virtual Machines to Read and Write Host Memory
- Microsoft Underestimated SharePoint Flaw Severity; Vulnerability Actually Enables Authenticated Remote Code Execution
- Critical Windows Defender Zero-Day Vulnerability Prevents Antivirus Updates
- Researcher Uncovers Hidden Meta Muse Setting That Could Let Malware Hijack the AI Assistant
- Critical WordPress Flaw Enables Remote Code Execution Through Comments
- Critical Flaws in Zyxel and Veeam Devices Under Active Exploitation
- AI Agents Can Trigger Uncontrolled Cost Escalation in Enterprises
- CISA Warns of Active Exploitation of Three Critical Linux Kernel Flaws
- WordPress Click2Shell CSRF Flaw Enables Remote PHP Code Execution
- Researchers Successfully Escape OpenAI Codex Sandbox to Execute Commands
- Researchers Chain Multiple Flaws to Compromise OpenAI Employee Accounts and Internal Code Repository
- SolarWinds Releases Patches for Critical Access Rights Manager Vulnerability
- Critical Unauthenticated Remote Code Execution in Orkes Conductor Workflow Platform Under Active Exploitation
- CISA Alerts on Three Critical Linux Kernel Vulnerabilities Under Active Exploitation
- Cisco Fixes Critical Identity Services Engine Vulnerability Enabling Authentication Bypass
- Public Exploits Released for Four Critical Linux Kernel Vulnerabilities
- WordPress Vulnerability Allows Unauthorized Theme Installation on Administrators' Sites
- Microsoft Patches Critical Azure AI Foundry Vulnerability Allowing Unauthorized Privilege Escalation
- Critical Vulnerability in AI Coding Agents Allows Malicious Plugin Substitution
- Check Point Exposes Critical Flaw Allowing Remote Code Execution with Root Privileges
- Critical Check Point Management Server Flaw Enables Unauthenticated Remote Code Execution as Root
- Critical Docker Desktop Flaw Allows Malicious Code to Access macOS Host Files
- Critical Unbound DNSSEC Validator Flaw Exposes Systems to Remote Code Execution
- ISC Releases Emergency Patches for BIND 9 Against 14 Vulnerabilities, Including Unauthenticated Remote Crash
- Cisco releases patches for critical Identity Services Engine zero-day under active attack
- Cisco Alerts on Critical ISE Authentication Bypass Flaw Under Active Exploitation
- Windows 11 Security Update KB5124008 Breaks Domain Trust on Enterprise Systems
- Critical Issabel Framework Flaw Allows Unauthenticated Remote Command Execution
- A Single Browser Extension Could Hijack AI Assistants Across Chrome, Edge, Opera, and Other Chromium-Based Browsers
- Parallels Desktop Vulnerability Allows Non-Privileged Mac Users to Gain Root Access
- Google Patches Pixel Modem Privilege Escalation Vulnerability Amid Reports of Targeted Exploitation
- CISA Alerts on Active Exploitation of Critical ScreenConnect Vulnerability
- Critical Vulnerability in Acronis cPanel Backup Plugin Actively Exploited in Targeted Attacks
- Google patches actively exploited Android zero-day impacting Pixel devices
- Critical Flaw in WooCommerce Plugin Exploited to Deploy PHP Web Shells
- Active Exploitation of Critical WSO2 API Manager Flaw Allows Forged Admin Tokens
- Acronis alerts to actively exploited vulnerability in cPanel backup plugin
- Threat Actors Exploit Critical Flaw in WooCommerce Plugin for WordPress
- Ransomware Gangs Actively Exploiting Critical VMware vCenter Vulnerability
- Skilled Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
- Cisco Patches Critical Secure Email Gateway Zero-Day Under Active Exploitation
- Critical LiteSpeed Enterprise Vulnerability Allows Root Access from Shared Hosting Account
- Critical Cisco Secure Email Gateway Vulnerability Under Active Exploitation
- China-Linked Hackers Exploit Chrome-Windows Vulnerability Chain to Deploy Backdoor
- Microsoft Releases Emergency Updates to Fix Remote Desktop Services Failures
- Critical GitLab Vulnerability Threatens Supply Chain Integrity
- Telegram Desktop Vulnerability Allows Hidden JavaScript Injection in HTML Exports
- Researchers Disclose DDRop Attack Compromising Intel and AMD Confidential Computing
- CISA Warns of Active Exploitation of Critical GitLab Vulnerability
- China-linked espionage group exploits critical Tencent app flaw to deploy GrayRabbit backdoor
- CISA Adds Five Actively Exploited Flaws in Artifactory, ScreenConnect, and RouterOS to KEV Catalog
- Dutch NCSC warns of imminent exploitation of critical Check Point VPN flaws
- GitLab Releases Patch for Critical Vulnerability Already Targeted by Active Exploitation Attempts
- Critical Artifactory Vulnerabilities Enable Backdoor Deployment in Supply Chain Attacks
- Critical GitLab Flaw Exploited Within 24 Hours of Public Disclosure
- GitLab Issues Critical Alert to Patch Maximum-Severity Path Traversal Vulnerability
- Check Point Releases Patches for Critical VPN Vulnerabilities
- JFrog Artifactory Vulnerability Chain Enables Admin Control and Backdoor Installation
- China-Linked Hacking Group Exploits Text Input Software Vulnerability to Install Backdoor
- PaperCut Replaces Emergency Patches With Maintenance Releases for Actively Exploited Vulnerabilities
- Three Threat Clusters Exploit Critical Cisco FMC Flaws to Steal Credentials and Deploy Qilin Ransomware
- Cisco FMC Vulnerabilities Exploited by Ransomware Groups and State-Sponsored Threat Actors
- New Zero-Day Exploit for Windows Defender Attributed to Disgruntled Researcher
- Cyber-espionage Groups Deploy 'BlueMoon' Kit Exploiting Windows and Chrome Zero-Days
- Check Point Patches Critical VPN Certificate Flaws Enabling Unauthenticated Remote Code Execution
- CISA Orders Urgent Patches for Cisco, Citrix, and Fortinet Flaws by September 12
- Critical Finding: One in Ten Exposed LiteLLM Servers Use Default Admin Key from Documentation
- Cisco Confirms Critical Firewall Management Center Flaw Under Active Exploitation
- Skullcandy Dime 3 earbuds vulnerable to Bluetooth hijacking without user confirmation
- Security Flaw in DeepSeek Harness Allows AI Agents to Disable Their Own Sandbox Protection
- Critical Flaw in Alby Hub Could Allow Attackers to Seize Internet-Exposed Bitcoin Wallets
- Over 36,000 Exposed Plex Servers Remain Unpatched Against Security Flaws
- Google Patches Critical V8 Vulnerability in Chrome Under Active Exploitation
- Critical cPanel Vulnerability Allows Mail-Privileged Accounts to Execute Code as Root
- F5 BIG-IP Malware Injects PHP Web Shell Into Memory to Evade Detection
- Critical vulnerability in Microsoft Defender allows system-level access
- Researcher Discloses Proof of Concept Bypassing Microsoft Defender Patch
- Google Releases Patch for Seventh Chrome Zero-Day Actively Exploited in 2026
- SAP Patches Critical Remote Code Execution Flaw Without Authentication Required
- Microsoft Releases Record 974 Security Patches, Including Two Actively Exploited Windows Zero-Days
- CISA alerts on critical N-able N-central flaw actively exploited in the wild
- Microsoft Sets New Record With 974 CVEs in September Patch Tuesday
- Microsoft September 2026 Patch Tuesday addresses record 966 vulnerabilities, including two actively exploited zero-days
- ChatGPT Vulnerability Allows Attackers to Steal Gmail Data via Hidden Prompt Injection
- WeChat Zero-Click Worm Discovered to Hijack Accounts via Incoming Calls
- FreeIPA Vulnerability Chain Allows Unauthenticated Clients to Create Admin Credentials
- Adobe Patches Critical Magento Vulnerability Being Actively Exploited to Deploy Backdoors
- Critical Zero-Day in Magento Actively Exploited to Deploy Linux Backdoors
- Telerik UI Padding-Oracle Flaw Chained to Unauthenticated Remote Code Execution
- N-able Releases Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Vulnerability
- N-able Releases Emergency Patch for Critical N-central Vulnerability
- MikroTik Routers Under Attack: Exposed SSH Access Allows Full Administrative Control Without Authentication
- Zero-Day Vulnerability in Magento and Adobe Commerce Exploited to Deploy Backdoors
- JetBrains Suffers Cadence Breach After Unpatched TeamCity Vulnerability Exploited
- Broadcom Patches Critical VMware Workstation and Fusion Flaw Enabling Host Code Execution
- OpenAI Admits Failure to Disclose Incident Where Rogue AI Agents Hijacked German Wiki
- Threat Actors Exploit PaperCut Vulnerabilities to Steal Credentials from Educational Institutions
- Critical Citrix NetScaler Authentication Bypass Actively Exploited in Attacks
- PostgreSQL Patches 12-Year-Old Logical Decoding Vulnerability Allowing Replication-Role Code Execution
- CrowdStrike Falcon Zero-Day Vulnerability Enables Privilege Escalation to SYSTEM Level
- Google Releases Emergency Patch for Critical Chrome Zero-Day Under Active Attack
- Over 440,000 Exploitation Attempts Targeting Critical WordPress Plugin Flaws
- Plex Issues Urgent Updates for Multiple Undisclosed Security Vulnerabilities
- Google Releases Emergency Patch for Critical V8 Vulnerability in Chrome Under Active Exploitation
- HPE Releases Patch for Critical ArubaOS-CX Remote Code Execution Vulnerability
- Cisco Discloses Critical Nexus 9000 Flaw Enabling Unauthenticated Remote Code Execution as Root
- Researcher Discloses Privilege Escalation Vulnerability in CrowdStrike Falcon
- CISA Adds Seven Security Flaws Under Active Exploitation to Vulnerability Catalog
- Critical Zero-Day Vulnerabilities in SonicWall SMA 1000 Allow Unauthenticated Remote Code Execution
- AI Coding Agents Vulnerable to Arbitrary Code Execution via Malicious Git Configurations
- SonicWall releases patches for two zero-day vulnerabilities affecting SMA 1000 appliances
- GeoNetwork Patches Critical Unauthenticated RCE Chain Affecting Government Geospatial Backends
- Attackers Exploit Critical Sangoma Switchvox Vulnerability to Execute Remote Code Without Authentication
- SonicWall Issues Alert on Actively Exploited SMA1000 Zero-Day Flaws
- Critical Artifactory Vulnerability Allows Unauthenticated Admin Access
- Critical Langflow Vulnerability Under Active Exploitation as Threats to AI Platform Escalate
- Critical Langflow Vulnerability Exploited to Steal OpenAI and AWS Credentials
- JFrog Artifactory Critical Flaw Exploited Days After Public Disclosure
- Recently Patched PaperCut Vulnerabilities Exploited in Active Data Theft Campaigns
- Threat Actors Exploit Critical Vulnerabilities in Langflow and Ruby on Rails
- Five Critical WordPress Plugin and Theme Vulnerabilities Enable Site Takeover and Remote Code Execution
- Critical Cosmos EVM Module Flaw Exploited to Drain Funds Across Multiple Blockchains
- PaperCut Releases Second Emergency Patch After Initial Fixes Bypassed
- Critical WordPress donation plugin flaw allows unauthenticated remote command execution on servers
- Attackers Chain Two PaperCut Vulnerabilities to Execute Code Without Authentication
- Critical ownCloud Flaw Exploited to Steal Nuclear Records from Philippine Research Institution
- Over 8,300 Gitea Servers Remain Vulnerable to Active Remote Code Execution Attacks
- Two Critical Flaws in Unitree G1 EDU Humanoid Robots Enable Root Remote Code Execution
- ServiceNow Patches Three Critical Flaws Allowing Unauthenticated Remote Code Execution
- ZBT Routers Made in China Ship With Two Factory Backdoors Granting Unauthenticated Root Access
- ServiceNow Releases Patches for Three Critical AI Platform Vulnerabilities
- cPanel Releases Patch for Critical Flaw Enabling Full Server Root Access to Hosting Customers
- PaperCut Warns of Active Zero-Day Exploitation Affecting Print Management Software
- PaperCut alerts to active exploitation of zero-day vulnerability in print management systems
- Vercel Patches Two Critical Next.js Vulnerabilities Enabling Unauthenticated Remote Code Execution
- Amazon Kiro Vulnerability Allows Data Theft via Prompt Injection
- CISA Orders U.S. Federal Agencies to Patch Critical Citrix NetScaler Flaw
- Researchers Uncover Rowhammer Attack Compromising NVIDIA Professional GPUs
- CISA Adds Six Actively Exploited Flaws to KEV Catalog, Including NetScaler, Linux, and SQL Server Vulnerabilities
- Critical Avada WordPress Theme Vulnerability Allows Unauthenticated Remote Code Execution
- GPUThor Attack Bypasses NVIDIA ECC Protections to Achieve Root Access
- Two Unpatched Critical Flaws Discovered in Kaltura Video Player
- Active Exploitation of Critical Gitea Flaw Delivers Cryptominer Payload
- Critical Vulnerability in NVIDIA NemoClaw Allows Poisoning of Local AI Models
- Marimo Patches High-Severity Flaw Allowing MCP Command Execution Before Notebook Load
- Attackers Exploiting Critical SAML Plugin Vulnerabilities to Gain WordPress Admin Access
- Critical Oracle WebLogic Flaw Under Active Exploitation Grants Unauthenticated Remote Access
- Unpatched Calix Vulnerability Allows Attackers to Bypass NAT and Expose Internal Devices
- WordPress Sites Under Attack: Critical Authentication Bypass Flaws in miniOrange Plugin
- Critical Keycloak Vulnerability Enables Unauthenticated Attackers to Hijack User Accounts
- Emerging Industrial Protocol Exposes Operational Control Systems to New Security Risks
- Microsoft Defender's Own Driver Discovered as Potential Security Threat
- CISA Orders U.S. Federal Agencies to Patch Actively Exploited TrueConf Server Vulnerabilities
- Microsoft Patches Critical Entra ID Flaws Under Active Exploitation
- Cisco Releases Patches for Nine Crosswork and Secure Workload Vulnerabilities, Five with CVSS 10.0 Severity
- Critical GitLab Vulnerability Being Actively Exploited Days After Public Disclosure
- Critical Flaw in Microsoft Entra ID Enables Remote Code Execution
- Passportal vulnerability exposes password vault master keys despite patch
- Critical Elementor Pro Vulnerability Enables Remote Code Execution on WordPress Sites
- New Injection Technique Allows Attackers to Steal Grok Chat Session Data
- Critical isolated-vm Vulnerability Enables JavaScript Sandbox Escape for Code Execution
- Citrix Releases Patches for Critical Authentication Bypass in NetScaler
- Critical Zimbra Flaw Allows Unauthenticated Remote Code Execution
- Citrix urges admins to patch critical NetScaler vulnerabilities immediately
- Attack Allows Expired Visa Cards to Be Reactivated for Contactless Payments
- NASA AIT-GUI Flaws Allow Unauthenticated Attackers to Issue Spacecraft Commands
- Critical Flaw in Elementor Pro Allows Unauthenticated Attackers to Upload PHP Files
- Spectre Attack Against Cloudflare Workers Extracts JWT Tokens at Increased Speed
- CISA Adds Four Critical macOS, SharePoint, and vCenter Vulnerabilities to Exploited List
- Clop-Linked Web Shell Found Decrypting Credentials in Compromised Windchill Servers
- Critical GitLab Zero-Click Vulnerability Complicates Detection in Self-Managed Deployments
- Microsoft Copilot Vulnerabilities Allow Single-Click Data Exfiltration from Connected Apps
- Critical Flaws in MLflow and FUXA Come Under Active Attack
- CISA Alerts on Critical Ray Vulnerability Under Active Exploitation
- GitLab Releases Patch for Critical Vulnerability Allowing Unauthenticated Project Deletion
- Snowflake GitHub Actions Vulnerability Allows Command Injection via Crafted Issues
- Critical Forminator WordPress Plugin Flaw Enables Unauthenticated Remote Code Execution
- MCP Servers: An Open Door to Enterprise Secrets in AI Environments
- Unisoc Modem Exploit Chain Via VoLTE Enables Full Android Kernel Access
- China-Linked Threat Actor Exploits Critical VMware vCenter Flaw to Deploy Babuk-Derived Ransomware
- Critical SAP Commerce Cloud Vulnerability Already Under Active Exploitation
- Critical macOS Screen Sharing Flaw Actively Exploited to Deploy Monero Miners on Internet-Exposed Systems
- macOS Authentication Bypass Vulnerability Exploited to Deploy Monero Mining Malware
- Critical SAP Commerce Cloud Vulnerability Now Under Active Attack
- Researchers Expose Chrome DevTools Technique for Session Hijacking on Windows Browsers
- Active Exploitation Discovered for Critical Unpatched GeoServer Vulnerability
- Global threat campaign exploits critical VMware vCenter vulnerability
- Unpatched GeoServer Flaw Enables Remote Code Execution Amid Active Exploitation
- Microsoft Patches LegacyHive Critical Windows Vulnerability
- Critical VMware vCenter Flaw Actively Exploited to Deploy Reverse SSH Access
- Critical vulnerabilities in Belgian eID browser extension expose citizen accounts to remote code execution
- Attackers Actively Exploit Critical SharePoint Vulnerability After PoC Publication
- Attackers Exploit Critical Adobe Commerce Vulnerability to Hijack Customer Accounts
- Lazarus Exploits Critical Windows Flaw to Deploy Backdoor in Defense and Aerospace Sectors
- "Plug and Pwn" Attacks Exploit Fake USB Devices to Gain Windows Administrator Access
- Flaw in OpenAI, Anthropic, and Google APIs Exposes Internal AI Model Reasoning
- Adobe Releases Patches for Critical CVSS 10.0 Vulnerabilities in ColdFusion and Campaign Classic
- Threat Actors Actively Exploit Critical VMware vCenter Vulnerability for Persistent Remote Access
- SAP Releases Patch for Critical Commerce Cloud Vulnerability Allowing Unauthenticated Code Execution
- Microsoft Defender Patch Bypass Demonstrated Requiring System-Level Access
- Cisco Alerts on Critical ASA and FTD Vulnerability Under Active Exploitation
- Microsoft Releases Critical August Patches Featuring Severe DNS Vulnerability
- Microsoft Patches Nearly 400 Vulnerabilities in August, Including One Under Active Attack
- Microsoft Patches 398 Flaws Including Windows Kernel Driver Under Active Exploitation
- Zoom Annotation Flaws Allowed Meeting Participants to Hijack Each Other's Systems
- Researchers Uncover SharePoint Exploitation Chain With AI Assistance Enabling Unauthenticated Remote Code Execution
- Malicious SIM Cards Can Execute Code on Cellular Modules in IoT Devices
- Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Accidental Leak
- Researchers Discover Privilege Escalation Chain in Windows 11 via Plug and Play
- Critical Metabase Flaw Enables Unauthorized Remote Admin Access Across Analytics Deployments
- Ransomware Groups Now Actively Exploiting Critical SonicWall SMA1000 Vulnerabilities, CISA Confirms
- Researchers Expose Methods to Compromise Passkeys Without Breaking Underlying Cryptography
- CISA Warns of Active Exploitation of Critical Progress LoadMaster Vulnerability
- Critical Flaws Found in Belgian eID Software Affecting 2 Million Users
- Hackers Compromise TrueConf Servers and Inject Backdoors into Client Installers
- Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data
- Atlassian's Rovo Assistant Vulnerable to Malicious Instructions That Exfiltrate Jira and Confluence Data
- CSS-Based Attacks Compromise Webmail Security to Steal Passwords and Session Tokens
- Metabase Critical Flaw Under Active Exploitation Grants Admin Access Without Authentication
- N-able Releases Emergency Patch for N-central as Attackers Gain Access to Managed Systems
- Critical Progress Kemp LoadMaster Vulnerability Added to CISA KEV Following 792+ Active Exploitation Attempts
- Critical SQL Injection Vulnerability in Metabase Exploited in Zero-Day Data Theft Attacks
- WordPress Fixes Critical Pre-Auth XSS Vulnerability in Login Screen Enabling PHP Code Execution
- 18-Year-Old Linux SCTP Flaw Enables Root Escalation and Container Escape
- AI-Powered Research System Uncovers Novel HTTP Desynchronization Techniques and Apache Zero-Day Vulnerability
- Bendix EC80 Brake Controller Recall Concealed Critical Security Patches
- NatJack Attacks Disclosed: Hijacking TCP Sessions Through NAT Table Manipulation
- Microsoft and Apple Release Security Patches for Critical Vulnerabilities
- Malware Can Exploit Windows Hello for Business Keys to Maintain Persistent Entra ID Access
- Flaws in Claude Code and Gemini CLI Allow GitHub Issues to Reach CI Workflow Secrets
- Google Releases Chrome 151 With Patches for Critical Security Vulnerabilities
- Swiss government SharePoint breach compromises 200 accounts
- New TONTOU CPU Attack Bypasses Spectre v2 Mitigations, Exposes Linux Password Hashes
- Critical KVM Flaw Enables L1 Guest Escape to Linux Host Systems
- Cisco Releases Patches for 12 Critical SD-WAN and IOS XE Vulnerabilities
- Researchers Discover Attack Bypassing Spectre v2 Defenses on Intel and AMD Processors
- Weak Random Number Generator in CryptoJS Behind $5.7 Million in Crypto Wallet Drains
- WebKit Flaws Enable Real IP Exposure Despite Apple's iCloud Private Relay
- Attackers Exploit SQL Injection in Oracle to Execute Code Compiled Inside Database Engine
- AWS, Google, and Vercel Patch Flaws Allowing Tool Execution in AI Agents Without Model Authorization
- Chinese Zbtlink Routers Shipped With Factory-Built Backdoor for Remote Access
- CISA Warns of Active Exploitation of Critical TeamCity Flaw
- AI-Powered Browsers Vulnerable to Zero-Click Agent Hijacking Attacks
- AI-Powered Browsers Remain Vulnerable to Prompt Injection Attacks
- CSS Exploited as New Attack Vector to Steal Webmail Data, Researchers Warn
- 15 TP-Link Vulnerabilities Undermine Zero-Trust Network Provisioning Strategy
- Google Patches Python APK Vulnerabilities Enabling Agent-to-Agent Attacks
- Paperclip AI Vulnerabilities Enable Command Execution Through Malicious Agent Imports
- Three Software Vendors Patch Critical Flaws in Veeam, Terraform, and Django
- Critical Open vSwitch Flaw Allows Local Users to Gain Root Access
- Critical Gitea Vulnerability Allows Unauthenticated File Server Access
- CISA Issues Warnings on Langflow, Tomcat, and N-central Vulnerabilities Under Active Exploitation
- TP-Link Patches Critical Vulnerabilities in Omada Device Provisioning System
- Firebase Misconfiguration Exposes Government and Corporate Video Calls Through AI Tool
- Google Removes ADK AI Workflows Following Prompt Injection Vulnerability Discovery
- cPanel Patches Critical Flaw Allowing Authenticated Users to Execute SQL as Database Root
- Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks
- CISA Adds Actively Exploited N-able N-central Vulnerability to KEV Catalog
- New Authentication Bypass Variant Discovered in N-able RMM Servers
- Bitcoin Hardware Wallet Maker Destroys Inventory After $88 Million Cryptocurrency Theft
- N-able warns of N-central authentication bypass flaw being actively exploited
- Critical Vulnerabilities Discovered in Google Password Manager Allowing Passkey-Protected Account Hijacking
- N-able Patches N-central Vulnerability Already Being Exploited in Live Attacks
- Thermo Fisher Patches Flaw Allowing Nearly Undetectable DNA File Tampering
- N-able Admits Attackers Compromised N-central Servers After Incomplete Patch Failure
- Three High-Severity Flaws Discovered in Hugging Face Diffusers Library
- COLDCARD wallet RNG flaw exposes millions in Bitcoin to theft
- Coldcard Hardware Wallet Flaw Enabled $70 Million Bitcoin Theft in 41 Minutes
- Rails patches critical Active Storage vulnerability allowing file access and remote code execution
- Rails Releases Patch for Critical Vulnerability Allowing Arbitrary File Read
- Adobe Campaign Classic Critical Flaw Enables Arbitrary Code Execution Without User Interaction
- Google Fixes Over 1,400 Vulnerabilities Across Three Recent Chrome Releases
- Researchers Uncover 84 Critical Flaws in 4G and 5G Core Networks Enabling Session Hijacking
- Google's AI Agent Discovers Long-Hidden Chrome Vulnerability After 13 Years
- Critical Azure Cosmos DB Flaw Enabled Complete Database Compromise
- Critical Remote Code Execution Vulnerability Patched in TeamCity
- JetBrains warns of critical remote code execution flaw in TeamCity
- Broadcom releases patches for three critical VMware flaws enabling authentication bypass and VM escape
- Azure Cosmos DB Vulnerability Enabled Unauthorized Access Across Customer Tenants
- Microsoft Copilot for Word Can Propagate Hidden Prompts to Generated Documents
- Critical Ruflo Vulnerability Allows Unauthenticated Attackers to Deploy Rogue AI Swarms
- Russian Threat Actors Exploit Outlook Web Access Vulnerability to Maintain Mailbox Access Post-Credential Rotation
- Critical Vulnerability in Cisco FMC Exposed to Active Exploitation
- Russian-backed group exploits Exchange OWA zero-day to establish persistent mailbox backdoors
- Cisco Alerts to FMC Static Credential Vulnerability Actively Exploited in Zero-Day Attacks
- Rails: Critical Image Upload Vulnerability Exposes Server Files
- Critical Ruflo Flaw Allows Unauthenticated Remote Code Execution
- Broadcom Fixes Three Critical VMware Flaws Enabling Authentication Bypass and Code Execution
- Critical Ruflo Platform Flaw Enables Persistent Attacks Beyond Patching
- Researchers Demonstrate How a Single Malicious Webpage Can Compromise Tor Browser
- VMware Releases Security Patches for Five Vulnerabilities in ESXi and Related Products
- Proof-of-Concept Released for Critical Check Point SmartConsole Authentication Bypass
- JFrog Zero-Day Vulnerabilities Exploited in OpenAI and Hugging Face Incident
- Gitea Releases Patch for Critical Remote Code Execution Vulnerability
- Critical Finding: Data Center Controllers Vulnerable to Brute-Force Takeover
- OpenAI Models Exploited Artifactory Zero-Days to Escape Testing Isolation
- Claude AI Discovers Vulnerabilities in Post-Quantum HAWK Scheme and Accelerates AES Attacks
- vBulletin patches critical unauthenticated remote code execution vulnerability
- Critical Flaw in Active Directory Certificates Enables Privilege Escalation
- Over 24,000 Exposed Server Management Controllers Leak Password Hashes Without Authentication
- JFrog Confirms Zero-Day Vulnerability in Artifactory Exploited by OpenAI Models
- OpenWrt Releases Critical Patch for DHCPv6 Flaw Allowing Root Code Execution
- Over 24,000 Exposed Servers Leak Password Hashes via Decades-Old BMC Vulnerability
- JetBrains Issues Critical TeamCity Alert for Unauthenticated Remote Code Execution Flaw
- Researcher Used AI to Develop Linux Privilege Escalation Exploit
- Critical Arista VeloCloud Orchestrator Vulnerability Exploited in Active Attacks
- Active Exploitation of Critical FastJson Java Library Vulnerability
- Arista releases patch for critical VeloCloud Orchestrator vulnerability under active attack
- Agentic Browsers Expose Critical Web Security Weaknesses After Two Decades of Progress
- Public Exploit Released for Critical Active Directory Certificate Services Vulnerability
- 'Confused Deputy' Vulnerabilities Found in Google Cloud and Microsoft Azure
- Public Exploit Released for Unauthenticated Code Execution Vulnerability in vBulletin
- Critical PTC Windchill Vulnerability Under Active Exploitation in Ransomware Campaigns
- n8n Patches Critical Sandbox Escape Vulnerability Allowing OS Command Execution
- Critical Fastjson Vulnerability Exploited in Active Attacks With No Patch Released
- Researcher Releases Functional Exploit for GitLab Remote Code Execution Flaw
- Cl0p-Linked Threat Actors Exploit PTC Software Vulnerabilities for Unauthenticated Remote Access
- Rockwell Automation Patches Code Execution Vulnerabilities in Arena Simulation Software
- Certighost: New Privilege Escalation Method in Active Directory
- Microsoft Fixes Azure Automation Default Setting That Enabled Cross-Tenant Identity Takeover
- Critical Flaw in ChatGPT Agents Allowed Deploying Autonomous Intruders via Phishing
- Critical Vulnerability in Bing Images Allows System-Level Command Execution
- NodeBB Patches Eight Critical Vulnerabilities Discovered by AI Tools
- Researchers Discover Critical Redis Vulnerabilities with Remote Code Execution Capabilities
- Russian State-Backed Group Exploits Zimbra Zero-Day Against US and Ukraine Targets
- Russian Espionage Group Exploited Zimbra Zero-Day to Steal Emails and 2FA Codes
- Russian Hacking Group Exploits Zimbra Flaw to Steal Email Data
- OpenAI Patches ChatGPT Agent Vulnerability Allowing Remote-Controlled AI Insertion
- Sandbox Escape Vulnerability Discovered in Claude Cowork Compromising Mac Files
- Critical Linux Kernel Flaw Enables Privilege Escalation on RHEL Systems
- Check Point Releases Patches for Critical SmartConsole Vulnerability Under Active Exploitation
- Researchers Discover Passkey Implementation Flaws in Microsoft Systems
- Critical snap-confine Flaw in Ubuntu Enables Privilege Escalation to Root
- Adobe Acrobat Extension Flaw Enabled Unauthorized Access to WhatsApp Web Data
- Windmill Platform Suffers Active Exploitation of Unauthenticated File Read Vulnerability
- Critical Azure DevOps Flaw Allows Hidden Command Injection to Hijack Code Review Agents
- Critical SharePoint Vulnerability Actively Exploited to Steal Authentication Keys
- Apple Fixes Hide My Email Vulnerability That Exposed Users' Real Email Addresses
- Critical Flaw in AWS Tool Allows Remote Code Execution via Malicious Web Pages
- Active Exploitation of Critical SharePoint Vulnerability Detected
- Zimbra Releases Patches for Critical SNMP and Command Injection Vulnerabilities
- Variable Risks in AI-Generated Code: Framework Compatibility Is Key
- Open Source AI Agents on Android Could Enable Code Execution on Host Computers
- The Race Against Time: Vulnerabilities Exploited Within Hours of Patch Release
- Critical WordPress Vulnerabilities Spark Wave of Mass Exploitation Attempts
- Free Unofficial Patches Released for Critical Windows Vulnerability
- Critical Vulnerability in ServiceNow AI Platform Exploited for Unauthenticated Code Execution
- Vulnerabilities in SonicWall SMA1000 Devices Exploited to Deploy Custom Malware
- Critical WordPress Vulnerability Exposes Millions of Sites to Remote Takeover
- Popular AI Tools Vulnerable to Sandbox Escape via File Execution
- Weekly roundup: Remote code execution in WordPress, critical SonicWall vulnerabilities, and attacks on AI services
- Active Exploitation Discovered in Critical Flaw Within ServiceNow's Artificial Intelligence Platform
- Critical Vulnerability Discovered in 7-Zip Enabling Code Execution via XZ File Extraction
- F5 Patches Critical NGINX Vulnerability Enabling Worker Crash and Remote Code Execution
- Cybercriminal Group Exploits Critical SonicWall VPN Vulnerabilities Before Public Disclosure
- Authentication Bypass in n8n Enables Access to Other Users' Accounts
- CISA Adds Critical SharePoint Vulnerability to Active Threats List
- OpenSSL Flaw Discovered That Exhausts Server Memory with Minimal TLS Requests
- Critical WordPress Vulnerability Enables Unauthenticated Remote Code Execution
- 7-Zip Releases Security Patch to Close Critical Remote Code Execution Vulnerability
- Public Exploits Available for Critical Remote Code Execution Vulnerabilities in WordPress
- Unpatched Shark Robotic Vacuum Vulnerability Enables Remote Device Control Within AWS Region
- Zoom Patches Critical Windows Flaw Allowing Account Takeover
- Researchers Discover Vulnerable Bootloaders That Bypassed Secure Boot Protections
- Vulnerability Discovered in Claude Allowed Automatic Malicious Prompt Injection to AI Agents
- Mozilla, Chrome, Adobe, and VMware Release Security Patches for Critical Vulnerabilities
- Two-Click Vulnerability Allows Compromise of Development Environments
- Researcher Publishes Proof-of-Concept for Critical Windows User Profile Service Vulnerability
- Critical Vulnerability in Cursor Allows Unauthorized Code Execution on Windows
- SonicWall Warns of Two Unpatched Critical Vulnerabilities in SMA 1000 Appliances
- Microsoft Releases Patches for Record-Breaking Number of Vulnerabilities in July Update
- Microsoft Releases Its Largest Security Update With Patches for 622 Vulnerabilities
- 6 GHz Wi-Fi Vulnerabilities Could Compromise Critical Systems
- Microsoft Releases Record 570 Security Patches in Largest Update Campaign
- SAP Releases Patches for Critical NetWeaver ABAP Vulnerability Scoring 9.9
- Vulnerability Discovered in Claude Chrome Extension Allowing Malicious Add-ons to Access Gmail and Google Drive
- Cursor IDE Remains Vulnerable to Automatic Malicious Code Execution in Compromised Repositories
- Microsoft releases June 2026 patch with record-breaking 200 vulnerabilities fixed
Ransomware (65)
- UK School Estate Affected by 3AM Ransomware in Suspected AI-Assisted Attack
- Synology NAS Devices Targeted in Ransomware Attacks Exploiting Previously Patched Flaw
- Synology alerts customers to escalating C3RB3R ransomware attacks on NAS devices
- Malicious Claude Code Extension on Cursor Deployed SSH Backdoors to Thousands of Developers
- Nefilim and Hive Ransomware Affiliate Sentenced to Nearly Six Years in Prison
- GMO advises customers to disconnect systems as ransomware attack looms
- Ransomware Attack on University of New Mexico Health System Disrupts Patient Care and Surgeries
- U.S. Cybersecurity Agency Reports Over 600 Critical Infrastructure Organizations Hit by SafePay Ransomware
- Compromised Rank Math WordPress Plugin Distributes Backdoors to Affected Sites
- Federal investigators suspect ransom negotiator operated ShinyHunters extortion website
- Ransomware Groups Escalate Tactics with Physical Threats and Employee Family Targeting
- Ransomware attack disrupts Japanese cloud provider serving government clients
- Engineer Sentenced to Over Two Years in Prison for Ransomware Attack on Employer Network
- Threat Actors Exploit Realtek SDK Flaw to Deliver Cling Botnet With STUN-Based Command Channel
- Warlock Exploits SharePoint Vulnerabilities to Disable Security Defenses and Deploy Ransomware
- China-Linked Warlock Ransomware Group Exploits SharePoint Vulnerabilities Targeting Critical Infrastructure
- Ransomware attack forces Vicksburg, Mississippi to shut down government systems
- Warlock ransomware group targets critical infrastructure in Portugal and Spanish-speaking countries
- Alleged KillSec Ransomware Leader Arrested—A 16-Year-Old Suspect
- Spanish Police Arrest 16-Year-Old Suspect Running KillSec Ransomware Gang
- Warlock: The Chinese ransomware targeting large organizations in Spain and Portugal
- South Africa Seeks Assistance Following Ransomware Attack on Air Traffic Control
- Ransomware attack hits Keio railway operator's systems in Japan
- JadePuffer Ransomware Operators Deploy Agentic AI to Attack Azure and Destroy Cloud Infrastructure
- Compromised GitHub Actions Resume Mini Shai-Hulud Malware Distribution
- Ryuk Ransomware Member Sentenced to 24 Months in Prison
- ShinyHunters Breaches Clop, Exposing Ransomware Victims to Fresh Extortion Threats
- Beyond the Ransom: The Full Financial Impact of Ransomware Attacks
- Ukrainian Conti Ransomware Developer Sentenced to Four Years in U.S. Prison
- New Android Malware Combines Ransomware and Spyware to Encrypt Files and Steal Data
- CISA Warns of Active Exploitation of Critical WatchGuard Firewall Flaw by Ransomware Groups
- Over 5,400 compromised websites distribute ClickFix malware via blockchain
- StreamRat Banking Trojan Distributed via Fake Streaming Ads on Meta Targeting Spanish-Speaking Users
- U.S. ATF Regulatory Agency Confirms System Compromise Following Qilin Ransomware Attack Claims
- Group Offers to Delete Stolen Data from Ransomware Servers for a Fee
- Akira Group Disables Security Defenses Using Safe Mode to Steal Data
- Ransomware Attack Strikes Colombian Justice Ministry Ahead of Presidential Transition
- Gunra Ransomware Group Exploits Fortinet Vulnerabilities to Bypass Multi-Factor Authentication
- DeadLock Leverages Polygon Smart Contracts to Strengthen Extortion Infrastructure Resilience
- Gunra Ransomware Operators Exploit Fortinet Vulnerabilities to Breach Critical Infrastructure Worldwide
- Former Medusa Affiliate Deploys New StormEncryptor Ransomware
- Chinese-Linked Group Deploys New StormEncryptor Ransomware Leveraging N-central Vulnerability
- Head Mare Threat Group Exploits TrueConf Vulnerabilities to Infect Russian Servers
- Ransom Cartel Creator Sentenced to 16 Years in Prison for Ransomware-as-a-Service Operation
- Ransom Cartel Ransomware Creator Sentenced to 16 Years in Prison
- 18 Malicious npm Packages Delivering Cross-Platform RAT to Alibaba Tool Users Discovered
- INC Ransomware Group Intensifies Attacks Exploiting SonicWall VPN Vulnerabilities
- River Bank Confirms Attackers Deleted Stolen Data in Ransomware Incident
- Ransomware gang exploits recent SonicWall vulnerabilities for privileged access
- Microsoft Teams Vishing Attacks Enable Chaos Ransomware Deployment
- Health System in South Carolina and Georgia Closes Offices Following Malware Attack
- Coca-Cola Confirms Data Theft in Fairlife Ransomware Attack
- Coca-Cola Confirms Data Breach Following Fairlife Ransomware Attack
- ClickFix Attacks on Steam Forums Infect Gamers with XMRig Cryptominers
- DevMan Expands Ransomware-as-a-Service Infrastructure with Centralized Portal
- Clop Intensifies Attacks Against PTC Product Management Systems
- Ransomware Attack Disrupts Japanese Frozen-Food Distribution Network
- Anubis Group Claims Fairlife Coca-Cola Attack, Threatens to Release Corporate Data
- Qilin Ransomware Group Exploits Palo Alto Networks Authentication Flaw
- Qilin ransomware group exploits critical flaw in Palo Alto VPN
- New ENCFORGE Ransomware Targets AI Model Files
- JadePuffer Expands Autonomous Attacks to Encrypt AI Data and Models
- Armenia Detains Russian Tourist at US Request Over Alleged REvil Group Links
- Ransomware Group Exploits Critical Vulnerabilities in SonicWall Remote Access Appliances
- Identity Attacks Surpass Exploits as Leading Ransomware Cause
Data breaches (227)
- DreamHost Confirms Data Breach Exposing FTP Credentials and Webmail Sessions
- NIKKE Game Launcher Compromised in Supply Chain Attack Spreading Malware
- mSecure Password Manager Breach Exposes Encrypted Customer Database
- WorkOS Discloses Security Incident After Unauthorized Access to Internal Sales Application
- Binance Discloses Fake Job Interview Led to $6.3 Billion Cryptocurrency Theft
- mSecure Alerts Users to Change Passwords and Reset 2FA After Suspicious Activity Detected
- Chainstack blockchain infrastructure provider suffers breach exposing customer data and authentication credentials
- Binance Exposes $6.43 Billion Theft: Fake Job Interviews, AI Tool Abuse, and Compromised Installation
- cPGuard Update Channel Compromised to Deploy Backdoors and Harvest Password Hashes on Linux Servers
- Harvard University breach compromises data from over 850,000 accounts
- Chainalysis Reports Data Breach Following AI-Powered Cyberattack
- Polymarket Refunds $3.9 Million to Traders Following DNS Hijacking at DebugBear
- 2.7 Million Dollar Theft at Polymarket Through Compromised Script
- Northflank hosting platform hit by breach compromising customers' AI API credentials
- Chainalysis Discloses Data Breach from 'Offensive Agentic Techniques'
- Chainalysis Reports Unauthorized Access to Customer Data in Security Incident
- Developers Targeted by Trojanized Claude Extension in Cursor
- Resolve Fashion Retailer Confirms Payment Card Data Breach
- Supply Chain Attack Drains $2 Million+ from Polymarket Traders
- Binance Attributes $6.3 Billion Crypto Theft to Compromised DevOps Engineer's Laptop
- Binance reports security breach affecting $6.3 billion in digital assets
- Binance Investigates Potential $5.8 Billion Cryptocurrency Theft
- Japan Airlines hit by third-party data breach affecting passenger records
- Polymarket Suspends Trading Following Malicious Script Deployment Through Third-Party Service
- Researcher Uncovers 26,400 Active Credentials Exposed in Public Gitee Repositories
- Sony ISP subsidiary data breach exposes 2.5 million customer records
- GMO Internet Offers $1 Million Bounty for Information on Cloud Service Attackers
- Cybercriminals Compromise Convertr Analytics Script to Harvest Payment Card Data
- Warp Discloses Breach Exposing AI Agent Logs and User Telemetry Data
- Keystone to Destroy Nearly 19,000 Wallets Following Security Key Breach
- Energy Giant ENGIE Discloses Customer Data Breach Following Partner Platform Compromise
- University of Copenhagen data breach exposes information on 525,000 individuals
- South Korean Police Dismantle Cybercrime Network Using ARTEX AI Pentesting Tool to Steal Millions of Records
- DreamHost Mandates Password Resets Following Security Incident
- Campaign Infects Nearly 1,000 Online Stores with Scanner-Evading Malicious Code
- Leaked LiteLLM Master Key Exposed in Public Repository Enabled Attackers to Compromise Release Pipeline
- Quest Diagnostics Confirms Patient Records Exposed in Data Breach
- Quest Diagnostics Reports Potential Data Theft Following Lab Service System Attack
- Capcom Suffers Breach Exposing 11 Million Email Addresses
- Quest Diagnostics Suffers Data Breach Exposing Patient Records Through Unauthorized Platform Access
- LiteLLM Supply Chain Attack Exploits Compromised GitHub OAuth Credentials
- State Bank of India Suffers Customer Personal Data Breach
- Railway Warns Developers to Rotate Secrets Following Suspicious Activity
- Toronto crime tips organization suspends operations following data breach disclosure
- Capcom confirms data breach exposing 11.7 million account credentials
- LiteLLM Supply Chain Compromised to Distribute Credential-Stealing Malware
- Railway warns of unauthorized access to customer environment variables
- LiteLLM Warns of GitHub Token Leak Following Malicious Package Injection
- Japan's Onamae Desktop Cloud suffers massive breach affecting nearly 27,000 customer servers
- TiDB Breach Reveals Blind Spots in Shared Cloud Security Models
- Supply Chain Attack Compromises LiteLLM Library with Credential Stealer and Backdoor
- Threat Actors Exploit Compromised UpdraftCentral Keys to Deploy Backdoors on WordPress Sites
- State Bank of India Confirms Data Breach Affecting Nearly 4,000 Customers
- Zeabur Shutting Down After Second Security Breach in Two Months
- Ex-OpenAI Engineer Arrested for Installing Hidden Recording Device
- ConnectWise Strengthens Security After Incident Compromising Cloud Backup Credentials
- Nikkei discloses third data breach in a month, 1.8 million records exposed
- ConnectWise Disables Cloud Backups Following Unauthorized Microsoft 365 Tenant Access
- OpenCode Breach Exposes User API Keys
- Rank Math PRO WordPress Plugin Compromised with Self-Restoring Backdoor
- OpenCode Console Breach Exposes API Keys for Major AI Providers
- ConnectWise Disables Application Identities Following Microsoft 365 Tenant Compromise
- ConnectWise Disables Cloud Backup Service Following Supply-Chain Attack Compromising Microsoft 365 Tenants
- Attackers Exploit Compromised ConnectWise Credentials to Access 173 Microsoft 365 Tenants
- Russian police detain suspected DataSuckers members following restaurant chain breach
- Anne Arundel County, Maryland Confirms Data Breach Following Ransomware Attack
- Burger King Japan Breach Exposes Data of Over 11 Million Customers
- GhostAction Campaign Compromises Nearly 1,900 GitHub Accounts, Targeting Over 30,000 Repositories
- Ledger Halts Sales Across Asia Following Supply-Chain Tampering Incident
- U.S. Dismantles Over 40 Laptop Farms Linked to North Korean IT Worker Fraud Scheme
- UK Housing Ombudsman Service Investigates Security Incident Involving Third-Party IT System
- Microsoft subsidiary Xandr hits with record €8.6 million fine for leaking sensitive user data
- Norway fines Microsoft ad subsidiary $9.6 million over unauthorized Grindr user data sharing
- Ledger Confirms Malicious Chip Implant in Southeast Asian Distributed Devices
- Ledger Halts Sales Through Distributor After Discovering Unauthorized Hardware Implant in Wallets
- Malware at Japanese contractor exposes 8.7 million karaoke user records
- ASOS Breach Exposes Critical Vulnerabilities in Customer-Facing SaaS Applications
- FBI Arrests Another Suspect Connected to ShinyHunters Group Following FBI Jobs Portal Breach
- iRhythm biosensor firm notifies states of data breach affecting hundreds of thousands
- Belarusian Hacktivists Confirm Extended Access to Russian Moscow Health Department Network in 2023
- Hackers Hijack ccTLDs and Issue Fraudulent HTTPS Certificates for Google Properties
- Japan Reports Significant Rise in Data Breaches Through Mobile API Exploitation and Known Software Vulnerabilities
- Maryland Hacker Convicted for $53 Million Uranium Exchange Theft
- ASOS Confirms Personal Data Access Following Social Engineering Attack
- Tensorlake npm Package Compromised to Distribute Credential-Stealing Malware
- Attackers Hijack Google Domains by Compromising Country-Code Registry Operators
- Advantest Confirms Personal Data Theft in Ransomware Attack
- ASOS Confirms Data Breach After Unauthorized In-App Notifications
- FBI Removes Accenture Contractor Following ShinyHunters Breach Linked to Patching Failure
- Denmark: Attackers Accessed CPR Registry Data for 8.8 Million People
- Denmark's population registry breach compromises personal data of 8.8 million people
- South Korea Investigates Bank Breaches Amid Suspected AI-Powered Attacks
- Danish technical university DTU breach exposes data of up to 200,000 individuals
- Frontline Education breach exposes school district employee data
- Massive breach in Pentagon human resources system exposes data of over 3 million service members
- Over 543,000 Valid Credentials Exposed in Public GitHub Repositories
- AI Coding Agents Leak Thousands of Internal Images to Public GitHub Repositories
- French Tax Authority Data Breach Using Compromised Employee Credentials Remained Undetected for Seven Weeks
- Times Car Confirms Data Breach Affecting 6.6 Million User Accounts
- Over 16,000 Supabase databases expose sensitive data due to misconfiguration
- Bitget Loses $388 Million Through Third-Party Security Product Vulnerability
- Malicious Extension Disguised as Ad Blocker Infected Millions of Chrome Users
- Over 80,000 Organizations Exposed AI Credentials Through Infostealer Theft
- Bitget Resumes Bitcoin Withdrawals Following $387.5 Million Cryptocurrency Theft
- US Army veteran sentenced to nearly six years in prison for extorting technology and telecom companies
- OpenAI's AI agents accidentally uploaded user images to external servers without authorization
- U.S. Army Soldier Sentenced to Nearly Six Years for Telecom Carrier Hacks
- North Korea Suspected in $351 Million Bitget Cryptocurrency Heist
- Rydox Marketplace Admin Pleads Guilty, Faces 22 Years in Prison
- Bitget Cryptocurrency Exchange Suffers $351.6 Million Theft Linked to Suspected North Korean Hackers
- Bitget Loses $351.6 Million in Crypto Exchange Breach Attributed to North Korean Hackers
- TeamFiltration Campaign Compromises Microsoft 365 Accounts via Default Credentials
- Threat actors use malicious AI agents to steal 600K credit cards across 100+ retail sites
- ShinyHunters Claims to Have Compromised FBI Systems and Stolen Agent Data
- Sweden Fines IT Provider Miljödata for Security Gaps Exposing 2.2 Million Records
- Shai-Hulud Attack Compromises CrowdSec's Private Repositories Via Stolen OAuth Token
- BigCommerce Notifies Merchants of Data Breach Linked to Ribon Apps
- TanStack Supply Chain Attack Led to Breach of 170 CrowdSec Private GitHub Repositories
- Gyazo data breach: 23.6 million user records stolen via server vulnerability
- AI Agent Compromised Spanish Organization and Altered Personal Data
- Brevo Supply Chain Attack Injects Malicious Scripts on Customer Websites
- Gyazo Security Breach Exposes 23.62 Million User Records
- Spanish Data Protection Authority Reports First AI-Powered Data Breach
- CenterPoint Energy Confirms Customer Data Stolen in Cyberattack
- Flaw in Japan's Digital Agency VPN exposes 246,000 government employee records
- Twitch Extension with Thousands of Downloads Leaks User Authentication Tokens
- HBO Max's Reddit Account Compromised to Distribute ClickFix Malware Through Ads
- Revolut Discloses Data Breach Exposing Financial Information and Passport Documents
- Malicious Twitch Extension Compromises OAuth Tokens for Nearly 31,000 Users
- Florida Confirms DMV Database Breach Through Compromised Law Enforcement Credentials
- Surfshark VPN Reveals Unauthorized Access to Internal Testing Servers
- IDScan Confirms Data Breach Following Discovery of 153 Million Stolen Driver's Licenses
- AdaptHealth Confirms Data Breach Affecting 4.1 Million People in July Attack
- Veradigm Confirms Patient Data Breach Following Third-Party Vendor Security Incident
- ShinyHunters Gang Claims Breach of Florida Driver's License Database
- Liquid Network Attackers Return Majority of Stolen Bitcoin, But Hold Millions in Reserve
- Massive breach exposes 220 million traveler records from Vietnam-linked database
- Grindr to Pay £26 Million Over Unauthorized HIV Status Data Sharing with Third Parties
- Mathspace educational platform discloses data breach impacting over one million users
- Trezor Confirms Data Breach at ShipMonk Exposed 67,000 U.S. Customers' Personal Information
- IDScan Faces Lawsuits Over Alleged Breach Affecting 153 Million Driver's Licenses
- Thomson Reuters Reports Unauthorized Access to Judicial Data in Case Management Platform
- Unpatched ownCloud Vulnerabilities Compromise Philippine Nuclear Agency
- FBI Investigates Dark Web Service Trading 153+ Million Stolen Driver's Licenses
- Security Nonprofit METR Loses $600,000 in AI Credits After Credential Theft Attack
- Aesto Health Reports Data Breach Affecting Over 9.5 Million Patients
- Novocure data breach exposes records of over 1,400 U.S. cancer patients
- Attackers Steal METR API Credentials and Drain $600,000 in AI Credits
- Attackers Steal Claude Account Sessions via Infostealer Malware
- Cronos blockchain resumes operations following $74 million Tectonic price-manipulation attack
- Manchester Airport Group suffers 86 GB data theft, hacking group claims responsibility
- Malicious Extensions on Chrome Web Store Steal Cryptocurrency and Browser Data
- McKesson Confirms Security Breach Following Alleged Theft of Patient Data by ShinyHunters
- Berlin Refuses Ransom Payment After State Network Data Breach
- Coordinated Attack by Hundreds of Autonomous Agents Compromised Hugging Face Servers
- Toy Maker Hasbro Discloses Employee Data Breach
- Manchester Airports Group Confirms Breach Exposing Traveler Data
- Los Angeles Art Museum Confirms 2025 Data Breach Exposing Personal and Medical Information
- Over 9,300 Exposed AWS Keys Remain Valid and Active
- Toronto children's hospital suffers employee and job applicant data breach
- Rust Supply Chain Attack: Malware Discovered in Three Popular Libraries
- Year-Long Scraping Campaign Compromises Salesforce and ServiceNow Customer Portals
- SafePal Exposes Data of Nearly 40,000 Customers Due to Order-Tracking Flaw
- SafePal data breach exposes information of nearly 40,000 customers
- Seven Cybercriminals Arrested for €30 Million Bank Fraud Via Service Provider Vulnerability
- Scottish Prosecutor's Office Data Breach May Extend to Multiple Government Agencies
- Shell Opens Investigation Following Clop's Data Theft Claims
- RingCentral Data Breach: ShinyHunters Compromised 1.6 Million User Accounts
- RingCentral Data Breach Impacts 1.6 Million Users
- Over 1,000 Charities Impacted by Beacon CRM Data Breach
- Data analyst sentenced to prison for stealing information and extortion
- Data Breach Affects 14,000 Trezor Customers Through Logistics Provider
- Trezor Confirms Data Breach Affecting Nearly 14,000 Customers Through Compromised Logistics Provider
- Data-theft campaign exploits Salesforce and ServiceNow customer portals
- Researchers Discover 737 Fake VPN Extensions on Chrome Intercepting User Traffic
- Malicious LiteLLM Releases on PyPI Compromised Credentials from 2,100+ Organizations
- LexisNexis Shuts Down Services After Detecting Suspicious Server Activity
- Valve Alerts Steam Hardware Customers to Data Breach at Shipping Partner
- Unlimited Technology Systems Data Breach Impacts 3.8 Million Individuals
- Levi Strauss suffers corporate data theft following social engineering attack on employees
- Unlimited Technology Systems Data Breach Impacts 3.8 Million People
- Canadian hacker pleads guilty in massive Snowflake extortion scheme
- Cybercriminal Pleads Guilty to Massive Snowflake Breaches Impacting 100 Million People
- Canadian man pleads guilty in Snowflake data-theft extortion scheme
- Thousands of n8n API Tokens Exposed in Public GitHub Repositories
- Open VSX Removes 77 Malicious Evil Twin Extensions Impersonating Developer Tools
- 77 Malicious Extensions Found Harvesting Developer Data from Open VSX
- Self-Propagating Malware Infects Over 1,300 npm Packages in Supply Chain Attack
- Madera Community Hospital Data Breach Impacts 150,000 People
- 31,000 Records Stolen in Liechtenstein Companies and Foundations Cyberattack
- Cyberattack Compromises Liechtenstein's Beneficial Ownership Registry
- Hackers Leak Data of Over 100,000 UK Police Officers and Justice Professionals
- Amgen reports patient data theft through third-party cloud system breach
- Brinks Home Confirms Data Breach Following Cybercriminal Attack
- UK Police Database Breach Exposes Officer and Government Contact Details on Dark Web
- Attackers Compromise Adform Script to Redirect Cryptocurrency Wallet Addresses
- Amgen Confirms Cloud Data Breach Exposing Patient Information and Corporate Data
- Adform ad platform compromised in supply-chain attack delivering cryptocurrency-stealing malware
- CareCloud Data Breach Compromises Information for Over 350,000 Individuals
- South Korea Penalizes Telecom Operator KT with $39 Million for Data Protection Violations
- Analog Devices Confirms Data Breach Affecting Company Networks
- ShinyHunters Claims Responsibility for Brinks Home Breach, Threatens Data Leak
- Analog Devices Confirms Unauthorized System Access and File Exfiltration
- OpenAI Compromised AI Models Affect More Services Beyond Hugging Face
- Hugging Face Breach After AI Agent Escape: Who Bears Responsibility?
- OpenAI Credentials Exposed During Hugging Face Breach Used to Compromise Accounts at Four Third-Party Services
- OpenAI AI Agent Compromised Credentials Across Multiple Services During Hugging Face Attack
- Compromised Joyfill npm Packages Distribute Remote Access Trojan
- Major data breach at medical billing company MCBS impacts over 1.2 million individuals
- Apple Sued Over Fraudulent App Store Crypto Wallet App That Stole $1.8M in Bitcoin
- ShinyHunters Claims Responsibility for Ernst & Young Data Breach via Supply Chain Attack
- OnTrac Confirms Customer Data Breach Following Security Incident
- Fast-Food Chain Chick-fil-A Suffers Data Breach Affecting Over 13,000 Customer Accounts
- Vatican's Official Prayer App Exposes Personal Data of 700,000+ Users
- Illinois Man Sentenced to Six Years in Prison for Hacking Over 750 Snapchat Accounts
- Origin Energy Data Breach Confirmed Affecting Two Million Customers
- Australian energy provider Origin confirms customer data breach
- European and US Banks Expose Customer Data Through Ad Tracking Pixels
- Estée Lauder Suffers Data Breach Following Oracle System Vulnerability Exploitation
- Ostium Trading Platform Suffers Nearly $24 Million Cryptocurrency Theft
- Hugging Face Reports Unauthorized Access to Internal Systems Following Attack by Autonomous AI Agents
- Hugging Face AI Model Platform Hit by Autonomous Agent Attack
- ACR Stealer Malware Harvests Credentials and Corporate Files via ClickFix Deception
- GoldenEyeDog-Linked Group Responsible for DigiCert Code-Signing Certificate Theft
- Seven Malicious npm Packages Found in Vite Using Blockchain Infrastructure for Command and Control
- Four Compromised AsyncAPI Packages Distribute Multilayered Botnet Malware
- CISA releases postmortem on GitHub credential leak: key lessons for security teams
Phishing and fraud (110)
- Phishing Campaign Exploits Google Calendar Invites to Hijack Corporate Sessions
- Anthropic-Impersonating Phishing Emails Evade Leading Email Security Gateways
- Fake Cryptocurrency App on Apple App Store Linked to $23K Solana Wallet Theft
- Massive Campaign: 319 Chrome Extensions Caught Hijacking User Searches
- Attackers Impersonate AI Bots to Systematically Hunt for Exposed Credentials
- Skyw4lker Device Code Phishing Campaign Exploits Legitimate Authentication Mechanisms Against U.S. Organizations
- Artificial Intelligence Makes It Easier for Attackers to Create Fake Login Pages for Account Takeovers
- Attackers Exploit Microsoft Teams to Impersonate IT Support and Distribute Malware
- Chinese National Extradited for Role in $36 Million Cryptocurrency Investment Scam
- Fraudsters Exploit Institutional Trust Through AI-Enhanced Social Engineering
- Cybercriminal Sentenced to Eight Years in Prison for Stealing $3.3 Million from US Taxpayers
- Large-Scale Microsoft Tech Support Scam Operation Exposed by Researchers
- Cybercriminals Monetize Fake Identity Documents and Deepfakes to Bypass KYC Controls
- Fake Claude and ChatGPT Impersonation Attacks Surge Against Enterprise Developers
- UAT-11985 Threat Group Leverages Fake Event Invitations to Target Taiwan Research Personnel
- Tech Support Scam Network Dismantled: Over 20,000 Cloudflare Pages Domains Hosting Fraud
- Malware Campaigns Impersonating Popular AI Products Target US Companies
- Yam Store Phishing Network Dismantled Behind Billion-Message Campaign
- Microsoft Takes Down Three Phishing Kits Behind Over 1 Billion Fraudulent Messages
- Global Law Enforcement Dismantles Network Behind One Billion Phishing Messages
- North Korea Escalates Phishing Attacks Against Ukraine for Military Intelligence
- Engineer Convicted for Cyber Extortion Scheme Targeting Industrial Company
- Cybercriminals Exploit Google Ads and Bing Redirects to Distribute Fake Claude ClickFix Malware
- Wazza Phishkit Discovered: Sophisticated Tool Targets Banks and Government Agencies
- Ransomware Recovery Company CEO Charged with Defrauding Victims
- North Carolina Musician Sentenced to 18 Months for $10 Million Streaming Fraud Using AI Bots
- Sophisticated Phishing Platform Impersonates ChatGPT, Gemini, and Claude Ad Portals
- Fake ChatGPT and Gemini Sites Steal Ad Account Credentials and MFA Codes
- Nikkei Confirms Compromise of Employee Email Accounts in Massive Phishing Campaign
- China-Linked TA419 Espionage Group Launches Phishing Campaign Against U.S. AI Policy Experts
- Scammers Breach Microsoft's Official X Account
- Microsoft's Official X Account Compromised in Cryptocurrency Pump-and-Dump Scheme
- Threat Actors Weaponize Malicious Custom GPTs to Deliver Remote Access Trojans via ChatGPT
- Phishing Campaigns Distribute MSP360 to Deploy Unauthorized Remote Access
- Star Blizzard Adopts New Phishing Tactic Against Ukrainian-Linked Targets
- Cybercriminals Abuse ChatGPT Custom GPTs to Distribute Remote Access Trojans
- US-Targeted Executive Phishing Campaign Steals Microsoft 365 Sessions and Deploys Remote Access Tools
- Fraudulent ChatGPT Variants in Search Ads Deliver Malware via ClickFix Attacks
- Former Air Force members sentenced to prison for business email compromise attacks
- Vietnamese National Charged with Money Laundering in $16 Million Pig Butchering Crypto Scam
- HR Training and Automation Emerge as Keys to Blocking IT Worker Fraud
- 'Salesbleed' Campaign Weaponizes Salesforce Agents for Slack Phishing Attacks
- Compromised Ukrainian Sites Distribute Fake Cloudflare Verification Pages to Deploy Info-Stealing Malware
- Placeholder Domain in Developer Docs Now Weaponized for ClickFix Attacks
- Cybercriminals Poison AI Chatbots to Fuel Mass Disinformation and Phishing Operations
- Microsoft Shuts Down Phishing-as-a-Service Platform Targeting Microsoft 365
- Researchers Uncover Malicious npm Package Impersonating Twilio Security Tool
- Microsoft Shuts Down EvilTokens Phishing Service Linked to 12,000 Compromised Inboxes
- SideCopy Expands Targeting of Indian Academic Institutions with ReverseRAT Spear-Phishing
- N0va: New Phishing Kit Targeting US and European Businesses
- Threat Actors Exploit Passkey Phishing to Hijack Microsoft Cloud Accounts and Steal Data
- Cybercriminals Generate 1 Million Personalized Fraud Emails in Just Three Days
- Cybercriminals Exploit Passkey and SSO Trust in Phishing Campaigns Targeting Microsoft 365
- Over 347,000 Trezor Users Targeted With Phishing Emails Following Brevo Platform Compromise
- Trezor Users Targeted in Massive Phishing Campaign Following Brevo Data Breach
- Google Play Early Access Program Exploited to Distribute Thousands of Fraudulent Apps
- Trezor Alerts Users to Email Provider Breach and Phishing Campaign
- U.S. Justice Department Shuts Down Xinbi Guarantee Scam Platform, Freezes $52.8 Million in Cryptocurrency
- Man Sentenced to 15 Years for Sextortion Using AI-Generated Explicit Videos
- Threat Actors Exploit Google Redirects in Multi-Hop Phishing Campaign
- DoppelCart fraud network operates over 119,000 fake shops to steal card data
- Cybercriminals Exploit Brazilian Government Servers for Phishing Infrastructure
- Executives Targeted Through Fake IT Help Desk Calls in Microsoft 365 Theft and Extortion Campaign
- BigBear 2.0 Phishing-as-a-Service Successfully Bypassed MFA at Over 250 Organizations
- Threat Actors Hide Phishing Lures Using Invisible Unicode Characters
- Mass Phishing Campaign Exploits Invisible Unicode Characters to Bypass Email Filters
- Large Enterprises Targeted in Fake Merger and Acquisition Scams
- ThreatsDay: CEO Phishing Kits, Dropbox Account Compromises, and OAuth Attack Chains
- United States Emerges as Primary Target in RMM Phishing Campaign Affecting 46 Countries
- Operation 'Spring Ring': Vishing Campaign Targets Microsoft Teams Users
- TerminalFix: New ClickFix Variant Spoofs Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor
- EU Governments Face Phishing Campaigns Targeting Messaging Apps
- NovaCookies Phishing Campaign Targets Microsoft 365 Session Hijacking
- AI-Powered Phishing Platform Uses Fake Apple Support Calls to Steal Device Passcodes from Theft Victims
- Attackers Abuse npm Mirrors to Host Phishing Pages Impersonating Cloudflare CAPTCHA
- AnonyMousKIT: New Automated Phishing Platform Targets iPhone Unlock Codes
- Mirage2FA Campaign Compromises Thousands of Microsoft 365 Accounts Across US and EU
- 24 npm Packages Discovered Hosting Fake Cloudflare CAPTCHA Pages via unpkg Mirrors
- ReliaQuest Blocks Data Theft Attempt Targeting Staff Through Social Engineering
- Researchers Uncover SynkLoader Malware Distributed via Microsoft Teams Phishing Campaign
- The Evolution of Phishing: When AI Agents Face Off in Email
- Large-Scale Recruitment Phishing Campaign Exploits Browser-in-the-Browser Technique to Bypass MFA
- Ukraine Dismantles 94 Fraudulent Call Centers, Seizes Millions in Cash
- Hundreds of Fake Chrome VPN Extensions Diverted User Traffic to Malicious Proxies
- UNC6671 Group Escalates Vishing Campaign Targeting Financial Services Employees
- AitM Phishing Campaign Hijacks Microsoft 365 Accounts to Target Finance and Payroll Communications
- Global Crime Syndicates Leverage AI for Large-Scale, Highly Convincing Fraud Operations
- Kali365 Exploits Microsoft Authentication to Compromise US Enterprises
- Greatness Phishing Platform Escalates Attacks on Microsoft 365 Users
- Greatness Phishing Platform Adds Device Code Technique to Bypass Multi-Factor Authentication
- Fraudulent Adobe and Zoom Updates Distribute ScreenConnect for Unauthorized Remote Access
- Device Code Phishing Attacks Surge 1,500% in 2026
- Device Code Phishing Emerges as the Fastest-Growing Threat of 2026
- Counterfeit TV Boxes Run Massive Fraud Scheme: Hijacking Connections and Spoofing Phones
- Nine-Year Fraud Campaign Spoofs Russian Company Websites to Steal Advance Payments
- Phishing campaign targeted exiled Belarusian activist and users in Russia and Kazakhstan
- Operation BlueDash: Impersonating Teams to Deploy RMM Tools
- Compromised Public Wi-Fi Gateways Exploited to Steal Corporate Credentials
- Cybercriminals Exploit ShinyHunters Leaks in $2,000 Sextortion Campaign
- Insurance Phishing Attacks Evolve Toward Real-Time Account Hijacking
- Attackers Compromise DNS on Hotel Wi-Fi Networks to Steal Microsoft 365 Credentials
- BlueNoroff Group Deploys Phishing Kit Targeting Cryptocurrency Wallets Before Malware Delivery
- Credential Stuffing Attack Compromises Chick-fil-A One Accounts
- Authorities Dismantle Kratos Infrastructure, One of the Most Widely Used Phishing Kits Targeting Microsoft 365
- Kratos Phishing Platform Dismantled Following International Arrest of Developer
- Cybercriminals Combine Advanced Evasion Techniques in Business Email Fraud Attacks
- AI-Assisted Phishing Kit Discovered Behind Unsecured Server Linked to WebDAV Malware
- Over One Million Emails Use Obfuscation Techniques to Bypass AI-Powered Security Filters
- Malicious OkoBot Framework Targets Cryptocurrency Wallets Through Phishing Injection
- Instagram Accounts of High-Ranking US Officials Compromised Through Meta Support Bot Vulnerability
Threat intelligence (649)
- Cyberattack disrupts refrigeration systems at French blood banks
- APT29 Leverages Compromised Web Analytics to Distribute Mobile Exploits
- Chinese-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
- Russian Police Arrest Three VasyGrek Members and Shut Down Criminal Network
- Attackers compromise cPGuard update infrastructure to distribute backdoor and steal user data
- Google Reports LLMjacking Attacks Generating Over $1 Million in Fraudulent Cloud AI Charges
- Google Alerts: LLMjacking Attacks Cost Enterprises Up to $1 Million
- Russia-Aligned Threat Group Exploits WinRAR Vulnerability to Steal Data
- Cyberattacks on Refrigeration Systems Hit European Supermarket Chains
- Binance Security: One Compromised Laptop Exposes Systemic Risk
- Chinese hackers deploy AI-powered penetration framework in coordinated attacks on 200+ organizations
- Fintech Platform Sageworks Forced Offline Following Suspected Cyberattack
- Google dismantles botnet infecting millions of Android TV devices with malware
- Weekly Security Roundup: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, and Android Spyware
- Google Takes Down 1.3 Million-Device Android Botnet, Accuses TV Box Maker of Selling Criminal Access
- Microsoft's AI Risk Report Overlooked Vulnerability Link Affecting Government Targets
- Iran-Aligned Group Compromises Infrastructure in Israel and Iraq
- Cyberattack disrupts refrigeration systems at European supermarket chains
- Attackers Impersonate IT Support on Microsoft Teams to Steal Corporate Data via AD CS Abuse
- Government Linux Servers Under Attack With Sophisticated Espionage Tools
- FBI Attributes $6 Billion Binance Heist to North Korea
- New VOLTA Malware Uses AI to Rank Victims by Financial Worth
- FBI Attributes $6.3 Billion Binance Cryptocurrency Heist to North Korean State-Sponsored Hackers
- U.S. Attributes $6.43 Billion Binance Cryptocurrency Theft to North Korean Hacking Group
- NetamLoader Malware Discovered Targeting Government Windows 10 Systems in Asia via .NET Injection
- US Court Sentences Syrian Hacker to Over Three Years in Prison for Coordinated Cyber Attacks
- Cloudflare Reports 38% Surge in Network-Layer DDoS Attacks During Q3 2026
- Law enforcement dismantles major international scam network
- Chinese-backed Hackers Deploy AI-Driven ARTEX Framework Against Over 200 Organizations Globally
- Trezor Alerts to Suspected Malicious Component in Hardware Wallet
- Italy Faces Wave of Cyber Vulnerabilities with No Clear Cause Identified
- Critical UEFI Flaw Affects Majority of Servers, Cloudflare AI Data Leak, and Anthropic Breach Disputes
- FBI Seizes Domain of Bulletproof Host Supporting Cybercriminals
- Syrian Hacker Sentenced to 42 Months in Prison for Attack That Triggered $136 Billion Market Plunge
- Claude Code Extension Compromised on Cursor Marketplace with Persistent SSH Backdoor
- FrostyNeighbor Threat Group Escalates Destructive Attacks in Ukraine
- Cryptocurrency Mining Campaign Returns to Hugging Face After Takedown
- Threat Roundup: Critical Firewall Flaws, Banking Trojans for Rent, and Token Theft Techniques Emerge
- AI Model Discovers Vulnerability Chains Across Major Browsers and Operating Systems
- Fake ChatGPT and Claude Apps Leverage Signed Executables to Distribute Cryptocurrency Miners
- AI Agents Already Operating in Browsers: Risks of Impersonation and Sensitive Data Access
- Underground AI Relay Disables Safety Features in Coding Tools
- Italy faces surge of cyber threats with unclear root cause
- U.S. Law Enforcement Shuts Down Bulletproof Hosting Service Linked to Ransomware and Cybercrime
- GhostAction Campaign Loses Steam but Remains Active on GitHub
- Volt Typhoon Operated Covert Network to Exploit Zero-Day Vulnerabilities
- Volt Typhoon Uses 'Silent Train' Framework to Hide Zero-Day Attacks
- Attack blast radius matters more than vulnerability scoring alone
- Anthropic's Unreleased AI Model Discovers and Chains Critical Flaws Across Browsers and Operating Systems
- Interpol's Operation Serengeti III Yields Over 1,400 Arrests Across Africa and the US
- Large-Scale Social Engineering Campaign Exploits External Teams Chats for Malware Distribution
- Software Component Lists Alone Cannot Fully Expose Supply Chain Attack Scope
- AI-Driven Hacking Campaign Against Japanese Organizations Leverages 44 Automated Agents
- Aokigahara Stealer Expands Focus to Developer Keyrings and AI Assistant Sessions
- Huntress Labs Identifies Critical Threats Targeting Businesses: Abuse of Legitimate Tools and Microsoft 365 Sessions
- Lazarus Deploys Malware via South Korean Security Software Using Post-Quantum Encryption
- Australia Takes Down Amadey Malware Backend, Restores Access to 180,000 Infected Computers
- Gheist Campaign Weaponizes GitHub Tokens to Steal Cloud Secrets
- Newly Discovered uCreator Android Spyware Intercepts Telegram 2FA Codes and Hijacks WeChat Accounts
- Token-Replay Attack Compromises 97 Microsoft 365 Accounts Across 79 Organizations
- Automated Campaign Exploits Stolen GitHub Tokens to Exfiltrate Repository Secrets
- Researchers Uncover Attempt to Trick AI Coding Agents Into Installing Malicious npm Packages
- AI Coding Agents Hijacked via Malicious File in Downloads Directory
- BlackX UEFI Bootkit Bypasses Secure Boot Using Known Vulnerability
- BlackX UEFI Bootkit Bypasses Secure Boot on Unpatched Windows Systems
- Researchers Uncover Infrastructure Used by Ransomware Affiliates Deploying AI-Driven Attacks
- AI Tools Enable Massive Attacks at Minimal Cost
- Tor Relays Compromised, Banks Detect Rogue AI Agents, Self-Replicating macOS Ransomware Surfaces
- How Caribbean Threats Cascade Into Global Cyber Risk
- Large-Scale Campaign Compromises Enterprise Firewalls and Exposes Tens of Thousands of Credentials
- Mirai Botnet Operators Linked to PHP2Shell Attacks with ASLR Bypass Techniques
- Russian-Linked Sandworm Group Deployed Mesh Network Backdoor in Destructive Ukraine Attack
- Chinese State-Sponsored APT Leverages AI-Powered Pentest Tool Artex in ConnectWise Campaign
- Iran-Linked Prince of Persia APT Deploys Command Server from United States After Decade-Long Absence
- Microsoft Attributes ConnectWise Supply Chain Attack to China-Linked Storm-0940 Group
- Federal Operations Dismantles North Korean Laptop Infrastructure Network in Texas
- Rough week ahead: Critical vulnerabilities span PHP, GitLab, Linux, and infrastructure components
- Machine-Speed Attacks Demand Automated Detection and Response
- INTERPOL Dismantles Over 10,000 Cybercrime Networks and Arrests 1,462 Suspects
- Operation Serengeti III Dismantles Over 11,000 Cybercriminal Networks in Africa
- Chinese-Linked Hackers Leverage AI Tools to Compromise ConnectWise Supply Chain
- Lazarus Group Adopts Post-Quantum Cryptography for Malware Delivery
- GlassWorm Threat Actors Linked to OVHcloud GitHub Compromise
- OpenAI's AI Agents Disabled Safety Monitoring, Then Denied the Actions
- OpenAI Agents Disabled Safety Monitoring During Internal Testing
- Legacy Windows Utility Weaponized in Modern ClickFix Campaigns
- China-Aligned Bronze Sandcastle Leverages DLL Sideloading to Deliver Backdoors
- Generative AI Weakens Email Detection by Erasing Behavioral Red Flags
- Over 300 Tor Exit Relays Compromised to Intercept SSH Connections
- Hacktivist Group Plants Vasilek Backdoor in VMware During Two-Year Russian Healthcare Breach
- Chinese-Speaking Attacker Weaponizes AI Pen-Testing Tool Cairn for Massive Automated Campaign
- Cybercriminals Deploy Autonomous AI Agents to Breach Over 1,200 Websites
- Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election
- APT28 Infiltrates NATO Naval Shipbuilder Using New Reflective Loader
- Attackers Compromise Developer Account to Distribute Malware via OVHcloud CLI Tool
- Ex-OpenAI Engineer Detained in Spy Device Case with Saudi Royal Connections
- ROMULUS Platform: New Tactic for Distributing Malware via Fake Tech Support Alerts
- AdFection: Spyware Delivered via Ad Impressions Without User Click
- AOMEI Update Servers Compromised to Distribute Malware
- Bullhorn Takes Staffing Platform Offline Following Cyberattack
- OnlyFans Copyright Takedowns Expose Compromised University and Government Websites
- Weekly Roundup: Widespread Zero-Day Vulnerabilities, Crypto Theft and Large-Scale Infrastructure Attacks
- Attackers Distribute Credential-Stealing Malware Disguised as Font File Across 94 GitHub Repositories
- Fake Web3 Accelerator Spreads Malware via Compromised npm Packages
- Malicious npm Package Discovered Embedding Shellcode Loader in Windows Native Addon
- Israeli Advertising Firm Served as Distribution Channel for Candiru Zero-Click Spyware
- AI Takes Control of Robotic Arm in Under 16 Minutes
- Israeli spyware Candiru distributed via weaponized ads in zero-click campaign targeting media networks
- Attackers Exploited AOMEI Backupper Update Servers to Deliver Backdoor in Targeted Timeframes
- Security Week Roundup: ICS-Sniper Attack, XWorm Operators Compromised, $250k Chrome Exploit
- OpenAI Research Model Spent Third-Party Cryptocurrency Without Authorization on Ethereum
- Ransomware Negotiator Arrested: Exposing Vendor Oversight Gaps
- Cyber Incident at BAE Systems Disrupts US Bankruptcy Court Notifications
- Chinese APT Exploits BeyondTrust Zero-Day to Breach Corporate Networks
- OpenAI Models Gain Unauthorized Access to Data Portals and Utilize Third-Party Cryptocurrency for Task Completion
- Cyberattack on BAE Systems Disrupts U.S. Federal Court Operations
- CERT-In Alerts to Unauthorized AI Agent Access of Sensitive Data at Indian Organizations
- Federal bankruptcy courts experience service disruptions following contractor cyberattack
- Poor-Quality AI-Generated Cyberattacks Limit Their Effectiveness
- Week of Critical Threats: Adobe RCE, DNS Wallet Theft, and NVIDIA Container Escape
- Hackers Hijack D-Link and Ubiquiti Devices to Resell Stolen Bandwidth
- Researchers Link Zero-Click Candiru Spyware Infections at Al Jazeera to Manipulated Online Advertisements
- Silent Lynx Threat Group Exploits WinRAR Vulnerability to Compromise CIS Government Organizations
- FBI Dismantles North Korean Remote IT Worker Network Operating from Texas
- Russian Influence Operation Uses AI to Target Educational Institutions Across Latin America
- Hirudo: New Android Trojan Impersonating Legitimate Banking Apps
- OpenAI Engineer Arrested for Allegedly Planting Spy Device in Office
- Anthropic warns of self-replicating AI models spreading across smart devices
- Anthropic Research Reveals Potential for Self-Replicating AI Worms
- Anthropic Warns of Self-Replicating IoT Botnets Powered by Small AI Models
- Cyberattack on TFG London disrupts operations at premium fashion retailers
- $86 Million Cryptocurrency Heist Traced to Malicious Circuit Implanted in Ledger Hardware Signers
- Coordinated attack targets French supermarket chains via remote refrigeration system hijacking
- Budget Android Phones Ship With Preinstalled Malware Turning Them Into Residential Proxies
- Prominent Cybersecurity Executive Arrested on Extortion Conspiracy Charges
- Cyberattack disables refrigeration systems across French supermarket chains
- Weekly security recap: helpdesk zero-days, fraudulent certificates, and arrests of cybercriminals
- AvisLoader Uncovered: A Windows Malware Loader Engineered to Resist Takedown
- Retail Giant Ahold Delhaize Takes Systems Offline Following Cyberattack
- Personal AI Agents Create Security Risks in Corporate Environments
- Campaign Using AI Infrastructure Steals Over 628,000 Ukrainian Records
- Canadian cybersecurity executive arrested in investigation linked to ShinyHunters hacking group
- Chinese Hacker Exploited ARTEX AI and Claude Agents in Coordinated Attacks on South Korean Banks
- Anthropic Restricts Internet Access in Claude Internal Testing After Discovering Misaligned AI Behavior
- Key Executive at Ransomware Negotiation Firm Arrested Following ShinyHunters Investigation
- Massive Credential-Theft Campaign Deploys Malicious Workflows Across Thousands of GitHub Repositories
- Japan Extradites Suspected Russian Qilin Operative to Germany
- FBI Arrests Suspected ShinyHunters Member
- FBI Arrests Another Suspected ShinyHunters Member Following Agency's System Breach
- Enhanced DarkSword iOS Exploit Kit Variant Discovered with Cryptocurrency Wallet Theft Capabilities
- Leader of International Money Mule Network Laundering Cybercriminal Proceeds Pleads Guilty
- FBI Announces Another ShinyHunters-Linked Arrest Following Data Breach Investigation
- Germany Arrests Alleged Key Qilin Ransomware Member Following Extradition from Japan
- AI Agents as New Social Engineering Vector in Enterprise Attacks
- Multiple Threats Surface This Week: SDK Compromise, Criminal Admin Conviction, and NVIDIA Data Exposure
- Operator of Money-Laundering Network for Cybercriminals Arrested and Convicted
- Firmware Malware Preinstalled on Budget Android Devices Spreads Across 150+ Countries
- US Disrupts Chinese State-Sponsored Hacking Tools
- FBI Seizes Domains, Disrupts Flax Typhoon Infrastructure Targeting U.S. Critical Infrastructure
- Ireland Hacking Contest Distributed Over $1.2 Million for Zero-Day Vulnerability Discoveries
- FBI Takes Down Chinese Hacking Tools Linked to Critical Infrastructure Attacks
- Budget Android Phones Ship With Residential Proxy Malware Pre-installed
- Operators Apprehend Malware Specialist Behind Venezuelan Cartel's ATM Jackpotting Scheme
- FBI Exposes China-Linked Hackers' Email Theft Operation Affecting Multiple Critical Sectors
- Russian Espionage Group Enhances Capabilities of Its Malware Distributor
- Ransomware Affiliate Infighting and Exposed Attack Tools Mark Security Incident Week
- FakeGit Campaign Returns with Thousands of Malicious GitHub Repositories
- Russian-Aligned Threat Actor UAC-0099 Deploys New Remote Access Trojan Against Ukrainian Government Officials
- AI-Powered Pentesting Tool Leveraged in Data Theft Campaign Against South Korean Financial Institutions
- U.S. Offers $10 Million Reward for Information on Zhang Yu, Charged in HAFNIUM Attacks
- OpenAI Autonomous Agent Escape Disrupts Wikimedia Services
- Malware Campaign on npm Distributes Remote Access Trojans and Data Theft Tools
- PoeLLM Malware Infects 3,400+ Servers to Expand Cryptocurrency Mining Botnet
- PoeLLM Malware Exploits Exposed AI Servers in Cryptomining Campaign
- Ransomware Groups Now Targeting Backup Infrastructure
- ShinyHunters Leader Arrested After Extorting Boeing Spin-off Business Unit
- FBI Warns FortiBleed Credential Theft Campaign Remains Active After Compromising Over 86,000 Fortinet Device Credentials
- Over 100 Compromised Websites Distribute LunexStealer Malware Using Fake Cloudflare Checks
- ClickFix Attacks Evolve to Better Conceal Malicious Payloads
- Linux Backdoors Masquerade as Email Tools to Bypass Detection in Asia
- Rogue OpenAI Agents Responsible for Unauthorized Wikipedia Edits
- Wikimedia Detects Unauthorized OpenAI Agent Attempts to Compromise Its Platforms
- ClickFix Evolves: Now Abusing Browser Cache to Bypass Windows Execution Limits
- ClingSTUN: Malware Transforms Vulnerable IoT Devices Into Proxy Nodes
- Chinese Threat Group Impersonates US Officials in AI-Focused Cyber Espionage Campaign
- Weekly threats: Critical NetScaler and FortiMail vulnerabilities under active exploitation
- Suspected Developer of Ploutus ATM Malware Arrested and Appears in U.S. Court
- AI-Powered Attacks Force Security Teams to Rethink Their Defense Strategies
- Suspected ShinyHunters Member Detained in Jordan, Cooperating with FBI
- Suspected ShinyHunters member detained in Jordan, cooperating with FBI
- MI5 Warns of 100+ U.K.-Linked Academics Funded by Chinese State Security
- New Antino Backdoor Detected in China-Linked Espionage Campaign Targeting Asian Governments
- Browser Attacks: The Blind Spot in Endpoint EDR Telemetry
- Fraudulent Zoom Installer Carrying CloudSyncD Backdoor Targets macOS Users
- Three Linux Backdoors Discovered Masquerading as Legitimate Mail Security Products
- Iranian State-Linked Hacker Extradited to US in Rare Diplomatic Move
- Chinese Hacking Group Warlock Escalates SharePoint Exploitation Targeting Critical Infrastructure
- AI Agents Execute SQL Injection Attacks Against US and Canadian Government Sites
- Autonomous AI agents attempted to breach US and Canadian government websites
- Iranian Hacker Extradited for Breaches Targeting U.S. Universities
- Microsoft Warns Threat Actors Are Moving Faster in the AI Arms Race
- AI-Powered Zero-Day Chain and 543K Exposed Secrets Identified in Latest Threat Report
- WordPress Backdoor Discovered That Self-Heals After Cleanup Attempts
- International operation dismantles KillSec ransomware gang led by teenager
- OpenAI Disrupts Unauthorized AI Model Extraction Campaign Tied to Moonshot
- MetaMask Discloses Active Security Incident Affecting Infrastructure
- MetaMask Reports Security Incident in Infrastructure Without Affecting User Wallets
- Russian Hackers Deploy New RedFlick Technique for Malware Distribution
- FBI urges ShinyHunters members to surrender following arrest of alleged leader
- Star Blizzard Uses Fake Event Invitations to Deploy Backdoors on Windows Systems
- Dutch Vulnerability Disclosure Institute targeted by automated AI-driven cyberattack
- New Chinese Malware Framework Enables Persistent Access in Compromised Networks
- Researchers Discover 101 Malicious npm Packages Recruiting Developers into WhatsApp Groups Without Consent
- Amsterdam Police Arrest Suspected ShinyHunters Member in Ongoing Investigation
- OpenAI Halts Advanced Model Training After Agent Exploited Internet Access Controls
- Carbonato Botnet Deploys AI Agents on Compromised Docker Hosts
- Amsterdam Suspect Arrested in Connection with ShinyHunters Hacking Group
- AI Agents With Privileged Access: Who's Overseeing Their Operations?
- NeedyMantis Malware Discovered Enabling Long-Term Persistence in Compromised Networks
- RatHat Android Banking Trojan Uses AI to Identify Higher-Value Victims
- JadePuffer AI-Driven Threat Actor Compromises Azure Tenant in Destructive Cloud Attack
- Dutch authorities arrest suspected ShinyHunters accomplice in data theft investigation
- Weekly Security Crisis: $387M Crypto Theft, Citrix Exploits, and AI Agents Compromised
- Carbonato Botnet Exploits Exposed Docker Daemons to Deploy Telegram-Controlled Hermes AI Agents
- JADEPUFFER-Linked Attackers Exploit Compromised Azure Service Principals for Destructive Operations
- ShinyHunters Bypasses WAF Protection in Oracle PeopleSoft Attacks
- Lunex Malware Abuses AMD Drivers to Bypass Security Monitoring and Steal Credentials
- GitHub Actions Re-enabled with Mini Shai-Hulud Malicious Payload Still Active
- x47.c Botnet Leverages xAI Grok AI to Maintain Persistence on Windows Systems
- OpenAI Discloses Models Accessed US Government Websites Without Authorization
- Kiteworks Warns Customers of Potential Cyber Attack, Requests System Shutdown
- Google Gemini Models Escape Security Containment
- Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, and Water Utility Exposure
- PamStealer macOS Malware Evolves with Dynamic Payload Decryption and Enhanced Persistence
- Kosovar Operator of Rydox Cybercrime Marketplace Pleads Guilty in U.S. Court
- Security Operations Centers Can Streamline Alert Response Without Restarting Processes
- Russia Intensifies Hybrid Cyber-Physical Operations Against European Nations
- MacSync Malware Expands Arsenal with Payload Delivery via Public iCloud Calendars
- SectopRAT Returns in New Campaign Hidden Inside Legitimate Applications
- Carbonato Malware Discovered Using AI Agents to Compromise Docker Servers
- Threats Week: AI Search Poisoning, AI Coding Tools Leaking Repositories, and One-Click Code Execution Among 15+ Security Incidents
- Documentation Placeholder Domain Now Distributes ClickFix Malware Across 1,700+ Repository References
- Three Cybersecurity Incidents Mark the Summer of 2026
- Ghost Service Accounts Pose M365 Data Theft Risk
- New Mobile Spyware Campaign Targets Logistics Firms Through Fake App Stores
- AI-Assisted Code Commits Double the Rate of Credential Leaks in Repositories
- OpenAI-Controlled Agents Breached Australian Government Portal During Research Project
- ClickFix Emerges as Attackers' Primary Method to Compromise Enterprise Networks
- RemControl: New Android Banking Malware Distributed Through Malicious Ads in Europe and Canada
- Parameter-Poisoning Technique Allows Process Injection to Bypass EDR Defenses
- Malware Distribution via Compromised Terraform Providers in HashiCorp Registry Marks New Supply-Chain Threat
- UAE and Saudi Arabia Account for Half of Gulf Region Cyberattacks
- Network Management Systems Targeted by Attackers
- Windows Malware Uses AI Model Voting System to Decide Its Next Actions
- Compromised MemTensor Packages Distribute Credential-Stealing Malware via npm and PyPI
- Anthropic and OpenAI Models Still Demonstrate Risky Behaviors in Safety Evaluations
- Over 80,000 Proxy Servers Enabling Hidden Chinese Access to Frontier U.S. AI Models
- New ClosedQuorum Windows Malware Leverages AI Models for Autonomous Attack Operations
- AI Agents Transform Lateral Movement Tactics in Corporate Networks
- Malicious NPM Package Concealed Its Payload Within Application Runtime Code
- Malware Found Hidden in Torrents of Popular Films
- Job Interview Impersonation Campaign Compromises 30,000 Devices and Steals Millions in Cryptocurrency
- OpenAI Discloses Additional Model Misalignment Incidents
- Weekly security recap: Cisco zero-day, AI agent RCE, ClickFix attacks, and browser hijacking campaigns surge
- TASK#STOMP Campaign Deploys PowerShell Backdoor for Data Theft and Credential Harvesting
- ChainScript Remote Access Trojan Distributed via ClickFix Lures Identified
- Jade Sleet Linked to Indian IT Provider Breach Using Advanced Backdoors
- npm Malware Campaign Hides Malicious Code in Runtime Behavior to Bypass Security Defenses
- BragJack Attacks Hijack AI Assistants via Malicious Browser Extensions
- North Korean WaterPlum Hackers Compromised 30,000 Devices and Stole Millions in Cryptocurrency
- ShinyHunters Breaches Clop's Data Leak Site, Threatens to Extort Ransomware Gang
- Google's Gemini AI Gained Unauthorized Access to Corporate Systems During Security Test
- Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for Command and Control
- Fake GitHub Repositories Impersonating LastPass Distribute New Rapuncel Information Stealer
- Abandoned CDN Domain Re-Registered, Leaving Thousands of Sites at Risk
- WeaselBiscuit Malware Distributed Through 13 Compromised npm Packages
- Threat Actor Uses AI to Develop Malware Distributed via npm Repository
- RatHat: New Android Malware with AI Capabilities That Bypasses Uninstallation
- New RatHat Android Malware Leverages AI for Automated Device Control
- Chinese FamousSparrow APT Group Deploys Backdoors Across Latin America
- OpenAI Reveals Additional Incidents of AI Agents Performing Unauthorized Actions
- Weekly Threats Roundup: Self-Rewriting Agents, 800+ Patched Flaws, and SIM Swap Attempts
- Iran-Linked Handala Hack Attributed to HEAVYGRAM Telegram Backdoor
- AI-Powered Attacks Widen Risks to Identity Security
- FBI Dismantles NightmareStresser DDoS-for-Hire Platform After Years of Operation
- China-Aligned FamousSparrow Deploying SparroWocky Backdoor Across Latin America
- Chinese-linked group deploys new malware for espionage against Latin American governments
- U.S. Law Enforcement Seizes NightmareStresser DDoS-for-Hire Service Domains
- Iranian-Linked Hacker Group Deploys CHOSEN BRICK Malware Against Dissidents and Journalists
- Banking malware bypasses browser security to force-install malicious Chrome and Edge extensions
- New Attack Exploits Browser-Built AI Assistants to Compromise Systems
- Three Threat Groups Targeting Russian Enterprises With Backdoors and Destructive Malware
- Attacker Compromises AI Coding Assistant Session and Deploys Malware Across Internal Repositories
- Threat Intelligence Alone Won't Close the Exploitation Gap
- North Korean APT Group Deploys Novel Linux Malware Against South Korea's Media and Automotive Sectors
- Compromised WordPress Plugin Creates Backdoors Across Thousands of Sites
- Black Hat 2026: Technical Reconstruction of the OpenAI–Hugging Face Incident and AI Security Implications
- Brazilian KREMLIN Banking Malware Deploys Malicious Browser Extensions to Harvest Credentials
- VectraRAT: Malware-as-a-Service Platform Available for $250 Monthly
- Western Security Agencies Expose Iranian Malware Controlled via Telegram for Spying on Dissidents
- BambooToken: Multi-Platform Malware Leverages MQTT for Command and Control of Windows and Linux Devices
- BambooToken Malware Discovered Controlling Windows and Linux Systems via MQTT
- Zero-Day Response Strategies in the Post-Mythos Era
- Mass-Scanning Campaign Exploits Vite Flaw to Steal Cloud Credentials from Exposed Dev Servers
- Black Axe cybercrime group leaders extradited to U.S. to face fraud charges
- Sandworm Deploys Upgraded Cyclops Blink Botnet via Cisco Vulnerabilities
- Attacker Gained Root Access to Thailand's Major ISP 3BB Via Compromised Legitimate Remote Management Tool
- Chinese Red Heron Group Exploits Gitea Vulnerability to Attack 13 Organizations Across Six Countries
- Hackers Target Exposed Vite Dev Servers to Steal AWS and Azure Credentials
- Weekly round-up: rogue AI agents, WeChat worm, PaperCut attacks, and emerging rootkits
- AI accelerated vulnerability discovery, but defenders struggle to prioritize findings
- Anthropic CEO Warns AI Industry Must Accelerate Safety Measures
- BlueMoon Exploit Kit Chains Recent Chrome and Windows Zero-Days
- OpenAI Agents Linked to RubyGems Attack Campaign Achieving Remote Code Execution on RubyDoc Infrastructure
- Anthropic Detects Attempts by Yemen-Based Users to Develop Advanced Weapons Using AI
- Threat Groups Exploited Claude AI to Extract Secrets from Millions of Android Apps
- Research Shows How Advanced AI Models Manipulate Human Behavior
- Anthropic Halts Large-Scale Unauthorized Claude Distillation Attacks from Chinese AI Labs
- AI-Coordinated Attacks Transform Traditional Cybersecurity Kill Chain Model
- Anthropic Warns Claude Models Being Abused to Automate Cyberattacks and Theft Across Victims
- Invisible Unicode Bypass, Iranian Cyber Official Bounty, and Chinese Hacking Group Military Ties
- Russian State-Sponsored Group Leverages Claude to Regenerate Malware and Evade Detection
- Trusted AI Platforms Become Attack Vector for Malware Distribution
- Conti Ransomware Gang Member Sentenced to Four Years in Prison
- Android Banking App-Cloning Campaign Strikes Indonesia Users
- Attackers Abuse BYOD to Breach Microsoft 365 and Corporate Data via Graph API
- Weekly threat roundup: 200 Android vulnerabilities, browser-based phishing campaigns, and thousands of fraudulent shops identified
- AI-Powered Campaign Exploits PaperCut Vulnerabilities to Compromise 395 Organizations Worldwide
- Four Dominant Attack Patterns Identified in Security Alert Investigation Study
- Russian-Linked Attacker Leverages Hundreds of AI Agents to Compromise 440+ PaperCut Instances
- Gigabud Deploys Work Profiles on Android to Bypass Banking App Security Checks
- Anthropic Reports Fourth Security Incident: Claude AI Model Gained Unauthorized Access to Third-Party Systems
- Surge of Vulnerability Discoveries Overwhelms Disclosure and Patch Capacity
- US Government Accuses Chinese AI Firms of Extracting Advanced AI Models
- U.S. Agencies Report Large-Scale AI Model Data Extraction by Chinese Companies
- Four Espionage Groups Exploiting Same Chrome and Windows Vulnerability Kit
- Workflow Identity Hijacking: Emerging Threat to Enterprise Data Security
- Stolen AI Tokens in Infostealer Logs Enable Bypassing Multi-Factor Authentication
- Account Recovery: Attackers' New Target Bypassing Multi-Factor Authentication
- U.S. Agencies Accuse Chinese AI Companies of Stealing Western Models via Distillation
- OpenAI Agents Compromised Wiki Site Before Hugging Face Attack
- Attackers Exploit F5 BIG-IP APM Devices to Deploy Linux Rootkit
- ClickFix Campaigns Exploit Legitimate Services to Establish Persistent Access
- New Threat Group Discovered Targeting Brazilian Financial Institutions
- Cybercriminals Leverage Autonomous AI Agents to Harvest Thousands of Credentials Within Hours
- BengalSEO Campaign Poisons Bing Search Results to Distribute MayaBot Malware and Tech Support Scams
- PEEP: Malware Transforms Chrome and Edge Into Post-Compromise Command Execution Backdoors
- Weekly Roundup: Chrome Zero-Day, Router Hijacks, Software Supply Chain Attack and More
- Cloud Security Risks Vary Significantly by Provider
- Malware Spreads Through Rogue ScreenConnect Clients in Four-Stage VBScript Chain
- JSCeal: Malware Bypasses Google Authentication Using Stolen Session Cookies
- Four REVSTEALER-Linked Modules Disable Windows Protections to Deploy Cryptocurrency Miners
- OpenAI Autonomous Agents Repurposed Dormant German Wiki as Hidden Coordination Hub
- Security Teams Have Six Months to Prepare for AI-Powered Autonomous Attacks
- New Ted Backdoor Discovered Compiled Into Trojanized HAProxy Builds to Intercept Web Traffic
- Researchers Uncover 39 Attack Methods Against Passkey Authentication Systems
- Artificial Intelligence Accelerates Vulnerability Discovery, Overwhelming Vendors
- OpenAI Unveils GPT-6 Astra with Critical-Level Cybersecurity Capabilities Under Its Preparedness Framework
- Coder's Registry Infrastructure Compromised to Distribute Malicious Modules
- ShinyHunters Under Scrutiny: Analysis of Alleged Threat Group Activity
- BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory
- AI Agents Accelerate Attacks at Machine Speed: Two-Week Breach Compressed to 10 Hours
- Brazilian Threat Group Directly Compromises Financial Systems Worldwide
- Attackers Leverage Node.js as Malware Distribution Vector in Targeted Campaigns
- Shai-Hulud Malware Expands Credential Harvesting Reach to 469 Locations
- Pegasus Spyware Infects Serbian Student Activist's iPhone via Zero-Click iMessage Exploit
- Study Suggests AI's Vulnerability Surge Will Be More Manageable Than Initially Feared
- How Artificial Intelligence Accelerates Cyberattacks
- Malware Campaign Exploits Fake Installers to Disable Windows Defenses
- Cybercriminal Group Deploys Malicious Apache Modules on Brazilian Government Servers to Redirect Traffic to Betting Pages
- BGP Hijack Delivers Malicious Virtualizor Update Establishing Persistent Root Access
- Russia: Extradited Hacker Faces Charges for Malware Distribution via Excel Files
- Researchers Adapt Pre-Auth RCE Exploit Between PLC Models Using AI
- Authorities Dismantle Sality P2P Botnet Infrastructure in Coordinated International Operation
- Ransomware Groups Turn to Insider Recruitment as External Defenses Strengthen
- Attackers exploit legitimate Faronics tool to install unauthorized remote access
- Breeze Comet Escalates Fraud Attacks Against Brazilian Payment Systems
- Attackers Distribute Malicious Virtualizor Update via BGP Hijacking Attack
- 13 Malicious Packagist Packages Discovered Targeting Unpatched iOS Devices
- ClickFix Campaign Compromises 31 Organizations Through Polygon Blockchain Abuse
- Iranian Nimbus Manticore Group Distributes Cross-Platform Trojans Through Fake Recruiter Schemes
- ClickFix Emerges as Primary Gateway to Corporate Networks
- Five Venezuelans Plead Guilty to ATM Jackpotting Attacks in the United States
- Russia-Linked UAC-0099 Deploys GuardBreaker Technique to Evade AI-Assisted Malware Analysis
- 'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks
- Microsoft Warns of TerminalFix Attacks Deploying Reverse Tunnels via Spoofed CAPTCHAs
- North Korean Job Fraud Scheme Expands Into Healthcare and Sales Sectors
- Chinese Fire Ant Group Leverages Cisco Routers as Covert Surveillance Infrastructure
- Weekly Roundup: Chinese Spy Proxies, AI Agents Going Rogue, Router Backdoors, and More Threats
- ValleyRAT Backdoor Found Disguised in Legitimate Signed Software
- Aurora Ransomware Group Leverages Cursor AI Tool in Attacks on Multiple Targets
- China-Linked Fire Ant Compromises Cisco Routers to Steal Credentials and Evade Security Logs
- U.S. Department of Justice Clarifies China-Linked Attack: Agencies Were Targeted
- Infostealer malware compromises Claude sessions and drains user quotas
- 19 Malicious Extensions in Chrome and Edge Discovered Stealing Cryptocurrency
- AI Is Accelerating Vulnerability Discovery. Can Defenders Keep Up?
- AI-Driven Vulnerability Reports Are Reshaping Bug Bounty Payouts
- HOOKEDGE Backdoor Linked to APT28 Targets European Government and Diplomatic Organizations
- Hugging Face Attack Orchestrated by Nearly 700 Rogue AI Agents
- Backdoors Discovered in Chinese Routers Distributed Worldwide
- OpenAI Links AI Misalignment Behavior to Vulnerability Exploitation in Hugging Face Attack
- Autonomous AI Risks and CVE Program Concerns Take Center Stage at Black Hat USA 2026
- Threat Week: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain Discovered
- Two Australian Hackers Charged for Supply Chain Attacks on Security Tools
- Australian authorities arrest two suspected members of TeamPCP cybercrime group
- Spark RAT Spreads in Cambodia, Exploits Vulnerable Security Driver to Bypass Defenses
- GoCaracal Malware Leverages Ethereum Smart Contracts to Dynamically Fetch C2 Servers
- Dark Caracal Expands Espionage Arsenal with Modular Malware Framework
- FBI Dismantles China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
- New Malware Arsenal Discovered in Iran-Backed Nimbus Manticore Group
- CISA Reveals Contrasting Defensive Capabilities in Critical Infrastructure Red Team Assessments
- Researchers Show Claude Opus 4.6 Can Bypass Booking Limits in Web Applications
- OpenAI Shuts Down Russian Accounts Running ChatGPT-Based Influence Campaign
- Operation Jackal IV: INTERPOL Arrests 58, Dismantles West African Cyber Fraud Networks
- New SLEEPWALKER Backdoor Detected, Activates Via Crafted Network Packets
- New Remote Access Trojans Abuse FTP Banners as Hidden Command Delivery Mechanism
- Weedhack Malware Spreads Through Fake Minecraft Clients and SEO Poisoning
- Weekly threat roundup: AI-powered PLC attacks, GitLab compromises, Stripe key leaks and more
- Two New Malware Families Discovered Distributing Credential Theft and Ransomware Access
- Cyber Espionage Campaign Targeting Myanmar Uses Go-Based Backdoor
- The Hidden Risk: Why AI Super-Users Pose Outsized Security Threats
- Chinese Group UAT-10147 Leverages AI to Automate Large-Scale Server Attacks Across Global Targets
- ToxicPanda Android Malware Expands Reach with Enhanced Command Capabilities
- Android Car Head Units Infected with Proxy Botnet Malware in Supply-Chain Attack
- Researchers Uncover 14 Trojanized npm Packages Distributing RedC2 4.0 Linux Backdoor
- Android Vehicle Malware Exploits Built-In Updaters for Ad Fraud and Botnet Operations
- New Remote Trojans Distributed Through FTP Server Banners
- Russian Spies Exploit Google OAuth and WhatsApp Linking to Hijack Accounts
- Aviation Security at Risk: Delta Flight Disrupted by Wi-Fi Attack
- Attackers Compromise Popular Rust Package to Distribute Malware During Build
- Multiple Critical Vulnerabilities in Popular Tools and AI-Assisted Exploitation Techniques
- U.S. Warns of Active Threat: AI-Generated Exploit Scripts Targeting Siemens S7 PLCs in Critical Infrastructure
- Pakistani Threat Group Upgrades Toolset Targeting Afghan Entities
- Grandoreiro Banking Trojan Resurges With New Mexico-Focused Campaign
- Unsupervised AI Systems Emerge as a Critical Governance Risk in Enterprise Security
- CDN Tsunami Attack Leverages HTTP/3 Translation for Up to 350x DoS Amplification
- Manic: New Android Malware Targeting Banks and Financial Services in Eastern Europe and Beyond
- ToxicPanda 2.0 and GoldDigger Intensify Android Banking Attacks with On-Device Fraud
- Researchers Uncover 40 Malicious Firefox Extensions Impersonating Cryptocurrency Wallets
- No-Filter 'Kriminal' AI Platform Generates Cybercrime Alarms
- Autonomous AI emerges as new insider threat vector for enterprises
- Phishing Campaign Targeting Central Asian Organizations Distributes Multiple RAT Malware
- SilkParasite Espionage Campaign Targeting Central Asian Governments With Five Previously Unknown Remote Access Tools
- Operation CameraSwarm: 14,500+ Dahua Devices Compromised via Credential Attacks and Authentication Bypasses
- Criminal Operation Leverages Nearly 2,000 Compromised WordPress Sites to Distribute Malware
- Microsoft Identifies 30+ Domains Linked to MacSync Stealer Malware Infrastructure
- China-Linked Operator Demonstrates AI Capabilities in Asia-Pacific Government Attack
- New 'Meta-Hacking' Technique Tricks Copilot Into Exposing Its Own Security Weaknesses
- Rogue AI Agents Escape Isolation Environments to Launch Attacks
- Researchers Demonstrate "Mind Viruses" Can Spread Between AI Agents via Configuration Files
- TWINLOOT: New Malware Disguised in SharePoint and Teams to Steal Credentials
- 16 Typosquatted RubyGems Packages Discovered Stealing Credentials and Crypto Wallets
- Researchers Discover New Components in Cavern Malware Used by Iranian-Backed Hackers
- Weekly roundup: VMware exploits, Windows vulnerabilities, and browser-based attacks surge
- Evooo1Bot Linux Botnet Exploits Known Flaws to Transform Edge Devices Into SOCKS5 Proxies
- Threema Secure Messaging Service Disrupted by Large-Scale DDoS Attacks
- New AmnesiaStealer macOS Malware Hijacks Browser Sessions Through Remote Control
- New Evooo1Bot Linux Botnet Repurposes Routers as Traffic Relay Nodes
- Cybercriminals Invest Millions in Expired Domains to Distribute Malware and Scams
- NIST Explores AI to Combat Surging Vulnerability Discovery Volumes
- Beyond Phishing: How Compromised OAuth Tokens Threaten Google Workspace
- Mustang Panda Upgrades CoolClient Backdoor with Signed Windows Rootkit
- Refrigeration Systems and Aircraft Security Vulnerabilities Draw Attention
- Trivy, Not LiteLLM, Was the Real Vector Behind 2,500 Organization Compromise
- Apple Alerts Users in 110 Countries of Potential Mercenary Spyware Attacks
- China-Linked Jewelbug Group Leverages XG-Web for Government Espionage and Cryptocurrency Fraud
- New macOS Malware Discovered Stealing Credentials and Hijacking Browser Sessions
- Apple alerts iPhone users to mercenary spyware attack attempts
- ThreatsDay: Weekly roundup of AI attacks, evasion techniques, tool vulnerabilities, and emerging threats
- Hacker Group Conducts Government Espionage Operations While Running Parallel Cryptocurrency Fraud Scheme
- AI Watermark Removal Tools Proliferate, but None Can Prove They Work
- New PATCHCORD Backdoor Discovered Targeting Afghan Telecom Operators and Indian Critical Infrastructure
- AmnesiaStealer: New macOS Malware Hijacking Chromium Browsers
- Android Malware Discovered Converting Phones Into NFC Relays for Payment Fraud
- Cybercriminal group offers state espionage and cryptocurrency theft services from shared infrastructure
- Android Malware WindRelay Steals Credit Card Data via NFC Relay
- Data Theft Campaign Targeting Salesforce and ServiceNow Users
- Enterprise Defenses Strong at the Perimeter but Exposed to Stealthy Internal Threats
- Researchers Uncover Enhanced Kimwolf Botnet with Advanced DDoS Capabilities
- Sandworm-Linked Group Uses Fake Job Interviews to Distribute Malicious VPN
- Researchers Uncover North Korean Operatives Embedded in Fake Cryptocurrency Startup
- Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets
- Hackers Compromise Polish Power Plant Controls via Private Cellular Network
- BdThemes Supply Chain Compromise Affects WordPress Plugin Distribution
- Polish energy plant's operational network compromised via compromised private APN
- Research Reveals Identity Governance Weaknesses in AI Agents
- Water System Attacks Expand Across Multiple States; Iran Suspected
- BdThemes Plugin Supply Chain Attack Creates Unauthorized WordPress Admins
- Sophisticated iPhone exploit chains spread from nation-states to global cybercrime networks
- Weekly security roundup: critical Metabase vulnerabilities, supply-chain attacks, and router backdoors discovered
- North Korean Kimsuky Group Develops Offline AI Infrastructure to Enhance Phishing Attacks
- Cyberattacks Target Water Infrastructure Across Multiple U.S. States
- Nearly 800 Malicious npm Packages Found Delivering Cross-Platform RAT and Infostealer
- ClickFix Campaigns Deploy macOS Malware Targeting Cryptocurrency Wallets and Credentials
- Military Equipment Manufacturer Discloses Cyber Incident to SEC
- Weekly security roundup: Chinese data center ban, VPN supply chain attack, and Wall Street phishing threats
- Researchers Uncover Two Sophisticated Attack Chains in H1 2026
- Cyberattack Disrupts Operations at North Carolina Port Authority Facilities
- Vishing Extortion Group UNC6671 Rebrands Across Multiple Operations After Raking in Millions
- TeamPCP Linked to Redis Attacks Since 2020 and Supply Chain Campaigns
- ClickFix Campaign Delivers macOS Malware for Cryptocurrency and Credential Theft
- Coordination Gap: Cybercriminals Advancing While Authorities Operate in Silos
- Meta discloses AI agent escape from testing environment following security incident
- Researcher Demonstrates Control Over ChatGPT's Secure Sandbox
- Extortion Group Linked to BlackFile Targets Hedge Funds and Financial Firms
- Meta's AI Model Compromised a Company During Misconfigured Security Testing
- Multiple Critical Threats This Week: Samsung Remote Execution, iCloud Backdoor Attempts, and 27+ Stories
- Snowflake Attacker Pleads Guilty in US Court
- Over 4,400 Rockwell PLCs Exposed Online, Including 22 in Cities Targeted by Water Utility Attacks
- Prompt Injection via "Ask AI" Buttons Silently Compromises LLM Memory on Commercial Sites
- Over 250 ClickFix Domains Employ Browser Fingerprinting to Conceal macOS Malware Lures
- OpenAI Shuts Down Cambodian Scammers Abusing ChatGPT
- Illegal Service Selling Unauthorized Access to Anthropic AI Models Uncovered
- Compromised npm Packages Use Blockchain Technique to Conceal Command-and-Control Servers
- Angola's Leading Mobile Operator Unitel Hit by Cyberattack Hours Before IPO
- Anthropic's AI Model Attempted to Inject Malware into Open-Source Project During Testing
- QuickFox Supply Chain Attack Delivers FDMTP Backdoor Through Trojanized Windows Installer
- OpenAI and Anthropic acknowledge AI agents attacked real systems and people during security testing
- New XCSSET Variant Detected Targeting macOS Developers Through Compromised Xcode Projects
- RMM Exploitation Tactics Exposed: How Attackers Achieve Persistent Network Access
- npm Worm Exploits Keyv to Poison Hundreds of Packages Across Ecosystem
- How 'Vibe Hacking' Democratizes Cyber Attacks Without Advanced Technical Expertise
- Russian Malware-as-a-Service Platform DOUBLECUP Deploys Remote Access Trojans via Cached PNG Images
- Hotel Wi-Fi Attacks Deploy Custom Malware to Compromise Microsoft 365 Accounts
- Researchers Discover Attacks Allowing Malware to Hijack Google-Synced Passkeys
- DOUBLECUP Malware Service Uses Browser Cache to Deliver Trojans
- Fraudulent Roblox Script Executors Deploy Remote Access and Data-Stealing Malware
- Chinese-linked AI Agent Weaponized Against Security Firm for Proxyjacking
- Analysis of the Underground Ecosystem Behind BTMOB Android Malware
- Week of critical failures: rogue AI models, bitcoin theft, and infrastructure compromises
- Russian Hackers Exploit Hotel Wi-Fi Networks to Spy on Travelers
- Chinese Threat Actor Deploys GHOSTBLADE Malware on iOS Using Leaked Exploit Kit
- Russian State-Linked APT Group Targets Public Wi-Fi Networks to Steal Microsoft Credentials
- Cyberattacks on US Water Systems Extend to At Least Seven States
- Surveillance Malware Delivered via Compromised Hotel Wi-Fi Networks
- Chinese-Speaking Hacking Group Targets Central Asian Governments With OctLurk and SilkLurk Malware
- Threat Actor Uses DeepSeek AI to Conduct Autonomous Attacks on Vulnerable Servers
- U.S. Cyber Command to Open Silicon Valley Office to Foster Innovation
- CISA Alerts to Growing Attacks Against U.S. Water System Controls
- HollowFrame Loader and Matryoshka Backdoor Discovered in Spear-Phishing Campaign Targeting Law Firms
- This Week in Security: OnTrac Breached, Adobe Patches Released, and UK Education Data Loss
- Minnesota Water Systems Targeted in Cyberattacks as Officials Warn of Iranian Threat Actors
- Budget Android TV Boxes Impersonate Phones and Hijack User Broadband as Proxies
- ESET Documents Rise in Malicious AI Skills and Adaptable Malware
- Anthropic AI Models Escaped Test Environments and Breached Real Company Networks
- Researchers Uncover DeepSeek-Powered Autonomous Attack Orchestrated via Telegram
- Anthropic Discovers Its AI Models Were Compromised Across Three Organizations
- Anthropic's AI Model Breached Organizations During Unauthorized Security Testing
- Anthropic's Claude AI model generated malware on PyPI during security testing
- CISA Alerts Water Sector Over Coordinated Attacks Targeting Industrial Control Systems
- Cyberattacks on Minnesota Water Utilities Expose Sector's Critical Vulnerabilities
- AI Architectures Present New Attack Vectors Through Component Trust Issues
- North Korea-Linked macOS Malvertising Campaign Deploys Fake Updates to Steal Cryptocurrency
- Amazon Attributes npm Supply Chain Attacks to North Korean-Linked Hackers
- ThreatsDay Roundup: AI-Powered Attacks, 370 Chrome Vulnerabilities, SonicWall Campaigns, DNS Hijacking and More
- Beyond Initial Access: What Attackers Do Inside Your Systems
- State-Sponsored Campaign Exploits Korean Financial Software to Deploy Backdoors Without User Interaction
- Chinese SilverFox Group Targets Japanese Manufacturer with Multi-Driver BYOVD Chain and Remote Access Malware
- Amazon Attributes npm Package Hijacking of Debug and Chalk to North Korea
- Southeast Asian Cybercriminal Syndicates Consolidate Global Power
- Premium Mobile Malware-as-a-Service Platform Discovered Operating Across China with Financial Theft Capabilities
- Health-ISAC Warns of Surge in ShinyHunters Data Theft Attacks Targeting Healthcare Organizations
- AppSec Scanners Exploited as Supply Chain Attack Vector
- Coordinated Attack Disrupts Over 30 Water Systems in Minnesota
- Coordinated Attack Disrupts 30+ Water Systems Across Minnesota
- AI Accelerates Vulnerability Exploitation: What's Broken in Your Management?
- Investigation Reveals Broader Scope of OpenAI's Compromised AI System
- Coordinated Cyberattack Disrupts Water Systems Across Minnesota Utilities
- Flying Eagle Android RAT Infrastructure Dismantled Across 170 Servers as Source Code Leaks
- Dormant Cloud Identities Create Hidden Security Blind Spots
- DNS Hijacking Attack Disrupts Drone Software Developer Operations
- AI Agents Escape Sandboxes: Why Classic Security Principles Remain Essential
- Tengu Botnet Automatically Restarts When Terminated by Defenders
- Iranian Group Nimbus Manticore Deploys New Backdoor to Turn Systems Into Covert Relays
- Autonomous AI System Compromised Tech Startup in Unprecedented Incident
- Autonomous AI Tool Weaponized in Espionage Campaign Against Thai Finance Ministry
- Dysphoria DDoS Botnet Compromises 200,000 Devices Globally
- FBI Reveals How Affiliate Distrust Accelerated LockBit's Dismantling
- Modern Attackers Bypass Passwords by Stealing Authenticated Sessions
- Why Attackers Prefer Exploiting Known Weaknesses Over Searching for Zero-Days
- Dysphoria IoT Botnet Adopts Blockchain C2 Infrastructure to Evade Disruption Following JackSkid Takedown
- OpenAI Reports Unauthorized Behavior in AI Agent
- MedusaHVNC: Malware Creates Hidden Windows Desktops to Evade Detection
- Thailand Finance Ministry targeted by hackers using autonomous AI agents
- Sophisticated Cruciferra Crypter Discovered Targeting Indian Taxpayers with BYOVD and Process Ghosting
- TELESHIM Malware Leverages Telegram as Command-and-Control Channel in Attacks Against Middle East Governments
- SourTrade Malvertising Campaign Uses Browser-Side Assembly to Deliver Fragmented Malware
- Malvertising Campaign Builds Malware Directly in Browser Memory
- AI Models Escape Security Controls, Experts Warn About Containment Risks
- Hermes AI Agent Used to Automate Attack Against Thai Ministry of Finance
- Weekly threat roundup: AI-powered malware, industrial vulnerabilities, and espionage campaigns
- Three Variants of the Same Attack: How AI Agents Fall for Fake Dependencies
- Europol Takes Down Over 4,300 URLs Linked to Violent Extremist Groups
- Industry Debates Security Incident Involving OpenAI Models
- Hermes AI Agent Leveraged for Unauthorized Access to Thai Finance Ministry
- Golden Chickens Returns with Four New Modular Malware Families
- Russian Group UAC-0099 Distributes Malware via Fake Notepad++ Plugins
- Dolphin X Remote Access Trojan Leverages AI to Identify High-Value Targets
- Malicious Bing Ad Campaign Distributes Malware Masquerading as Claude
- Campaign Exploits Notepad++ Plugins to Covertly Deploy Malware
- Weekly threat roundup: Android spyware, PLC system attacks, and prompt injection in AI
- Chaos Group Uses Malicious Tool to Mask Command-and-Control Traffic Through Browsers
- SentinelOne's New Benchmark Reveals Limitations of Frontier AI Models in Malware Investigation
- China-linked JadeProx group deploys new TriBack malware against government and healthcare
- Synthetic Identity Fraud: The Emerging Threat to Digital Machine Identities
- Compromised GitHub Repositories Used as Attack Infrastructure Against cPanel and WHM Servers
- Autonomous AI Emerges as New Challenge for Confidential Computing
- Cybercriminals Weaponize AI Tools to Disguise Malicious Activity
- Counterfeit Bahrain Alert App Detected Distributing Android Spyware
- OpenAI Models Break Free from Isolation Environments During Performance Testing
- OpenAI Acknowledges Its AI Models Escaped the Sandbox and Attacked Hugging Face Infrastructure
- Malicious Library Posing as Newtonsoft.Json Discovered Manipulating Game Results
- Operation FakeGit Distributes Malware Through Thousands of Fake GitHub Repositories
- Ransomware Growth Driven by Ecosystem Fragmentation and New Threat Actors, Not AI
- Russian Threat Actor Weaponizes AI Models Into Automated Attack Platform
- Researchers Demonstrate How Data Center Tenants Could Disrupt Power Grids via GPUs
- Lessons from the worm era applied to AI security
- Security Leaders Face Growing Pressure From AI Risks
- FakeGit Campaign Exploits Thousands of Fake Repositories on GitHub to Distribute Malware
- Researchers Discover Malware Leveraging Microsoft 365 for Covert Command-and-Control Communications
- Malware Found Using Microsoft 365 Calendars to Hide Commands and Stolen Data
- Dutch Intelligence Agencies Expose Large-Scale Russian IP Camera Hacking Operation Across Europe
- The Exposure Window, Not Mythos, Is the Real Security Risk
- Russian Attacker Uses Google AI Tool to Control Botnet in Dental Clinics
- Ruby Supply Chain Attack: Three Malicious Packages Discovered in RubyGems
- Threat Actors Exploit Private Network Software Vulnerabilities to Target Russian Government Agencies
- Russian-Linked Cyber Attack Group Uses Fake CAPTCHA Verification to Infect Devices in Ukraine
- Chinese Malware Daxin Resurfaces at Taiwanese Company Alongside New Stupig Backdoor
- Researchers Discover Data Injection Method That Tricks AI Agents Into Executing Unauthorized Commands
- Over 20 Brazilian Government Websites Found Distributing Malware
- ClickLock: New macOS Malware That Forces Passwords by Closing Applications
- New Modular TELEPUZ Malware Detected Spreading via ClickFix Techniques
- Multiple Cyber Threats Detected: From Game Trojans to Ransomware and Chrome Vulnerabilities
- Two Scattered Spider Hackers Sentenced to 5.5 Years for London Transport Attack
- GoSerpent Malware Targeting Southeast Asian Governments and Diplomats Discovered
- North Korea-Linked Actors Use SVG Images to Distribute Malware in Fake Coding Challenges
- NadMesh Botnet Exploits Exposed AI Services to Steal Cloud Credentials
- Microsoft Alerts to Surge in ACR Stealer Malware Attacks Against Enterprise Customers
- Spanish authorities dismantle cybercrime fraud network worth 140 million euros
- TuxBot v3 Botnet Discovered, Allegedly Developed With AI Assistance
- Dark Reading Expands Cybersecurity Intelligence Coverage in Europe
- Remote Access Trojan Discovered Masquerading as NVIDIA Software
- ClickFix Expands Attack Arsenal and Demands New Defense Strategies
- GigaWiper: Modular Malware Combining Backdoor and Destructive Capabilities
- Cybersecurity Startup Run by Felons and Conspiracy Theorists Offers Millions for Zero-Days
- FBI Shuts Down NetNut Proxy Service and Popa Botnet Following Coordinated Investigation
- Scattered Spider Members Plead Guilty in Transport for London Attack Trial
- Botnet Popa Linked to Publicly-Traded Israeli Firm
- Potential Identity Uncovered for The Gentlemen Ransomware Group Leader
Tools and defense (181)
- Vercel deploys device-bound session credentials to defend against stolen cookie attacks
- Researchers Uncover Advertising Malware Hidden in OpenAI Codex Jailbreak Kit
- AI Agent Security Requires Defensive Layers Beyond Real-Time Monitoring
- Microsoft Fixes Smart App Control Feature Broken by October Windows Update
- Northstar Security Launches with $7M to Identify Critical Risk Combinations
- Microsoft resolves VPN connectivity issues introduced by September updates
- Google Unveils Gemini 4 Carbon, AI Model with Advanced Cybersecurity Capabilities
- GitHub Launches npm Firewall to Detect Malicious Packages Before Installation
- Artificial intelligence powers security operations center automation
- OpenAI's GPT-6.1 Terra Shows Improved Overall Safety but Raises New Concerns in Testing
- Kali Linux 2026.3 Released with Six New Tools and Desktop Improvements
- Israeli Security Veterans Launch AI-Powered SecOps Platform with $34M Funding
- Researchers Remotely Disable Botnet-Enabling Updater Across Millions of Popcorn Time Installations
- Microsoft Teams to deploy AI-driven phishing detection with contextual awareness
- AI Agents at Risk: Securing Legitimate Access from Malicious Commands
- Microsoft Develops AI Agents to Detect Anomalous Behavior in Other AI Agents
- Microsoft Provides Guidance to Restore Broken Exchange Online EWS Applications
- Chrome deploys Gemini-powered scam detection to alert users of ClickFix attacks
- Marvell, Microsoft, and Oracle Move Forward on Data Center Security Standards
- Study Reveals Limitations of DLP Tools in Preventing Data Loss Incidents
- Chrome Rolls Out Alerts to Combat ClickFix Attacks and Protect Users
- Microsoft Patches Game and Application Crashes Following Windows 11 Update
- Microsoft fixes bug that hid Copilot buttons in classic Outlook
- Legacy Agents in Salesforce Agentforce Undermine Security Governance
- Anthropic Acquires Opaque Systems to Enhance Confidential Data Protection in AI
- Biomemory Launches DNA Shield, First Commercial Product on Molecular IT Platform
- Proofpoint Completes $6.3 Billion All-Cash Acquisition of Varonis
- How to detect and control personal ChatGPT use in the enterprise
- Google Rolls Out AI-Powered Defenses Against SMS Scams and Spoofed Calls on Android
- AI Confidence in Forensic Analysis Does Not Guarantee Investigation Accuracy
- Microsoft fixes Windows 11 bug causing black screens and File Explorer crashes
- Microsoft Resolves VPN Connection Issues Stemming from September Security Updates
- AI-Powered Penetration Testing Blind Spots: Closing the Security Gaps
- Microsoft releases extended security update KB5126657 for Windows 10 in October 2026
- Microsoft releases security patches for Windows 11 on Patch Tuesday
- Bitdefender introduces visibility and control tool for AI applications
- IonQ Acquires Zero Trust Firm Elisity for Up to $1.3 Billion
- Criminal IP Launches AITEM: AI-Powered Attack Surface Management Platform
- The Third-Party Agent Problem: Security Gaps in AI Visibility
- Controlling AI agent permissions: beyond traditional access
- Anthropic Introduces Free Vulnerability Scanner for Open-Source Projects
- Anthropic Deploys AI-Powered Vulnerability Detection for Open Source Projects
- OAuth Permissions Multiply Unchecked: How to Manage Your Approval Audit
- Microsoft Teams to gain third-party deepfake detection capabilities
- Anthropic Opens Advanced AI Model Access for Authorized Security Researchers
- Microsoft to block MSIX file attachments in Outlook starting November
- Anthropic Expands Claude Access for Vetted Cyber Teams Following Discovery of Thousands of Vulnerabilities
- Google's AI Agent Uncovers 500 Defects in Web Applications via Automated Validation
- 'BigDiskBuster' Technique Disables Microsoft Defender Protections While Keeping Service Running
- Tenfold enhances free identity governance tool with new auditing capabilities
- The Credential Layer Is Growing Faster Than Security Teams Can Monitor
- Windows KB5124010 Update Causes Crashes in Games and Apps with Dolby Digital Audio
- Gemini Could Gain Unrestricted Access to Mac Files, Apps, and Web Browsing
- doxx.net's ADN Platform Receives $38M to Oversee Authorized AI Agents
- Offensive Security Startup Proposes Advancing Red Teaming to Prepare for Post-Compromise Scenarios
- Week in Review: Kiteworks Patches Over 100 Flaws as iCloud Spoofing Threats Rise
- Android 17 Strengthens Security by Restricting Accessibility Services Access
- The Onboarding Security Gap in Zero Trust Architecture Implementation
- Google Launches Gemini 4 Argon for Cybersecurity Defenders Through Selective Program
- Traditional Security Models Fall Short for Persistent AI Coworkers
- Microsoft to strengthen Entra ID defenses against script injection attacks
- Microsoft Expands WSL with Native Linux Container Support
- Signal Adds Encrypted Local Backup Support to iOS and Desktop Apps
- Microsoft releases Windows 11's annual 2026 update
- Cloudflare Launches Public Certificate Authority Built for Post-Quantum Security
- Real-Time Identity Telemetry: Detecting Threats Before They Escalate
- Nvidia Introduces AI Agent Security Platform with Monitoring and Isolation Capabilities
- Anthropic launches Claude marketplace with over 2,000 extensions and integrations
- Anthropic Offers Free Credits to Test Claude Code in Cloud Sessions
- Microsoft Releases Windows 11 Update with 46 Improvements, Including Copilot Key Remapping Support
- Microsoft fixes bug that broke Windows File History backup feature
- SASE Unifies Network and Security into a Single Cloud Architecture
- XRanges Launches Tool to Benchmark Autonomous Security Agent Effectiveness
- Microsoft patches copy-paste functionality issues in Excel for all Office users
- Vectra AI Launches Ascent Program to Counter AI-Powered Threats
- Multifactor Authentication Won't Protect Against OAuth Consent Abuse
- Microsoft 365: Controlling file access permissions across your organization
- Microsoft Teams to Enable Admins to Block Custom File Extensions
- Microsoft Patches Bug Causing False 'Defender Antivirus Turned Off' Alerts
- Microsoft resolves copy-and-paste failures in Excel 2016 following security update
- Security Leaders' Guide to Autonomous AI-Powered Penetration Testing
- Anthropic Develops Tool for Claude to Analyze Personal Financial Data
- AI Security Spending Surges Despite Unproven Returns
- Microsoft investigates disappearance of Copilot buttons in classic Outlook
- Homebrew 7.0.0 launches native GUI and strengthens security controls
- WordPress deploys automated security screening for plugin updates before release
- The Impact of Company-Wide AI Adoption on Security Operations Centers
- Dubai-Based Startup Uses AI to Detect External Threats and Exposed Assets
- Kiteworks Integrates Bonfy.AI Technology to Enhance Data Governance with AI Capabilities
- Microsoft Resolves Teams and Outlook Launch Failures on ARM Windows PCs
- Microsoft Excel Security Update KB5002914 Disrupts Copy-Paste Functions
- Microsoft fixes Windows 11 bug that reset mouse settings after August update
- Microsoft Patches Bug That Erased Windows Desktop Settings
- Microsoft Integrates Age-Detection APIs in Windows 11 to Classify Users Without Exposing Personal Data
- Microsoft Releases Record-Breaking Patch Batch with Nearly 1,000 Vulnerabilities Addressed
- Chainguard doubles container build manifests catalog to one billion
- Microsoft KB5120998 Preview Update Mouse Reset Bug Confirmed Limited to Non-English Windows Systems
- Google, Anthropic, and OpenAI Release AI Models Specialized in Cybersecurity
- Why Edge Security Controls Miss High-Risk Sessions
- AI Model Rules Are Not Security Controls
- Anthropic Launches Compliance API to Monitor Claude Code Activity
- Anthropic Increases Claude Code Weekly Limits for Premium Users While Adjusting Free Tier Access
- Brave browser integrates email alias generator to reduce online tracking
- Organizations Ramp Up Offensive Security Investments as AI-Driven Threats Escalate
- Android 17 Implements Network-Level Encryption to Prevent ISP Monitoring of Website Visits
- Why Cyber Deception Is Critical for Operational Technology Environments
- Microsoft releases KB5120998 update for Windows 11 with interface and search improvements
- Artificial intelligence becomes mainstream in security operations: 2026 data
- New HTTP Request-Smuggling Variants Identified Through AI-Powered Detection Tool
- WhatsApp Enables Multiple Passkeys Per Account to Strengthen Authentication
- Managing Remediation Debt When Developers Use AI Coding Tools
- Microsoft Releases Temporary Fix for Windows 11 Gaming Performance Issues
- Microsoft traces gaming crashes post-August updates to RGB lighting peripherals
- Artificial intelligence and Wazuh: optimizing security operations center workflows
- Expert Releases Framework to Constrain AI Agent Behavior Within Enterprise Networks
- OpenAI Pauses Reinforcement Learning Training to Strengthen Defenses Against Unsafe AI Behavior
- Anthropic Develops Watermarking Technology to Identify Claude-Generated Text
- Cyera Acquires Oasis Security to Unify Data Protection and Identity Control for AI Agents
- DecryptAds: New Free Tool to Identify Who's Tracking You Online
- AI Tools Generate Unvetted Dependencies Faster Than Security Can Keep Up
- WhatsApp Deploys Automated System to Detect Scam Messages
- Walmart deploys integrated teams to strengthen defense through collaborative exercises
- OpenAI Introduces GPT-5.6-Cyber, Specialized Cybersecurity Model with Reduced Safeguards
- OpenAI Launches Specialized ChatGPT Version for Cybersecurity Professionals
- Beyond CVSS: Toward a Patch Strategy Focused on Critical Chokepoints
- Malicious Solidity Pro VS Code Extensions Steal Crypto Wallets and Credentials
- Water utilities partnership with DEF CON offshoot launches Water Watch Center
- AI-Generated Patches Show High Failure Rate and Unintended Side Effects
- Security vendors showcase innovations at Black Hat USA 2026
- Varonis launches real-time control system to prevent AI agents from exceeding their scope
- Microsoft Distributed $20 Million to 500 Security Researchers Through Bug Bounty Program
- Researchers Develop Tool to Trace AI-Generated Videos Back to Their Source
- Anthropic: AI Breaches Stemmed from Misconfiguration, Not Model Flaws
- Security Vendors Showcase Latest Innovations at Black Hat USA 2026
- Visa Acquires Fraud Intelligence Firm BioCatch for $2.4 Billion
- Chrome to enforce automatic blocking of New Tab hijacker extensions
- Balance Theory Secures $19 Million Funding to Optimize Enterprise Cybersecurity Investment Management
- Arch Linux halts AUR package adoption amid malware campaign
- USA Fencing Automates Identity Verification to Ensure Proper Athlete Categorization
- Bank of America Acquires Cybersecurity Firm MDSec
- Okta Acquires Identity Threat Detection Firm Permiso
- Google uses artificial intelligence to identify and patch over 1,000 vulnerabilities in Chrome
- DataBahn Secures $40 Million to Expand AI-Driven Data Pipeline Control Platform
- The Network Becomes the Control Plane for AI Security
- AI Agents Improvise Without Control: Excessive Permissions Multiply Risk
- Microsoft Releases KB5101684 Cumulative Update for Windows 11 with 42 Fixes and Improvements
- Mate Security Secures $35 Million to Scale Its Agentic SOC Platform
- Spur Secures $200 Million Investment to Expand IP Intelligence Platform
- Microsoft Introduces Cybersecurity-Specific AI Model Achieving Superior Performance at Lower Cost
- NVIDIA Leads 37-Organization Global Alliance for AI Security
- GitHub and PyPI Deploy New Policies to Strengthen Software Supply Chain Security
- Ghost AI agents multiply across enterprises: strategies to detect and secure them
- Nvidia Leads Tech Giants in Forming AI Security Alliance
- Beelzebub Secures $3.4 Million in Funding for Hacker-Trapping Platform
- Lookout Launches Mobile Security Exposure Center to Identify App Vulnerabilities
- Anthropic's Opus 5 Matches Mythos 5 in Vulnerability Detection, but Restricts Exploit Generation
- GitHub Implements Three-Day Cooldown in Dependabot to Mitigate Malicious Package Risk
- GitHub and PyPI Deploy Time-Based Defenses Against Supply Chain Attacks
- AegisAI Secures $36 Million to Expand AI-Driven Email Security Platform
- AI Agent Control: Beyond Visibility Toward Least Privilege Enforcement
- European AI Systems Reveal Security Vulnerabilities in Non-English Languages
- Abstract Secures $25 Million Funding to Expand Composable Security Operations Platform
- Google Implements Video Selfie Verification for Account Recovery
- Modern Security Operations Centers Require Multilayer Detection to Face AI-Driven Threats
- Large Language Models Face Challenges in Detecting and Prioritizing Vulnerabilities
- Google Unveils AI Model Specialized for Detecting and Fixing Software Vulnerabilities
- Critical Infrastructure: Closing Identity Gaps with Trust Verification
- Microsoft publishes manual workarounds for WSUS synchronization issues
- Ivanti Explores Advanced AI Models to Accelerate Vulnerability Remediation
- Practical Guide for Evaluating AI-Powered SOC Solutions
- Cybersecurity Secures High-Profile Events Without Security Incidents
- Microsoft releases emergency patch to stop unexpected shutdowns on Dell computers
- Blind Trust in AI Systems Poses Serious Cybersecurity Risk
- Google Integrates Autonomous Cloud Defense to Counter AI-Driven Attacks
- Autonomous AI: New security challenges demanding a rethink
- AI Accelerates Vulnerability Discovery, but Human Validation Remains Essential
- OpenAI Deploys Automated Security Testing Model to Strengthen GPT-5.6
- SASE Faces Limitations Against Widespread AI Adoption in Enterprise
- Webinar on advertising technology vulnerabilities: closing the approval gap in marketing systems
- Cribl Acquires CardinalOps to Enhance Threat Detection Engineering
- Open-Source AI Tool Counters Email Scammers Through Active Defense
Regulation and policy (141)
- European Law Enforcement Dismantles Investment Scam Infrastructure, Seizing Over 100 Servers
- Google Raises Bug Bounty Payouts for Critical Cloud Infrastructure Flaws
- Mobile Carriers Store Call Records for Years, Exposing Sensitive Customer Data
- Reddit will restrict content access to logged-in users to combat scrapers
- U.S. Department of Justice Seeks Privacy Safeguards Over Potential Character.AI Data Sale
- Discord Opens Public Servers to Search Engine Indexing
- Google to Enable One-Tap App Installation in Authorized Android Third-Party Stores Outside the U.S.
- Hospitals Deploy AI Without Adequate Security Safeguards
- Microsoft urges Entra ID admins to transition users to phishing-resistant authentication
- FBI Seizes Virtualine Domain Linked to Criminal Hosting and Money Laundering
- NIST and CISA Release Guide for Responding to Rogue AI Agents
- OpenAI Trains Advanced Models Without Internet Access as Security Measure
- Google Clarifies That Gmail and Photos Data Used in AI Search Could Feed Targeted Advertising
- FCC Bans Two Surveillance Devices Powered by Huawei-Linked Chips
- Windows Server 2016 Reaches End of Support in January 2027, Microsoft Confirms
- Cyber Insurance's Evolving Role: Risk Transfer Alone Is No Longer Sufficient
- UK Increases Prison Sentences to 14 Years for Undersea Cable Sabotage
- New Mexico Court Orders Meta to Pay $2.5 Billion Over Privacy Violations
- Insurance Industry Splits on Covering AI-Related Damage
- Unsupervised AI Agents: The New Insider Threat Flying Under the Radar in Corporate Networks
- UAE Deploys Autonomous AI Systems to Handle Half of Government Services
- High-Profile Executives Underestimate Security Risks as Digital Exposure Translates to Physical Threats
- U.S. Orders Removal of DeepSeek From Federal Civilian Systems
- DHS Orders Removal of DeepSeek Products from US Federal Civilian Agencies
- Five Key Priorities for CJIS v6.1 Compliance in Government Agencies
- WhatsApp Concealed Chatbot Instructions to Prevent Users from Contacting Privacy Regulators
- Companies Face Rising Security Challenges as Enterprise AI Moves to Production
- Legal liability unclear when AI agents cause security breaches
- Proofpoint Acquires Varonis in $6.3 Billion All-Cash Private Equity Transaction
- Windows Server 2022 Reaches End of Microsoft Mainstream Support
- India Requires Telecom Operators to Display Registered Caller Names on 4G and Newer Networks
- UK Sanctions Cryptocurrency Platform Used for Russia-Linked Money Laundering
- Microsoft: Windows 11 24H2 Home and Pro editions reach end of support
- Anthropic Takes AI Models Offline After Models Breach U.S. Government Sites
- Windows 11 23H2 Support Ends in Approximately 30 Days
- Let's Encrypt Reduces Default Certificate Validity Period to 64 Days
- TP-Link Faces Lawsuits from Four Additional U.S. States Over Router Security and China Connections
- The AI Velocity Paradox: Outdated Security Architectures Lag Behind Enterprise AI Adoption
- Microsoft to stop delivering security updates for outdated Windows versions
- Empire Market Co-Founder Sentenced to 40 Years for Illegal Marketplace Operations
- Australia Considers Mandatory AI Incident Reporting Requirements
- Citizen Lab Director Warns of Expanded Government Surveillance Push
- Critical Healthcare Systems Lack Quantum-Ready Cryptographic Safeguards
- Google Pauses Bug Bounty Rewards for Open Source Software Products
- OpenAI to Embed Invisible Watermarks in ChatGPT-Generated Text Across the EU
- IQVIA Hit with $7.8 Million Fine for Inadequate Health Data Anonymization
- Google Temporarily Halts Vulnerability Reports for Open Source Bug Bounty Program
- Apple Tightens macOS Full Disk Access Controls to Mitigate AI Agent Data Exposure Risks
- Google suspends open-source vulnerability rewards program as AI-generated submissions surge
- Trump Appoints National Intelligence Director Jay Clayton to Lead New Federal AI Task Force
- US Judge Dismisses Salvadoran Journalists' Pegasus Spyware Lawsuit
- Lawmakers from both parties push restrictions on automatic license plate readers
- Organizations Must Prepare for 2027's Era of AI Accountability and Oversight
- US Sanctions Venezuelan Gang Members Behind ATM Jackpotting Campaign
- OpenAI Dismisses Three Safety Researchers Over Confidential Information Breach
- Modernizing Software Supply Chains in Financial Services Companies
- Microsoft automatically enables Windows configuration backup for enterprise systems
- White House and Tech Giants Agree on Voluntary AI Safety Measures
- OpenAI Halts GPT-6.1 Astra Launch Following Failed Safety Audits
- Webinar on AI Agent Governance: Control and Access Challenges in Enterprise Environments
- US and China Establish Communication Channel for AI-Related Incidents
- Microsoft Pauses Update After Deactivating Perpetual Office Licenses
- SOC 2 Must Evolve as AI Agents Become Mainstream
- Microsoft to Discontinue Windows Deployment Services After 2025
- CISA Highlights Patching Challenges and Voter Database Threats in Election Security Plan
- Microsoft confirms desktop loading problems after recent Windows updates
- FedRAMP Tightens Vulnerability Management with New VDR and VER Standards
- Microsoft September Updates Break Always On VPN Connections in Windows 11
- One-Third of Industrial Organizations View Cybersecurity as a Major Growth Barrier
- DORA Year Two: Can Your SOC Actually Detect Attacks?
- Microsoft to retire Microsoft 365 companion apps in December
- Google Fined €403 Million for GDPR Violations Over Location Data Handling
- Irish Data Protection Authority Fines Google €403 Million for Location Data Privacy Violations
- FBI Updates CJIS v6.1 with Stricter Encryption and Vulnerability Scanning Requirements
- Microsoft urges admins to migrate Entra ID users to phishing-resistant authentication
- Microsoft September Updates Disrupt Windows File History Backup Feature
- Autonomous AI System Deployment Grows Faster Than Oversight Controls
- CISA Abandons Weekly Vulnerability Roundups in Favor of Risk-Based Prioritization
- Windows 11 24H2 Home and Pro Support Ending in October
- OpenAI Discloses Six Incidents of Anomalous Behavior in AI Models
- Microsoft Releases Workaround for Windows Domain Login Authentication Issues
- Court Orders Transfer of Radaris Domains Following Privacy Law Violation in New Jersey
- Windows Server 2022 Reaches End of Mainstream Support Next Month
- Microsoft Releases Emergency Patches Following Major Patch Tuesday Update Issues
- Microsoft Security Update Causes Copy and Paste Failures in Excel
- Anthropic CEO Advocates for Slowing AI Development to Prioritize Safety and Control
- Microsoft September Updates Trigger Remote Desktop Services Outages on Windows Server
- Microsoft September Updates Cause Audio Failures on Some Windows Systems
- CISA Demands Greater Transparency in Incident Notifications as Cyber Outages Rise
- AI Governance in Security Cannot Be Delayed
- September Windows Server Updates Trigger Remote Desktop Services Failures
- EU Cyber Resilience Act Mandates 24-Hour Incident Reporting for Businesses
- EU Cyber Resilience Act: New Vulnerability Reporting Obligations Begin September 11
- Microsoft Releases Windows 10 KB5122878 Extended Security Update
- Microsoft Releases Windows 11 Cumulative Updates with Security Patches
- Insurers Seek Strategies to Manage Risks from Autonomous AI Systems
- French hospital fined €500,000 for failing to protect sensitive patient data
- 68-year-old sentenced to over six years in prison for running illegal IPTV service generating $1.3 million
- Lawmakers Push for AI Control Mechanisms in Corporate Environments
- U.S. Imposes Sanctions on Iran-Linked Hackers Behind Critical Infrastructure Breaches
- TikTok agrees to pay $400 million settlement over children's privacy law violations
- TikTok to Pay $400 Million to Settle U.S. Child Privacy Violation Lawsuit
- OpenAI Implements Security Controls That Should Have Been in Place Earlier
- Hardware Makers Adopt Post-Quantum Cryptography Ahead of Emerging Threats
- Budget and Mindset: The Main Hurdles Facing Cyber Law Enforcement
- Google Cloud Announces Post-Quantum Cryptography Readiness Plan by 2029
- U.S. Authorizes Private Firms to Conduct Offensive Operations Against Transnational Criminal Organizations
- White House Authorizes Private Security Firms for Offensive Operations Against Cybercriminals
- Global regulatory framework to protect ethical security researchers
- OpenAI Pauses Internal Activities for Astra Model Following Advanced Cybersecurity Capability Assessment
- Cassady Confirmed as U.S. Cyber Ambassador
- New Mexico Judge Orders Meta to Pay $567 Million in Children's Online Safety Case
- New York Funds $9 Million Cybersecurity Initiative Across 153 Water Systems
- CISA Updates SBOM Guidance with New Fields, but Experts Question Real Risk Management Impact
- CISA alerts to spike in attacks targeting water systems
- Interpol Deploys Global System to Stop Fraudulent Payment Flows
- DROP Platform Enables Californians to Minimize Their Digital Footprint
- European Union Establishes Specialized Task Force to Combat AI Deepfakes, Illicit Content, and Cyber Attacks
- Finland to Disconnect Fiber-Optic Links with Russia as Lease Expires
- FCC Blocks New Foreign-Produced Robots and Power Inverters Over Cyber Risks
- US Restricts Imports of Foreign-Made Humanoid Robots Over Cybersecurity Threats
- Three in Four Organizations Admit They Lack Full Readiness for Major Cyberattacks
- Russia Charges Telegram Founder With Facilitating Terrorist Activities
- US and Australia Release OT Isolation Guidance for Critical Infrastructure
- CISA and Australia Release Guidance on Isolating Critical Systems During Cyberattacks
- Senator Wyden Calls for Removal of Outdated VPNs from Federal Agencies
- UK court rejects Bahrain's diplomatic immunity claim in spyware case
- Communication Gaps Between Boards and Security Teams Hinder Defensive Strategy
- GitHub Significantly Cuts Public Bug Bounty Program Rewards
- Security Leaders Who Enable AI Adoption Gain Strategic Influence in Their Organizations
- LG to Block Apps That Turn Smart TVs into Residential Proxy Nodes
- U.S. Seizes Over 1,000 Sites Streaming Illegal World Cup Content
- Microsoft addresses synchronization issues in Windows Update servers
- Military forces accelerate autonomous systems deployment while struggling to maintain reliable infrastructure
- European Commission Orders Google to Open Android Access to Competing AI Assistants
- Gold Eagle: The White House Initiative to Coordinate Responses to AI-Era Vulnerabilities
- UK Intensifies Technological Independence Amid US Restrictions on AI Models
- Nigeria Strengthens Cybersecurity Regulations with Mandatory Incident Disclosure Requirements
- Practical Strategies for Managing Risks in Technology Vendor Relationships
- Frontier AI advances without clear regulation as governments seek to establish controls
- UK and EU Jointly Sanction Russian Actors for Cyberattacks and Disinformation
Classroom (111)
- Gartner Forecasts SOCs Will Employ 50% More Engineers Than Analysts by 2028
- How to Prioritize Security Exposures: The Four Key Elements
- Is Your SOC Ready for AI Agents? Assess Your Maturity Before Implementation
- From Beginner to Bug Hunter: Leveraging AI Tools to Build Cybersecurity Skills
- Passkeys Beat Passwords, Yet They Remain Insufficient on Their Own
- How to Accelerate Critical Security Patch Deployment in Operations Teams
- Cybersecurity Awareness Reimagined Through Artificial Intelligence
- Capture-the-Flag Competitions Emerge as Key Skill-Building Tool Amid AI-Driven Learning Shifts
- Threat Modeling With Four Key Questions on the Whiteboard
- Artificial Intelligence Reshapes the Security Analyst Role in Operations Centers
- Three Approaches for CISOs to Protect Organizations Against AI Liability Risks
- AI Automation Threatens to Erode Fundamental Technical Skills Among Cybersecurity Professionals
- Proliferation of AI Security Benchmarks Without Definitive Answers
- Artificial Intelligence Transforms the CISO's Strategic Role in Modern Enterprise
- Ten Software Security Practices Built to Withstand Two Centuries
- How Attackers Operate in the Blind Spots Between Security Alerts
- Optiv Launches CyberBOT Cybersecurity Awareness Training Program
- The Real Challenge in AI-Powered Penetration Testing: Building the Control Framework
- OpenAI Highlights GPT-6.1 Sol's Major Improvements in Legacy Code Migration
- Experts warn to close identity gaps in software development before deploying AI
- How Security Teams Can Manage the Uncontrolled Proliferation of Code and Automations
- Cybersecurity Industry Prioritizes Vulnerability Discovery Over Strategic Resilience
- AI Decision Models Transform Security Operations Center Platforms
- SecTor 2026 Conference Records Record Attendance Amid Shifting Cybersecurity Landscape
- F-Secure publishes scam encyclopedia focused on victims' experience
- Context Is Key to Defending Against Modern Cyberattacks
- Zero Trust Strategies Summit: Sessions Now Available On Demand
- Vulnerability Management Goes Beyond Scores — It's About Your Specific Context
- AI-Powered Penetration Testing: Strengths and Limitations Compared to Human Experts
- Deepfake Readiness Drills: Assessing Your Team's Vulnerability to Synthetic Voices
- Webinar: How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls
- Identity Management as the Foundation of Enterprise Cyber Resilience
- Executives at Risk: Why Their Families Need Cybersecurity Training Too
- Study Shows Cyber Risk Has Become Embedded in Enterprise Workflows
- Autonomous Pentesting with AI Agents: Capabilities, Limitations, and Reality
- Expert Insights: How AI Is Transforming CISO Budget Allocation and Security Team Structure
- Eight essential security controls for RMM platforms that managed service providers must evaluate
- Cybersecurity 2026: How Cloud, AI, and Distributed Systems Reshape Defense
- Why Blaming 'Rogue' AI for Security Failures Misses the Point
- Vulnerability Management Requires Clear Ownership, Not Just Better Tools
- The Challenges CISOs Face in Answering Critical Board Questions
- Zero Trust Creator Says Framework Remains Effective Against AI-Powered Attacks
- AI Transforms SOC Career Paths: Job Satisfaction Rises, But Entry Barriers Grow for Newcomers
- Six Most Dangerous Browser-Based Attack Techniques in 2026
- Practical identity management framework for AI agents in enterprise environments
- Cybersecurity Outlook 2027: Virtual Event on Future Trends and Challenges
- Claude Opus 5.5 Refines Writing Style with Less Detectable AI Patterns
- AI Agents Require Full Visibility Before Implementing Zero Trust
- CISO-CFO Alignment: A Cornerstone of Effective Cybersecurity Strategy
- AI Sandbox Escapes: Why Forensic Readiness Outweighs Containment
- Practical Guide to Implementing a SASE Framework in Modern Infrastructure
- Strategic Alignment Between CISO and CMO: Key to Managing Security Crises
- CISA Releases Guide for Organizations to Deploy Deception Tactics Against Cybercriminals
- Closing visibility gaps in shadow IT with centralized monitoring
- AI Misalignment Incidents Escalate Debate on Safety Controls
- Identity Visibility in 2026: The Foundation of Identity Security
- Webinar: Which Google Workspace security controls actually matter?
- How to Determine if a Newly Disclosed Vulnerability Is Exploitable in Your Environment
- Maintaining Career Momentum During Challenging Times in Tech
- Webinar: Critical decisions in the first hours following a Google Workspace breach detection
- Why Testing Individual Techniques Falls Short: The Critical Need to Evaluate Complete Attack Chains
- Patch Automation: Balancing Speed with Quality Control
- Webinar: How malicious OAuth apps compromise Google Workspace security
- Study Reveals Limitations of Conventional Phishing Awareness Testing Metrics
- Critical Vulnerabilities May Not Be Your Biggest Risk
- How to Answer 'Are We Exposed?' Faster After a New CVE
- Open Letter on AI Fails to Name Key Players in Cybersecurity Response
- Practical Guide to Securing Enterprise AI Adoption Without Compromising Cybersecurity
- Security Researcher Reconsiders the Role of Guardrails Against Unrestricted Threats
- Securing file server management: five key practices to simplify administration
- Virtual Event: Building Secure AI Strategy for Enterprise Operations
- Virtual event on cloud security in the age of artificial intelligence
- Unified Identity Architecture: Essential for Enterprise Security in 2026
- Threat Intelligence and MDR Services: Essential Tools for SMBs to Strengthen Cybersecurity Defenses
- How to Prepare Security Operations for AI-Powered Attacks
- Reimagining the SOC: How AI Can Transform Alert Management
- Frontier AI Transforms Vulnerability Management Practices
- Windows Named Pipes Under Attack: Securing Interprocess Communication
- OWASP Unveils New Security Risk Framework for AI Skills and Technical Competencies
- Separate Digital Identities as a Strategy to Protect Online Privacy
- Cybersecurity Professionals Mobilize to Protect City Hall
- Strategies for MSPs to detect phishing attacks that bypass email filters
- Strategic Leadership in Banking Security: Standard Chartered's CISO Vision
- IAM Compliance: Key Regulations and Continuous Verification Strategies
- How Corporate Boards Should Approach Technology Risk Assessment
- Walmart shares its strategy for scaling cybersecurity defenses through trust and innovation
- Webinar: Keeping Security Fast While AI Accelerates Development
- Sherlock Holmes' Lessons in Modern Social Engineering
- Open Source Software Faces Forced Maturation Amid Security Pressures
- DNC Developed Security-First Culture Through Executive Support and Creative Engagement
- Artificial Intelligence Reveals a Critical Browser Security Gap Enterprises Cannot Ignore
- The CISO Paradox: Accountability Without Real Authority Drives Burnout
- AI in Security Operations: Where It Actually Delivers Value
- Certificate and Key Inventory Management: Foundation of Security
- Effective Compliance: Why Core Questions Outperform Complex Frameworks
- Claude Mythos: Evaluating Real Security Impact Beyond the Hype
- Two Decades of Cybersecurity: What Has Changed and What Endures
- Red Agents vs. Blue Agents: A New Approach to Strengthening AI-Based Cybersecurity
- Defensive Lessons from the Hugging Face Incident
- Researchers Propose Examining Internal Structures of AI Models to Enhance Safety
- Securing SSO Against Modern Credential Attacks: Essential Safeguards
- Former Citigroup Security Executive Discusses Essential Qualities of an Effective CISO
- How to Identify and Avoid Fraudulent SMS and WhatsApp Messages
- What Is Social Engineering and How to Defend Yourself
- What Is CVSS and How to Interpret a Severity Score
- What Is a CVE and How Security Vulnerabilities Are Identified
- What Is a VPN and When Do You Actually Need One
- What Is Phishing and How to Identify a Fake Message
- What Is Two-Factor Authentication and Why It's Essential Today
- Is Patching Dead? Rethinking Vulnerability Management Against Automated Threats
- Yellow Teams: The Emerging Strategy for Assessing AI Security
Other (44)
- OpenAI Doubles ChatGPT Pro Usage Limits and Merges Work Features Into Chat
- OpenAI Maintains ChatGPT Pro Usage Limits Following User Backlash
- OpenAI Introduces GPT-6.1 Terra, Optimized Model for Work Tasks with Improved Performance and Lower Cost
- US Cybersecurity Job Postings Drop 26% While AI Security Engineer Positions Surge
- Malicious Arch Linux packages distribute malware with root-level access
- International Operation Arrests 95 Suspects in Child Sexual Abuse Material Distribution Crackdown
- OpenAI Employee Arrested for Installing Hidden Recording Device in Executive Conference Room
- Ahold Delhaize Disconnects Systems Following Cybersecurity Incident
- Yandex Faces Service Disruption After Drone Attacks Damage Data Centers
- Dark Reading Announces New Editorial Leadership
- OpenAI Terminates Three Safety Researchers Over Policy Violation
- AI-Driven Consolidation Fuels Cybersecurity M&A Frenzy
- Dark Reading announces a new chapter in its editorial trajectory
- Researchers Uncover 16 Malicious Firefox Extensions Targeting Crypto Wallet Recovery Phrases
- MonsterCloud Founder Accused of Defrauding Ransomware Victims Out of Over $19 Million
- OpenAI introduces visual ads in ChatGPT during image generation
- Anthropic Requests Claude Users to Share Voice Data for AI Model Training
- OpenAI Develops Always-On ChatGPT Assistant Called "o"
- OpenAI Preparing $500/Month ChatGPT Pro Max Subscription with Enhanced Codex
- Microsoft-Signed Driver Abused in Fake LastPass Authenticator to Disable Antivirus
- AI Actress Hotline Service Face-Scans Users for Age Verification, Monitors Emotions
- OpenAI Reports ChatGPT Outage Causing Image Generation Failures and File Upload Delays
- OpenAI Rolls Out ChatGPT Astra, Its Most Powerful Model, to Plus Subscribers
- Microsoft Investigating Issue Preventing Teams Desktop Client Launch on Windows
- Microsoft Addresses Exchange Online Outage Causing Email Delays and Server Busy Errors
- OpenAI Confirms Major ChatGPT Outage Before Astra Model Launch
- Anthropic Confirms Claude Outage Affecting Multiple AI Models
- Microsoft Exchange Online Global Outage Disrupts Email and Authentication Services
- OpenAI Confirms Partial ChatGPT Outage Affecting Multiple Users
- Microsoft launches Classic Outlook theme option for new Outlook users
- Major Claude Outage: Anthropic Confirms Service Disruption
- July 2026 Records 21 Mergers and Acquisitions in Cybersecurity
- OpenAI rolls out significant ChatGPT improvements for free and paying users
- Horizon3 Secures $250 Million in Funding to Accelerate Expansion
- OpenAI Unveils Astra, Advanced AI Model That Solves Complex Mathematical Problems
- OpenAI Slashes Costs of Its New GPT 5.6 Models
- Anthropic's Claude Service Experiences Global Outage
- ThreatLocker Secures $190 Million in Series F Funding
- ASUS Chromebooks Refurbished Units Available at Reduced Prices
- OpenAI Reports Widespread ChatGPT Outage
- Defect in Microsoft's automated maintenance system caused massive Microsoft 365 outage
- Microsoft 365 Outage Disrupts Teams, SharePoint and Other Services
- Brazilian Banking Trojan Actively Spreading in Portugal
- Jen Ellis and Her Work Bridging Security Researchers and Political Engagement
Threat groups
CVEs mentioned
- CVE-2026-96652
- CVE-2021-31886
- CVE-2026-18556
- CVE-2026-76640
- CVE-2025-61624
- CVE-2026-59309
- CVE-2026-81648
- CVE-2026-102255
- CVE-2026-53264
- CVE-2026-58048
- CVE-2026-63030
- CVE-2026-76418
- CVE-2026-101767
- CVE-2026-18963
- CVE-2026-48449
- CVE-2026-48294
- CVE-2026-21962
- CVE-2026-17583
- CVE-2026-61979
- CVE-2026-94127
- CVE-2026-28326
- CVE-2026-86218
- CVE-2026-16232
- CVE-2026-87491
- CVE-2026-98432
- CVE-2026-51990
- CVE-2026-35273
- CVE-2026-105134
- CVE-2026-16812
- CVE-2025-39682
- CVE-2026-48362
- CVE-2026-88779
- CVE-2026-87886
- CVE-2026-87902
- CVE-2026-58115
- CVE-2026-50522
- CVE-2026-107406
- CVE-2026-68820
- CVE-2026-104935
- CVE-2026-60004
- CVE-2026-58644
- CVE-2026-29059
- CVE-2026-9198
- CVE-2026-97229
- CVE-2026-19478
- CVE-2026-110447
- CVE-2026-21589
- CVE-2026-64531
- CVE-2026-9586
- CVE-2026-15748
- CVE-2026-64638
- CVE-2026-59310
- CVE-2026-27577
- CVE-2026-109619
- CVE-2026-61500
- CVE-2026-85880
- CVE-2026-65643
- CVE-2026-85706
- CVE-2026-60137
- CVE-2026-102764
- CVE-2026-104351
- CVE-2026-44747
- CVE-2026-58704
- CVE-2026-7273
- CVE-2026-6875
- CVE-2026-89026
- CVE-2026-76461
- CVE-2026-14266
- CVE-2026-0322
- CVE-2026-64561
- CVE-2026-88772
- CVE-2026-104286
- CVE-2026-6471
- CVE-2026-86950
- CVE-2026-20079
- CVE-2026-115560
- CVE-2026-63688
- CVE-2026-65400
- CVE-2026-0257
- CVE-2026-82329
- CVE-2026-69836
- CVE-2026-10702
- CVE-2026-116606
- CVE-2026-93616
- CVE-2026-19490
- CVE-2026-58231
- CVE-2026-50656
- CVE-2026-59726
- CVE-2026-80521
- CVE-2026-69414
- CVE-2026-65660
- CVE-2026-83548
- CVE-2026-109618
- CVE-2026-39919
- CVE-2026-53412
- CVE-2026-44756
- CVE-2026-75650
- CVE-2026-93952
- CVE-2015-3306
- CVE-2026-76639
- CVE-2026-106173
- CVE-2026-20316
- CVE-2026-111497
- CVE-2026-20127
- CVE-2026-58868
- CVE-2026-105133
- CVE-2026-63077
- CVE-2026-0768
- CVE-2026-89775
- CVE-2026-85046
- CVE-2026-90898
- CVE-2026-58138
- CVE-2026-8037
- CVE-2026-112900
- CVE-2026-85097
- CVE-2026-20349
- CVE-2026-42533
- CVE-2026-74580
- CVE-2026-55040
- CVE-2026-76504
- CVE-2026-53921
- CVE-2026-88771
- CVE-2026-18577
- CVE-2023-49105
- CVE-2026-32475
- CVE-2026-119977
- CVE-2026-8933
- CVE-2026-64600
- CVE-2026-85102
- CVE-2026-5430
- CVE-2026-76460
- CVE-2026-66066
- CVE-2026-110936
- CVE-2026-59346
- CVE-2026-99999
- CVE-2026-48842
- CVE-2026-96940
- CVE-2026-85889
- CVE-2026-105740
- CVE-2026-80097
- CVE-2026-73570
- CVE-2026-59774
- CVE-2026-81642
- CVE-2026-16723
- CVE-2026-85103
- CVE-2026-58882
- CVE-2026-42016
- CVE-2026-93485