Stay informed with the latest cybersecurity news and threat intelligence.
Vercel has disclosed nine security vulnerabilities in Next.js, the widely used React framework, including two critical-severity flaws that allow attackers to bypass authentication middleware and hijac
CERT-UA has disclosed a significant shift in the tactics of threat cluster UAC-0099, revealing a novel infection chain that abuses a legitimate Notepad++ 8.8.3 executable to sideload malware, alongsid
Chick-fil-A has notified customers of a data security incident in which unauthorized parties gained access to Chick-fil-A One loyalty accounts through a credential stuffing attack, exposing personal i
An exposed directory on an operator-controlled Alibaba Cloud server revealed the inner workings of the JadeProx intrusion set, including bash history, webshell paths, phishing kits, and a full post-ex
Anthropic has expanded its AI-driven vulnerability detection capabilities by launching Claude Security as a native Claude Code plugin, now available in beta for all Claude Code users. The move brings
Sangoma has patched two critical vulnerabilities in FreePBX that allow unauthenticated remote attackers to execute arbitrary commands and take over administrator accounts, prompting a “Red”
A newly disclosed heap buffer overflow in the FreeRDP Windows client’s clipboard channel allows a malicious RDP server to corrupt heap memory and potentially achieve remote code execution (RCE) on con
A newly disclosed CVE-2026-64600, dubbed “RefluXFS,” a critical race condition in the Linux kernel’s XFS filesystem that allows unprivileged local users to escalate to full root priv
A newly disclosed vulnerability in Exim, one of the most widely deployed mail transfer agents (MTAs) on Unix-like systems, allows local attackers to escalate privileges by accessing files outside the
GitHub Actions abuse is powering a large-scale attack campaign that exploits the cPanel CVE-2026-41940 authentication bypass to steal server credentials and other sensitive secrets from internet-facin
A critical Bluetooth vulnerability in the dealer-installed KARR Security System exposes more than 2.2 million vehicles across the United States to remote unlocking, immobilization, and horn/light mani
Moonshot AI’s newly released Kimi K3, a 2.8-trillion-parameter mixture-of-experts model, has demonstrated the growing offensive capability of autonomous AI agents by independently uncovering rem
Apple has patched a long-standing vulnerability in its iCloud+ Hide My Email feature that allowed anyone to unmask a user’s real email address. The patch, applied on July 3, 2026, comes more tha
A critical vulnerability in AWS’s agentic IDE Kiro lets attackers hide malicious instructions inside ordinary web pages, tricking the AI agent into rewriting its own configuration file and execu
CISA has added two chained WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, to its Known Exploited Vulnerabilities (KEV) catalog, warning that the flaws enable unauthenticated, pre-a
ASUS has patched a critical router vulnerability, tracked as CVE-2026-13385, that allows remote man‑in‑the‑middle (MITM) attackers to force affected devices to download and execute arbitrary commands
A critical broken access control vulnerability in Meta’s customer support infrastructure allowed attackers to read private support emails, chats, and case data belonging to other users, and even
Zimbra has released Zimbra Collaboration Suite (ZCS) version 10.1.20, addressing a critical command injection vulnerability in its SNMP monitoring component along with multiple cross-site scripting (X
Google has rolled out a Stable channel update for Chrome Desktop, patching 12 security vulnerabilities, all rated High severity. The update brings Chrome to version 150.0.7871.181/.182 for Windows and
Google has unveiled Gemini 3.5 Flash Cyber, a lightweight cybersecurity model fine-tuned to detect, validate, and patch software vulnerabilities faster and more efficiently than mainline Flash models.
Hackers are increasingly abusing Microsoft’s legitimate device code flow to bypass multi-factor authentication (MFA) and hijack Microsoft 365 accounts, turning trusted identity controls into a covert
Iran-linked hackers are quietly building long-term, flexible access into critical networks and exposed operational technology (OT), using trusted pathways to pivot between espionage and selective disr
Craneware plc (AIM: CRW.L), the Edinburgh-headquartered healthcare financial performance software provider, disclosed on 20 July 2026 that it suffered a cybersecurity incident resulting in unauthorize
The tool combines payload encryption with advanced Windows evasion methods, helping attackers bypass endpoint defenses and complicate incident response. Cruciferra is a Mono-based crypter marketed on
A newly identified Windows malware sample, dubbed HOLLOWGRAPH, is abusing the Microsoft Graph API to turn a compromised Microsoft 365 calendar into a covert two-way command-and-control channel. Group-
A newly disclosed detection gap in Microsoft Defender XDR could be causing security teams to silently miss command-and-control (C2) traffic and other malicious external communications, according to re
Microsoft has confirmed that the Podcasts feature within its Copilot app will be officially discontinued starting August 18, 2026, cutting off access for users to create new podcasts or retrieve previ
A massive data breach at gig economy platform Paidwork has compromised the personal and financial information of over 23 million users, marking one of the largest breaches to hit the gig work sector t
Threat actors deploying Qilin ransomware exploited a Palo Alto Networks GlobalProtect authentication bypass flaw, CVE-2026-0257, as the consistent initial access vector across multiple June 2026 intru
Ransomware groups publicly named 7,551 victims from April 2025 through March 2026, a 24.9% rise from the previous reporting period. The surge was led by Qilin, which claimed 1,358 victims up 443% year
Chris Fall, director of the Center for AI Standards and Innovation (CAISI), has resigned from his post just three months after being appointed by the Trump administration. The departure adds fresh ins
A recent attack investigated by ANY.RUN experts revealed how attackers used more than 20 hijacked Brazilian government websites to support a campaign targeting banking organizations.  By hid
A massive data breach at gig economy platform Paidwork has exposed the personal and financial information of more than 23 million users, marking one of the largest breaches to hit the gig work sector
Microsoft SharePoint Server flaws are being actively exploited to deploy web shells, steal IIS machine keys, and maintain long-term access to compromised enterprise environments. The attacks affect on
A critical pre-authentication remote code execution (RCE) vulnerability in WordPress has been uncovered not by a human researcher but by an AI system. The discovery, attributed to OpenAI’s GPT-5
Plugging in a monitor is not supposed to change the software on your computer. According to testing by CyberDigest, LG monitors do exactly that, triggering a silent installation process that ends with
A newly disclosed toolkit called Furtex is drawing attention for packaging a wide range of post-exploitation, evasion, and telemetry-blinding techniques into a single project built around raw io_uring
Microsoft has announced it will discontinue updates to the OneDrive sync app for devices running Windows 10 version 21H2 and earlier, effective August 15, 2026. The change, detailed in Message Center
Microsoft has shipped an out-of-band (OOB) emergency update for Windows 11 to resolve performance regressions tied to an Intel Innovation Platform Framework (Intel IPF) driver. The update, tracked as
A newly surfaced open-source project called PENTDEM is drawing attention for packaging 34 real-world penetration testing tools into an autonomous, LLM-guided daemon that can run full attack chains wit
Cloud Software Group has disclosed two security vulnerabilities affecting Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows, the more severe of which allows a sta
A critical pre-authentication remote code execution (RCE) vulnerability in WordPress Core, dubbed “wp2shell.” The flaw requires no preconditions and can be exploited by an anonymous attack
Ernst & Young LLP, one of the world’s Big Four professional services firms, has disclosed a data breach in which an unauthorized third party infiltrated a vendor-managed IT service platform
A newly disclosed critical weakness in OpenSSL lets an attacker crash a server without ever completing a handshake or proving their identity. Documented by the Okta Red Team, named “HollowByte,&
Amazon Web Services (AWS) confirmed on July 17, 2026, that a defect in its Cost Explorer tool caused some customers to see massively inflated billing projections, with reports showing estimated charge
OpenAI has confirmed that its GPT-5.6 Codex model has, in a handful of documented cases, unexpectedly deleted files from users’ home directories, raising fresh concerns about the operational saf
A newly disclosed local privilege escalation technique allows non-administrator Windows users to tamper with an administrator’s registry hive, opening the door to code execution at the administr
A newly identified ransomware family, Spirals, was used in a double-extortion attack against an IT services company in South Asia in June 2026. Researchers from Symantec’s Threat Hunter Team said the
TP-Link has disclosed two security vulnerabilities affecting its Kasa EC70 v4 and EC71 v4 smart camera models, which could let attackers on the same local network intercept administrative credentials
Cisco Talos has uncovered a new financially motivated threat cluster, tracked as UAT-11795, that has been conducting a large-scale malware campaign targeting users across the United States and parts o
Socket’s Threat Research Team has uncovered 11 malicious NuGet packages masquerading as game cheats, bots, and “panels” that deliver a Windows surveillance-capable payload named pepesoft.exe. The pack
A critical batch of vulnerabilities in its PowerProtect Data Domain product line, including two flaws with the maximum-severity CVSS score of 9.8, allows completely unauthenticated attackers to seize
The U.S. Department of Justice unsealed an indictment on July 14, 2026, charging three Russian nationals and two affiliated “bulletproof hosting” companies for running criminal infrastruct
Google has rolled out a new Chrome Stable channel update addressing 15 security vulnerabilities, including two critical-severity use-after-free (UAF) flaws in the Ozone platform layer. The update brin
Indian government job seekers are being targeted in a multi-stage malware campaign that uses a fake Cabinet Secretariat recruitment notice to deploy both a legitimate remote-management tool and a cust
Microsoft has disclosed an actively exploited elevation-of-privilege vulnerability in Active Directory Federation Services (AD FS), tracked as CVE-2026-56155. The flaw was released on July 14, 2026, a
Microsoft has addressed five information disclosure vulnerabilities affecting the Windows Remote Desktop Protocol (RDP) in its July 2026 Patch Tuesday release, each carrying an “Important”
Blackpoint’s Adversary Pursuit Group has identified a new Rust-based remote access trojan, dubbed LabubaRAT, masquerading as NVIDIA software. The malware, delivered as nvidia-sysruntime.exe, uses NVID
SonicWall has issued an urgent security advisory (SNWLID-2026-0008) confirming active, in-the-wild exploitation of two critical vulnerabilities affecting its SMA1000 Series appliances. The flaws, trac
Microsoft has confirmed a new compatibility issue affecting select Dell PCs after installing a recent Windows 11 preview update, causing unexpected shutdowns, degraded performance, overheating, and ra
The Cybersecurity and Infrastructure Security Agency (CISA) has publicly detailed an internal security incident involving the exposure of AWS GovCloud credentials in a public code repository, offering
A newly disclosed critical flaw in how Dell stores BIOS administrator and user passwords allows full recovery of plaintext credentials from a flash dump in milliseconds. Tracked as CVE-2026-40639 (DSA
A multi-stage Trojan is turning ordinary software development workflows into a supply chain attack vector by weaponizing Visual Studio project files. Documented by Doctor Web researchers, first detect
Zimbra has released version 10.1.19 of its Collaboration Suite (ZCS), codenamed “Daffodil,” addressing a stored cross-site scripting (XSS) vulnerability in the Classic Web Client. The patc
A new disclosure of widespread security and privacy failures across popular Android VPN applications, revealing that dozens of apps transmit sensitive data in plaintext and fail to deliver the fundame
There is no single best next-generation firewall there’s a best one for your size, your team, and your regulatory reality. A 40-person company buying a Palo Alto chassis wastes money; a bank running a
Citrix, a Cloud Software Group company, has introduced Model Context Protocol (MCP) Gateway capabilities for NetScaler, extending its application delivery and security platform to govern enterprise ag
A highly sophisticated malware campaign was recently discovered lurking within the NuGet ecosystem, targeting developers who use the popular Braintree payment gateway. Security researchers at Socket f
A newly identified phishing-as-a-service (PhaaS) platform, Forg365, is abusing Microsoft’s device code authentication flow to hijack Microsoft 365 sessions at scale. ZeroBEC researchers uncovere
Multiple critical security flaws in GNU Guix could allow malicious substitute servers or network attackers to achieve remote privilege escalation, corrupt the Guix store, and potentially expose sensit
Hackers are exploiting the CitrixBleed 2 vulnerability to steal active session tokens, bypass multi-factor authentication, and deploy ransomware in targeted Citrix NetScaler environments. Huntress Tac
A newly disclosed Linux kernel vulnerability in the Filesystem in Userspace (FUSE) subsystem could allow unprivileged local attackers to gain root privileges on affected systems. Tracked as CVE-2026-3
Microsoft has unveiled a major expansion of AI-driven security tooling across Windows, aiming to find vulnerabilities earlier, fix them faster, and deliver more reliable patches at scale. The initiati
A newly disclosed six vulnerabilities in U-Boot, one of the most widely deployed bootloaders in embedded systems, routers, IoT devices, and Baseboard Management Controllers (BMCs) used in data center
Security researchers have disclosed three high-severity vulnerabilities in OpenClaw, the popular open-source AI coding assistant with over 381,000 GitHub stars, that allow attackers to achieve full re
Roundcube has released version 1.7.2, a security-focused update addressing six vulnerabilities, including two CVE-tracked flaws that could allow attackers to execute stored cross-site scripting (XSS)
Wireshark has released version 4.6.7, addressing 12 security vulnerabilities that could lead to application crashes, information disclosure, and resource exhaustion via maliciously crafted network tra
A newly disclosed attack technique, called adversarial hallucination squatting (HalluSquatting), developed by researchers at Tel Aviv University and Technion, exploits the predictable tendency of larg
A threat actor leveraging AI-assisted tooling breached a large AWS-based environment and expanded across applications, cloud infrastructure, source-control repositories, CI/CD pipelines, and runtime s
Threat actors are now weaponizing AI-generated PowerShell scripts to enumerate Active Directory (AD) environments, according to new findings from Huntress. The discovery, tied to an incident on June 3
U.S. insurer AssuranceAmerica has confirmed a data breach exposing the personal information and driver’s license numbers of roughly 6.9 million people, marking the largest known exposure of Amer
The legitimate VPN service is highly popular for its ability to bypass China’s Great Firewall. However, attackers are exploiting its reputation to deploy hidden malware. This fake installer drop
GitLab released versions 19.1.2, 19.0.4, and 18.11.7 on July 8, 2026, patching eight vulnerabilities ranging from high to low severity across Community Edition (CE) and Enterprise Edition (EE). The co
Threat researchers have uncovered a new data extortion group named “Helix” that bypasses traditional security perimeters without deploying a single piece of malware. Emerging from the remn
A threat actor operating under the alias “Nocturne” has posted a database listing on a dark web forum claiming to have exfiltrated customer data from Nike and confidential records from oph
Palo Alto Networks has disclosed multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of PAN-OS. Tracked as CVE-2026-0288, it could allow unauthenticated attac
A researcher has published proof-of-concept exploit code and a full technical breakdown of a Linux kernel vulnerability that lets any logged-in desktop user escalate to root, requiring no special priv
A Windows update reportedly triggered the silent installation of an LG-branded application on user systems, which then displayed an unsolicited McAfee promotional pop-up even on machines where McAfee
A novel attack chain that turns Anthropic’s Claude Desktop application into a remote code execution vector, requiring no phishing email and no traditional malware. The technique instead weaponiz
Anthropic has rolled out Claude Cowork to web and mobile platforms, letting AI agent sessions persist across devices and continue executing tasks even when users step away. The expansion, announced Ju
A native YouTube ad-blocking feature was rolled out by DuckDuckGo across its desktop and mobile browsers, allowing users to watch YouTube videos without pre-roll or mid-roll interruptions. The feature
A new disclosure reveals that a GitHub “Verified” badge does not guarantee that a commit hash uniquely identifies signed content, undermining a core assumption behind hash-based security c
The extradition of an alleged Scattered Spider member from Finland to the United States has drawn attention far beyond the criminal charges themselves. Buried on page 8 of the indictment lies a detail
A severe zero-day vulnerability dubbed Bad Epoll has been publicly disclosed in the Linux kernel’s epoll I/O event notification subsystem, allowing any unprivileged local user to escalate privil
North Korean hackers have launched a sophisticated new macOS malware campaign that targets Mac users, specifically developers and those in the Web3 space. Historically, these threat actors rely on fak
Two newly disclosed vulnerabilities in ModSecurity, the widely deployed open-source Web Application Firewall (WAF) engine, could allow attackers to bypass detection rules entirely. Both flaws affect M
In May 2026, researchers at FortiGuard Labs uncovered a sophisticated new campaign delivering the Ousaban banking Trojan to users in Spain and Portugal. Originally known for targeting Brazil, this lat
Seven newly disclosed vulnerabilities in FatFs, the ubiquitous FAT/exFAT filesystem library, could let a malicious USB drive, SD card, or firmware update trigger memory corruption and code execution o