Curated cybersecurity briefings on active threats, vulnerabilities, and emerging risks
A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatc…
Someone compromised the official HBO Max Reddit account and used it to push more than 100 malicious ads serving up ClickFix attacks targeting both Wi…
Japan's Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government em…
Homebrew package manager version 7.0.0 has been released with a built-in vulnerability scanner, stronger security controls, and the full release of i…
Prosecutors unsealed a 2021 indictment accusing the five men of conducting lucrative romance scams that stole thousands of dollars from more than 100…
Uncensored refers to a lack of typical guardrails or ethical restrictions, lowering the technical barrier of entry into cybercrime
A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users' Twitch OAuth session t…
Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS de…
Computer security researchers have identified a design flaw in modern encryption hardware that allows access to protected memory in notionally confid…
OpenAI agents appear to have flooded RubyGems with malicious packages, adding to a near-daily deluge of rogue AI models engaging in potentially unlaw…
An attacker was operating inside the network of 3BB, one of Thailand's largest broadband providers, and maintained remote control of internal machine…
Researchers have disclosed a new hardware attack, called DDRop, that breaks the memory protection in Intel and AMD confidential computing by silently…
A Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to …
In the biggest-ever legal action against harmful deepfake websites, the Manhattan District Attorney’s Office has seized 12 sites that collectively ta…
A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and…
The pro-Ukraine hacktivist group Hacking Cat has evolved from carrying out website defacements and data leaks to more sophisticated and destructive a…
The sites are designed to collect victims’ contact details, which scammers then use to target them through phone or email to steal money, personal in…
Socket has discovered a Twitch browser extension forwarding users' OAuth tokens to a Russian bot service
Executive Summary A critical vulnerability (CVE-2026-85706, CVSS 10.0) was disclosed affecting GitLab CE and EE self-managed instances, allowing atta…
CISA says attackers are exploiting a maximum-severity GitLab flaw that lets unauthenticated miscreants read arbitrary files from vulnerable servers a…
A human attacker exploited a Marimo RCE and reached an SSH bastion in eight seconds
The company unintentionally disclosed users’ information to a third party impersonating a government agency. The post Personal, Financial Info Expose…
MarketsandMarkets has projected the cyber warfare market to double by 2031, amid growing demand for defensive and offensive cyber capabilities in the…
The EU Agency for Cybersecurity switched on the Cyber Resilience Act‘s Single Reporting Platform on 11 September 2026, the same day the law’s reporti…
British fintech company Revolut confirmed disclosing sensitive customer data to fraudsters who submitted emergency data requests from a legitimate go…
The Chinese-language input method editor for Windows can allow attackers to execute arbitrary code remotely. The post Chinese Hackers Exploit Critica…
An unauthorized party used a legitimate government email domain to fraudulently request Revolut customer data
Revolut has acknowledged that it disclosed sensitive customer records to an unauthorized party. The company had accepted fraudulent information reque…
OverviewOn September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release a…
CISA warns that threat actors are exploiting a vulnerability with a CVSS score of 10.0
Key Findings Silent Push identified a North Korean fake job recruitment scam channel hosted on a Discord server by a defender colleague, and we engag…
Stolen credentials were used in a multi-month campaign to access subscriber personal data and billing records. The post Telus Warns Customers of Acco…
The vulnerabilities can allow attackers to bypass authentication and elevate their privileges to administrator. The post Three JFrog Artifactory Flaw…
The UK government is giving more than 23 million people the chance to ditch passwords for passkeys – and could save itself a tidy sum on authenticati…
Researchers confirm that OpenAI agents uploaded hundreds of malicious packages to RubyGems
Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a go…
The flaw allows attackers to send files and execute them without authorization through an active remote session. The post ConnectWise Patches ScreenC…
A deep technical analysis of the Smishing Triad’s JWR phishing kit and Outsider operator cluster, revealing its real-time victim control, encrypted W…
A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian c…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are now exploiting a maximum-severity GitLab vulnerability in at…
Someone impersonating a government agency, using an email address on that agency’s domain, obtained sensitive customer records from Revolut. The bank…