Curated cybersecurity briefings on active threats, vulnerabilities, and emerging risks
Only a week after warning about the perils of competitor Z.ai's GLM-5.3 model and its advanced cybersecurity capabilities, Anthropic has expanded its…
CVE-2026-21589 allows unauthenticated remote attackers to read specific files within the web application root directory of affected Atlassian product…
Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for …
WordPress 7.1.3 landed on 6 October 2026. It’s a maintenance and security release with seven security fixes and four bug fixes. Two weeks ago, 7.1.2 …
On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiti…
Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial intell…
Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly…
Eight days after Meta launched Muse, operators added a fake Muse Ads product to a human-operated phishing platform already impersonating Gemini, Clau…
In this post, we share LLM-specific validation patterns that attackers use to test exposed AWS credentials for Amazon Bedrock access.
Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple se…
If you signed up for Trump Mobile, you may be part of an exclusive club of ... ransomware victims. Criminals called BYOD claim to have broken into th…
Part 1 of this week's saga can be found here. This research is a glimpse into the capabilities that power our Preemptive Exposure Management solution…
UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to …
Aguirre was added to the FBI’s “Top 10 Most Wanted Fugitives” list in March, becoming the first cybercriminal added to the list.
The personal data of at least 68,000 people was reportedly exposed in breaches of at least seven financial institutions, with officials saying they b…
Gamers around the world are holding their breath for November 19, 2026, the day Grand Theft Auto VI is expected to drop. Many of them have been waiti…
A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor au…
ClickFix sites stage a VBScript payload in the browser cache to bypass the Run dialog's length limit
Osaka Metropolitan University said on Tuesday that the outage left its internal network, email and a range of administrative and academic systems una…
The FBI has removed an Accenture contractor over a data breach that exposed personal information of thousands of bureau employees. The post FBI Blame…
Thousands of global fashion retailer ASOS customers have received a push notification through the ASOS app this morning alleging that the company has…
Nikkei says two employee cloud accounts were accessed, with one used to send 9,000 phishing emails
CERT-UA found fake Cloudflare verification pages that led visitors into a now-familiar ClickFix trap. This time the goal was to infect machines with …
The IBM subsidiary has also announced its Lightwell Clearinghouse is now available to all customers
GitHub Copilot CLI may reveal developer secrets if it comes across instructions that tell it to do so, depending on the underlying model. The coding …
Cryptographic Context Injection against a coding agent: one encrypted page makes GitHub Copilot CLI send local secrets to an attacker in 28 seconds.
An alleged leader of Tren de Aragua’s ATM jackpotting activities, Canelon Aguirre was on the FBI’s top 10 most wanted list since March 2026. The post…
Attackers who know where to look can read files from Atlassian Data Center installations without logging in, the company has warned. About CVE-2026-2…
Forescout found that just 6% of Internet of Medical Things (IoMT) and 16% of medical OT are capable of supporting post quantum cryptography
Facebook users are reporting receiving a message with a fake Facebook Marketplace listing that has their name as the seller.It works like this. You r…
ASOS has said it is investigating a cyber incident and that some customer personal information may have been accessed.
A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have sh…
Asos customers have reported receiving a rogue app notification claiming the online clothing retailer's Snowflake instance has been compromised and t…
An unauthorized party abused a private Danish company's legitimate access to the country's Central Population Register (CPR), exposing names, address…
ASOS customers have received a seemingly legitimate push notifications claiming the retailer’s IT systems have been breached through a Snowflake brea…
The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including uns…
Domino’s Pizza customers tell us they have received emails saying they account has been accessed by a third party. Domino’s says its internal systems…
404Media is reporting (alternate link) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot sec…
Dell is urging customers to patch a vulnerability (CVE-2026-86360) in Dell System Update (DSU) that could allow an unauthenticated remote attacker to…
Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign. The post Long-Running NPM Malware C…
Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructur…
Hackers abused a company’s lawful access to the CPR system to steal the personal information of registered citizens. The post 8.8 Million Impacted by…
UK education software provider Bromcom has notified customers of a personal data breach affecting its single sign-on (SSO) technology. In a September…
Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to sen…
Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect since O…
Report Fraud says cybercrime revenue stemming from account takeover increased 417% annually
A data breach at Denmark’s Central Population Register (CPR) has exposed the personal information of 8.8 million people. These include people living …
Two unrelated WordPress plugins, two separate stored Cross-Site Scripting vulnerabilities, one payload. Over the past several days our telemetry has …
An affiliate of The Gentlemen RaaS group ran a parallel leak site during extortion of two dozen victims
A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands…
A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files …
The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the th…
Unauthorized parties have gained access to the names, addresses, and personal identification numbers of about 8.8 million people, living and dead, in…
A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Inste…
Atlassian has told its users to patch its datacenter products, pronto, to prevent attackers accessing their files. The Australian collaborationware c…
Several mysteries surround what appeared to be an unauthorized push notification sent to customers of London-based clothing company ASOS.
Linux KVM, the hypervisor favoured by hyperscale clouds, apparently has a full VM escape bug. That nasty news came from security researcher Paulos Yi…