ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
Scammers registered 212 fraudulent domains in 5 days impersonating Venezuela earthquake relief organizations, exploiting disaster relief as an industrialized fraud service. The real vulnerability isn't technical—it's procedural and jurisdictional, requiring faster takedown coordination between regis
"BioShocking" prompt injection tricks AI browsers into data theft by framing malicious actions within game scenarios. It bypassed safety guardrails in six major AI browser products, exposing a critical vulnerability: agents cannot reliably distinguish fiction from reality when reframing attacks.
Mitsubishi patched critical vulnerabilities in MELSOFT Update Manager's 7-Zip component affecting PLC firmware updates across manufacturing sectors. Local attackers can execute arbitrary code by tricking users into decompressing malicious archives, potentially compromising critical industrial automa
DCMTK toolkit has 5 critical flaws: path traversal allowing file writes (CVE-2026-50003) and memory leaks causing DoS (CVE-2026-50254/35505). Unauthenticated attacks threaten hospitals globally.
"Silent Swap" is a malicious browser extension that steals cryptocurrency by silently replacing wallet addresses with attacker-controlled ones. It intercepts clipboard operations without visible indication, redirecting transactions to the thief's wallet while victims unknowingly send funds.
Supreme Court ruled 6-3 that cellphone location data gets Fourth Amendment protection, rejecting the 'third-party doctrine.' The landmark decision reshapes how police obtain digital evidence.
Threat actors exploit critical Langflow RCE (CVE-2026-33017, CVSS 9.3) to deploy Monero cryptominers on enterprise networks. The attack chain features lateral movement via SSH credential reuse, log wiping, and persistence hardening to maintain exclusive access.
A fake Perplexity extension on the Chrome Web Store hijacked search queries and tracked browsing data through attacker infrastructure, Microsoft Threat Intelligence discovered. The impostor used deceptive branding to intercept user searches and collect telemetry before routing them through malicious
AI coding agents are vulnerable to "GuardFall," a shell obfuscation bypass that lets attackers steal credentials and alter code. The flaw affects 10 of 11 tested agents and exploits their tendency to run with full developer permissions, creating a dangerous supply chain attack vector.
GuardFall exploits how AI coding agents scan commands as plain text while bash interprets shell syntax. This mismatch lets attackers use metacharacters like empty quotes to execute dangerous commands undetected, potentially compromising entire development systems.
BlueHammer (CVE-2026-33825) is a Microsoft Defender flaw allowing privilege escalation. Exploited for 8 days pre-patch, multiple ransomware groups used it to disable security and deploy payloads.
NIST reduced CVE enrichment analysis to streamline resources, creating gaps in vulnerability coverage. While critical vulnerabilities now process faster, organizations lack complete data for risk prioritization.
AI-generated workflows function perfectly while embedding exploitable security flaws—overprivileged access, credential exposure, unvalidated data—invisible to traditional security tools. Teams assume correct output means secure process, creating blind spots in production systems.
Six vulnerabilities in AirDrop and Quick Share allow nearby attackers to crash services and bypass security prompts without user interaction, using only a laptop within wireless range.
SimpleHelp vulnerability CVE-2026-48558 enables attackers to bypass authentication and gain admin access to managed systems. Active exploits use TaskWeaver and Djinn Stealer malware to compromise infrastructure and steal credentials.
SimpleHelp's OIDC bypass (CVE-2026-48558) allows unauthenticated access via forged tokens. Exploited to deploy Djinn Stealer malware targeting developer credentials across managed systems.
Kemp LoadMaster contains a critical pre-auth RCE flaw (CVSS 9.8) enabling unauthenticated root access via a broken input sanitization function. With a public PoC available, thousands of organizations must patch urgently.
Ransomware operators exploit BlueHammer (CVE-2026-33825), a Windows Defender flaw enabling escalation to SYSTEM access. CISA confirmed active exploitation in campaigns, requiring immediate patching.
Quantifind closed a $200M funding round to expand its AI-native financial crime prevention platform globally. The funding reflects growing demand for advanced solutions to combat money laundering and sanctions evasion.
Apple released emergency patches for 30+ vulnerabilities, including four critical WebKit flaws discovered via AI tools. The memory corruption bugs enable remote code execution through malicious websites on iOS and macOS.
Oracle Payments faces critical exploitation: CVE-2026-46817 allows unauthenticated remote control via HTTP. Actively exploited just 30 days post-patch, threatening thousands of enterprise deployments.
A SimpleHelp RMM vulnerability enables Djinn Stealer deployment targeting developer credentials and cloud infrastructure. The attack chain demonstrates modern supply chain exploitation methods.
Critical flaw in Horner Automation Cscape (CVE-2026-12897) allows code execution when opening malicious CSP files, risking manufacturing control systems. Requires local access but poses significant threat to environments with external consultants or remote workers. Patch available in version 10.2 SP
Amazon Q's VS Code extension has a critical flaw enabling credential theft through malicious repositories. MCP integration allows arbitrary code execution with low attack complexity.
Adversarial patterns on clothing fool facial recognition AI with 60-90% accuracy in lab tests. Experts warn that real-world effectiveness is limited by deployment challenges and advancing defenses.
A malicious Perplexity Chrome extension logged searches and keystrokes, routing data to attackers. It appeared normal to users. Microsoft detected it; Google removed it from the Web Store.
Microsoft extended Windows Server 2022 hotpatching support to October 2027, giving enterprises two additional years to deploy critical security patches without reboots. This addresses the operational complexity of managing large-scale server deployments and aligns with industry trends toward zero-do
WhatsApp launches usernames to hide phone numbers from new contacts, addressing privacy concerns. The optional-credential feature won't appear in public directories—usernames must be directly shared to enable messaging.
WhatsApp now allows optional usernames to hide phone numbers from new contacts. The feature, rolling out June 29, includes optional secret-key protection for security.
WhatsApp is launching usernames to hide phone numbers from strangers, addressing a long-standing privacy gap. The optional username key adds an extra security layer, matching features already in Signal and Telegram.