ACTIVE THREATS: File servers are here to stay. Heres how to manage them securely • Chinese Fire Ant hackers turn Cisco routers into spying platforms • Microsoft asks users to ignore 'Antivirus is turned off' errors • Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets • ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions ACTIVE THREATS: File servers are here to stay. Heres how to manage them securely • Chinese Fire Ant hackers turn Cisco routers into spying platforms • Microsoft asks users to ignore 'Antivirus is turned off' errors • Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets • ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution. The following versions of PTC Windchill Product Lifecycle Management are affec...
View CSAF Summary Successful exploitation of this vulnerability could allow an authenticated low-privileged user to gain access to SMS messages outside of their authorized tenant scope via a crafted c...
Apple is pushing lock screen alerts to outdated iOS users about active web-based exploits targeting unpatched vulnerabilities, marking a shift toward direct proactive security communication.
AitM phishing attacks bypass Cloudflare's Turnstile to compromise TikTok business accounts for malvertising and malware campaigns. Hijacked accounts leverage platform trust to amplify attack reach.
A logic error in Open VSX's scanner conflated failure with success, allowing malicious extensions to bypass validation and reach the registry. The flaw treated disabled scanners as passing ones.
CISA warns of active attacks on Wing FTP Server (CVE-2025-47813) enabling unauthenticated data theft. The critical flaw threatens government and critical infrastructure organizations worldwide.
CISA flagged CVE-2025-47813, a critical Wing FTP Server information disclosure flaw, as actively exploited in the wild. Federal agencies must patch it urgently under BOD 22-01 to prevent data exposure and follow-on attacks.
Criminals impersonate support on fake live chat to steal payment cards via social engineering and urgency tactics. They exploit user trust in official customer support interactions.
MacSync infostealer spreads through ClickFix campaigns disguised as AI tool installers, using social engineering and fake security alerts to trick users into running malicious commands on macOS systems.
Microsoft removed Samsung Galaxy Connect from its Store after the app blocked access to Windows C: drives on Galaxy Book 4 systems. The incident reveals gaps in vetting device management tools.
A global Microsoft Exchange Online outage disrupted email and calendar access across industries. The incident exposed organizational reliance on cloud services and highlighted critical gaps in disaster recovery planning.
DRILLAPP backdoor targets Ukrainian organizations using Microsoft Edge debugging features to evade detection. The Russian-linked malware maintains persistence via legitimate developer tools for command-and-control communications.
Twitter suspended 800M accounts for spam, yet state-backed disinformation campaigns persist openly. This reveals suspension volume alone doesn't suppress platform manipulation effectively.
Threat actors are selling unauthorized access to thousands of unpatched surveillance cameras. They exploit default credentials and brute-force attacks, then resell access on dark web marketplaces.
0ktapus phishing spoofed Okta to compromise 130+ organizations. Using fake authentication emails, attackers stole credentials for ransomware and data theft across finance, tech, and healthcare sectors.
Trane Tracer building management systems contain critical vulnerabilities (CVSS 8.1) in cryptographic and memory handling, allowing unauthorized access to building automation controlling HVAC, lighting, and security systems.
A critical Siemens S7-1500 vulnerability enables code execution through malicious trace files via social engineering. Attackers exploit legitimate diagnostic workflows to compromise industrial infrastructure globally.
CISA flagged two exploited Google flaws—CVE-2026-3909 (Skia) and CVE-2026-3910 (V8). Attackers are actively weaponizing these browser vulnerabilities across government and critical infrastructure.
HPE AOS-CX networking platform contains a critical authentication bypass allowing unauthenticated attackers to remotely reset admin credentials. The vulnerability provides immediate administrative access without requiring valid credentials or prior system compromise, exposing millions of network dev
Vulnerability exploitation now dominates Google Cloud attacks over credential theft. Attackers exploit flaws faster than organizations patch, leveraging automation and zero-day stockpiles.
AI smartphone phishing defenses fail against targeted attacks, Omdia research shows. Attackers evolve faster than detection systems, using social engineering and technical evasion techniques.
Nonprofits face rising cyberattacks despite being mission-driven. Limited security budgets and access to sensitive donor data make them attractive targets for ransomware gangs and other threat actors.
Nonprofits face frequent cyberattacks but rarely report them, creating a data gap in threat intelligence. These organizations are attractive targets due to valuable data and limited security resources.
Microsoft patched a critical RRAS remote code execution vulnerability in Windows 11 Enterprise through an emergency hotpatch, allowing attackers to execute arbitrary code with elevated privileges. The severity triggered an out-of-band release bypassing the standard patch cycle for immediate deployme
** Starkiller is a new phishing-as-a-service platform that proxies real login pages in real time, capturing credentials and session tokens to bypass MFA. Only FIDO2/passkeys resist this attack.
Attackers hijacked AppsFlyer's Web SDK, injecting malware to steal cryptocurrency from affected users and organizations. The supply chain compromise reveals the massive risk when trusted software becomes weaponized—exposing thousands of dependent systems to attack.
Kimwolf, built from a weaponized vulnerability by operator "Dort," became the largest botnet ever. Dort escalated from cyber attacks to real-world violence against researchers, forcing law enforcement intervention.
March's 77 Microsoft patches span Windows, Office, and Edge with no active zero-days. Yet the broad attack surface—from RCE to privilege escalation—requires urgent prioritization.
Microsoft is investigating a critical C: drive access issue on Samsung Windows 11 laptops following February 2026 updates. Affected systems cannot access the drive or launch applications, with the problem appearing limited to specific Samsung configurations.
Threat actor Storm-2561 distributes counterfeit VPN clients impersonating Ivanti, Cisco, and Fortinet to steal enterprise credentials. Spread via phishing emails and fraudulent download sites, the malware silently harvests logins before displaying error messages to maintain the deception.