ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
Critical vulnerabilities in supply chains, browsers, and enterprise equipment are actively exploited in the wild. The Axios compromise exemplifies how trusted platforms become attack vectors for surveillance and data theft, threatening journalists and millions of readers.
Modern attacks traverse multiple OS platforms, but siloed SOCs create detection gaps. Unified cross-platform security operations are essential to defend against sophisticated, multi-OS threat campaigns.
Fortinet patched a critical zero-day in FortiClient EMS that allows unauthenticated attackers to execute arbitrary code and compromise all managed endpoints. The vulnerability stems from improper access control, letting adversaries gain full administrative access to the enterprise management platfor
FortiClient EMS vulnerability (CVSS 9.8) allows unauthenticated remote exploitation and is actively being exploited. Attackers gain admin access and disable endpoint protection. Patch immediately.
** Scammers are sending fake traffic violation texts with QR codes that bypass SMS filters, stealing personal and financial data via convincing phishing sites. Never scan QR codes from unsolicited mes
Hackers exploit React2Shell vulnerability in Next.js to steal credentials from hundreds of apps. The undetected campaign has harvested logins and API tokens for weeks, with stolen data sold on underground markets.
Fortinet patched CVE-2026-35616, a critical pre-authentication bypass in FortiClient EMS that requires no credentials. Actively exploited in the wild with 9.1 CVSS severity, it allows attackers admin access to endpoint management infrastructure.
36 malicious npm packages posing as Strapi plugins deploy backdoors targeting developer environments and databases via postinstall scripts. The supply chain attack exploits npm's trust assumptions to compromise systems with credential harvesters and persistent implants.
LinkedIn secretly scans users' browsers for installed extensions and device data without consent. This "BrowserGate" practice highlights privacy risks in tech's regulatory gray zones.
Device code phishing attacks surged 37x as exploit kits proliferated; attackers abuse OAuth 2.0 Device Authorization Grant to hijack accounts with 15-35% success rates.
Apple and Google's app privacy labels promised transparency but remain inconsistent and vague. With minimal verification of self-reported data, they fail to help users make informed decisions about which apps collect their personal information.
LinkedIn secretly scans visitors' browsers for 6,000+ Chrome extensions using hidden JavaScript while harvesting device data—all without user consent or notification, raising major privacy concerns in the "BrowserGate" report.
Microsoft discovered PHP web shells that hide commands in HTTP cookies, evading WAFs and detection systems. Attackers exploit legitimate cookie behavior to make malicious traffic appear routine, representing a sophisticated evolution in web shell obfuscation tactics.
Researchers discovered that XR headset users produce unique skull vibration signatures that existing accelerometers can detect for frictionless biometric authentication. No additional hardware required.
Microsoft remediates a global Exchange Online outage affecting enterprises. Persistent backend issues cause widespread mailbox access failures across OWA, desktop, and mobile clients despite ongoing mitigation efforts.
** A Nigerian romance scammer got 15 years after accidentally trying to con a fellow fraudster, whose chat logs exposed his entire operation. A cautionary tale in OPSEC failure.
Enterprises face expanding mobile vulnerabilities from shadow AI embedded in apps, unpatched devices, and zero-click exploits—creating blind spots that traditional security models can't defend.
CrowdStrike and Microsoft partnered to integrate Microsoft Defender data into CrowdStrike's SIEM platform, allowing enterprises to consolidate security telemetry across both systems. This partnership marks a historic shift from their years of direct competition to collaborative ecosystem building.
Drift Protocol lost $285M through a novel durable nonce attack that exploited race conditions in nonce validation. Hackers bypassed multi-sig controls to seize admin access on the Solana DEX, marking the first major exploitation of Solana's nonce mechanism.
**CVE-2025-55182** (critical, CVSS 9.8+) in Next.js 12–14.2 has compromised 766+ hosts. Attackers actively exploit the flaw to steal credentials and environment variables. Treat as priority incident response.
Hitachi Ellipse contains a critical RCE vulnerability (CVE-2025-10492, CVSS 9.8) in its JasperSoft library's Java deserialization code, allowing unauthenticated remote code execution. Affects thousands of power utilities and manufacturing facilities globally, threatening critical infrastructure oper
Yokogawa CENTUM VP contains a hardcoded PROG account password (CVE-2025-7741) exposing critical infrastructure to privilege escalation and unauthorized system modification. Local attackers gaining HMI access could manipulate industrial processes in energy, chemical, and food production facilities wi
Siemens patched two DoS flaws in SICAM 8 grid controllers: resource exhaustion and malformed XML attacks allow unauthenticated attackers to crash infrastructure, threatening power system stability.
Residential proxies evade IP reputation systems in 78% of cases, allowing attackers to mask malicious activity as legitimate traffic. This vulnerability enables undetected credential stuffing, account takeover, and fraud.
** This week's ThreatsDay Bulletin reveals chained pre-auth exploits, a kernel-level Android rootkit, and AWS CloudTrail evasion — all exposing gaps in standard defenses.
** Criminals use vacant homes as mail drop points, combining postal interception with synthetic identities to commit financial fraud. Defenders must bridge physical and cyber threat models.
** Apple expanded iOS/iPadOS 18.7.7 to more devices to counter DarkSword, a zero-click exploit kit chaining WebKit and kernel flaws used in targeted spyware attacks. Update all devices immediately.
Bitcoin investor stored $400M in access codes in a fishing rod case that disappeared. Recently, $35M moved from a dormant wallet, raising questions about whether the codes were recovered or stolen—highlighting the risks of unconventional crypto security practices.
Venom Stealer is a malware-as-a-service platform automating ClickFix social engineering attacks. It enables even low-skilled threat actors to launch phishing campaigns with automated tools.
Attackers exploit valid credentials and routine access instead of sophisticated exploits. Organizations often overlook this risk while investing in patching and advanced defenses.