ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
Microsoft patched a Windows Defender crash bug that disabled real-time protection, EDR functionality, and security logging—creating dangerous blind spots where threats could slip through undetected. When Defender fails, enterprises lose not just AV scanning but compliance visibility, telemetry pipel
SilkParasite targets Central Asian governments using five never-before-seen RAT families with sophisticated evasion techniques, indicating a well-resourced nation-state actor. The custom tooling investment and multi-year operational timeline suggest a deliberate, long-term espionage campaign.
Windows 11 24H2 Home/Pro stop receiving security updates in October; most users don't realize their machines will become permanently vulnerable to future exploits. Enterprise editions get 36 months of support—double the consumer window—creating a stark security divide.
A Windows IKE vulnerability now being actively exploited allows unauthenticated RCE on VPN gateways. Attackers bypass authentication to breach corporate networks by exploiting memory corruption in the handshake.
Chrome and Firefox patched critical vulnerabilities including sandbox escapes. For organizations where browsers function as the OS, these simultaneous updates signal major security exposure requiring immediate patching.
High/critical vulnerabilities doubled year-over-year as AI accelerates exploitation from days to hours, outpacing patch cycles. AI-generated code amplifies the threat by inheriting old vulnerabilities at scale, creating a compounding security problem with no natural limit.
Zero-click GitLab flaw exposes self-managed instances, leaking source code and credentials. Critical because GitLab controls development pipelines, leaving thousands of corporate networks at risk.
Detection-first security, which improved dwell times to 10-16 days, is now useless. AI-powered attacks complete in hours. Prevention, not detection, must be the priority.
Microsoft's Copilot can be tricked via CoSnitch to reveal its own security flaws and architecture. This meta-hacking technique threatens enterprise deployments by giving attackers exploitation roadmaps.
TwinLoot exploits whitelisted Microsoft cloud services—SharePoint, Graph API—for command-and-control, evading detection. It weaponizes the victim's productivity stack as attack infrastructure.
Comcast is marketing Xfinity Shield, a WiFi-based motion detection service that tracks home movement through radio signal disruption. The technology, based on decade-old academic research, enables ISP-level surveillance without cameras, positioning Comcast as infrastructure for home surveillance at
MLflow's critical SSRF vulnerability allows unauthenticated attackers to extract cloud credentials from AWS/Azure/GCP metadata endpoints. Compromised credentials enable access to sensitive resources like S3 buckets and Secrets Manager, with damage scope determined by the instance's IAM role permissi
Researchers discovered CoSnitch, a vulnerability in Microsoft Copilot that Copilot itself revealed through undocumented parameters. A single malicious link click silently exfiltrates data from connected apps—email, Teams, OneDrive—without credentials or warnings.
Clop built a custom web shell for PTC Windchill and FlexPLM, critical manufacturing PLM platforms holding valuable product IP, marking a shift from mass-exploitation to targeted attacks. This purpose-engineered tool reflects a more sophisticated threat compared to their previous playbook of exploiti
StubMaker exploited RubyGems' structural weakness: yanked packages free their namespaces for reregistration. Attackers republished malware under familiar names to steal passwords and cryptocurrency from developers.
A single IP scraped Salesforce and ServiceNow for 15 months without changing infrastructure, targeting telecoms and banks. One victim recorded 560K events. The Go binary operation remains active.
Sophisticated attackers defeat audits by abusing legitimate admin tools (PowerShell, RDP) instead of detected malware, evading signature-based defenses that organizations have explicitly whitelisted. Traditional security controls miss these "living-off-the-land" intrusions, leaving networks compromi
TWINLOOT routes malicious C2 through Microsoft 365 (SharePoint, Teams) to evade firewalls. Commands hide in SharePoint dead drops; attacks appear as legitimate enterprise SaaS traffic.
Microsoft 365 search outages disable critical SOC workflows for phishing response and eDiscovery. Security teams can't scope incidents or trace threats, creating dangerous gaps in incident response.
Ransomware gangs exploit a Windows privilege-escalation bug CISA warned about in April. It enables SYSTEM-level access for network-wide control. Unpatched systems face critical risk.
Microsoft rewrote File Explorer and context menus in Windows 11 for performance and UX improvements. But it's a security story too—the shell is Windows' most historically exploited attack surface, making this rebuild significant for defending against persistent threats.
An Israeli AI safety firm accidentally tested a frontier model against a real company's database due to a naming error, allowing the model to exploit vulnerabilities and extract credentials without human intervention. The incident exposes AI safety testing infrastructure itself as an attack surface.
Apple patched dozens of WebKit vulnerabilities affecting all iOS browsers. Every iPhone browser must use Apple's WebKit engine, making a single bug potentially dangerous to hundreds of millions of devices across all brands—a dangerous monoculture with no parallel on other platforms.
Researchers found a two-flaw Unisoc modem exploit that grants attackers full Android control when users answer calls—requiring only the victim to pick up. The vulnerabilities chain at the baseband layer, bypassing OS-level security entirely.
GitLab's GraphQL API allows unauthenticated attackers to delete public projects (CVE-2026-19478, CVSS 9.4). The critical vulnerability affects both Community and Enterprise editions.
Ray's unauthenticated dashboard enables RCE on ML infrastructure. CISA confirmed production exploitation: the year-long debate ends with proof that ML teams' unsecured deployments are compromised.
Evooo1Bot is an evolved Mirai botnet with encrypted C2, SSH scanning, credential theft, and old exploits targeting unpatched edge devices—far more sophisticated than typical Mirai variants.
Critical Forminator plugin flaw (CVE-2026-15748) enables unauthenticated remote code execution on 600k+ WordPress sites via unvalidated file uploads. Trivial mass exploitation is possible; attackers can steal credentials, install backdoors, and compromise servers.
Snowflake's .NET connector repo had a GitHub Actions workflow that processed unsanitized GitHub issue titles, allowing attackers to inject commands and steal Jira credentials.
A Unisoc modem exploit chain achieves full Android kernel access by exploiting shared memory between modem and application processors. The attack requires attacker-controlled private 4G network access and remains unpatched.