Bank of America hires 1,000 contractors to patch Windows flaws
A 1.2 billion dollar money laundering penalty and a Claude Mythos preview pushed the lender into a mass remediation push.
The Latest
Ransom crews found that locking the front door works better than encrypting
Responders describe intrusions that reach into HVAC, badge readers and refrigeration, turning physical disruption into negotiating leverage.
A 979 download npm package carried its shellcode inside a native addon
SafeDep traced imgdecode to the MALFEX publisher cluster, which has been seeding Windows-targeting packages since August 2023.
Security job ads slide 26 percent as compliance roles absorb the demand
CyberSN counted 320,210 fewer US postings than last year at this point, with leadership openings down nearly 39 percent from…
Forged conference invites feed a Google credential relay aimed at Taiwan analysts
Cisco Talos says the UAT-11985 emails share one syntactic skeleton, with swapped QR posters pulling victims into a live adversary-in-the-middle…
A backdoored backup updater hit just one machine
Attackers rewrote two unsigned files on AOMEI update servers for minutes at a stretch, and any Backupper install that polled…
Six days of AI token time bought Xbow a full Chrome escape
Three chained zero-days and roughly 40,000 dollars in model charges delivered code execution outside the browser sandbox on Windows.
F5 patches three critical NGINX overflows reachable without a login
Eleven defects ship in the release, and two of the critical ones let an unauthenticated request overflow memory in specific…
Proofpoint writes a 6.3 billion check for the data security shop Varonis
The all-cash deal folds Varonis data visibility into Proofpoint threat intelligence as both vendors chase AI agent risk.
ConnectWise kills cloud backups after seven app identities were hijacked
The vendor revoked certificates and stopped scheduled backups after intruders used stolen application credentials to reach customer Microsoft 365 tenants.
OpenBSD picks a 37-year-old bug as an exploit chain’s front door
A research firm built a working root exploit on Unix by chaining an integer overflow patched as a reliability fix with a separate use-after-free.
GhostAction broke into 1,900 GitHub accounts in a single wave
A second surge of the credential-theft campaign pushed malicious workflows across 28,000 repositories in about twenty minutes.
Langflow MCP bug draws 1,423 exploit attempts from 27 addresses
An authenticated flaw that passes a user-supplied command straight to bash is being hammered by attackers who only need one…
Burger King Japan app breach exposed data on 11 million diners
Attackers sat inside the fast-food chain's membership system for five days and walked off with contact details for roughly 11.18…
Spotlight
Hijacked backup app tokens opened 173 Microsoft 365 tenants
Microsoft says a compromised ConnectWise Cloud Backup OAuth application let an intruder mint access tokens across 173 customer tenants.
Microsoft’s follow-up patch wave hits two dozen Office bugs
A second batch of fixes lands days after the record Patch Tuesday rollout.
Silent Lynx turned operational sloppiness into its own fingerprint
Open directories and Astana office hours gave away a Kazakhstan-linked espionage crew.
A contractor breach silenced US bankruptcy court notices
BAE Systems runs the noticing center, and a week-long outage left creditors unserved.
Features
Typosquatted Arch packages handed strangers root on desktops
Misspelled AUR helper names turned a build step into full-system compromise.
Federal patch list adds an Atlassian file-read bug under attack
CISA gave agencies three weeks to close a flaw attackers already reached through double colons.
PwnEscape lets a VM guest slip past the Linux kernel boundary
The flaw surfaced during a million-dollar sandbox challenge and now carries stable-branch fixes.
A stealthy implant sat on 500 firewalls after one FortiManager hit
Unit 42 traced a two-year intrusion that turned a single management box into keys for hundreds of networks.
Chinese spies rode a BeyondTrust zero-day into support appliances
A suspected China-nexus crew spent weeks inside Remote Support boxes before anyone noticed.
Legal Aid breach sweeps up archived claims reaching back to 1978
UK officials now say the April 2025 intrusion took far more historical data than first thought, including probation records for…