Leaky server exposes toolkit behind 14,500-camera Dahua hijack
Hunt.io rebuilt Operation CameraSwarm from an exposed operator directory after more than 14,500 Dahua devices were compromised.
The Latest
NASA mission console flaws open spacecraft commands to strangers
Cycode found unauthenticated command injection paths in the AIT-GUI console NASA uses to operate instruments and spacecraft.
Five US agencies warn AI scripts now hunt exposed Siemens PLCs
A five-agency advisory flags an active AI-assisted campaign against internet-exposed Siemens S7 controllers across critical US sectors.
OpenAI presses pause on frontier AI training after escape risks
OpenAI halts frontier reinforcement learning for two weeks while it strengthens sandboxes, monitoring, and alignment defenses.
Android banking trojan ToxicPanda gains 167 commands and global reach
Zimperium details ToxicPanda 2.0's expanded on-device fraud while IBM flags a fresh GoldDigger campaign in South Africa and the UK.
Rapid7 urges emergency patching of Citrix NetScaler login bypass
Citrix fixed a CVSS 9.3 authentication bypass in NetScaler ADC and Gateway that attackers are expected to exploit quickly.
Firefox store hosts 40 wallet-stealing add-ons in crypto heist ring
Socket found 40 malicious Firefox extensions posing as Web3 products to drain recovery phrases and private keys.
WordPress page builder flaw turns file forms into remote code execution
Patchstack warns that a CVSS 9.0 flaw in Elementor Pro lets unauthenticated attackers upload PHP files and take over sites.
Snowflake CI workflow injection leaks Jira tokens through crafted issues
Wiz's Red Agent found a GitHub Actions injection in a Snowflake repository that exposed Jira credentials via a specially crafted…
StubMaker typosquats Ruby libraries to drain browser wallets
OpenSourceMalware is tracking StubMaker, a campaign of 16 typosquatted RubyGems packages that drops a Windows infostealer on developers.
WordPress form plugin flaw lets strangers plant backdoor PHP files
A critical arbitrary file upload bug in Forminator Forms, running on more than 600,000 WordPress sites, lets unauthenticated attackers execute PHP.
Evooo1Bot borrows Mirai code to rent out routers as proxies
Fortinet's FortiGuard Labs uncovered Evooo1Bot, a Mirai-derived Linux botnet that turns hacked edge devices into SOCKS5 proxies.
Azure directory dumps put McDonald’s and TCS staff data up for sale
A seller posting employee directories claims they came from Azure tenants of nine companies, and Hudson Rock says the samples…
Order tracking gap exposes SafePal buyers’ names and home addresses
SafePal says an authorization flaw in its order tracking plugin exposed the personal details of about 39,798 customers, but no…
Spotlight
DNS rebinding trick puts Ray AI clusters within browser attackers’ reach
CISA added an actively exploited Ray AI framework flaw to its KEV catalog, citing evidence of active exploitation in the wild.
Unauthenticated GraphQL injection lets strangers wipe GitLab projects
GitLab shipped emergency patches for a critical GraphQL code injection flaw that lets unauthenticated attackers modify or delete public projects.
Fake captchas on 2,000 hacked WordPress sites push malware
Check Point links nearly 2,000 hacked WordPress sites to fake-captcha malware delivery.
TWINLOOT hides inside Microsoft cloud to swipe logins and roam
New Windows implant TWINLOOT abuses SharePoint and Teams to steal credentials and move laterally.
Features
US charges 17 Iran-linked hackers in decade-old campus theft case
US prosecutors charge 17 Iran-linked hackers over a decade of university and corporate data theft.
Microsoft shadows MacSync stealer as its domains keep rotating
Microsoft tracks 30-plus rotating domains tied to the MacSync stealer through behavioral pivots.
MLflow and FUXA flaws draw scans aimed at cloud secrets
Scanners are hammering MLflow and FUXA servers as attackers chase cloud credentials and code execution.
Medusa ransomware tops 500 victims as agencies update warning
Updated FBI, CISA, and HHS guidance puts Medusa ransomware victims past 500 organizations.
Copilot reveals the trick that lets one click drain connected apps
Varonis shows how one click on a crafted link can drain data from connected apps in Microsoft Copilot Personal.
Four exploited flaws land on CISA urgent patch list
CISA adds four actively exploited flaws covering macOS, SharePoint, vCenter, and Microsoft IKE to its urgent patch catalog.