A backdoored cPGuard update ran as root on nearly 3,000 hosting servers
A forged cPGuard release ran as root on about 2,950 Linux hosting servers, and the attacker also walked off with roughly 7,900 customer records.
The Latest
SlippyNunchucks rode Sogou’s own update channel to plant DarkVigil
ESET tied a DNS-hijacking campaign to a Chinese input method's plaintext vocabulary fetches, delivering the DarkVigil backdoor since July.
WordPress core race flaw gets a 72-hour deadline from federal cyber chiefs
A race condition in WordPress's own upgrade path earned a KEV listing on November 3 with a three-day federal deadline.
Xen patches a pair of guest escapes with no mitigation in sight
Two Xen hypervisor flaws let one guest reach into another's memory, and releases between 4.6 and 4.16 get no patch…
Thermostat tampering reached France’s blood service through a supplier
France's blood service caught tampered cold-room setpoints in time, after an intruder reached the equipment through a refrigeration supplier.
Barracuda chains an authorization bypass to root on its own gateways
An authorization bypass and a command injection chain into root on six Barracuda appliance families, so patch the firmware and…
Tenants cannot see the boundary that keeps their clouds apart
The Xen escape disclosed this week is a reminder that multi-tenant isolation depends entirely on an operator's patch cadence, not…
Stolen model tokens are running up six-figure cloud bills in a day
Mandiant traced stolen inference keys to daily bills above $100,000, with some victims reaching $1 million before access was revoked.
An engineer’s laptop and one fake interview led to the Binance drain
Binance says a rigged coding exercise and an abused AI development tool gave North Korea-linked attackers an engineer's laptop and…
A Russian crew grabs browser passwords and deletes its own malware
ESET tied a fast-moving stealer campaign against Ukrainian courts and city councils to a group that may be selling access…
Red Hat lifts a Linux TCP flaw to critical while Ubuntu delays
A use-after-free reachable without a login is patched on RHEL but still sitting in Ubuntu's opt-in testing pocket.
A flow editor with no password handed attackers root on industrial gear
A maximum-severity hole in Node-RED's HTTP interface is now drawing working exploits that end in a memory-resident bot.
Bitcoin and Litecoin vanish from BTCPay servers running July builds
Merchants on versions 2.4.1 or older are told to build a fresh server and generate a new wallet rather than…
Ransomware crews found Synology boxes that never took the 2024 patch
A critical DSM flaw fixed 23 months ago is back in play as customers report .L0CK3D encrypted files.
Spotlight
A TV box maker sold criminals access to 1.3 million homes
Google cut ties with Videostrong and took down XCPE, a botnet that turned certified Android hardware into rented exit nodes.
Trigger.dev says someone walked off with customers’ environment variables
A Sunday disclosure confirms an attacker reached secrets inside a hosted AI workflow platform that many teams use for agent backends.
European grocers are still running the freezers that got hacked in October
More than 100 stores from Belgium to Sweden lost cold storage overnight, and the controllers are the same make as last month.
A ransomware crew let its AI agents climb to domain admin
Sophos recovered Cursor logs showing the Aur0ra gang handing agents VPN credentials and objectives, then watching them map Active Directory and move laterally on their own.
Features
Fake nuclear alerts hit phones on both sides of the Ukraine war
Attackers hijacked Ukrainian and Russian emergency warning apps within hours of each other, pushing radiation and missile messages that neither…
Government Linux servers fell to scripts an AI likely wrote
Unit 42 traced a year-long espionage campaign that leaned on large language models to build its payloads and mash its…
A stealer now hands its operator a ranked list of victims
Cisco Talos found the VOLTA infostealer feeding stolen data into three different AI models so it can tell buyers which…
A loader hid inside Windows update folders on Asian government PCs
Kaspersky found NetamLoader abusing AppDomainManager injection from a CAB file parked in SoftwareDistribution, on a Windows 10 build reserved for…
Five coding assistants let a web page reach past the sandbox
Forever Security found the embedded browsers in Cursor, Copilot, Claude Desktop, VS Code and Codex granted powers a normal browser…
Bedrock Data hands exposure fixes to whoever owns the dataset
Instead of piling findings into a central backlog, the platform tickets the data owner directly and reopens the case if…