Bitget halts withdrawals after a $351.6M wallet heist
Suspected North Korean thieves moved $351.6M out of Bitget's hot wallets through a spoofed transaction request.
The Latest
Attackers cash in on an unauthenticated Roundcube mail flaw
Canada's cyber centre says a patched SQL injection in Roundcube Webmail is being exploited in the wild.
Poisoned leads turned Salesforce’s AI agent into a data thief
Three flaws in Salesforce Agentforce let attackers hijack trusted agents for silent CRM theft and Slack phishing.
A lone operator rented AI agents to breach 27 firms
A Chinese-speaking crook spent about $15,000 on open-source AI agents to raid hundreds of retailers and steal 600,000 card records.
Cloudflare container flaw exposed neighbors’ leftover disk data
A misconfigured storage pool let one Cloudflare container read another tenant's deleted files, forcing a cleanup of every disk.
A botnet recruits an AI agent to harvest stolen API keys
CARBONATO hijacks exposed Docker daemons, then runs an AI agent to loot credentials and fund its own model access.
Every major OS leaks user activity through file alerts
Researchers found decade-old flaws in file-notification systems that let an unprivileged process infer what other users are doing.
Australia opens inquiry after OpenAI agent breached health portal
A research agent got past controls on a government statistics portal, prompting a taskforce review and questions about how slowly…
Malware hands its tactical decisions to a panel of AI models
Cisco Talos found a Windows implant that polls four commercial AI models and acts on whichever answer wins.
Malware turns up in HashiCorp Terraform registry packages
Aikido traced Go malware inside two Terraform providers and two Go modules, the first abuse of HashiCorp's registry as a…
A disk-filling tool quietly stops Microsoft Defender updates
BigDiskBuster fills the system drive so Defender cannot install platform or signature updates, and there is no patch.
Enterprise browser startup Island hits a $6.4B valuation
Island has closed a $400M Series F led by Evolution Equity Partners, pushing total funding past $1B.
Elsevier confirms a brief redirect after LAPSUS$ hijacked its traffic
The publisher says a limited redirect touched select platforms after students reported landing on the LAPSUS$ leak site.
ShinyHunters says it broke into the FBI and took 2TB of files
ShinyHunters says an Oracle PeopleSoft zero-day put it inside the FBI jobs portal, and it wants a retraction rather than…
Spotlight
Microsoft lands its first takedown of a fully AI-run crime service
Microsoft has seized the infrastructure behind a phishing kit that used AI to pick its victims, and two suspects are on bail in London.
Check Point rushes a hotfix for a management server zero-day
A path traversal bug in Check Point's management plane was already being used against customers weeks before the vendor knew it existed.
A heap overflow in BIG-IP APM lets outsiders run code
A heap overflow in BIG-IP APM hands unauthenticated attackers code execution on any appliance serving as an OAuth authorization server.
Arista tells customers to patch a VeloCloud orchestrator flaw now
A CVSS 10.0 input validation bug in on-premises VeloCloud Orchestrator is under active exploitation, and fixes cover only two of four release trains.
Features
A Chinese crew turned three unpatched browser bugs into a backdoor
Volexity has linked a China-aligned group to a three-bug Chrome and Windows chain that ran before either vendor shipped a…
WordPress core patch closes a path traversal that can run code
WordPress 7.1.2 closes a path traversal in get_page_template() that needs no account and can end in code execution on some…
Zyxel switches fall to an obfuscated exploit as CISA sets a deadline
A Chinese-speaking operation pulled configuration files and hashed root credentials from 996 Zyxel GS1900 switches before federal agencies got 72…
Malware hides in a B-tree library now that npm blocks install hooks
A malicious npm package pulled two million weekly downloads while running its payload from ordinary library code instead of an…
TASK#STOMP hides a document thief behind Windows’ own tools
A PowerShell backdoor built from native Windows components steals business files, Wi-Fi passwords and clipboard contents while hiding as scheduled…
A single line break turned a WordPress comment into a server shell
An anonymous commenter could plant a script that ran in an administrator's browser and, from there, uploaded a web shell…