AmnesiaStealer trades keychain dumps for live macOS browser hijacks
Jamf Threat Labs details a three-stage Rust stealer that harvests macOS credentials and gives operators live, hidden control of the victim's browser.
The Latest
Free 15.5 GB dump puts 7.3 million Chess.com accounts at risk
A free archive with 7.3 million Chess.com records looks like large-scale scraping, though one internal-facing detail needs explaining.
Probes hit GeoServer SQLi zero-day within hours of disclosure
watchTowr logged hundreds of exploitation probes against an unpatched GeoServer SQLi bug within hours of its disclosure.
Akira’s Safe Mode play blinds EDR but crashes its own encryptor
Huntress says an Akira affiliate rebooted a victim into Safe Mode to kill EDR, then the encryptor crashed on the…
Session swap bug in Adobe Commerce draws attacks right after patch
Sansec blocked the first exploits of CVE-2026-71362, an unauthenticated account takeover in Adobe Commerce rated 9.1.
Dark web vendors peddle AI attack planners with nation-state depth
Trellix found dark web services like APEX AI and MessiahGPT that lower the skill bar for ransomware-grade attacks.
Trezor customer data spills through logistics partner ShipMonk
A breach at shipping partner ShipMonk exposed names, emails and addresses for over 13,000 Trezor customers.
Fake IT interviews slip poisoned WireGuard builds past Ukrainian sysadmins
CERT-UA ties fake recruiter lures to Sandworm subgroup UAC-0145, which hides PowerShell execution inside a poisoned WireGuard client.
Hundreds of Chrome VPN extensions secretly shunt traffic to one proxy
Socket finds 737 VPN and proxy add-ons funneling browser sessions through a single provider.
Anonymous guest access let one actor mine SaaS portals for 17 months
Reco tracks a long-running campaign harvesting records from over-permissioned SaaS portals.
CEVA breach stalls eight European warehouses and leaks client data
A July cyberattack on CEVA Logistics halted shipments and exposed customer details for Valve and others.
US memo recruits vetted companies to hit foreign cybercrime networks
A new White House program would let private firms run offensive operations under federal oversight.
Agentic hackers breached Taiwan agencies with self-correcting AI tool
Israeli firm Dream documents what appears to be the first autonomous AI attack on a government.
New Defender exploit defeats RoguePlanet patch, hands out SYSTEM shells
A researcher's ShieldBreak PoC claims to bypass Microsoft's fix for the Defender RoguePlanet flaw.
Spotlight
Fake defense jobs deliver Troy backdoor via Windows kernel bug
Check Point ties a Windows zero-day to Lazarus attacks on defense firms using fake job offers.
Forged JWT tokens put unpatched SharePoint servers in attacker hands
Attackers are exploiting a critical SharePoint authentication bypass days after Rapid7 shipped proof-of-concept code.
Robinhood Ventures Fund II opens a retail window into security startups
Robinhood Ventures Fund II's listed debut puts retail money behind AI security, identity, and counter-drone startups.
Exploited WinSock driver flaw tops Microsoft’s 398-fix August release
Microsoft's August update batch closes 398 flaws led by a WinSock driver zero-day already under attack.
Features
Adobe ships urgent fixes for three maximum-severity app flaws
Adobe's August security batch includes three CVSS 10.0 bugs in ColdFusion and Campaign Classic with a Priority 1 rating.
Stolen AI gateway packages exposed secrets at 2,100 organizations
A CloudSEK dataset maps the March LiteLLM poisoning campaign to secret exposure at thousands of organizations.
Path traversal bug opens VMware vCenter to stealthy remote takeover
Attackers are exploiting a patched vCenter flaw to plant reverse SSH tunnels and hold onto compromised servers.
Cisco firewalls rebootable by crafted SSL VPN requests in new bug
Cisco warns an unauthenticated attacker can crash ASA and FTD firewalls with a single crafted HTTP request.
Kimwolf botnet evolves to mimic browsers with HTTP/2 flood attacks
Unit 42 documents Kimwolf v7, a rebuild that hides DDoS floods behind browser fingerprints and Ethereum domains.
SAP patches maximum-severity flaw in Commerce Cloud data adapter
SAP's August update fixes a CVSS 10.0 hole letting unauthenticated attackers run code in Commerce Cloud.
