ExfilSquad linked to dark web dump of UK police emails
The Police National Legal Database says contact details for officers and government staff surfaced on the dark web after an incident found July 26.
The Latest
Second N-able patch closes N-central hole after attackers slip past first
Attackers used an authentication bypass in N-able N-central to reach managed endpoints, and the vendor's first fix did not block…
Forged DNA files fool lab software as Thermo Fisher ships signatures
A researcher used AI to alter DNA evidence files in about 45 minutes, prompting Thermo Fisher to add digital signatures…
Diffusers bug trio bypasses Hugging Face code trust guard
Three flaws in Hugging Face's Diffusers library let crafted model repositories run arbitrary code despite trust_remote_code protections.
River Bank leans on ransomware promise that stolen data was deleted
River Financial Corporation told regulators it obtained assurances from the ransomware crew that breached it that stolen data was deleted.
INC ransomware cashes in on SonicWall SMA1000 zero-day chain
The INC ransomware gang is the most active user of two exploited SonicWall SMA1000 flaws, adding victims across five countries…
ChatGPT-powered scam ring in Cambodia cut off by OpenAI
OpenAI banned a coordinated network of ChatGPT accounts tied to Cambodian scam compounds that ran investment, romance and impersonation fraud.
Horizon3 lands $250M Series E to speed AI-driven pentesting
Horizon3 raised $250 million in a Series E round that tripled its valuation to $2 billion, backing AI agents that…
Adform tracker hack redirected crypto payments to attacker wallets
A poisoned JavaScript file served by ad tech firm Adform rewrote crypto wallet addresses on customer sites.
Adobe fixes CVSS 10 Campaign Classic bug that needs no user click
Adobe patches a CVSS 10 Campaign Classic flaw that allows code execution with no user interaction.
Google AI roots out 13-year-old bug as Chrome patch count hits 1,442
Google's record Chrome patch wave fixed 1,442 bugs, including a Gemini-discovered flaw that hid for 13 years.
Researchers map 84 implicit-trust flaws across 4G and 5G cores
An academic study found dozens of vulnerabilities in open-source 4G and 5G core networks rooted in implicit trust.
Nebula exploit demo defeats Tor Browser with one page load
Nebula Security showed a single page load can break Tor Browser through a Firefox JIT flaw.
Amazon ties debug and chalk npm hijacks to North Korean hackers
Amazon attributes the debug and chalk npm hijacks to the North Korean group behind the axios attack.
Spotlight
Hacked Korean sites weaponize AnySign4PC to silently plant backdoors
A South Korean joint advisory warns that compromised websites silently infected visitors through AnySign4PC flaws.
XCSSET v40 returns with memory-only macOS supply chain attacks
The XCSSET malware returns as v40 with memory-only execution and a new Chrome-hijacking module.
Coldcard firmware bug tied to $70M Bitcoin heist
A firmware randomness flaw in Coldcard wallets is linked to a 41-minute sweep that drained more than $70M in Bitcoin.
Memory-only backdoors OctLurk and SilkLurk stalk Central Asia
Kaspersky ties two memory-resident backdoors to government network intrusions across Central Asia.
Features
Autonomous attacks run by DeepSeek agent on a single Telegram order
Unit 42 details a DeepSeek-driven agent that launched attacks after a single Telegram command.
Brinks Home breach claim adds 4.9M records to ShinyHunters tally
ShinyHunters claims a Brinks Home Salesforce breach exposing millions of records.
Claude models attacked real companies they mistook for a game
Anthropic found three incidents where its Claude models reached live production systems during capture-the-flag evaluations.
Azure Cosmos DB bug could have unlocked every tenant database
Wiz found a chain it calls CosmosEscape that let a crafted Gremlin query grab a platform-wide master key.
Prompt injection turns Word documents into self-spreading worms
Researcher Hakon Maloy showed how hidden instructions in a Word file can alter Copilot output and copy themselves into new…
Okta buys Permiso to pair identity posture with threat detection
Okta's deal for Permiso Security merges identity threat detection with posture management as AI agents multiply.
