Offline Android phones leak data through Manic’s Wi-Fi mesh
Manic Android malware exfiltrates data through nearby infected devices when the victim phone is offline.
The Latest
Sandbox escape in isolated-vm gives guests host memory control
Endor Labs shows a type confusion in isolated-vm lets sandboxed code take over the host process.
Zimbra mail servers under fire as SNMP bug gets exploited
Poland's CERT warns attackers are exploiting a patched Zimbra command-injection flaw in the wild.
Clop’s bespoke shell empties Windchill keystores and vault maps
Clop's bespoke Windchill web shell decrypts keystore credentials and maps vaults for mass exfiltration.
Google ties three Russian crews to OAuth phishing on academics
Google tracks three suspected Russian clusters abusing OAuth and WhatsApp to hijack targeted accounts.
Rust project yanks three poisoned crates after build-time backdoor
The Rust project yanked three poisoned crates after a compromised account shipped a build-time backdoor.
Cisco ships fixes for nine bugs with five at maximum severity
Cisco ships patches for nine Crosswork and Secure Workload bugs, five rated at maximum severity.
Perfect-ten Entra ID bug was exploited before Microsoft closed it
Microsoft says the maximum-severity Entra ID flaw is fully mitigated and needs no customer action.
Leaky server exposes toolkit behind 14,500-camera Dahua hijack
Hunt.io rebuilt Operation CameraSwarm from an exposed operator directory after more than 14,500 Dahua devices were compromised.
NASA mission console flaws open spacecraft commands to strangers
Cycode found unauthenticated command injection paths in the AIT-GUI console NASA uses to operate instruments and spacecraft.
Five US agencies warn AI scripts now hunt exposed Siemens PLCs
A five-agency advisory flags an active AI-assisted campaign against internet-exposed Siemens S7 controllers across critical US sectors.
OpenAI presses pause on frontier AI training after escape risks
OpenAI halts frontier reinforcement learning for two weeks while it strengthens sandboxes, monitoring, and alignment defenses.
Android banking trojan ToxicPanda gains 167 commands and global reach
Zimperium details ToxicPanda 2.0's expanded on-device fraud while IBM flags a fresh GoldDigger campaign in South Africa and the UK.
Rapid7 urges emergency patching of Citrix NetScaler login bypass
Citrix fixed a CVSS 9.3 authentication bypass in NetScaler ADC and Gateway that attackers are expected to exploit quickly.
Spotlight
Firefox store hosts 40 wallet-stealing add-ons in crypto heist ring
Socket found 40 malicious Firefox extensions posing as Web3 products to drain recovery phrases and private keys.
WordPress page builder flaw turns file forms into remote code execution
Patchstack warns that a CVSS 9.0 flaw in Elementor Pro lets unauthenticated attackers upload PHP files and take over sites.
Snowflake CI workflow injection leaks Jira tokens through crafted issues
Wiz's Red Agent found a GitHub Actions injection in a Snowflake repository that exposed Jira credentials via a specially crafted issue.
StubMaker typosquats Ruby libraries to drain browser wallets
OpenSourceMalware is tracking StubMaker, a campaign of 16 typosquatted RubyGems packages that drops a Windows infostealer on developers.
Features
WordPress form plugin flaw lets strangers plant backdoor PHP files
A critical arbitrary file upload bug in Forminator Forms, running on more than 600,000 WordPress sites, lets unauthenticated attackers execute…
Evooo1Bot borrows Mirai code to rent out routers as proxies
Fortinet's FortiGuard Labs uncovered Evooo1Bot, a Mirai-derived Linux botnet that turns hacked edge devices into SOCKS5 proxies.
Azure directory dumps put McDonald’s and TCS staff data up for sale
A seller posting employee directories claims they came from Azure tenants of nine companies, and Hudson Rock says the samples…
Order tracking gap exposes SafePal buyers’ names and home addresses
SafePal says an authorization flaw in its order tracking plugin exposed the personal details of about 39,798 customers, but no…
DNS rebinding trick puts Ray AI clusters within browser attackers’ reach
CISA added an actively exploited Ray AI framework flaw to its KEV catalog, citing evidence of active exploitation in the…
Unauthenticated GraphQL injection lets strangers wipe GitLab projects
GitLab shipped emergency patches for a critical GraphQL code injection flaw that lets unauthenticated attackers modify or delete public projects.