Rydox marketplace owner pleads guilty and faces up to 20 years
Ardit Kutleshi admitted in a US court to running the Rydox cybercrime marketplace for a decade.
The Latest
Asus tells eShop shoppers an intruder reached their order records
Asus says an intruder reached part of its eShop and may have taken customer contact details and order records.
Forgotten service accounts cracked open 28 Microsoft 365 tenants
Proofpoint linked 28 Microsoft 365 tenant intrusions to unrotated service accounts still holding default passwords.
Anyone holding your GitLab issue email can commit code as you
Aikido Security found GitLab's per-user issue email doubles as a non-expiring token that can commit code as the account owner.
Lunex stealer blinds endpoint defenses with a vulnerable AMD driver
A steal-everything platform called Lunex disables endpoint defenses through a vulnerable AMD driver before it grabs browser and wallet data.
Citrix has no fix yet as attackers hit NetScaler zero-days
watchTowr says two unpatched NetScaler RCE flaws are being exploited and Citrix has published no fix.
One click on a crafted link can seize an Elementor site
A CSRF flaw in the Elementor website builder lets a single link create a rogue administrator account on millions of…
Rented botnet drains victims’ AI credits with help from Grok
A new Windows botnet called x47.c uses xAI's Grok model to pick its next action and burns through victims' paid…
Kiteworks tells customers to power down for nine hours
Kiteworks asked customers to run a precautionary nine-hour shutdown after federal intelligence warned of a possible attack.
Army hacker Kiberphant0m lands 70 months for telecom extortion
A US soldier who stole call records from AT&T and others as the persona Kiberphant0m was sentenced to 70 months…
Compromised service principals let Storm-3168 ravage Azure tenants
Microsoft tied a destructive Azure campaign to the agentic crew JADEPUFFER, which abused two hijacked service principals to wipe cloud resources.
Fake payroll apps quietly slip remote control onto HR laptops
A campaign offers fake desktop clients for three US payroll platforms, then installs ScreenConnect to give an attacker unattended access…
Two unfixed OnePlus bugs hand installed apps full root access
A researcher published two chained OnePlus flaws that let an ordinary app gain root after the vendor warned of legal…
A placeholder web address in 1,700 repos now serves malware
The documentation stand-in third-party[.]com has been weaponised, serving a ClickFix lure that poisons the clipboard on Windows machines.
Spotlight
Bitget halts withdrawals after a $351.6M wallet heist
Suspected North Korean thieves moved $351.6M out of Bitget's hot wallets through a spoofed transaction request.
Attackers cash in on an unauthenticated Roundcube mail flaw
Canada's cyber centre says a patched SQL injection in Roundcube Webmail is being exploited in the wild.
Poisoned leads turned Salesforce’s AI agent into a data thief
Three flaws in Salesforce Agentforce let attackers hijack trusted agents for silent CRM theft and Slack phishing.
A lone operator rented AI agents to breach 27 firms
A Chinese-speaking crook spent about $15,000 on open-source AI agents to raid hundreds of retailers and steal 600,000 card records.
Features
Cloudflare container flaw exposed neighbors’ leftover disk data
A misconfigured storage pool let one Cloudflare container read another tenant's deleted files, forcing a cleanup of every disk.
A botnet recruits an AI agent to harvest stolen API keys
CARBONATO hijacks exposed Docker daemons, then runs an AI agent to loot credentials and fund its own model access.
Every major OS leaks user activity through file alerts
Researchers found decade-old flaws in file-notification systems that let an unprivileged process infer what other users are doing.
Australia opens inquiry after OpenAI agent breached health portal
A research agent got past controls on a government statistics portal, prompting a taskforce review and questions about how slowly…
Malware hands its tactical decisions to a panel of AI models
Cisco Talos found a Windows implant that polls four commercial AI models and acts on whichever answer wins.
Malware turns up in HashiCorp Terraform registry packages
Aikido traced Go malware inside two Terraform providers and two Go modules, the first abuse of HashiCorp's registry as a…