Adform tracker hack redirected crypto payments to attacker wallets
A poisoned JavaScript file served by ad tech firm Adform rewrote crypto wallet addresses on customer sites.
The Latest
Adobe fixes CVSS 10 Campaign Classic bug that needs no user click
Adobe patches a CVSS 10 Campaign Classic flaw that allows code execution with no user interaction.
Google AI roots out 13-year-old bug as Chrome patch count hits 1,442
Google's record Chrome patch wave fixed 1,442 bugs, including a Gemini-discovered flaw that hid for 13 years.
Researchers map 84 implicit-trust flaws across 4G and 5G cores
An academic study found dozens of vulnerabilities in open-source 4G and 5G core networks rooted in implicit trust.
Nebula exploit demo defeats Tor Browser with one page load
Nebula Security showed a single page load can break Tor Browser through a Firefox JIT flaw.
Amazon ties debug and chalk npm hijacks to North Korean hackers
Amazon attributes the debug and chalk npm hijacks to the North Korean group behind the axios attack.
Hacked Korean sites weaponize AnySign4PC to silently plant backdoors
A South Korean joint advisory warns that compromised websites silently infected visitors through AnySign4PC flaws.
XCSSET v40 returns with memory-only macOS supply chain attacks
The XCSSET malware returns as v40 with memory-only execution and a new Chrome-hijacking module.
Coldcard firmware bug tied to $70M Bitcoin heist
A firmware randomness flaw in Coldcard wallets is linked to a 41-minute sweep that drained more than $70M in Bitcoin.
Memory-only backdoors OctLurk and SilkLurk stalk Central Asia
Kaspersky ties two memory-resident backdoors to government network intrusions across Central Asia.
Autonomous attacks run by DeepSeek agent on a single Telegram order
Unit 42 details a DeepSeek-driven agent that launched attacks after a single Telegram command.
Brinks Home breach claim adds 4.9M records to ShinyHunters tally
ShinyHunters claims a Brinks Home Salesforce breach exposing millions of records.
Claude models attacked real companies they mistook for a game
Anthropic found three incidents where its Claude models reached live production systems during capture-the-flag evaluations.
Azure Cosmos DB bug could have unlocked every tenant database
Wiz found a chain it calls CosmosEscape that let a crafted Gremlin query grab a platform-wide master key.
Spotlight
Prompt injection turns Word documents into self-spreading worms
Researcher Hakon Maloy showed how hidden instructions in a Word file can alter Copilot output and copy themselves into new documents.
Okta buys Permiso to pair identity posture with threat detection
Okta's deal for Permiso Security merges identity threat detection with posture management as AI agents multiply.
Fake macOS update pages drop crypto stealers in DPRK campaign
North Korea-linked actors are using fake full-screen macOS updates to push ClickFix-style clipboard attacks.
Gitea patch blocks RCE that turned patches into git hooks
CVE-2026-60004 lets a repository writer plant a git hook and run commands as the Gitea service account.
Features
CareCloud breach hits 350,000 with medical and financial data loss
Hackers stole personal, financial and medical data from CareCloud's AWS environment in March.
BMC research finds 24,650 servers leaking password hashes
Research finds tens of thousands of internet-facing BMCs disclosing IPMI password hashes without authentication.
Image uploads can leak Rails master keys through critical Active Storage bug
A CVSS 9.5 Rails Active Storage flaw lets unauthenticated attackers read arbitrary server files through crafted image uploads.
CVSS 10 Ruflo bug gives attackers full control of AI agents and their memory
Ruflo's unauthenticated MCP bridge earns a perfect CVSS 10 as researchers demonstrate AI memory poisoning.
Attackers weaponize Cisco FMC static credentials before Cisco released hotfix
CISA adds actively exploited Cisco FMC static credentials flaw to its known vulnerabilities catalog.
Spy group OWAReaper backdoor survives password changes and device rebuilds
TA488 exploits OWA cross-site scripting flaw to plant browser implants that survive credential rotation.
