A SQL injection raid exposes Polish patients’ national ID numbers
Attackers pulled Polish national ID numbers from a clinic platform through a SQL injection flaw.
The Latest
Pentagon records office admits a nine-month intruder access
The Defense Manpower Data Center left unencrypted records open to intruders for nine months.
A rogue MCP server can walk off with your OAuth tokens
A malicious MCP server can redirect a client's OAuth handshake and pocket the secrets.
Microsoft ties a quiet intrusion toolkit to the Daemon Tools breach
The toolkit let intruders hold ground inside telecom, university and government networks.
Apple patches a zero-day used in surgically targeted attacks
An out-of-bounds write in Apple's drawing engine was aimed at a targeted few.
OpenAI benches its next flagship after deception findings
A frontier model failed its own safety audits and will not ship in October as planned.
Dutch police hold 24-year-old over ShinyHunters extortion case
Dutch detectives are holding a 24-year-old Amsterdam man over the ShinyHunters extortion crew.
A 2005 forum dump shows how little ransomware culture has changed
Ninety active accounts produced most of Exploit.in's traffic, and the habits they built still shape today's ransomware crews.
Making an AI sound drunk makes it spill secrets and break rules
UNSW researchers fine-tuned five language models on 57,000 drunk texts and watched their guardrails dissolve.
US phone forensics vendor accused of hiding its Russian owners
Prosecutors say Oxygen Forensics kept Russian shareholders off the paperwork while selling hacking tools to US agencies.
One ransomware crew pivots between four brands with the same playbook
Microsoft says Storm-2570 swaps ransomware payloads but never swaps its tools, handing defenders a stable set of behaviors to hunt.
A hidden field in DC health reports exposed 400,000 Medicaid files
Two public reports on the DC health finance agency's website carried personal data in fields no visitor was meant to…
Nvidia puts an agent watchdog in silicon to cage rogue AI
Nvidia's Open Agent Safety Platform pairs a sandbox runtime with a separate hardware monitor that can stop a stray AI…
Rydox marketplace owner pleads guilty and faces up to 20 years
Ardit Kutleshi admitted in a US court to running the Rydox cybercrime marketplace for a decade.
Spotlight
Asus tells eShop shoppers an intruder reached their order records
Asus says an intruder reached part of its eShop and may have taken customer contact details and order records.
Forgotten service accounts cracked open 28 Microsoft 365 tenants
Proofpoint linked 28 Microsoft 365 tenant intrusions to unrotated service accounts still holding default passwords.
Anyone holding your GitLab issue email can commit code as you
Aikido Security found GitLab's per-user issue email doubles as a non-expiring token that can commit code as the account owner.
Lunex stealer blinds endpoint defenses with a vulnerable AMD driver
A steal-everything platform called Lunex disables endpoint defenses through a vulnerable AMD driver before it grabs browser and wallet data.
Features
Citrix has no fix yet as attackers hit NetScaler zero-days
watchTowr says two unpatched NetScaler RCE flaws are being exploited and Citrix has published no fix.
One click on a crafted link can seize an Elementor site
A CSRF flaw in the Elementor website builder lets a single link create a rogue administrator account on millions of…
Rented botnet drains victims’ AI credits with help from Grok
A new Windows botnet called x47.c uses xAI's Grok model to pick its next action and burns through victims' paid…
Kiteworks tells customers to power down for nine hours
Kiteworks asked customers to run a precautionary nine-hour shutdown after federal intelligence warned of a possible attack.
Army hacker Kiberphant0m lands 70 months for telecom extortion
A US soldier who stole call records from AT&T and others as the persona Kiberphant0m was sentenced to 70 months…
Compromised service principals let Storm-3168 ravage Azure tenants
Microsoft tied a destructive Azure campaign to the agentic crew JADEPUFFER, which abused two hijacked service principals to wipe cloud…