Sleepwalker backdoor naps in memory until a magic packet wakes it
The Sleepwalker backdoor waits in memory for one magic packet, then runs commands in its own language.
The Latest
Spring’s latest patch run fixes 91 flaws, one critical
Broadcom's Spring framework patches 91 flaws in one release, including a critical LDAP bug.
One approved push notification let vishers into ReliaQuest
One approved MFA push gave ShinyHunters-linked callers a brief view-only session inside ReliaQuest.
Bogus Codex ads trick Mac devs into pasting malware
Sponsored ads route Mac developers to fake Codex pages that end in a malicious Terminal command.
SAML plugin bugs hand WordPress admin access to strangers
Two unauthenticated bugs in the miniOrange SAML plugin let attackers log in as any WordPress user.
WeedHack infostealer still ranks top in Minecraft mod searches
Fake Minecraft client sites keep ranking at the top of search results while dropping the WeedHack infostealer.
Phishing kit bypasses 2FA across 4,500 corporate domains
A two-year phishing-as-a-service campaign bypasses 2FA across more than 4,500 Microsoft 365 domains.
Oracle’s top-severity WebLogic flaw hits CISA urgent patch list
CISA adds a CVSS 10.0 Oracle WebLogic flaw to its exploited list and gives federal agencies a three-day patch window.
Password reset bypass in Keycloak opens every account to takeover
Red Hat patches a critical Keycloak flaw that lets unauthenticated attackers seize any account, including admins.
Bogus rescue outfit double-dips on ransomware victims
GuidePoint finds a sham firm called Ransom Busters billing victims for recoveries it likely cannot deliver.
Linux rig joins Apple Find My to pull live location feeds
Researcher Zerotistic enrolls a Linux machine in Apple's Find My network and decrypts shared location data.
764 offshoot leader gets record 77-year term for abuse spree
Kyle Spitze, an original 764 member, draws the longest federal sentence yet imposed on a nihilistic violent extremist.
Slovak watchdog pulls speed cameras over hacking and data risks
Slovakia's NBU warns that NERO R-ONE road cameras carry serious cyber risks, from data exposure to remote access.
Graduation invites hide Go backdoor aimed at Myanmar officials
Seqrite Labs tracks Operation QUICSILVER, a China-nexus espionage push that delivers a QUIC-based Go implant to Myanmar targets.
Spotlight
SPECTRE backdoor shows how AI sharpens mass web server raids
Cisco Talos details UAT-10147, a Chinese-speaking crew that leans on AI tooling and a new SPECTRE implant to hit web servers.
iAuthFlow V2 kit keeps access alive with attacker passkeys
A new phishing kit enrolls attacker passkeys to keep access after password resets.
LockBit threatens US Bank leak as lender points to vendor breach
LockBit lists US Bank on its leak site, but the lender says the claim traces to a vendor event.
Cheap $25 template powers hundreds of phantom banking sites
A $25 template underpins hundreds of fake banking sites built for fraud, Allure Security finds.
Features
Spectre attack on Cloudflare Workers leaks JWT across tenants
Researchers leaked a JWT from a co-located Cloudflare Worker via Spectre at 12 bits per second.
CDN Tsunami turns HTTP/3 edge into 350x flood amplifier
New research shows CDN protocol conversion can amplify a low-bandwidth attack stream up to 350x at the origin.
Iran-aligned attackers forced a four-day UK power station outage
Iran-linked hackers knocked a small UK power plant offline for four days, The Telegraph reports.
TikTok pays $400M to settle US child privacy lawsuit
TikTok will pay $400M to end a US lawsuit over child privacy violations, the Justice Department announced.
Apollo confirms cloud intrusion as BlackFile spree widens
The private equity giant says attackers hit its cloud platforms in July, exposing names and Social Security numbers.
CISA orders TrueConf patches after Ukraine-linked server attacks
Two exploited TrueConf Server flaws land on CISA's KEV list as Head Mare is caught delivering a poisoned installer.