Helix Extortion Group Targets SharePoint with Vishing and Device Code Tactics
The Helix group uses vishing and device code phishing to break into SharePoint, then exfiltrates data for extortion or sale.
The Latest
GigaWiper Backdoor Blends Remote Access with Irreversible Data Destruction
GigaWiper is a modular Golang backdoor that merges remote access tools with disk wiping and fake ransomware capabilities.
Free Android VPN Apps Fail Basic Security Tests in Major Academic Study
A new automated testing framework reveals widespread traffic leaks, plaintext data transmission, and tracking behavior across 281 popular free Android…
Researcher Finds Google Dialogflow CX Flaw Opened Door to Agent Hijacking
Google patched a flaw in Dialogflow CX that allowed an attacker with edit permissions on one chatbot to hijack others…
Insider Negotiator Helped BlackCat Ransomware Gang Maximize Payouts
A former cybersecurity incident response employee received a 70-month prison sentence for feeding confidential victim data to the BlackCat ransomware…
Dutch Police Trace Odido Telecom Hack to Local Suspects Through Phone Call
Investigators traced the Odido breach to local hackers after a Dutch-speaking caller impersonated an IT employee to gain access.
Microsoft Plans to Pull Legacy OWA Light from Exchange Server
Microsoft is removing the legacy OWA Light email client from Exchange Server in August 2026, citing modern browser capabilities and…
AI Coding Assistant Bypasses Safety Filters Through Multi Step Code Tasks
Researchers discovered GitHub Copilot produces harmful content in 816 out of 816 workflow runs when dangerous requests are broken into…
Friendly Fire Attack Hijacks AI Security Agents to Run Malicious Code
Researchers demonstrated that autonomous AI coding agents from Anthropic and OpenAI will execute hidden malicious binaries when asked to review…
Recovery of Dell BIOS Passwords Enabled by Broken Encryption Scheme
Dell BIOS passwords stored with a flawed XOR cipher allow full recovery from flash dumps in milliseconds, posing risks to…
Leaked Server Exposes Mass WordPress Backdoor Operation
Researchers found an attacker's unsecured server containing 800 MB of data, revealing how a webshell brokerage compromised thousands of WordPress sites at scale.
Pegasus Spyware Used Against EU Lawmaker on Surveillance Probe Committee
Forensic analysis revealed a European Parliament member's iPhone was compromised with Pegasus spyware during sensitive committee hearings on surveillance abuse,…
Zimbra Classic Web Client Vulnerability Allows Code Execution via Malicious Emails
A stored XSS vulnerability in Zimbra's Classic Web Client lets attackers execute malicious code when a user opens a specially…
CISA Publishes Post Incident Analysis After Contractor Leaks AWS GovCloud Credentials
A contractor's accidental exposure of AWS GovCloud credentials in a public GitHub repository prompted CISA to release a detailed after…
Spotlight
Threat Actor Claims Theft of 35 GB of Source Code from Accenture
A threat actor claims to have stolen 35 GB of data including source code and credentials from Accenture, but the company says the incident is isolated and remediated.
Remote Crash Vulnerability Discovered in Alibaba’s XQUIC Library for HTTP/3
A single arithmetic error in XQUIC's memory handling during QPACK table resizing lets any remote client crash HTTP/3 servers with normal network traffic.
Rust Based MODBEACON Trojan Relies on gRPC Streaming for Stealthy C2
The memory resident Rust based trojan reuses the transport layer from an open source anti-censorship proxy framework to create encrypted C2 channels.
Page Cache Overflow in Linux FUSE Grants Local Root Access
A local attacker can exploit a page cache overflow in the Linux kernel's FUSE subsystem to gain root privileges by corrupting a SUID binary.
Features
One Click Android 17 Exploit Delivers Full Device Takeover via Browser and Kernel Zero Days
The IonStack exploit chain uses a Firefox zero day and a 15 year old Linux kernel flaw to achieve full…
Progress Software Warns of Active Threat Against ShareFile Storage Zone Controllers
Progress Software has ordered ShareFile customers running on-premises Storage Zone Controllers to shut down the servers immediately due to what…
Researchers Uncover Six Bootloader Bugs That Allow Code Execution Before OS Loads
Four crash bugs and two code execution flaws in the U-Boot bootloader allow attackers to compromise a device before its…
Weak Randomness in Wallet Code Lets Attackers Steal Over $5 Million in Crypto
Coinspect discovered that poor random number generation in older or lesser-known crypto wallets made their seed phrases predictable, leading to…
Process Parameter Poisoning: Novel Injection Sidesteps EDR Defenses
A proof of concept places malicious code in Windows process startup data rather than writing it directly into memory, bypassing…
Session Hijack Exploit in Citrix NetScaler Opens Door to Rapid Ransomware Deployment
Attackers are exploiting a Citrix NetScaler memory disclosure flaw to steal active session tokens and deploy ransomware in under an…
