Spirals ransomware encrypts victim networks in under 24 hours
Symantec discovered Spirals, a Rust-based ransomware that encrypted an IT services company's network in less than a day.
The Latest
Zoom patches critical Windows flaw that allows account takeover
Zoom fixed CVE-2026-53412, a critical account takeover vulnerability with a CVSS score of 9.8 affecting Windows users.
Russian hackers use fake Webex and Zoom installers to deliver Starland RAT
Cisco Talos uncovered a Russian-speaking threat actor using trojanized installers to deliver Starland RAT and memory-only implants.
New NadMesh botnet hunts exposed AI services for cloud credentials
Researchers discovered the NadMesh botnet, which targets exposed AI infrastructure to steal cloud keys and Kubernetes tokens.
Grok Build uploaded entire Git repositories to xAI cloud storage
A security researcher found that xAI's Grok Build CLI packaged and uploaded entire code repositories, including deleted secrets, to Google…
Claude for Chrome flaw lets rogue extensions read Gmail messages
Researchers discovered that malicious Chrome extensions can abuse a permission flaw in the Claude for Chrome extension to read Gmail…
ACR Stealer uses ClickFix lures to steal browser tokens and Microsoft 365
Microsoft observed two ACR Stealer campaigns using fake error messages to trick users into running code that steals credentials and…
Abbott discloses cyberattack on its cancer diagnostics business
The medical device giant confirmed unauthorized access to internal systems in its cancer diagnostics unit, which includes the recently acquired…
Microsoft patches record 570 flaws as AI accelerates vulnerability discovery
Artificial intelligence helped Microsoft discover and patch 570 security vulnerabilities in July, nearly tripling last month's record-breaking patch count.
SharePoint zero-day added to CISA KEV as exploitation mounts
CISA warns of active exploitation of CVE-2026-58644 and three other SharePoint flaws, urging federal agencies to patch within a week.
TuxBot v3 IoT botnet shows signs of AI-assisted development
The TuxBot v3 Evolution botnet framework was built with help from an LLM, but the AI left a safety disclaimer in the code.
White House launches Gold Eagle AI vulnerability clearinghouse
The Treasury-led Gold Eagle program uses frontier AI models to accelerate vulnerability discovery and coordinated patching.
Malicious Vite npm packages use blockchain command and control to deliver remote access trojan
Checkmarx uncovered seven malicious npm packages targeting Vite developers with blockchain-based C2 infrastructure spanning Tron, Aptos, and Binance Smart Chain.
Ernst and Young data breach exposes client tax documents through IT support platform
A third-party IT service management platform used by EY was breached for two weeks in spring 2026, leading to the…
Spotlight
Chinese hacking subgroup linked to DigiCert breach and code-signing certificate theft
Expel researchers attributed the April DigiCert breach to CylindricalCanine, a GoldenEyeDog subgroup that stole code-signing certificates to sign malware.
Ransomware attack halts Coca-Cola Fairlife dairy production across US plants
A ransomware incident at Coca-Cola’s Fairlife dairy subsidiary has forced the suspension of US production operations while the company investigates.
WordPress core flaw lets unauthenticated attackers run arbitrary code
A pre-authentication remote code execution bug in WordPress core affects versions 6.9 and 7.0, with emergency patches released July 17 and forced updates enabled.
OpenSSL HollowByte flaw freezes server memory with 11-byte TLS requests
A denial-of-service vulnerability in OpenSSL lets attackers lock server memory permanently using tiny TLS handshake messages, with fixes shipped June 9 but no CVE assigned.
Features
Cyberattack on Japanese logistics firm forces KFC to halt online orders
A ransomware attack on Nichirei Group cold-chain logistics systems disrupted KFC Japan ingredient supply, stopping app and website orders.
Chinese actors use Claude Code and DeepSeek to automate cyber espionage
Security researchers uncovered state-sponsored operators using Claude Code and DeepSeek models to automate intelligence gathering and maintain persistent access to…
Scattered Spider hackers sentenced to five years for TfL cyberattack
Two members of the Scattered Spider cybercrime gang received 5.
Unpatched Shark vacuum flaw lets attackers control millions of devices remotely
A certificate flaw in Shark robot vacuums allows attackers to command any device in the same AWS region, accessing cameras…
ClickLock macOS stealer kills apps every 210ms until victims give up password
A new infostealer called ClickLock holds macOS desktops hostage by repeatedly killing applications until the user types their login password.
SonicWall SMA1000 zero-days exploited in the wild for ransomware access
Two chained vulnerabilities give attackers full remote code execution on unpatched SMA 1000 appliances.
