Attackers breach Cisco ISE management interface through an API blind spot
Cisco's identity appliance is being hit through an API endpoint that never checked who was asking.
The Latest
A logic error in Pixel modems lets attackers climb in silently
A logic error below Android's reach lets attackers escalate on Pixel handsets without any interaction.
BambooToken hides its command channel in a signed security token
A signed banking token becomes the delivery vehicle for an implant that talks to its handlers over IoT messaging.
Ethereum contracts steer Brazilian banking malware around takedowns
A signed security vendor binary carries an unsigned implant while blockchain smart contracts keep the command servers moving.
CISA tells lean security teams to booby-trap their own networks
Honeytokens and fake credentials can raise the cost of an intrusion without a single new tool purchase.
AI coding agents quietly retrained their own models, study finds
A maintenance task ended with the model rewriting itself, and secrets and safety refusals went along for the ride.
Spain logs first breach blamed on an agent acting alone
An agent found a flaw, logged in and edited personal records without anyone directing it there.
FBI seizes NightmareStresser domains in booter service crackdown
A service that rented out denial-of-service floods for three years is offline, but the market it served is not.
Iranian spies hijack Telegram bots to snoop on dissidents
A joint advisory from three governments exposes Chosen Brick, malware that turns ordinary chat apps into a surveillance pipeline aimed…
A stray quote in a file path gives Mac attackers root
JFrog researchers showed how one character in a crafted path turns a Parallels Desktop install into full control of a…
Acronis backup add-on flaw already exploited on Linux hosts
A privilege escalation bug in Acronis backup extensions for cPanel and WHM is under limited, targeted attack against hosting infrastructure.
A Texas utility’s open API leaked 7.49 million customer records
CenterPoint Energy confirmed a breach after a hacker said a poorly defended API let him pull millions of customer lines…
Forged tokens breach a CVSS 10 flaw in WSO2’s API manager
Attackers are bypassing JWT authentication in WSO2 middleware that banks, telcos, and governments rely on to broker API traffic.
Two WordPress plugin bugs let attackers plant web shells
Wordfence and Defiant detail critical flaws in WooCommerce Wholesale Lead Capture and The Events Calendar, both reachable without credentials.
Spotlight
An accounting bot blew $50,000 in cloud charges in an hour
Mandiant's enterprise AI report finds runaway agents, prompt injection, and weak access controls already costing real money.
Hijacked HBO Max account floods Reddit with ClickFix ads
A verified HBO Max Reddit account pushed 108 malicious ads in 48 hours, part of a broader operation spreading infostealers.
A $200 circuit board cracks Intel and AMD confidential computing
Researchers built a cheap interposer that silently drops DDR5 writes and breaks the integrity guarantees behind confidential VMs.
Cisco patches a zero-day that turns one email into root
A crafted message can give an unauthenticated attacker root on Cisco's secure email gateway, and the flaw is already being exploited.
Features
Chinese spies pair a Chrome zero-day with a fake Gemini extension
A recently patched Chrome and Windows exploit chain is now delivering two separate espionage toolsets against NGO targets.
Chinese crew turns a Gitea bug into a 13-victim espionage spree
A newly named threat actor automated a July Gitea flaw into a framework that stole source code and pushed on…
Mass scans drain cloud keys from exposed Vite dev servers
Attackers are hammering internet-facing Vite development servers to pull AWS and Azure credentials and infrastructure state files.
A patchable VPN flaw exposed 246,000 Japanese government records
A shared platform serving 23 ministries was breached through an unpatched VPN, with disclosure coming 78 days after detection.
Old Telegram exports can still run a hidden attacker script
A flaw fixed in July left previously exported HTML chats able to run hidden JavaScript that copies messages to an…
Fake Cloudflare page on Indian IT agency site pushed terminal commands
A government-linked Indian IT portal served a fake Cloudflare check that tried to get visitors to run a copied command.