Hide My Email Flaw Exposes User Addresses After Year Long Wait for Fix
A researcher discovered a vulnerability in Apple's Hide My Email that can expose real email addresses, and the fix has been delayed for over a year despite the company's promises.
The Latest
PolinRider Campaign Delivers 108 Malicious Packages Targeting Developers
The PolinRider campaign compromises developer workstations through malicious packages and VS Code task files across multiple registries.
First Fully AI Driven Ransomware Attack Spotted in the Wild
Researchers observed an autonomous AI agent conduct a complete ransomware intrusion from reconnaissance to data encryption without human intervention.
Lynx and INC Ransomware Groups Linked to Widespread Fortinet Credential Theft
The massive FortiBleed credential theft campaign was far larger than initially reported, targeting over 430,000 FortiGate firewalls and directly linked…
Global Takedown Hits Residential Proxy Botnet Behind 2 Million Compromised Home Devices
Law enforcement and industry partners disrupted the NetNut residential proxy network, which compromised millions of home devices to route malicious…
Exploit Released for Microsoft Exchange SSRF Flaw Enabling File Access
A public proof-of-concept exploit demonstrates how authenticated low-privileged users can exploit a Microsoft Exchange SSRF vulnerability to read arbitrary files…
Privilege Bypass Found in Anthropic’s Claude Cowork Sandbox Environment
Researchers bypassed every security layer in Anthropic's Claude Cowork sandbox using a DLL sideloading technique combined with an unvalidated parameter…
AI Assisted SQL Injection Exploit Compromises Major Event Ticketing Platform
An AI model helped a security researcher bypass a web application firewall and exploit a SQL injection vulnerability in a…
Alibaba Set to Block Anthropic’s Claude Code Over Covert Detection Claims
Alibaba plans to block Claude Code from its networks starting July 10 after researchers claim the AI tool silently detects…
Deceptive GitHub Repos Lure Researchers with Infected Exploit Code
Attackers are hiding a Python-based RAT called ChocoPoC in dependency lists rather than exploit code, making malicious GitHub repositories harder…
Seven FatFs Library Bugs Expose Millions of Embedded Devices to Code Execution
Seven unpatched vulnerabilities in the widely embedded FatFs library enable memory corruption and code execution through malicious USB drives, SD cards, or firmware updates.
New macOS Stealer Uses Fake Maccy Site and PAM Validation to Harvest Login Credentials
PamStealer uses a fake Maccy website and PAM based password validation to steal macOS login credentials and browser data.
Unauthorized Access to Kubota’s Network Systems Exposes Employee Data
Kubota North America is notifying employees that their personal data including Social Security numbers and bank account details were exposed…
Researchers Uncover ARToken PhaaS Platform Linked to EvilTokens Toolkit
Cisco Talos discovered a new PhaaS platform with over 80 exposed API endpoints, revealing deep integration with the EvilTokens toolkit…
Spotlight
Remote Kill Switch Flaw Prompts India to Ban Three E-Rickshaw Apps
Three mobile apps that allowed unauthorized users to remotely disable moving e-rickshaws have been banned by Indian authorities after videos showed them being used to stop vehicles mid-journey.
TeamPCP Exploits Trusted Developer Tools in Widespread Supply Chain Campaign
The FBI has identified a coordinated supply chain campaign where TeamPCP compromises trusted developer tools to steal credentials and extort victims at scale.
OpenAI Rolls Out GPT-5.6 Sol with Tiered Access and Tighter Defenses
OpenAI's staggered preview of GPT-5.6 Sol, Terra, and Luna under government oversight introduces enhanced cybersecurity capabilities with strict guardrails against offensive misuse.
Poisoned Tool Descriptions Can Hijack AI Agents to Exfiltrate Data
Attackers can embed hidden commands in tool descriptions that trick AI agents into sending sensitive data to external servers without triggering alerts.
Features
Fake Software Installers Deliver Stealthy SharkLoader Malware Worldwide
The StrikeShark campaign packages the SharkLoader malware inside fake installers for Cisco AnyConnect and Google Update to infiltrate government and…
Attackers Hide Commands in Web Code to Hijack AI Browsing Agents
Attackers are hiding malicious instructions in invisible HTML and structured data to trick AI browsing agents into making fraudulent payments…
CVE-2026-43503 Exploit Turns Kernel Memory Optimization Into Root Access
JFrog published the first working exploit for CVE-2026-43503, a Linux kernel flaw that lets local attackers overwrite file backed memory…
Former EU Spyware Investigator’s iPhone Compromised by NSO Group Pegasus
Forensic analysis reveals the lawmaker's iPhone was infected using the PWNYOURHOME zero-click exploit during sensitive committee deliberations on spyware abuses.
JetBrains Patches Critical Flaws That Could Allow Full Server Compromise
Attackers can chain authentication bypass flaws with remote code execution vulnerabilities across JetBrains Hub, YouTrack, TeamCity, and IDEs to take…
The IPO Window Opens: 9 Cybersecurity Startups Poised for Public Debuts
With Netskope and Rubrik proving the public markets are receptive, PitchBook identifies nine VC-backed cybersecurity startups most likely to follow…
