Zyxel switches fall to an obfuscated exploit as CISA sets a deadline
A Chinese-speaking operation pulled configuration files and hashed root credentials from 996 Zyxel GS1900 switches before federal agencies got 72 hours to patch.
The Latest
Malware hides in a B-tree library now that npm blocks install hooks
A malicious npm package pulled two million weekly downloads while running its payload from ordinary library code instead of an…
TASK#STOMP hides a document thief behind Windows’ own tools
A PowerShell backdoor built from native Windows components steals business files, Wi-Fi passwords and clipboard contents while hiding as scheduled…
A single line break turned a WordPress comment into a server shell
An anonymous commenter could plant a script that ran in an administrator's browser and, from there, uploaded a web shell…
A nested-virtualization bug lets ARM64 guests touch host memory
A skipped cache invalidation leaves a freed page of host memory mapped and writable for a guest virtual machine on…
One in five water utilities has logins sitting in infostealer logs
SpyCloud found 1,787 of roughly 10,000 US water organizations exposed, including one infected device holding logins for 167 utility tenants.
A SharePoint spoofing bug turned out to be full remote code execution
Microsoft scored the flaw 6.5 as a spoofing issue, while the National Vulnerability Database calls the same bug an 8.8…
A fake LastPass page ships a signed driver that kills security tools
A GitHub page posing as the LastPass Authenticator installs a Microsoft-signed kernel driver that terminates 145 security processes before a…
Ireland fines Google €403M over how it handled location data
Ireland's regulator says Google's location processing broke GDPR rules and orders a six-month fix.
Fake recruiters call Rust maintainers to plant malware on their Macs
Fake recruiters are booking video calls with Rust maintainers and pushing malware.
Jade Sleet slips two macOS backdoors onto a developer’s laptop
Two Rust backdoors for Apple Silicon sat dormant on a developer's Mac for eleven days.
Settra ransomware pairs stolen VPN logins with RMM persistence
A new ransomware strain enters through VPN credentials and hides behind RMM agents.
CISA retires its weekly vulnerability bulletin after 22 years
CISA is retiring a weekly vulnerability bulletin it has published since 2004.
Rival crew seizes Clop’s leak site and bills the extortionists
A rival crew says it now owns Clop's leak site and wants an eight-figure cut.
Spotlight
Attackers flipped control settings at two Colorado water utilities
Two small Colorado water providers found control settings changed and alarms silenced.
A wrong company name let Gemini attack three real businesses
Google's Gemini model attacked three real companies because one fictional target name matched a real domain, and the company stayed quiet about it for months.
A forgotten Cloudflare key turned 100,000 sites into a malware channel
Attackers used a long-lived Cloudflare API key stored in Brevo's own source code to push malware through the marketing platform's scripts to more than 100,000 websites.
Linux kernel flaws pile up as root exploits land in public
CISA added three Linux kernel flaws to its exploited list while a researcher published working root exploits for four more.
Features
Pakistan-linked spies built a Rust backdoor that talks through GitHub
Zscaler ThreatLabz tied four new tools, including a Rust backdoor that uses private GitHub repositories for command and control, to…
Scattered Spider’s Ahmed Elbadawy pleads guilty and forfeits $17.6M
A year-old sealed plea became public this week when prosecutors moved to seize about $17.6M in crypto, vehicles and luxury…
Salt Typhoon turns to Latin America with a new modular backdoor
ESET found the SparroWocky backdoor in government networks across eight Latin American countries as the group shifted 90 percent of…
One extension can seize the AI inside five Chromium products
A single extension holding two common permissions could command the built-in AI in Chrome, Comet, Edge, Opera Neon and Claude…
A static key in SolarWinds ARM lets outsiders run code remotely
SolarWinds has patched a hard-coded key that let unauthenticated attackers run code in Access Rights Manager.
Researchers pointed Claude Opus 5 at OpenAI and got inside
Hacktron used Claude Opus 5 to exploit a libheif memory bug, then walked through OpenAI's single sign-on into staff accounts.