One click on a crafted link can seize an Elementor site
A CSRF flaw in the Elementor website builder lets a single link create a rogue administrator account on millions of WordPress sites.
The Latest
Rented botnet drains victims’ AI credits with help from Grok
A new Windows botnet called x47.c uses xAI's Grok model to pick its next action and burns through victims' paid…
Kiteworks tells customers to power down for nine hours
Kiteworks asked customers to run a precautionary nine-hour shutdown after federal intelligence warned of a possible attack.
Army hacker Kiberphant0m lands 70 months for telecom extortion
A US soldier who stole call records from AT&T and others as the persona Kiberphant0m was sentenced to 70 months…
Compromised service principals let Storm-3168 ravage Azure tenants
Microsoft tied a destructive Azure campaign to the agentic crew JADEPUFFER, which abused two hijacked service principals to wipe cloud…
Fake payroll apps quietly slip remote control onto HR laptops
A campaign offers fake desktop clients for three US payroll platforms, then installs ScreenConnect to give an attacker unattended access…
Two unfixed OnePlus bugs hand installed apps full root access
A researcher published two chained OnePlus flaws that let an ordinary app gain root after the vendor warned of legal…
A placeholder web address in 1,700 repos now serves malware
The documentation stand-in third-party[.]com has been weaponised, serving a ClickFix lure that poisons the clipboard on Windows machines.
Bitget halts withdrawals after a $351.6M wallet heist
Suspected North Korean thieves moved $351.6M out of Bitget's hot wallets through a spoofed transaction request.
Attackers cash in on an unauthenticated Roundcube mail flaw
Canada's cyber centre says a patched SQL injection in Roundcube Webmail is being exploited in the wild.
Poisoned leads turned Salesforce’s AI agent into a data thief
Three flaws in Salesforce Agentforce let attackers hijack trusted agents for silent CRM theft and Slack phishing.
A lone operator rented AI agents to breach 27 firms
A Chinese-speaking crook spent about $15,000 on open-source AI agents to raid hundreds of retailers and steal 600,000 card records.
Cloudflare container flaw exposed neighbors’ leftover disk data
A misconfigured storage pool let one Cloudflare container read another tenant's deleted files, forcing a cleanup of every disk.
A botnet recruits an AI agent to harvest stolen API keys
CARBONATO hijacks exposed Docker daemons, then runs an AI agent to loot credentials and fund its own model access.
Spotlight
Every major OS leaks user activity through file alerts
Researchers found decade-old flaws in file-notification systems that let an unprivileged process infer what other users are doing.
Australia opens inquiry after OpenAI agent breached health portal
A research agent got past controls on a government statistics portal, prompting a taskforce review and questions about how slowly OpenAI reported it.
Malware hands its tactical decisions to a panel of AI models
Cisco Talos found a Windows implant that polls four commercial AI models and acts on whichever answer wins.
Malware turns up in HashiCorp Terraform registry packages
Aikido traced Go malware inside two Terraform providers and two Go modules, the first abuse of HashiCorp's registry as a distribution channel.
Features
A disk-filling tool quietly stops Microsoft Defender updates
BigDiskBuster fills the system drive so Defender cannot install platform or signature updates, and there is no patch.
Enterprise browser startup Island hits a $6.4B valuation
Island has closed a $400M Series F led by Evolution Equity Partners, pushing total funding past $1B.
Elsevier confirms a brief redirect after LAPSUS$ hijacked its traffic
The publisher says a limited redirect touched select platforms after students reported landing on the LAPSUS$ leak site.
ShinyHunters says it broke into the FBI and took 2TB of files
ShinyHunters says an Oracle PeopleSoft zero-day put it inside the FBI jobs portal, and it wants a retraction rather than…
Microsoft lands its first takedown of a fully AI-run crime service
Microsoft has seized the infrastructure behind a phishing kit that used AI to pick its victims, and two suspects are…
Check Point rushes a hotfix for a management server zero-day
A path traversal bug in Check Point's management plane was already being used against customers weeks before the vendor knew…