Apple Patches Over Two Dozen Vulnerabilities in iOS, macOS, and Safari
Apple's latest security patches address over two dozen vulnerabilities, primarily in WebKit, that could be chained to steal data or execute malicious code.
The Latest
New Attack Chain Exploits Blogger to Deploy Information Stealer
Researchers detail a multi-stage attack that uses Blogger pages and PowerShell to deploy the PureLogs information stealer while evading traditional…
Steganographic Detection Code Found in Anthropic’s Claude Code CLI Tool
Reverse engineering of Anthropic's Claude Code CLI tool reveals hidden code that uses steganography in system prompts to covertly signal…
Enriching Cyber Threat Intelligence with Contextual Data
The integration automatically enriches IP addresses, domains, and URLs with contextual risk scoring, infrastructure relationships, and phishing analysis within the…
Campaign Launches 81 Million Password Spray Attempts Against Microsoft 365 Tenants
Huntress researchers observed a password spraying campaign that used valid credentials from past breaches and an OAuth flaw to compromise…
FTC fines Amazon $2.25 million for blocking fraud victims from obtaining transaction records
The FTC alleged that Amazon customer service agents routinely blocked identity theft victims from accessing evidence of fraudulent transactions by…
Malicious WhatsApp VBScript Lures Victims by Posing as Financial Documents
Attackers are using compromised WhatsApp accounts to distribute malicious VBScript files disguised as financial documents, leading to the unauthorized installation…
U.S. Commerce Department Ends Export Controls on Two Anthropic AI Models
The decision followed an 18 day standoff during which global access to the advanced systems was blocked due to national…
Unpatched Flaw in Apple’s Email Masking Feature Leaks Real Addresses
A long standing flaw in Apple's Hide My Email feature, unrepaired over a year after disclosure, lets attackers reverse engineer…
FortiGate Credential Theft Campaign Directly Fuels Ransomware Operations
Researchers confirmed that the FortiBleed credential harvesting campaign targeting FortiGate firewalls is directly feeding INC Ransom and Lynx ransomware operations…
Microsoft Confirms Defender Zero Day CVE-2026-50656 Bypasses Protections
A fully functional exploit for a Microsoft Defender privilege escalation flaw works on patched systems and bypasses signature based detection.
Active Exploitation of Ubiquiti UniFi OS Flaws Prompts Urgent CISA Directive
CISA warns that attackers are actively exploiting at least one Ubiquiti UniFi OS vulnerability and gives federal agencies until June…
New Browser-Only Ransomware Hijacks Chrome Feature to Encrypt Android Photos
A proof of concept shows how AI-generated code turns a legitimate Chrome file access feature into a weapon for encrypting…
Kubernetes Cluster Takeover Risk from Unpatched Argo CD Repo-Server Bug
The unauthenticated exploit chain lets attackers move from code execution on the repo-server to poisoning Redis caches and deploying malicious…
Spotlight
India Blocks WhatsApp Username Feature Over Online Fraud Fears
India's government has ordered WhatsApp to suspend its new usernames feature, citing risks of untraceable fraud and impersonation by bad actors hiding behind foreign phone numbers.
Trojanized Pyrogram Forks Unleash Backdoor on Telegram Bot Servers
A campaign dubbed 'Operation Navy Ghost' has been distributing trojanized Pyrogram packages on PyPI since November 2025, giving attackers remote code execution on compromised Telegram bot servers.
Inside the BEC Ecosystem: How Organized Crime Drives Email Fraud
BEC is a multistage operation involving reconnaissance, AI powered scams, underground call centers, and mule networks that defenders must understand to preempt attacks.
AI Hallucinated Domains Become a New Vector for Phishing Attacks
Attackers are registering fake web addresses hallucinated by AI models before anyone else can, then using them to host phishing pages that steal login credentials and personal data.
Features
Android Developer Verification Mandate Takes Effect in Four Countries This September
Android devices in four countries will block standard installations of apps from unverified developers starting September 30, 2026, pushing open…
New Permanent SecureROM Exploit Targets Apple A12 and A13 Chips
The usbliter8 exploit achieves permanent arbitrary code execution inside Apple A12 and A13 SecureROM by exploiting a hardware flaw in…
Microsoft Teams Gains Bot Detection to Curb Unwanted Meeting Access
Microsoft Teams now detects and segregates unknown bots in the meeting lobby, giving organizers clearer visibility and control over automated…
SystemBC Malware Enables Stealthy C2 Tunneling and Persistent Access
SystemBC malware turns victim computers into stealthy traffic tunnels, enabling ransomware groups to maintain persistent access and evade detection through…
GuardFall Attack Bypasses Safety Filters in Popular AI Coding Tools
GuardFall exploits a decades-old shell parsing trick to bypass safety filters in open-source AI coding agents, affecting ten out of…
Study Finds 282 iOS Apps Expose AI API Keys Through Network Traffic
Researchers found that 282 of 444 iOS AI apps leaked credentials through network traffic, with only 28 percent of developers…
