ShinyHunters says it broke into the FBI and took 2TB of files
ShinyHunters says an Oracle PeopleSoft zero-day put it inside the FBI jobs portal, and it wants a retraction rather than a ransom.
The Latest
Microsoft lands its first takedown of a fully AI-run crime service
Microsoft has seized the infrastructure behind a phishing kit that used AI to pick its victims, and two suspects are…
Check Point rushes a hotfix for a management server zero-day
A path traversal bug in Check Point's management plane was already being used against customers weeks before the vendor knew…
A heap overflow in BIG-IP APM lets outsiders run code
A heap overflow in BIG-IP APM hands unauthenticated attackers code execution on any appliance serving as an OAuth authorization server.
Arista tells customers to patch a VeloCloud orchestrator flaw now
A CVSS 10.0 input validation bug in on-premises VeloCloud Orchestrator is under active exploitation, and fixes cover only two of…
A Chinese crew turned three unpatched browser bugs into a backdoor
Volexity has linked a China-aligned group to a three-bug Chrome and Windows chain that ran before either vendor shipped a…
WordPress core patch closes a path traversal that can run code
WordPress 7.1.2 closes a path traversal in get_page_template() that needs no account and can end in code execution on some…
Zyxel switches fall to an obfuscated exploit as CISA sets a deadline
A Chinese-speaking operation pulled configuration files and hashed root credentials from 996 Zyxel GS1900 switches before federal agencies got 72…
Malware hides in a B-tree library now that npm blocks install hooks
A malicious npm package pulled two million weekly downloads while running its payload from ordinary library code instead of an…
TASK#STOMP hides a document thief behind Windows’ own tools
A PowerShell backdoor built from native Windows components steals business files, Wi-Fi passwords and clipboard contents while hiding as scheduled…
A single line break turned a WordPress comment into a server shell
An anonymous commenter could plant a script that ran in an administrator's browser and, from there, uploaded a web shell to the site.
A nested-virtualization bug lets ARM64 guests touch host memory
A skipped cache invalidation leaves a freed page of host memory mapped and writable for a guest virtual machine on…
One in five water utilities has logins sitting in infostealer logs
SpyCloud found 1,787 of roughly 10,000 US water organizations exposed, including one infected device holding logins for 167 utility tenants.
A SharePoint spoofing bug turned out to be full remote code execution
Microsoft scored the flaw 6.5 as a spoofing issue, while the National Vulnerability Database calls the same bug an 8.8…
Spotlight
A fake LastPass page ships a signed driver that kills security tools
A GitHub page posing as the LastPass Authenticator installs a Microsoft-signed kernel driver that terminates 145 security processes before a password stealer runs.
Ireland fines Google €403M over how it handled location data
Ireland's regulator says Google's location processing broke GDPR rules and orders a six-month fix.
Fake recruiters call Rust maintainers to plant malware on their Macs
Fake recruiters are booking video calls with Rust maintainers and pushing malware.
Jade Sleet slips two macOS backdoors onto a developer’s laptop
Two Rust backdoors for Apple Silicon sat dormant on a developer's Mac for eleven days.
Features
Settra ransomware pairs stolen VPN logins with RMM persistence
A new ransomware strain enters through VPN credentials and hides behind RMM agents.
CISA retires its weekly vulnerability bulletin after 22 years
CISA is retiring a weekly vulnerability bulletin it has published since 2004.
Rival crew seizes Clop’s leak site and bills the extortionists
A rival crew says it now owns Clop's leak site and wants an eight-figure cut.
Attackers flipped control settings at two Colorado water utilities
Two small Colorado water providers found control settings changed and alarms silenced.
A wrong company name let Gemini attack three real businesses
Google's Gemini model attacked three real companies because one fictional target name matched a real domain, and the company stayed…
A forgotten Cloudflare key turned 100,000 sites into a malware channel
Attackers used a long-lived Cloudflare API key stored in Brevo's own source code to push malware through the marketing platform's…