A Russian crew grabs browser passwords and deletes its own malware
ESET has tracked a group it calls Gorbag since at least February 2025, whose toolkit suits one fast pass rather than a long stay. All victims sit in Ukraine: policing and judicial agencies make up roughly one in four, municipal government, mostly councils in frontline districts, takes another such share,…
The Latest
Red Hat lifts a Linux TCP flaw to critical while Ubuntu delays
A use-after-free reachable without a login is patched on RHEL but still sitting in Ubuntu's opt-in testing pocket.
A flow editor with no password handed attackers root on industrial gear
A maximum-severity hole in Node-RED's HTTP interface is now drawing working exploits that end in a memory-resident bot.
Bitcoin and Litecoin vanish from BTCPay servers running July builds
Merchants on versions 2.4.1 or older are told to build a fresh server and generate a new wallet rather than…
Ransomware crews found Synology boxes that never took the 2024 patch
A critical DSM flaw fixed 23 months ago is back in play as customers report .L0CK3D encrypted files.
A TV box maker sold criminals access to 1.3 million homes
Google cut ties with Videostrong and took down XCPE, a botnet that turned certified Android hardware into rented exit nodes.
Trigger.dev says someone walked off with customers’ environment variables
A Sunday disclosure confirms an attacker reached secrets inside a hosted AI workflow platform that many teams use for agent…
European grocers are still running the freezers that got hacked in October
More than 100 stores from Belgium to Sweden lost cold storage overnight, and the controllers are the same make as…
A ransomware crew let its AI agents climb to domain admin
Sophos recovered Cursor logs showing the Aur0ra gang handing agents VPN credentials and objectives, then watching them map Active Directory…
Fake nuclear alerts hit phones on both sides of the Ukraine war
Attackers hijacked Ukrainian and Russian emergency warning apps within hours of each other, pushing radiation and missile messages that neither…
Government Linux servers fell to scripts an AI likely wrote
Unit 42 traced a year-long espionage campaign that leaned on large language models to build its payloads and mash its own operators' mistakes into working attack code.
A stealer now hands its operator a ranked list of victims
Cisco Talos found the VOLTA infostealer feeding stolen data into three different AI models so it can tell buyers which…
A loader hid inside Windows update folders on Asian government PCs
Kaspersky found NetamLoader abusing AppDomainManager injection from a CAB file parked in SoftwareDistribution, on a Windows 10 build reserved for…
Five coding assistants let a web page reach past the sandbox
Forever Security found the embedded browsers in Cursor, Copilot, Claude Desktop, VS Code and Codex granted powers a normal browser…
Spotlight
Bedrock Data hands exposure fixes to whoever owns the dataset
Instead of piling findings into a central backlog, the platform tickets the data owner directly and reopens the case if the fix does not hold.
Shufti wants to know which agent is really spending your money
The identity vendor has launched agent verification that ties every autonomous action to a real principal, a mandate and a revocable credential.
Northstar raises $7M to map the combinations attackers hunt for
The startup has left stealth with a graph that connects identities, assets and vulnerabilities, then sends AI agents to close the risky overlaps.
Ivanti’s exploited VPN chain lands two more flaws on the KEV list
CISA has added fresh Ivanti Connect Secure bugs to its exploited-vulnerability catalog, extending a chain Volexity tied to a root-level break-in.
Features
Pentagon treats base freezer failures as a suspected hack
US investigators are examining whether a cyber intrusion forced freezer outages at military commissaries, and they are comparing notes with…
Germany’s AfD breach exposed more than 345,000 mail accounts
Have I Been Pwned has confirmed the scale of a September hack-and-leak against the German party, with over a terabyte…
Canonical ships fixes for a flawed cloud trust check
A client-authentication weakness in LXD and MicroCloud scores a maximum CVSS 10.0 and lets an attacker borrow a trusted identity…
A single hidden text can knock out an Android phone
A malformed WAP Push message crashes Android's telephony stack with no user interaction, and a flood of them can hold…
Oracle E-Business Suite probes began the day after patch day
Defused Cyber recorded exploratory exploits against an unauthenticated SQL injection that chains to remote code execution on affected servers.
Binance lost $6.3B after an engineer’s laptop was compromised
Researchers attribute the largest crypto theft on record to North Korea, with about $3B frozen on-chain and the exchange promising…