Image uploads can leak Rails master keys through critical Active Storage bug
A CVSS 9.5 Rails Active Storage flaw lets unauthenticated attackers read arbitrary server files through crafted image uploads.
The Latest
CVSS 10 Ruflo bug gives attackers full control of AI agents and their memory
Ruflo's unauthenticated MCP bridge earns a perfect CVSS 10 as researchers demonstrate AI memory poisoning.
Attackers weaponize Cisco FMC static credentials before Cisco released hotfix
CISA adds actively exploited Cisco FMC static credentials flaw to its known vulnerabilities catalog.
Spy group OWAReaper backdoor survives password changes and device rebuilds
TA488 exploits OWA cross-site scripting flaw to plant browser implants that survive credential rotation.
ShinyHunters takes credit for DentaQuest breach exposing 23 million patients
DentaQuest is notifying over 23 million patients after the ShinyHunters extortion group stole 234 GB of data including Social Security…
Microsoft launches first cybersecurity AI model as part of Project Perception
Microsoft unveiled MAI-Cyber-1-Flash, its first specialized cybersecurity AI model, scoring 96% on CyberGym benchmarks and cutting vulnerability discovery costs by…
JetBrains patches critical TeamCity bug allowing unauthenticated server takeover
CI/CD platforms have become prime targets for attackers seeking supply chain access, and JetBrains’ latest security advisory underscores the risk.
VMware VM breakout threat patched across ESXi product line
Broadcom shipped emergency patches for a critical VM escape vulnerability affecting VMware ESXi, vCenter, and Fusion products.
Coordinated OT attack hits over 30 Minnesota water utilities
A coordinated cyberattack targeted operational technology systems at more than 30 community water utilities across Minnesota.
Cyera buys Oasis Security for $1B in identity-data merger
Data security company Cyera agreed to acquire agentic access management provider Oasis Security in a $1 billion deal.
Microsoft 365 accounts hijacked through compromised hotel Wi-Fi gateways
Threat actors compromised captive Wi-Fi gateways at hotels to silently redirect business travelers to fake Microsoft 365 login pages.
Iran-linked hackers turn victim machines into covert relays with NightLedger
Nimbus Manticore deploys NightLedger backdoor and custom WebSocket tunnelers to turn compromised systems into covert relay nodes across the Middle…
BlackFog dissects MedusaHVNC malware that hides entire browser sessions from victims
BlackFog researchers dissect MedusaHVNC, a remote access trojan that exploits Windows hidden desktops to hijack browser sessions and evade detection.
Certighost exploit opens Active Directory certificate services to domain takeover
Researchers released a Certighost exploit for a critical AD CS flaw that lets authenticated users escalate privileges to full domain…
Spotlight
Hollowgraph malware turns Microsoft 365 calendars into covert spy channels
Group-IB discovered HOLLOWGRAPH, malware that uses Microsoft 365 calendars as covert command channels with events dated to 2050.
Russian Laundry Bear group exploits Zimbra zero-day to steal email and 2FA codes
US agencies warn that Russian APT group Laundry Bear is actively exploiting CVE-2025-66376 against unpatched Zimbra Collaboration servers worldwide.
ChatGPT AgentForger bug lets phishing links deploy rogue workspace agents
A vulnerability in OpenAI's ChatGPT workspace agent system could let attackers deploy malicious agents through a single phishing link.
Kimi K3 AI agents discover Redis zero-days and build working RCE exploits
Chinese AI agents from Kimi K3 autonomously found zero-day vulnerabilities in Redis and developed functional remote code execution exploits.
Features
Uploaded SVG images could hijack Microsoft Bing servers with system rights
Attackers could achieve SYSTEM-level code execution on Bing servers by uploading crafted SVG files through two chained vulnerabilities.
Smart tv proxy network dismantled as fbi seizes two million devices
Law enforcement seized hundreds of domains linked to a residential proxy service that turned smart TVs into botnet nodes for…
CVE chain in PTC engineering tools opens door for Cl0p data heists
A pre-auth information leak combined with unauthenticated RCE in PTC products lets Cl0p affiliates steal intellectual property.
Java deserialization bug in Fastjson draws active exploits with no fix ready
Alibaba's Fastjson 1.x library carries a critical deserialization flaw that attackers are exploiting in Spring Boot applications.
SourTrade malvertising uses your browser to assemble malware piece by piece
A malvertising campaign called SourTrade makes victims' browsers download and assemble malicious executables using a legitimate runtime.
Chick-fil-A loyalty accounts drained in credential stuffing spree
Chick-fil-A disclosed a credential stuffing attack that compromised customer accounts in the Chick-fil-A One loyalty program.
