Apollo confirms cloud intrusion as BlackFile spree widens
The private equity giant says attackers hit its cloud platforms in July, exposing names and Social Security numbers.
The Latest
CISA orders TrueConf patches after Ukraine-linked server attacks
Two exploited TrueConf Server flaws land on CISA's KEV list as Head Mare is caught delivering a poisoned installer.
Calendar add-ons on npm hide Linux backdoor in plain sight
Trend Micro finds 14 trojanized packages that drop the RedC2 4.0 implant the moment they are imported.
First malware rides legitimate car head unit updates
Kaspersky finds a downloader pushed through built-in firmware updaters of Android dashboards, tied to the MoYu Group.
China-linked crew leans on AI while spying on Central Asian states
Bitdefender ties the SilkParasite cluster to China and finds AI-assisted code in a five-RAT espionage arsenal.
Defender boot driver opens kernel file writes on all Windows versions
Check Point weaponizes Microsoft's signed BTR.sys driver to run kernel-level operations with no flaw exploited.
Researchers ring up real purchases with dead Visa cards
A USENIX study shows expired Visa cards can be revived at checkout by rewriting the expiry read over NFC.
Encrypted webpages trick Grok into leaking chat data to attackers
Adversa AI shows how ciphertext hidden in a page can make xAI's Grok hand over chat details with no warning.
Offline Android phones leak data through Manic’s Wi-Fi mesh
Manic Android malware exfiltrates data through nearby infected devices when the victim phone is offline.
Sandbox escape in isolated-vm gives guests host memory control
Endor Labs shows a type confusion in isolated-vm lets sandboxed code take over the host process.
Zimbra mail servers under fire as SNMP bug gets exploited
Poland's CERT warns attackers are exploiting a patched Zimbra command-injection flaw in the wild.
Clop’s bespoke shell empties Windchill keystores and vault maps
Clop's bespoke Windchill web shell decrypts keystore credentials and maps vaults for mass exfiltration.
Google ties three Russian crews to OAuth phishing on academics
Google tracks three suspected Russian clusters abusing OAuth and WhatsApp to hijack targeted accounts.
Rust project yanks three poisoned crates after build-time backdoor
The Rust project yanked three poisoned crates after a compromised account shipped a build-time backdoor.
Spotlight
Cisco ships fixes for nine bugs with five at maximum severity
Cisco ships patches for nine Crosswork and Secure Workload bugs, five rated at maximum severity.
Perfect-ten Entra ID bug was exploited before Microsoft closed it
Microsoft says the maximum-severity Entra ID flaw is fully mitigated and needs no customer action.
Leaky server exposes toolkit behind 14,500-camera Dahua hijack
Hunt.io rebuilt Operation CameraSwarm from an exposed operator directory after more than 14,500 Dahua devices were compromised.
NASA mission console flaws open spacecraft commands to strangers
Cycode found unauthenticated command injection paths in the AIT-GUI console NASA uses to operate instruments and spacecraft.
Features
Five US agencies warn AI scripts now hunt exposed Siemens PLCs
A five-agency advisory flags an active AI-assisted campaign against internet-exposed Siemens S7 controllers across critical US sectors.
OpenAI presses pause on frontier AI training after escape risks
OpenAI halts frontier reinforcement learning for two weeks while it strengthens sandboxes, monitoring, and alignment defenses.
Android banking trojan ToxicPanda gains 167 commands and global reach
Zimperium details ToxicPanda 2.0's expanded on-device fraud while IBM flags a fresh GoldDigger campaign in South Africa and the UK.
Rapid7 urges emergency patching of Citrix NetScaler login bypass
Citrix fixed a CVSS 9.3 authentication bypass in NetScaler ADC and Gateway that attackers are expected to exploit quickly.
Firefox store hosts 40 wallet-stealing add-ons in crypto heist ring
Socket found 40 malicious Firefox extensions posing as Web3 products to drain recovery phrases and private keys.
WordPress page builder flaw turns file forms into remote code execution
Patchstack warns that a CVSS 9.0 flaw in Elementor Pro lets unauthenticated attackers upload PHP files and take over sites.