Russian-linked operators are using fake cloud-storage pages and diplomatic themes to trick targets into giving away access to online accounts. The following article body is 650 words, excluding the IoC …
FBI Shuts Down China-Linked Hacking Platforms Used to Target NASA and U.S. Networks
The U.S. Department of Justice and FBI have seized domains associated with two China-linked hacking platforms, QScan and QTRouter, allegedly used to target NASA, federal agencies, critical infrastructure, and sensitive …
New Apache Log4j2 Flaw Lets Attackers Bypass Security Checks and Execute Remote Code
A newly disclosed Apache Log4j2 issue could allow attackers to bypass a deserialization allowlist and execute code remotely in narrowly defined deployments. The issue, tracked as Log4j2 #4255, affects applications …
OpenAI AI Agents Chain Zero-Days to Compromise Hugging Face and Internal Systems
OpenAI has disclosed a major AI safety incident in which internal research agents bypassed sandbox restrictions, gained internet access, and compromised portions of Hugging Face and OpenAI research infrastructure during …
New Windows Backdoor Hides Inside ESET Agent and Wakes Up With a Secret Network Packet
SLEEPWALKER is a Windows backdoor built to stay quiet until an operator sends a specially crafted network packet. Rather than calling home to a fixed command server, it hides inside …
AI-Powered AnonyMousKIT PhaaS Steals Apple IDs and 2FA Codes to Unlock Stolen iPhones
AnonyMousKIT is turning stolen iPhones into an entry point for account theft. The phishing-as-a-service platform targets people already searching for a lost device, then uses convincing recovery messages to capture …
WatchGuard Agent for Windows Vulnerability Allows Code Execution with Elevated Privileges
WatchGuard has disclosed two critical vulnerabilities in its Windows-based WatchGuard Agent that could allow unauthenticated attackers to execute arbitrary code with elevated privileges. The flaws, tracked as CVE-2026-57910 and CVE-2026-57909, …
Adobe Campaign Classic Vulnerabilities Enable Arbitrary Code Execution
Adobe has released a Priority 1 security update for Adobe Campaign Classic following the identification of three critical vulnerabilities that could allow unauthenticated remote attackers to execute arbitrary code. The …
Apache Tomcat Vulnerabilities Let Attackers Bypass Security Controls and Crash Servers
The Apache Software Foundation has patched a dozen security vulnerabilities in Apache Tomcat, the widely deployed open-source Java servlet container, with fixes rolled into version 11.0.25. The flaws, disclosed on …
CISA Warns of Gitea Code Injection Vulnerability Exploited in Attacks
The Cybersecurity and Infrastructure Security Agency has added a newly disclosed Gitea vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The flaw, tracked as CVE-2026-60004, …