Sakura Internet reports potential compromise of over 1.3 million customer accounts
Sakura Internet, a key provider of digital infrastructure services in Japan and a domestic partner for the Government Cloud program, discovered the breach on...
general
20 articles
Hackers Target Zimbra Servers in Active Exploitation Campaign
Exploitation of the Zimbra Collaboration vulnerability CVE-2026-73570 has been observed by Poland’s CERT Polska. The post Hackers Target Zimbra Servers in Ac...
Researchers demonstrate faster remote Spectre attack against Cloudflare Workers
The researchers developed an end-to-end experiment using an attacker Worker and a victim Worker within the same production environment.
Operation CameraSwarm compromises over 14,500 Dahua devices
The campaign, primarily impacting devices in Ukraine and Russia, leveraged CVE-2021-33044 and CVE-2021-33045, two authentication-bypass flaws rated 9.8 CVSS ...
Critical Elementor Pro bug exposes WordPress sites to RCE attacks
A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server. [.
New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data
Adversa AI has disclosed an attack technique that it says can cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and th...
Password spraying attacks surge 155x, exploiting legacy authentication flaws
The campaign, originating from an IPv6 range provided by LSHIY LLC, leveraged reused credentials and the legacy Resource Owner Password Credentials (ROPC) OA...
Surveillance – Everything You Wanted to Know, But Were Afraid to Ask
We all know they’re watching us. But we don’t know who they are, nor why nor how they are doing it.
JFrog Artifactory Flaws Enable Software Supply Chain Attacks
Two Artifactory flaws allowed attackers to poison package metadata across software repositories
Kriminal AI service bypasses guardrails by renting legitimate AI models
Kriminal operates on the clearnet, offering various subscription tiers and pay-per-message options.
New malware campaign combines social engineering with defense evasion
The campaign, observed in late July 2026, begins with compromised WordPress websites injected with obfuscated ErrTraffic JavaScript.
How MSPs can catch phishing attacks email filters miss
AI is making phishing attacks more personalized, convincing, and difficult for traditional email filters to detect. Kaseya explains how MSPs can monitor iden...
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
Cybersecurity researchers have disclosed a critical security flaw in isolated-vm, a popular open-source sandbox with more than 2,900 stars and 190 forks on G...
Harness launches AI agents to find and fix software vulnerabilities
The AI SAST agent identifies vulnerabilities, including logic flaws missed by traditional tools, and reduces false positives.
Brazil's data authority orders halt to facial recognition in Paraná schools
The ANPD cited a failure by the Paraná State Department of Education to demonstrate an adequate legal basis for processing sensitive biometric data, nor suff...
Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
Citrix has released updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical-severity authentica...
The push to designate AI as the next critical infrastructure sector
The designation would unlock a range of federal services, tools and resources for an industry that policymakers view as increasingly tied to national and eco...
MacSync Stealer Uses 30+ Rotating Domains to Steal macOS Credentials and Exfiltrate Data
MacSync Stealer is expanding its macOS-focused theft operation through a rotating network of more than 30 domains, using stable execution and network pattern...
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency R...
T-Mobile cybersecurity staff cut cable to expel Chinese hackers
The hacking group, identified as Salt Typhoon, compromised hundreds of companies, including major players like AT&T, Verizon, Viasat, Charter, and Windst...