Hackers run khunt post-exploitation toolkit from Oracle database
Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database that was used to breach a corporate...
general
20 articles
AI agents caught using social engineering in UK security tests
UK researchers found AI agents using deceptive tactics to manipulate humans in security tests.
How a $50,000 Exploit Chain Turned Bixby Against Samsung Phones
The chain involved the exploitation of several vulnerabilities in the Samsung Members and Samsung Account applications. The post How a $50,000 Exploit Chain ...
AI Deception Emerges in Cyber Tests as Agents Target Real People and Systems
AISI found AI agents taking unsanctioned online actions, including social engineering and code attacks, during controlled cyber tests. The UK’s AI Security I...
Tom Cotton prods Treasury for tax code tweaks to modernize OT
The Senate Intel Committee chair wrote to Treasury Secretary Scott Bessent about changes to spur investment in aging technology to better guard against cyber...
OctLurk and SilkLurk Windows Backdoors Target Governments in 6 Countries
Kaspersky links OctLurk and SilkLurk to cyberespionage attacks stealing passwords, emails and files from government systems in six countries since January 2025.
Pre-auth RCE in enterprise Java hits Bonita and OFBiz servers
An attacker sends a single web request to a Bonita server and lands inside an internal API that assumed nobody could reach it. The request arrives unauthenti...
Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures
A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change M...
AI governance is the missing security control
AI governance shifts security left by embedding oversight before AI reaches production.
OpenAI Disrupts Poipet Scam Network Using ChatGPT Across Multiple Fraud Schemes
OpenAI said it disrupted a Cambodia-based scam operation that used its generative artificial intelligence (AI) chatbot ChatGPT to facilitate a wide range of ...
COLDCARD security audit phishing attack installs remote access tool
A phishing campaign is exploiting fears surrounding the recently disclosed COLDCARD wallet vulnerability and suspected $88.6 million Bitcoin theft to trick u...
QuickFox VPN targeted in long-standing supply chain attack delivering FDMTP backdoor
In a report by The Hacker News, researchers disclosed a long-standing supply chain attack targeting QuickFox, a VPN and network acceleration tool used by ove...
Swiss Federal IT Agency FOITT compromised about 200 accounts due to SharePoint flaws
Switzerland’s Federal Office for Information Technology and Communications (FOITT) disclosed that approximately 200 accounts were compromised on its on-premi...
App SDKs may be sharing user location data with third parties by default
Some applications are inadvertently sharing users' precise location data with third parties, including advertisers and data brokers, due to default settings ...
Cybercrime victims lose an average of $9,468, with global toll exceeding $1.24 trillion
New figures reveal that cybercrime victims are losing an average of $9,468 per incident, highlighting the escalating global scale of this problem.
77 malicious extensions found on Open VSX marketplace
Seventy-seven malicious extensions impersonating legitimate developer tools were discovered on the Open VSX marketplace, transmitting system and development ...
TP-Link Omada ZTP systems vulnerable to fleet-wide compromise
Fifteen new vulnerabilities were discovered in the zero-touch provisioning (ZTP) systems used by TP-Link’s Omada networking ecosystem, with researchers warni...
CAF Bank online service restored after attempted fraud and login removal
CAF Bank restored its online banking service after a prolonged outage lasting more than 10 days, which the bank attributed to attempted fraud and a subsequen...
Agentic AI and cybersecurity dominate discussions at Las Vegas Hacker Summer Camp
Per The Register, the annual Hacker Summer Camp in Las Vegas, encompassing three major cybersecurity conferences, is set to heavily feature discussions aroun...