Archive
All articles, newest first. Page 49.
Radiology Associates of Richmond Discloses Breach Affecting 266,000 Following Nine-Month Investigation
Radiology Associates of Richmond has confirmed a July 2025 data breach impacting over 266,000 patients. The disclosure follows a nine-…
CISA Adds Microsoft Defender DoS Flaw to KEV Catalog with June 3 Deadline
CISA has added CVE-2026-45498, a Denial of Service vulnerability in Microsoft Defender, to its Known Exploited Vulnerabilities catalog…
NGate Malware Trojanizes HandyPay App to Steal Contactless PINs in Brazil
ESET Research has uncovered a new NGate variant that trojanizes the legitimate HandyPay Android app to relay NFC data and intercept PI…
CVE-2026-41091: Microsoft Defender Engine Exploited for SYSTEM Privilege Escalation
A link-following vulnerability in the Microsoft Malware Protection Engine enables local privilege escalation to SYSTEM. An analysis of…
CISA Adds Critical Langflow Vulnerability (CVE-2025-34291) to KEV Catalog Following Active Exploitation
CISA has added CVE-2025-34291, a critical origin validation flaw in the Langflow platform, to its Known Exploited Vulnerabilities cata…
Fake Data Breach Alerts: When the Warning Becomes the Trap
Cybercriminals are weaponizing 'breach fatigue' and generative AI to craft hyper-realistic phishing alerts that mimic official inciden…
Anthropic’s Project Glasswing Unearths 10,000 Flaws, Triggering 'Patching Paralysis'
Project Glasswing identified over 10,000 critical vulnerabilities in just one month. As Anthropic’s Claude Mythos model accelerates di…
May 2026 Patch Tuesday: 137 Flaws and the Domain Controller Threat
Microsoft's May 2026 security update addresses 137 vulnerabilities, including 31 critical flaws. While no zero-days were reported, una…
CVE-2026-48172: Critical Root Escalation in LiteSpeed cPanel Plugin Under Active Attack
A critical vulnerability in LiteSpeed’s cPanel plugin allows for privilege escalation to root. We break down the mechanism and provide…
Ransomware 2026: Post-Quantum Ciphers, Encryptionless Extortion, and the Rise of EDR-Killers
The 2026 ransomware landscape is defined by the adoption of post-quantum algorithms and a shift toward encryptionless extortion, with…
Apple Patches macOS RCE Vulnerability in USD Library (ZDI-26-314)
A critical out-of-bounds write in the macOS USD library could allow remote code execution through malicious 3D files. Apple released a…
macOS USD Library Bug ZDI-26-315 Exposes System Memory, Patch Issued May 12
Apple has addressed ZDI-26-315, an out-of-bounds read vulnerability in the macOS Universal Scene Description (USD) library. Rated CVSS…
Verizon DBIR 2026: Vishing Success Rates Surpass Email by 40%
The 2026 Verizon Data Breach Investigations Report (DBIR) reveals a 2% median click rate for phone-based phishing, significantly highe…
AI Unearths 300 WordPress Zero-Days for $20 Each: The Human Triage Crisis
A high-efficiency AI pipeline has discovered over 300 critical zero-day vulnerabilities in WordPress plugins at an estimated cost of $…
GitLab 19.0 Debuts Native Secrets Management and Air-Gapped AI
GitLab 19.0 integrates native secrets management, agentic merge request workflows, and self-hosted AI models, reinforcing its 'single…
Cloud Atlas Upgrades Arsenal: Novel Backdoors and Stealth RDP Patching for Cyber-Espionage
Between 2025 and 2026, the Cloud Atlas APT deployed previously undocumented backdoors, VBCloud and PowerShower, alongside modified sys…
M365 Phishing: How Kali365 and EvilTokens Bypass MFA Without Passwords
Two emerging Phishing-as-a-Service (PhaaS) platforms are leveraging device code phishing and OAuth consent abuse to hijack Microsoft 3…
TrendAI Fixes Actively Exploited Apex One Zero-Day; CISA Sets June 4 Patch Deadline
TrendAI has issued critical patches for CVE-2026-34926, a directory traversal vulnerability in Apex One on-premises installations curr…
30-Minute Lateral Breakouts: Why the SOC is Losing the Race Against AI-Driven Threats
Average breakout times have accelerated by 29%, with the fastest recorded exfiltration dropping from over four hours to just six minut…
Italian Revenue Agency Phishing: CERT-AGID Alerts on Targeted SPID Credential Theft
CERT-AGID has identified a targeted phishing campaign impersonating Italy’s Revenue Agency. The attack uses pre-populated login forms…
Unit 42: Frontier AI Models Exploiting Open-Source Transparency to Automate Supply Chain Attacks
Frontier AI models are demonstrating the autonomous reasoning required to identify vulnerabilities in open-source code and orchestrate…
Talos Unveils AI Honeypots to Trap Malicious Agents: The Rise of Cognitive Warfare
Cisco Talos demonstrates how generative honeypots can deceive automated AI threats by weaponizing their lack of contextual awareness a…
Kemp LoadMaster Vulnerability: Authenticated RCE Found in customLocation Parameter
Advisory ZDI-26-319 reveals a command injection flaw in Progress Software’s Kemp LoadMaster. Authenticated users can exploit the custo…
PoC Zealot: Autonomous AI Executes End-to-End GCP Cloud Attack
Unit 42’s Zealot project demonstrates how multi-agent AI systems can autonomously chain SSRF, credential theft, and BigQuery exfiltrat…