Do Son A new device code phishing campaign abuses Microsoft's OAuth flow to hijack Microsoft 365 accounts, no password stealing needed. How to spot it.
GlassWASM malware hides WebAssembly payloads in trojanized Open VSX extensions, abusing Solana memos for stealthy command-and-control.
A transmitter with the highest advertised depth isn’t automatically the right choice for a difficult bore. Deep...
cybernewswire
Luxembourg, Luxembourg, 19th June 2026, CyberNewswire
The UNC1151 Gmail phishing campaign by Ghostwriter steals passwords and 2FA codes from Polish targets via fake Google login pages. Stay alert.
IBM X-Force links the Interlock and Rhysida ransomware ecosystem through shared malware like Supper, NodeSnake, and overlapping crypters.
CVE-2026-8713 is a critical Avada Builder vulnerability enabling unauthenticated arbitrary file deletion on 1M WordPress sites. Update to 3.15.4 now.
Discover how APT37 NarwhalRAT malware uses MS-themed phishing and a dead-drop C2 to target users with a sophisticated Python backdoor.
Google Calendar now offers 200 custom colors and a full RGB picker, replacing its old 11-color limit for events.
Anthropic initiates a Claude Code quota reset for premium subscribers affected by a morning server glitch that erroneously blocked message transmissions.
Discover how the MaXSS and Spyder Chrome extension vulnerabilities in MaxAI and SiderAI put millions at risk. Protect your browser sessions today.
Apple now allows iOS third-party app stores in Brazil under a CADE settlement, alongside new fees and a Notarization review process.
Two critical NGINX vulnerabilities, CVE-2026-42530 and CVE-2026-42055, let remote attackers crash workers and possibly run code. Patch NGINX now.
A critical iba deserialization vulnerability (CVE-2026-8024) lets unauthenticated attackers gain remote code execution on ibaPDA and ibaDatCoordinator.
A 27-year-old OpenBSD authentication bypass (CVE-2026-55706) is now public, with full details and a working PoC exploit for the PPP PAP flaw.
A critical LiteLLM authentication bypass (CVE-2026-49468) lets crafted Host Header Injection reach protected AI Gateway routes. Patch in 1.84.0.
A critical Langflow file upload flaw (CVE-2026-55450) is public with a PoC, enabling unauthenticated denial-of-service and path disclosure. Patch 1.9.1.
Rockwell Automation vulnerabilities affect FactoryTalk Historian and FLEX I/O adapters, including a critical unauthenticated password-change flaw.
CISA warns of Splunk CVE-2026-20253, a CVSS 9.8 Splunk Enterprise vulnerability exploited in the wild allowing pre-authenticated remote code execution.
Protect your servers with the latest Node.js security updates. Patch critical vulnerabilities like CVE-2026-48933 to secure your infrastructure today.
Velvet Ant ran Operation Highland for nearly a decade, backdooring PAM and OpenSSH to hide inside an isolated critical infrastructure network.