Do Son Malwarebytes warns of 17.5M Instagram accounts leaked by "Solonik." Meta denies a system breach but fixed a bug used to spam password reset emails.
Critical OWASP CRS flaw CVE-2026-21876 (CVSS 9.3) allows XSS bypass via UTF-7 encoding. ModSecurity & Coraza users: update to v4.22.0 immediately.
Urgent Patch: React Router CVE-2025-61686 (CVSS 9.1) exposes server files via session flaws. Fix XSS & Open Redirect bugs by updating to v7.9.6 now.
Team Cymru exposes the carding supply chain: How criminals use the Soviet .su domain and bulletproof hosting to run resilient fraud markets.
Alert: Apache Struts 2 XXE flaw (CVE-2025-68493) exposes apps to data theft & DoS. Upgrade to v6.1.1 or apply JVM workarounds immediately.
Critical Apache Uniffle flaw CVE-2025-68637 (CVSS 9.1) exposes Big Data clusters to MITM attacks. Update to v0.10.0 immediately to secure traffic.
New Astaroth campaign "Boto Cor-de-Rosa" uses a Python worm to hijack WhatsApp Web. It auto-messages your contacts to spread banking malware globally.
Infoblox exposes the "Pig Butchering-as-a-Service" economy. Providers like Penguin and UWORK sell turnkey fraud kits to automate scams globally.
Critical zlib flaw CVE-2026-22184 (CVSS 9.3) allows RCE via buffer overflow in the untgz utility. Update to version 1.3.1.2 immediately to secure systems.
MuddyWater APT deploys new "RustyWater" malware against Middle East targets. CloudSEK reveals how the group is ditching PowerShell for stealthy Rust tools.
Critical unpatched flaws in Vivotek IP7137 cameras allow unauthorized live streaming (CVE-2025-66049). Disconnect these EOL devices immediately.
Cisco Talos reveals UAT-7290, a China-nexus group targeting global telecoms. They act as both spies and infrastructure builders for other hackers.
Critical flaws in InputPlumber (CVE-2025-66005) expose Linux gamers to session hijacking. Update to v0.69.0 or SteamOS 3.7.20 immediately to secure.
Password advice used to be straightforward enough. Pick something hard to guess, change it sometimes, don’t stick...
Meta secures 6.6 GW of nuclear power through landmark deals with Vistra, Oklo, and TerraPower to energize its Prometheus AI supercluster in Ohio.
Microsoft debuts Copilot Checkout at NRF 2026, allowing users to buy products from Shopify, Etsy, and more directly inside the AI chat window.
Gmail enters the Gemini 3 era! Google makes "Help Me Write" free for all, while launching a premium AI Inbox and natural-language search for 2026.
Linus Torvalds shuts down the debate on AI slop in the Linux kernel, calling documentation rules "pointless posturing" and sticking to peer review.
Microsoft’s Build 26220.7535 introduces a targeted Group Policy to uninstall Copilot on managed enterprise devices after 28 days of inactivity.
Iran's nationwide internet blackout saw a brief 0.01% traffic surge from Tehran universities on Jan 9, 2026, signaling a new "whitelist" control strategy.
Microsoft officially ended telephone activation on Dec 3, 2025. Users must now use the aka.ms/aoh online portal, ending the era of true offline licensing.
Microsoft Defender's new FakeMas filter is erroneously blocking the official MAS activation script due to a typosquatted domain war. Learn the fix.