Do Son Proofpoint ties TA488 and TA458 to half-click exploits and webmail zero-days that steal email from Ukrainian, NATO and US government mailservers.
JetBrains patched 18 vulnerabilities across its IDEs. CVE-2026-64812 and CVE-2026-64813 reach CVSS 10, and most of the rest allow arbitrary code execution.
Apache Syncope patches an SQL injection (CVE-2026-57308) and a privilege escalation flaw (CVE-2026-62183). Update to 4.0.7 or 4.1.2 to stay safe.
A public proof-of-concept for CVE-2026-57239 turns a Foxit PDF Reader vulnerability into full SYSTEM privileges via local privilege escalation.
Three Next.js vulnerabilities (CVE-2026-64645, CVE-2026-64649, CVE-2026-64642) enable Server-Side Request Forgery and middleware bypass. Patch now.
CVE-2026-14890 is an unpatched SGLang vulnerability enabling unauthenticated remote code execution through pickle deserialization. Restrict access now.
Canonical has introduced the Canonical Enterprise Store for Ubuntu Pro users, enabling software distribution across air-gapped and enterprise networks.
The new 10-inch Raspberry Pi Touch Display 2 brings 1200x1920 resolution and ten-finger touch for $80, but requires a Raspberry Pi 5 or newer.
Varonis Threat Labs analyzed Dolphin X stealer, a forum-sold RAT with 300+ credential targets and an AI Profiler that ranks victims for operators.
Google's Nuvem subsea cable spans 6,900 km from South Carolina to Portugal via Bermuda, delivering 384 Tbps of transatlantic capacity.
Discover how the new GitHub bug bounty program impacts researchers. The platform replaces floating ranges with fixed payouts and a lucrative VIP tier.
A new GST phishing campaign targets Indian taxpayers. This operation delivers Remcos RAT malware using an embedded bitmap payload to steal user credentials.
Discover Google's upgraded iOS to Android migration tool featuring seamless eSIM transfer, saved passwords, Wi-Fi credentials, and WhatsApp data.
The HelloNet campaign spreads malware through the ViPNet update system, hitting Russian government and energy firms. Kaspersky suspects a China link.
The DoNot APT hit Bangladesh military targets with a fake officer biography. Cyderes traced a live, multi-stage implant to active C2 servers.
A GitHub Actions abuse campaign turned thousands of workflows into cPanel and WHM exploitation infrastructure, harvesting cloud and payment credentials.
ISC fixed 9 BIND vulnerabilities in 9.20.26 and 9.21.24. The top BIND vulnerability, CVE-2026-13321, enables DNSSEC cache poisoning. Patch now.
A Ninja Forms vulnerability chain hits 600K+ sites. CVE-2026-65048 is an unauthenticated stored XSS rated CVSS 9.3. Update to 3.14.10 now.
Qualys discloses CVE-2026-64600 (RefluXFS), an XFS privilege escalation to root affecting 16.4M+ Linux systems. Patch the kernel and reboot now.
Check Point confirms CVE-2026-16232, a SmartConsole authentication bypass, is exploited in the wild. Apply the July 22 jumbo hotfix now.
A new Exim vulnerability lets a local attacker escape the spool directory and escalate privileges. Upgrade to Exim 4.99.5 to close the hole now.