Do Son
The logistics industry has undergone an incredible change over the last decade. Increasing customer demand, global supply...
The US seized 1,000+ domains in an illegal World Cup streaming crackdown, part of global streaming domain seizures under Operation Offsides.
Gitea vulnerability CVE-2026-58443 (CVSS 9.6) lets public-only tokens write to private repos. Details and PoC code are public. Update to v1.27.0.
Proofpoint details OAuth client ID spoofing, a stealthy account enumeration technique probing Microsoft Entra ID without a successful sign-in event.
Apache Doris vulnerability CVE-2026-58319 lets unauthenticated attackers hit FE HTTP admin APIs. Upgrade to Doris 3.1.0 now to close the flaw.
Siemens Opcenter X authentication bypass (CVE-2026-56451, CVSS 10) lets attackers forge JWTs for full unauthorized access. Update to V2604 now.
HOLLOWGRAPH malware turns Microsoft 365 calendars into covert C2 through Microsoft Graph API abuse. Group-IB links it to the Cavern framework.
CrashStealer is a native C++ macOS infostealer posing as Apple's crash reporter. Jamf details its notarized dropper, AES-GCM theft, and persistence.
Operation ShadowRecruit targets Indian job seekers with SheetAgent RAT, abusing ControlR and Google Sheets for C2. Seqrite links it to APT36.
LabubaRAT is a Rust-based remote access tool disguised as NVIDIA software. It supports HTTPS, WebView2, and DNS tunneling for command and control.
OpenAI trims the Codex context window from 372K to 272K and adds a system-prompt rule banning rm -rf $HOME after GPT-5.6 Sol wiped user home directories.
Microsoft's KB5121767 out-of-band update fixes a Dell USB-C driver fault from the July 2026 patch that caused shutdowns, overheating, and battery drain.
Gurman reveals a secret new Intel Mac Pro (J170) and cancelled M2/M3 Extreme chips behind the Mac Pro discontinuation, as Mac Studio takes the crown.
Read our mid-July weekly threat intelligence report. Stay informed on active vulnerability updates, Fortinet flaws, and CISA KEV additions.
Kimai vulnerability CVE-2026-52824 (CVSS 9.1) lets attackers forge cookies for account takeover via a default Docker APP_SECRET. Update to 2.58.0 now.
External routing lookups carry hidden costs: rate limits, data exposure and availability coupling. Here is why teams are moving to self-hosted routing intelligence.
A new OpenSSL HollowByte vulnerability enables remote DoS attacks using just 11 bytes. Learn how to protect your servers against this OpenSSL DoS attack.
Volexity found attackers chaining SonicWall SMA zero-day flaws to root SMA VPN appliances and plant stealth malware. Patch the hotfix now.
The Justice Department now allows federal employees to download TikTok on government devices following massive structural changes and security updates.
The Hugging Face breach was driven end-to-end by an autonomous AI agent attack. Internal datasets and service credentials were exposed.
Meta and Anthropic are negotiating a $10 billion lease for AI computing power. This deal could transform Meta into a major cloud infrastructure provider.
Anthropic updates its Claude Fable 5 subscription model due to computational constraints, removing free access for Pro tiers.