Europe Confirms Record €4.1B Penalty Against Google for Android Practices.

Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials.

Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival.

Microsoft fixes bug that removed Copilot button in Outlook (it was an improvement not a bug :/).

DHS Breached.

A key Department of Homeland Security information-sharing database was accessed by an hacker in recent weeks.

ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API.

WinRAR flaw could allow attackers to take control of your computer.

New UNPATCHED FatFs vulnerabilities hit a filesystem library bundled into potentially MILLIONS of embedded devices.

Malformed USB drives, SD cards, or update files can trigger memory corruption, crashes, leaks, or hangs.

Kaspersky says the attacks span Russia, Brazil, and Kazakhstan, using BusySnake Stealer, GitHub-hosted payloads, Go2Tunnel reverse tunneling, and patched CVE-2025-9491 LNK abuse.

A compiled AppleScript stages a Rust stealer that validates the entered login password through PAM, then targets browsers, crypto wallets, iCloud Keychain, and clipboard content.

A series of cyberattacks targeting the UAE’s financial sector.

108 malicious packages and extensions were published across npm, Packagist, Go, and Chrome.

North Korea-linked PolinRider uses obfuscated JavaScript loaders, VS Code auto-run tasks, and blockchain services to fetch DEV#POPPER RAT and OmniStealer.

WILD: Meta reportedly paid hundreds of contractors to pretend to be teenagers in a targeted effort to disrupt rival AI companies.

Researchers have found a never-before-seen piece of macOS malware that combines a series of clever tradecraft to infect Macs with stealthy, custom-developed credential-stealing code.

JadePuffer ransomware used AI agent to automate entire attack.

North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign.

Apple AirDrop and Android Quick Share flaws expose users to wireless attacks.

ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit.

PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords.

Pegasus Used Against MEP Investigating Pegasus, Citizen Lab Finds.