Microsoft just fixed 56 Windows bugs — one’s already being exploited.
It hides in the Cloud Files driver used by OneDrive, Google Drive, and iCloud — even if those apps aren’t installed. Hackers can chain it with phishing to gain SYSTEM access.
Plus: 2 zero-days in PowerShell and GitHub Copilot for JetBrains.
It hides in the Cloud Files driver used by OneDrive, Google Drive, and iCloud — even if those apps aren’t installed. Hackers can chain it with phishing to gain SYSTEM access.
Plus: 2 zero-days in PowerShell and GitHub Copilot for JetBrains.
Fortinet, Ivanti & SAP just fixed critical bugs that let attackers break in or run code remotely.
➜ Fortinet: auth bypass via fake SAML login.
➜ Ivanti: admin takeover through poisoned dashboards.
➜ SAP: code injection in Solution Manager (CVSS 9.9).
➜ Fortinet: auth bypass via fake SAML login.
➜ Ivanti: admin takeover through poisoned dashboards.
➜ SAP: code injection in Solution Manager (CVSS 9.9).
North Korean hackers are exploiting the new React2Shell bug (10.0-severity) to drop EtherRAT — malware that hides its commands inside Ethereum smart contracts.
It even makes 9 blockchain nodes “vote” to pick its server, so takedowns fail.
It even makes 9 blockchain nodes “vote” to pick its server, so takedowns fail.
4 hacker groups are now using the same malware tool — CastleLoader.
It’s sold as malware-for-hire by a group called GrayBravo. They’re hitting targets from logistics to IT using fake online Booking pages and software updates.
Each attack links back to the same control servers — built to spread fast.
It’s sold as malware-for-hire by a group called GrayBravo. They’re hitting targets from logistics to IT using fake online Booking pages and software updates.
Each attack links back to the same control servers — built to spread fast.
Storm-0249 just changed tactics.
The hacker group Microsoft flagged in 2024 is now faking Microsoft domains and abusing real security tools like SentinelOne to sneak in ransomware.
They’re using PowerShell commands that never drop files—making them almost invisible.
The hacker group Microsoft flagged in 2024 is now faking Microsoft domains and abusing real security tools like SentinelOne to sneak in ransomware.
They’re using PowerShell commands that never drop files—making them almost invisible.
Hackers are uploading fake resumes on Indeed and JazzHR to breach Canadian companies.
80% of attacks in this campaign hit Canada.
The “PDFs” actually launch QWCrypt ransomware through a tool called RedLoader.
80% of attacks in this campaign hit Canada.
The “PDFs” actually launch QWCrypt ransomware through a tool called RedLoader.
Researchers found malicious packages in VS Code, Go, npm, and Rust stealing developer data.
They mimicked themes, AI tools, and libraries to grab screenshots, Wi-Fi passwords, and browser cookies.
They mimicked themes, AI tools, and libraries to grab screenshots, Wi-Fi passwords, and browser cookies.
Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure.
New Spiderman Phishing Kit Targets European Banks with Real-Time Credential Theft.
Fortinet, Ivanti, and SAP Issue Urgent Patches for Authentication and Code Execution Flaws.
Switzerland’s Federal Office for Armaments, Armasuisse, reviewed Palantir’s proposal for a major IT upgrade to its military intelligence systems and flagged significant risks. The assessment warned that the company’s US headquarters, proprietary platforms, and reliance on on-site engineers could expose Swiss data to American authorities. It also raised concerns about the privacy implications of Palantir’s expansive data-analysis capabilities.
Hackers are hiding inside Google Drive.
Researchers found a Windows backdoor called NANOREMOTE that uses the Google Drive API to steal files and run commands.
It even pretends to be Bitdefender software so it looks safe.
Researchers found a Windows backdoor called NANOREMOTE that uses the Google Drive API to steal files and run commands.
It even pretends to be Bitdefender software so it looks safe.
Hackers are still hitting Middle East governments.
A group called WIRTE (Ashen Lepus) is expanding to Oman and Morocco with new malware named AshTag.
It hides in fake political PDFs — open one, and it steals your files.
A group called WIRTE (Ashen Lepus) is expanding to Oman and Morocco with new malware named AshTag.
It hides in fake political PDFs — open one, and it steals your files.
700+ Gogs servers hacked — no patch yet.
New flaw (CVE-2025-8110) lets attackers overwrite files and run code through symbolic links, bypassing last year’s fix.
Wiz found Supershell malware — often used by Chinese groups — on many hacked servers.
New flaw (CVE-2025-8110) lets attackers overwrite files and run code through symbolic links, bypassing last year’s fix.
Wiz found Supershell malware — often used by Chinese groups — on many hacked servers.
Hackers are attacking CentreStack and Triofox right now using a built-in key that never changes.
It lets them break in, read the web.config file, and run code on the server.
At least 9 companies have already been hit.
It lets them break in, read the web.config file, and run code on the server.
At least 9 companies have already been hit.
New: React2Shell attacks are surging.
Hackers are exploiting a critical RSC flaw (CVE-2025-55182) to install crypto miners and new malware — PeerBlight, CowTunnel, and ZinFoq.
Hackers are exploiting a critical RSC flaw (CVE-2025-55182) to install crypto miners and new malware — PeerBlight, CowTunnel, and ZinFoq.