Researchers found an indirect prompt injection flaw abusing Google Gemini via calendar invites.

A hidden prompt in an event could trigger Gemini, when asked about a schedule, to summarize private meetings into a new calendar entry—visible to attackers in some enterprise setups.

Thousands of fake banking sites are quietly pulling users in via Google.

CTM360 tracked 11,000+ fake bank domains targeting the U.S. and UK, many ranking next to real institutions. These sites run full onboarding and fake approvals before charging “fees” via crypto or PayPal.

A major Telegram scam marketplace may be winding down.

Elliptic reports Tudou Guarantee has largely halted transactions in its public channels after processing $12B+ in illicit activity.

DON'T UPLOAD YOUR FAMILY PHOTOS TO AI - Cyber Dispatch

New breach: Under Armour was the victim of a ransomware attack in November. Customer data was published to a hacking forum this week and includes 72M email addresses, along with other personal information.

Oracle E-Business Suite Authentication Bypass & RCE (CVE-2025-61882)

ACF plugin bug gives hackers admin on 50,000 WordPress sites.

Cloudflare has fixed a flaw in its web application firewall (WAF) that allowed attackers to bypass security rules and directly access origin servers, which could lead to data theft or full server takeover.

FearsOff security researchers reported the bug in October through Cloudflare's bug bounty program, and the CDN says it has patched the vulnerability in its ACME (Automatic Certificate Management Environment) validation logic with no action required from its customers.

NightSpire ransomware gang alleges Hyatt breach, leaks data.

Google says Gemini won’t have ads, as ChatGPT prepares to add them.

Warwickshire school to reopen after cyberattack crippled IT.

Jordanian pleads guilty to selling access to 50 corporate networks

UK govt. warns about ongoing Russian hacktivist group attacks.

Fake ad blocker extension crashes the browser for ClickFix attacks.

MX Linux 25.1 brings back switchable init systems.

OpenAI's ChatGPT Atlas browser is testing actions feature.

Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading.

RansomHouse Claims Data Breach at Major Apple Contractor Luxshare.

CrowdStrike shareholders lose battle to recoup losses from 2024 outage.

Evelyn Stealer Malware Abuses VS Code Extensions to Steal Developer Credentials and Crypto.

VoidLink Signals the Start of a New Era in AI-Generated Malware.