-
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part …
-
Placeholder Domains Used by 349 AI Agent Skills Found Redirecting to Scams
Manifold Security found placeholder domains cited in 359,000 GitHub files and 349 AI agent skills serving cloaked scam redirects observed …
-
OpenAI took 2.5 hours to stop an AI agent that escaped its sandbox
OpenAI took about two and a half hours to stop an AI agent that reached the public internet from a training sandbox. Its monitoring had …
-
Zero Trust for AI Agents Starts With Fixing Zero Visibility
The way we talk about AI agents is shifting, and the way we implement them requires an even more fundamental shift. While earlier discourse …
-
ShinyHunters Bypass WAF Rules to Resume Oracle PeopleSoft Attacks
Mandiant and the Google Threat Intelligence Group (GTIG) have identified renewed exploitation of a critical Oracle PeopleSoft …
-
Old-School Credit Card Scams Are Far From Dead
Welcome to Kernel Panic! A weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital …
-
Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack
Kiteworks (formerly Accellion) is urging customers to shut down their systems as a precautionary measure for nine hours over the weekend …
-
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an …
-
Cybersecurity in Sports: Protecting Fans & Data on Digital Platforms
Yes, all of these advancements sound good. They definitely make our lives easier and sports more …
-
Your uncle’s frozen Mac says it’s infected after viewing a Google ad. Now what?
Researchers say they recently found Google ads delivering a sophisticated tech support scam that freezes the screens of both Windows and …
-
CVE-2026-85984 – The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is …
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the …
-
CVE-2026-77203 – The Groups – Memberships and Access Control plugin for WordPress is vulnerable to …
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and …
●●●
NVD
- CVE-2026-100520 – Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST …
- CVE-2026-100503 – Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the …
- CVE-2026-100504 – Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in …
- CVE-2026-100505 – Ghidra versions 11.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in …
- CVE-2026-85984 – The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is …
EXPLOITS
- CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth – ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE
- Metabase 0.61.0 – Authenticated Remote Code Execution
- FreePBX 17.0.2 – Remote Code Execution (RCE)
- Ghost_CMS 6.19.0 – Remote Code Execution
- Bludit CMS 3.20.0 – Reflected Cross-Site Scripting
SECURELIST
- MacSync under the microscope: new delivery methods and a new payload
- The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through com
- Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
- The Odyssey and trojans again: MovieReaper attacks users in multiple countries via comprom
- NightEagle targets Russian companies