-
A recent security audit of PHP’s PDO ecosystem uncovered a denial-of-service vector in the pdo_pgsql driver that can crash PHP processes when emulated prepared statements are enabled. PDO’s parser assumes a valid zend_string and dereferences it, trigge…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated interview-themed phishing campaign that impersonates major global brands to harvest Gmail credentials. Attackers pose as recruiters offering marketing roles at well-known companies, leveraging personalized targeting and a layered redire…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Authorities used a persistent Windows Global Device ID, along with VPN telemetry and cloud service records, to connect the infrastructure used in a major extortion attack to a 19-year-old member of the Scattered Spider group, Peter Stokes. In a superse…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A coordinated social-engineering campaign observed in late June 2026 combined email phishing with an abused Microsoft Teams cross‑tenant chat to deliver a sophisticated EtherRAT implant via a malicious MSI loader. Initial access began with a targeted e…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
BeyondTrust has disclosed multiple critical and high-severity vulnerabilities affecting its Remote Support (RS) and Privileged Remote Access (PRA) appliances. These flaws expose organizations to risks such as authentication bypass, denial-of-service at…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A significant security vulnerability in Google’s Gemini Live API has exposed applications to remote code execution (RCE) due to misconfigured ephemeral tokens. This flaw allows attackers to inject client-controlled setup frames and execute arbitrary co…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly identified Iran-linked threat group, tracked as Cavern Manticore, is deploying a sophisticated modular command-and-control (C2) framework built on a shared .NET foundation to conduct stealthy reconnaissance and lateral movement against Israeli …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Microsoft has disclosed a high-severity remote code execution (RCE) vulnerability in its Chromium-based Edge browser, identified as CVE-2026-57992. This vulnerability could allow attackers to execute arbitrary code on affected systems under specific co…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A rising phishing technique is exploiting a legitimate Microsoft authentication flow to hijack corporate accounts without stealing passwords. Attackers are weaponizing the OAuth 2.0 Device Authorization Grant commonly used to sign in input-constrained …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly discovered deserialization vulnerability, tracked as CVE-2026-44963, affects Veeam Backup & Replication. This vulnerability allows authenticated domain users to execute remote code on backup servers by exploiting weaknesses in the handling …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
