-
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities in the Zammad helpdesk platform to its Known Exploited Vulnerabilities (KEV) Catalog following reports of active exploitation. The U.S. Cybersecurity and Inf…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A GlassWorm-linked software supply chain campaign has abused seemingly harmless Visual Studio Code color themes to distribute malicious loaders across the Visual Studio Marketplace and Open VSX Registry. The activity demonstrates how extensions designe…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Threat actors are increasingly bypassing conventional malware detection by abusing legitimate remote monitoring and management software instead of deploying custom implants. In a recent phishing operation, attackers delivered a genuine, digitally signe…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Microsoft has released a revised security update package for on-premises Exchange Server, dated September 2026, which includes a fix for CVE-2026-96940. This V2 release applies to Exchange Server Subscription Edition, Exchange Server 2019, and Exchange…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
South Korean President Lee Jae Myung has ordered a comprehensive investigation into a series of data breaches impacting major banks and other financial institutions. Concerns have been raised that attackers may have utilized AI-enabled offensive securi…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Google has disclosed that PageBreak, an internal AI security agent developed by its Product Security team, has identified and validated more than 500 cross-site scripting (XSS) vulnerabilities across the company’s first-party web applications, includin…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Citrix has released emergency security updates to address a high-severity memory overflow vulnerability in NetScaler ADC and NetScaler Gateway. This flaw, tracked as CVE-2026-88779, could allow unauthenticated remote attackers to cause persistent denia…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly identified IoT botnet, Cling, disguises its command-and-control communications as legitimate STUN traffic, including packets that appear to originate from Google’s public STUN infrastructure. The technique enables attackers to manage compromise…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Microsoft Threat Intelligence has identified a ClickFix campaign in which compromised websites use fake CAPTCHA-style verification prompts to trick Windows users into executing malicious commands. The operation stages its payload inside the browser cac…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
GitLab has issued emergency security updates for a critical vulnerability in its Self-Hosted AI Gateway that could allow authenticated attackers to execute arbitrary commands on vulnerable AI Gateway deployments. The flaw, tracked as CVE-2026-90970, ca…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
