-
Palo Alto Networks has warned that attackers are exploiting a high-severity remote code execution flaw in the PAN-OS management interface. Tracked as CVE-2026-0322, the bug lets an authenticated attacker with network access run arbitrary code with root…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Citizen Lab has confirmed the first public case of zero-click mercenary spyware delivered through targeted online ads. It calls the technique “AdFection”. The attack hit devices at Al Jazeera with Candiru spyware, and the ads were bought by…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
PEERSTITCH, a memory-resident ARM64 implant deployed against FortiGate firewalls during a prolonged intrusion into a telecommunications managed service provider. The malware hijacks legitimate FortiOS processes, leaving no persistent executable, openin…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The UK’s Legal Aid Agency (LAA) now says the 2025 data breach exposed far older data than first reported. About 250,000 stolen records predate 2007, and the earliest verified record is from 1978. UK legal aid cyberattack The LAA identified a cybe…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A ClickFix campaign uses the Lorem Ipsum Loader to install a Python-based tunneling implant, giving attackers a covert route into victims’ networks and potentially laying the groundwork for ransomware deployment. In an incident investigated in late Sep…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Linus Torvalds used Anthropic’s Claude Code to build experimental patches that remove a long-running page-cache scalability bottleneck in the Linux kernel. The series is not merged. Reviewers have already found a race condition and raised memory-…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
AI agents can expose credentials during routine development tasks, moving secrets from protected stores into command arguments, logs, transcripts, and inputs to external models. The concern is not that developer tools are inherently malicious. Rather, …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Vercel has released an out-of-band security update for Next.js that fixes two critical remote code execution (RCE) flaws and one high-severity denial-of-service (DoS) bug. One of the critical flaws, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), sits in the Ima…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Iron Man System, a commercial phishing-as-a-service platform supplying criminals with ready-made websites impersonating banks, couriers, tax agencies, traffic authorities, and other trusted organizations worldwide. Researchers purchased a license throu…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Citrix has released security updates for XenServer 8.4 and XenServer 9. The updates fix several vulnerabilities, three of which could let a malicious privileged guest VM user compromise or crash the underlying host. Cloud Software Group rated the bulle…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
