HOLLOWGRAPH represents a sophisticated cyber espionage campaign that abuses Microsoft 365 calendar functionality as command-and-control (C2) infrastructure. Threat actors exploit legitimate calendar sharing features to establish covert communication channels, encoding commands within calendar events
Microsoft has confirmed widespread synchronization delays affecting Windows Server Update Services (WSUS), disrupting enterprise patch deployment infrastructure globally. Organizations relying on WSUS for centralized update management are experiencing sync failures, incomplete metadata downloads, an
A sophisticated threat actor known as GoldenEyeDog successfully breached DigiCert’s infrastructure, compromising code-signing certificates that organizations trust to verify software authenticity. The breach enables attackers to sign malicious code with legitimate certificates, bypassing security co
A critical remote code execution (RCE) vulnerability (CVE-2025-14266) has been discovered in 7-Zip, one of the world’s most popular file compression utilities. The flaw resides in the XZ archive format decompression module and allows attackers to execute arbitrary code when a victim extracts a speci
A critical remote code execution (RCE) vulnerability in ServiceNow, tracked as CVE-2024-6875, is now being actively exploited by threat actors. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable ServiceNow instances, affecting multiple versions of the platform. Organiz
Cybersecurity firm Volexity has disclosed an active zero-day exploitation campaign targeting SonicWall’s Secure Mobile Access (SMA) 1000 series VPN appliances. Threat actors are leveraging previously unknown vulnerabilities to achieve root-level access on these devices, allowing them to establish pe
North Korean state-sponsored threat actors have deployed a sophisticated steganographic technique to deliver OTTERCOOKIE malware by concealing malicious payloads within SVG (Scalable Vector Graphics) image files. This campaign specifically targets software developers, leveraging seemingly benign ima
A critical 15-year-old vulnerability in NGINX web server (CVE-2026-42533) enables remote code execution through worker process manipulation. The flaw affects multiple NGINX versions dating back to 2011 and allows attackers to crash worker processes and achieve RCE on vulnerable systems. Immediate pa
Ukrainian threat group UAC-0145 has launched a sophisticated social engineering campaign using fake CAPTCHA verification prompts, known as “ClickFix,” to trick users into executing malicious PowerShell commands. The campaign specifically targets Ukrainian users through compromised websites and phish
Threat actors have weaponized the legitimate update mechanism of ViPNet, a widely-deployed secure communication software used across Russian government agencies, to deliver malicious payloads. The attack demonstrates advanced knowledge of the software’s architecture and represents a significant supp