A critical vulnerability (CVE-2026-42530) has been discovered in NGINX’s HTTP/3 implementation that could allow remote attackers to trigger denial-of-service conditions and potentially achieve remote code execution. The flaw affects NGINX versions with HTTP/3 support enabled and stems from improper
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Splunk Enterprise vulnerability (CVE-2024-36991) to its Known Exploited Vulnerabilities (KEV) catalog after detecting active exploitation in the wild. Federal agencies must patch their systems by Sunday under binding op
Salesforce has disabled the Klue competitive intelligence application from its AppExchange marketplace following reports of OAuth token abuse that potentially exposed sensitive customer data. The incident involved improper handling of authentication tokens, allowing unauthorized access to Salesforce
A massive data leak has exposed the membership roster and internal communications of Dialog, an exclusive invite-only network founded by billionaire Peter Thiel. The breach reveals detailed personal information of hundreds of influential tech executives, investors, politicians, and intelligence comm
Apple has released a firmware update addressing a critical vulnerability in Beats Studio Buds and Beats Studio Buds+ that allowed nearby attackers to hijack the microphone and eavesdrop on users. The flaw (CVE-2024-54537) affected the Bluetooth pairing process, enabling unauthorized access within Bl
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert after approximately 74,000 Fortinet firewall credentials were leaked online through the “FortiBleed” incident. The exposed credentials include VPN login details, device configurations, and administrative access to
A staggering compilation of 24 billion stolen credentials has been discovered in what researchers are calling one of the largest credential dumps in history. The dataset, dubbed “MOAB” (Mother of All Breaches), aggregates previously leaked credentials from thousands of breaches spanning multiple yea
AutoJack is a critical vulnerability affecting AI agents that autonomously browse web content. By crafting a malicious webpage with embedded instructions, attackers can achieve remote code execution (RCE) on the host system running the AI agent. This attack exploits the trust boundary between natura
Gentlemen ransomware-as-a-service (RaaS) has emerged with sophisticated tactics that leverage multiple Endpoint Detection and Response (EDR) killing tools to disable security software before encryption. The operation employs bring-your-own-vulnerable-driver (BYOVD) attacks and exploits legitimate ut
International law enforcement agencies have successfully disrupted the SocGholish botnet infrastructure operated by the notorious Evil Corp cybercrime group. The operation dismantled command-and-control servers responsible for distributing fake browser updates that infected thousands of systems worl