VMware has disclosed multiple stored cross-site scripting (XSS) vulnerabilities affecting several of its enterprise products. These flaws allow authenticated attackers to inject malicious JavaScript code that executes in victims’ browsers when viewing compromised pages. The vulnerabilities impact VM
A critical remote code execution (RCE) vulnerability in Redis allows unauthenticated attackers to achieve complete server compromise. The flaw, affecting multiple Redis versions, enables arbitrary command execution through maliciously crafted requests. Organizations running vulnerable Redis instance
UNC3753, a financially motivated threat actor, has executed an alarming hybrid attack campaign combining social engineering vishing calls with physical break-ins to steal data and extort U.S. organizations. The group targets help desks to obtain VPN credentials, then conducts reconnaissance before s
Microsoft has introduced a critical security enhancement to Visual Studio Code that delays automatic extension updates by two hours. This measured response targets supply chain attacks where threat actors compromise legitimate extensions through account takeovers or malicious updates. The delay prov
Cybercriminals have stolen over 20,000 Instagram accounts by impersonating Meta’s AI-powered customer support system. The attackers leveraged social engineering tactics, fake verification pages, and phishing links disguised as official Meta support channels to harvest credentials and session tokens.
Security researchers have discovered a critical vulnerability in Anthropic’s Claude Code Model Context Protocol (MCP) implementation that allows attackers to intercept unencrypted network traffic and steal OAuth authentication tokens. The flaw affects developers using Claude’s MCP servers for code i
Microsoft has unveiled Intelligent Terminal, an AI-enhanced version of Windows Terminal that integrates natural language processing and contextual assistance directly into the command line interface. This new tool leverages large language models to provide intelligent command suggestions, error reso
Threat actors have developed a sophisticated malware campaign targeting WordPress sites, leveraging Steam’s gaming platform as an unconventional command-and-control (C2) channel. This innovative technique abuses Steam’s public profile features to hide malicious commands in plain sight, evading tradi
The C0XMO botnet is actively targeting DD-WRT routers through known vulnerabilities, establishing persistent footholds on compromised devices. Unlike typical botnets, C0XMO actively hunts and terminates competing malware, securing exclusive control over infected systems. The campaign demonstrates so
A school shooting survivor has filed a lawsuit against an AI-powered gun detection company after its security system failed to identify a weapon before a violent incident. The case highlights critical concerns about the reliability of artificial intelligence solutions deployed in high-stakes securit