A Canadian national has pleaded guilty to orchestrating a massive data extortion campaign targeting Snowflake cloud database customers, compromising over 165 organizations worldwide. The attacker exploited stolen credentials to access sensitive customer data, extorting victims for millions of dollar
Security researchers have unveiled a novel interrupt injection attack that successfully bypasses Spectre v2 mitigations on both Intel and AMD processors. The attack exploits the way CPUs handle interrupts during speculative execution, allowing attackers to leak sensitive data from kernel memory desp
Multiple critical vulnerabilities have been disclosed across three major platforms, headlined by a perfect CVSS 10.0 cross-tenant authentication bypass in Terraform’s Model Context Protocol (MCP) server. Veeam Backup Enterprise Manager faces credential exposure risks, while Django patches SQL inject
A critical 13-year-old privilege escalation vulnerability in the Linux kernel’s Open vSwitch (OVS) module, dubbed OVSwrap (CVE-2026-64531), allows local unprivileged users to gain root access. The flaw affects kernel versions since 2012 and stems from improper handling of netlink messages in the OVS
CISA has added Apache Tomcat CVE-2026-34486 to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The critical vulnerability affects encryption mechanisms in multiple Tomcat versions, allowing attackers to decrypt sensitive session data and potentiall
Apple is once again locked in a high-stakes battle with UK authorities over encryption backdoors, specifically regarding access to iCloud data. The UK government is pressuring Apple to create mechanisms that would allow law enforcement to bypass end-to-end encryption protections on iCloud services.
The Swiss Federal Office of Information Technology (FOITT) confirmed a security breach affecting approximately 200 employee accounts through exploitation of SharePoint vulnerabilities. Attackers leveraged configuration weaknesses and authentication flaws to gain unauthorized access to internal syste
The Greatness Phishing-as-a-Service (PhaaS) platform has evolved with a dangerous new capability: device code phishing attacks that bypass multi-factor authentication (MFA). This technique exploits OAuth 2.0’s device authorization flow to trick victims into authenticating malicious applications, gra
Security researchers have discovered that malware can steal Google-synced passkeys from infected systems without requiring user passwords, biometric authentication, or any interaction. The attack exploits the way Google Chrome syncs passkey data, allowing attackers to extract and reuse credentials o
A critical seed generation flaw in COLDCARD hardware wallets has been linked to the theft of nearly $89 million in Bitcoin. The vulnerability stems from insufficient entropy during the seed phrase generation process, allowing attackers to reconstruct private keys and drain user funds. Multiple victi