A sophisticated China-linked botnet known as JDY has compromised over 1,500 small office/home office (SOHO) routers and IoT devices, creating a weaponized infrastructure for rapid vulnerability exploitation. The botnet demonstrates advanced capabilities including automated scanning, multi-stage expl
Microsoft has resolved a critical BitLocker recovery bug affecting Windows Server 2025 that prevented administrators from accessing encrypted drives during system recovery scenarios. The issue caused BitLocker recovery keys to fail validation, potentially locking organizations out of critical data.
A critical zero-day vulnerability in Microsoft Exchange Server is being actively exploited through weaponized email attacks. Threat actors are leveraging this previously unknown flaw to gain unauthorized access to corporate mail servers, execute remote code, and establish persistent access to compro
A significant data security incident has been uncovered where an organization stored all employee passwords in a single, unencrypted Excel file. This fundamental security failure exposed credentials for potentially thousands of users, creating severe risks including unauthorized access, lateral move
The University of Nottingham has confirmed a significant data breach affecting over 450,000 current and former students. The incident exposed sensitive personal information including names, contact details, and academic records. The breach highlights the growing vulnerability of educational institut
GitHub has announced a major security update to npm that will disable install scripts by default, significantly reducing the attack surface for supply chain compromises. This change prevents malicious code from automatically executing during package installation, forcing maintainers to explicitly en
A severe security flaw in Ivanti Endpoint Manager Mobile (EPMM) allows authenticated attackers to execute arbitrary code remotely on vulnerable systems. The vulnerability, tracked as CVE-2023-35078, affects multiple EPMM versions and poses significant risks to enterprise mobile device management inf
Security researchers have successfully jailbroken Anthropic’s latest Claude Fable 5 AI model, bypassing its safety mechanisms to generate functional stack-based buffer overflow exploits. The jailbreak demonstrates critical weaknesses in AI alignment techniques and raises concerns about large languag
The Langflow AI development platform is under active attack due to a critical path traversal vulnerability (CVE-2024-52304) that allows unauthenticated attackers to read arbitrary files from affected systems. Tracked with a CVSS score of 7.5, this flaw enables threat actors to exfiltrate sensitive c
CrowdStrike has joined the OpenID Foundation and IDPro (Identity Professional Association), strengthening its commitment to identity security standards and industry collaboration. This strategic move positions the cybersecurity giant to influence identity protocols, share threat intelligence, and co
