A Russian state-sponsored threat actor has developed a sophisticated attack methodology exploiting public Wi-Fi captive portals to deliver malware to unsuspecting users. The campaign targets hotels, airports, and coffee shops across Europe and North America, transforming legitimate login pages into
A threat actor group known as ExfilSquad has successfully breached a UK police database, exposing personal information of over 100,000 police officers and staff members. The leaked data includes names, ranks, email addresses, phone numbers, and potentially home addresses of law enforcement personnel
Critical vulnerabilities in Hugging Face’s Diffusers library allow attackers to execute arbitrary code by bypassing safety mechanisms designed to protect against malicious AI model files. The flaws enable remote code execution (RCE) when users load compromised models from repositories, turning trust
A critical remote code execution (RCE) vulnerability tracked as CVE-2026-12935 has been discovered in TP-Link TL-WR940N routers. This flaw allows unauthenticated attackers to execute arbitrary commands on affected devices, potentially leading to full device compromise. With millions of these budget
N-able’s N-central remote monitoring and management (RMM) platform suffered a critical security vulnerability that attackers exploited even after the vendor’s initial patch proved insufficient. Threat actors leveraged the flaw to establish persistent tunnels into managed service provider (MSP) netwo
Water treatment facilities in Georgia and Michigan have been compromised in cyberattacks linked to escalating US-Iran tensions. Attackers targeted industrial control systems (ICS), potentially gaining access to operational technology that manages water treatment processes. These incidents follow a p
SonicWall Secure Mobile Access (SMA) appliances are under active attack via a critical zero-click remote code execution vulnerability that grants attackers root-level access without authentication. The flaw, affecting internet-facing VPN gateways used by thousands of organizations, allows complete d
N-able’s N-central remote monitoring and management (RMM) platform remains vulnerable to active exploitation despite an initial patch release. CVE-2026-18577, a critical authentication bypass vulnerability, allows unauthenticated attackers to gain complete administrative control over N-central serve
Google Chrome is implementing enhanced security controls to automatically block extensions that hijack New Tab pages, a common tactic used by malicious actors to redirect user traffic and inject unwanted content. This browser-level protection will activate by default, significantly reducing the atta
Ruby on Rails has released emergency security patches addressing a critical Remote Code Execution (RCE) vulnerability in Active Storage. The flaw, tracked as CVE-2024-47887, affects multiple Rails versions and could allow attackers to execute arbitrary code on vulnerable servers. All Rails applicati