A highly critical SQL injection vulnerability (CVE-2026-9082) has been discovered in Drupal core affecting sites running PostgreSQL databases. With a CVSS score of 9.8, this flaw allows unauthenticated attackers to execute arbitrary SQL queries, potentially leading to complete database compromise. A
Google has released an emergency security update for Chrome addressing multiple critical vulnerabilities, including CVE-2025-0411 and CVE-2025-0410, which could allow remote attackers to execute arbitrary code on affected systems. These high-severity bugs affect Chrome’s V8 JavaScript engine and ANG
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: a command injection flaw in Trend Micro Apex One (CVE-2024-51537) and an arbitrary file read vulnerability in Langflow (CVE-2024-11056). Both
A new investigation reveals that one telecommunications provider has been hosting the majority of active command-and-control (C2) servers operating across the Middle East. This concentration of malicious infrastructure under a single provider raises significant questions about infrastructure abuse,
A legitimate Lenovo diagnostics driver has been weaponized by threat actors to terminate Endpoint Detection and Response (EDR) processes through a Bring Your Own Vulnerable Driver (BYOVD) attack. The vulnerable driver allows attackers with administrative privileges to execute code at the kernel leve
npm has reset all bypass-2FA automation tokens following a sophisticated supply chain attack dubbed “Mini Shai-Hulud.” The attack targeted npm’s publishing infrastructure, exploiting automation tokens that could bypass two-factor authentication requirements. All affected users must regenerate their
A sophisticated cross-platform credential stealer has been discovered in the NPM ecosystem, employing advanced sandbox evasion techniques to harvest sensitive data from developer workstations. The malware specifically targets Windows, Linux, and macOS systems, using environment fingerprinting to det
Cisco recently experimented with using AI to automate security incident report writing, revealing both the potential and limitations of AI in cybersecurity operations. While the AI successfully generated structured reports and saved time on routine documentation, it also produced inaccuracies, misse
Cybercriminals are distributing ValleyRAT malware through counterfeit Microsoft Teams download websites. The malicious campaign targets unsuspecting users searching for legitimate Microsoft Teams installations, delivering a sophisticated remote access trojan (RAT) capable of data exfiltration, syste
Google inadvertently published technical details of an unpatched security vulnerability in Chromium before a fix was available, potentially exposing millions of Chrome, Edge, and other Chromium-based browser users to exploitation. The premature disclosure has sparked concerns about coordinated vulne