A newly disclosed HTTP/2 vulnerability dubbed “HTTP/2 Bomb” enables attackers to trigger severe resource exhaustion on major web servers including nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora through a single malicious request. The attack leverages HTTP/2’s HPACK header compress
Security researchers have disclosed a sophisticated zero-click exploit chain targeting Google’s Pixel 10 devices that achieves full root access without any user interaction. The attack leverages vulnerabilities in the Pixel’s telephony stack and kernel subsystem, allowing remote code execution throu
Organizations rapidly adopting AI tools face unprecedented data loss risks as employees inadvertently expose sensitive information through AI platforms. This guide provides actionable strategies to prevent AI-driven data leakage, including implementing data loss prevention (DLP) controls, establishi
A critical authentication bypass vulnerability in HP Poly VoIP phones (CVE-2024-41937) allows unauthenticated attackers to gain administrative access to affected devices. With a CVSS score of 9.8, this flaw affects multiple Poly phone models widely deployed across enterprise environments. Attackers
A critical vulnerability in Visual Studio Code’s URI handling mechanism allows attackers to steal GitHub OAuth tokens through a single click. By exploiting the `vscode://` protocol handler and the GitHub Pull Requests extension, threat actors can craft malicious links that trigger automatic authenti
Multiple npm packages maintained by Red Hat were compromised in a sophisticated supply chain attack dubbed “Miasma.” Attackers gained unauthorized access to Red Hat developer credentials and injected malicious preinstall scripts designed to harvest environment variables, AWS credentials, and other s
A ransomware operator has violated one of cybercrime’s most fundamental unwritten rules by deploying attacks against Russian targets. This breach of the “golden rule” — never target Russia or former Soviet states — has sparked intense discussion in underground forums and raised questions about the a
A ransomware operator made headlines for violating the cardinal rule of cybercrime: never discuss your operations publicly. The individual, dubbed a “dumbass” by the security community, reportedly bragged about ransomware activities on social media and public forums, leading to rapid identification
A critical zero-day vulnerability in Visual Studio Code allows attackers to steal GitHub authentication tokens through a single click on a malicious link. The exploit leverages VS Code’s URI handler mechanism to execute unauthorized actions without user consent, potentially compromising thousands of
A sophisticated malware campaign dubbed “Weedhack” is actively targeting Minecraft players through malicious YouTube videos promoting fake game cheats and hacks. The operation delivers CountLoader malware, which has infected over 86,000 systems, subsequently deploying cryptocurrency miners and infor