The Oncology Institute of Hope and Innovation (TOI), a California-based cancer care provider, disclosed a significant data breach affecting patient information following a cyberattack on a third-party vendor. The incident compromised sensitive patient data including names, Social Security numbers, m
A critical zero-day vulnerability in Hitachi’s KnowledgeDeliver Learning Management System (LMS) is being actively exploited to deploy Godzilla webshells and Cobalt Strike beacons. Attackers are leveraging an authentication bypass flaw to gain unauthorized access, establish persistent backdoors, and
A severe vulnerability in 7-Zip, one of the world’s most popular file compression utilities, allows attackers to execute arbitrary code on victim systems through specially crafted archive files. The flaw affects multiple versions of the software and poses significant risks to organizations and indiv
InvisibleFerret malware has evolved its evasion tactics by abandoning traditional Python scripts in favor of compiled Python (.pyd) and shared object (.so) files. This strategic shift allows the malware to bypass signature-based detection systems that primarily focus on script-based threats. The upd
Threat actors are employing sophisticated social engineering tactics by disguising malicious Linux payloads as legitimate SSH-related files during software package installations. The attack leverages user trust in familiar system utilities, hiding malware within files named to resemble standard Open
iOS security researchers at Mysk have revealed that WhatsApp stores chat histories in an unencrypted SQLite database accessible to other Meta apps on the same Apple device. While end-to-end encryption protects messages in transit, there is no equivalent protection once those messages are stored locally.
A clothing merchandise website associated with FBI Director Kash Patel was compromised by threat actors deploying ClickFix malware, a sophisticated social engineering attack that tricks victims into executing malicious PowerShell commands. The attack leveraged fake CAPTCHA verification prompts to di
A critical zero-day vulnerability in KnowledgeDeliver Learning Management System (LMS) is being actively exploited in the wild to deploy BLUEBEAM web shells. Attackers are leveraging an unrestricted file upload flaw to gain persistent access to compromised systems, affecting educational institutions
Microsoft Access databases with embedded VBA macros represent a significant yet underestimated security threat to enterprise environments. Unlike Word or Excel macros that face heavy scrutiny and protection mechanisms, Access databases can execute malicious VBA code with minimal security warnings, b
A sophisticated supply chain attack orchestrated by the threat group TeamPCP has successfully infiltrated GitHub and Microsoft infrastructure, with malicious activity detected through May 24, 2026. The campaign leverages compromised developer accounts and poisoned packages to distribute malware acro
