Microsoft security researchers have uncovered a critical attack vector where threat actors poison Model Context Protocol (MCP) tool descriptions to manipulate AI agents into exfiltrating sensitive data. This novel technique exploits how AI agents interpret natural language instructions embedded in t
Attackers are actively exploiting a remote code execution (RCE) vulnerability in Langflow, a popular low-code AI application development platform, to deploy XMRig cryptocurrency miners on exposed instances. The exploitation targets publicly accessible Langflow endpoints, leveraging insecure configur
Business Email Compromise (BEC) attacks have evolved from opportunistic scams into sophisticated operations powered by underground criminal networks. Recent investigations reveal coordinated ecosystems where specialized actors trade compromised credentials, corporate intelligence, and money launderi
AI-powered video surveillance systems now allow operators to search footage using natural language queries like “show me everyone wearing a red jacket” or “find people meeting in parking lots after 10 PM.” This technology, deployed across cities worldwide, transforms massive video archives into sear
GitHub’s Advisory Database has reached unprecedented volume levels, with vulnerability submissions now exceeding the platform’s review capacity. The backlog has created significant delays in security advisory publication, potentially leaving thousands of open-source projects vulnerable while maintai
A critical authentication bypass vulnerability in SimpleHelp remote support software (CVE-2024-48558) is being actively exploited by threat actors to deploy TaskWeaver malware and the Djinn information stealer. The flaw allows unauthenticated attackers to gain unauthorized access to systems running
Aflac, one of the world’s largest insurance providers, has disclosed a data breach affecting its Japanese subsidiary after unauthorized access to internal systems. The incident compromised customer data including personal information and policy details. The breach highlights growing threats to the i
A sophisticated malware strain dubbed TONResolver has emerged, leveraging The Open Network (TON) blockchain smart contracts as a dead drop resolver (DDR) mechanism for dynamic command-and-control (C2) infrastructure switching. This novel evasion technique exploits the immutable and decentralized nat
Security researchers have discovered critical vulnerabilities in Apple’s AirDrop and Google’s Quick Share file-sharing protocols that allow nearby attackers to trigger device crashes and denial-of-service conditions. These flaws exploit weaknesses in proximity-based sharing mechanisms, enabling mali
A sophisticated Windows backdoor dubbed “Mistic” has been discovered targeting enterprise networks with advanced in-memory code execution capabilities and credential harvesting features. The malware operates entirely in memory to evade traditional detection methods, establishes persistent command-an