The “Nightmare Eclipse” incident has reignited long-standing tensions between security researchers and software vendors over responsible disclosure practices. A critical vulnerability discovery turned contentious when disagreements over patch timelines, credit attribution, and public disclosure led
A sophisticated social engineering campaign is actively targeting US law firms, with threat actors impersonating IT support personnel to gain initial access. Attackers are leveraging phone calls and remote access tools to infiltrate networks, steal sensitive client data, and deploy ransomware. This
A sophisticated macOS infostealer dubbed “Reaper” is actively exploiting Apple’s legitimate Script Editor application to harvest cryptocurrency wallet data and stored passwords from infected Mac systems. The malware bypasses traditional security controls by leveraging trusted system utilities, speci
A newly identified threat cluster designated OP-512 has been actively targeting Microsoft Internet Information Services (IIS) servers with a custom-built web shell framework. The sophisticated malware employs advanced evasion techniques, modular architecture, and encrypted command-and-control channe
Researchers have demonstrated a novel AI worm capable of carrying its own lightweight language model to infected systems, enabling autonomous decision-making without relying on external infrastructure. This self-contained approach allows the malware to operate completely offline, evade traditional d
Recent red teaming exercises have uncovered a critical vulnerability in agentic AI systems: attackers can craft automated attack chains that bypass human-in-the-loop (HITL) safety controls without any user interaction. These zero-click exploits manipulate AI agents into executing malicious actions b
A critical authentication bypass vulnerability (CVE-2024-13430) in the Everest Forms Pro WordPress plugin has been actively exploited by attackers to gain unauthorized administrative access to websites. The flaw, affecting versions prior to 3.1.7, allows unauthenticated attackers to escalate privile
VECT 2.0 ransomware contains a critical implementation flaw where its encryption process damages files in a way that even the official decryptor from threat actors cannot reliably restore. Victims who pay ransoms are left with corrupted, unusable data despite receiving legitimate decryption keys. Th
Cybercriminals have launched sophisticated scam campaigns targeting FIFA World Cup 2026 enthusiasts, deploying fake ticketing websites, banking malware, and credential harvesting operations. With the tournament still months away, threat actors are exploiting fan excitement through phishing sites mim
Let’s Encrypt has introduced Merkle Tree Certificates (MTC), a revolutionary quantum-resistant certificate infrastructure designed to protect web communications against future quantum computing threats. This deployment represents the first large-scale implementation of post-quantum cryptography in T