Ivanti has disclosed two critical vulnerabilities in Ivanti Sentry—CVE-2026-10520 and CVE-2026-10523—that enable unauthenticated attackers to achieve remote code execution (RCE). CVE-2026-10520 is an authentication bypass vulnerability with a CVSS score of 9.8, while CVE-2026-10523 is a command inje
Threat actors are leveraging a sophisticated multi-stage ClickFix social engineering technique to deploy MLTBackdoor malware on Windows systems. The attack chain begins with fake CAPTCHA prompts that trick users into executing malicious PowerShell commands, ultimately installing persistent backdoor
A critical zero-day vulnerability in Microsoft Windows BitLocker has been discovered that allows attackers with physical or local access to bypass full-disk encryption protections. The flaw exploits weaknesses in the boot process and TPM (Trusted Platform Module) communication, enabling unauthorized
Ivanti has disclosed a maximum severity vulnerability (CVE-2025-22457) in its Sentry product that allows unauthenticated attackers to execute arbitrary code with root privileges. The flaw affects Sentry versions 10.0.2 and earlier, carrying a CVSS score of 10.0. Organizations using Ivanti Sentry mus
Threat actors are increasingly targeting cloud logging infrastructure as a primary defense evasion technique. By disabling, deleting, or manipulating cloud audit logs across AWS CloudTrail, Azure Monitor, and Google Cloud Logging, attackers effectively blind security teams during intrusions. This ta
Meta has updated its data usage policies to expand how it leverages off-Meta business activity data beyond advertising purposes. The social media giant will now use information about user interactions with third-party businesses—collected through Meta Pixel, Conversions API, and similar tools—to per
Microsoft’s June 2026 Patch Tuesday addresses 89 security vulnerabilities across its product ecosystem, including five zero-day vulnerabilities—three actively exploited in the wild. The most critical issues affect Windows Kernel, Microsoft Exchange Server, and Azure Cloud Services. Organizations sho
Security researchers have discovered that GPS satellites are being used as an unconventional key distribution platform, broadcasting hidden military codes embedded within civilian navigation signals. This covert communication method leverages the ubiquity of GPS infrastructure to distribute cryptogr
Security researchers have unveiled FROST (File system and RDMA Operations-based Side-channel Timing), a novel side-channel attack that exploits SSD timing characteristics to allow malicious websites to track which websites and applications users access. By measuring minute timing differences in stor
The French government’s secure messaging platform Tchap suffered a security breach allowing attackers to hijack user accounts through a password reset vulnerability. The incident exposed the accounts of government officials, civil servants, and military personnel who rely on the platform for officia