A critical heap overflow vulnerability (CVE-2026-14266) has been discovered in 7-Zip, one of the world’s most popular file compression utilities. The flaw allows attackers to execute arbitrary code on victim systems by crafting malicious archive files. With over 500 million users worldwide, this vul
North Korean state-sponsored threat actors successfully compromised the npm ecosystem by targeting the widely-used axios HTTP client library. Before the main attack, threat actors practiced on a lesser-known npm package, refining their techniques. This sophisticated supply chain attack demonstrates
Over 30 Minnesota water utility systems have been targeted in a coordinated operational technology (OT) attack, marking one of the most significant cyber assaults on U.S. critical water infrastructure to date. The attack campaign specifically targeted industrial control systems (ICS) managing water
A critical vulnerability (CVE-2026-10702) in Firefox’s underlying engine has exposed Tor Browser users to session hijacking attacks through malicious web pages. The flaw allows attackers to bypass Tor’s anonymity protections and execute arbitrary code, potentially unmasking users and compromising th
Microsoft’s Secure Boot implementation has been compromised by a 13-year-old vulnerability involving improperly revoked bootloaders and shims. Security researchers discovered that previously revoked certificates and binaries remained functional, allowing attackers to bypass Secure Boot protections o
A critical vulnerability in the Intelligent Platform Management Interface (IPMI) protocol, dating back 22 years to its inception, has left approximately 24,000 servers exposed to offline password cracking attacks. The flaw allows unauthenticated attackers to retrieve password hashes during the RAKP
A critical Bluetooth vulnerability in KARR Security’s connected car systems affects approximately 2.2 million vehicles worldwide, allowing attackers to remotely unlock doors and disable engine immobilizers. The flaw stems from weak authentication mechanisms in the mobile app’s communication protocol
South Korea’s National Diplomatic Academy (NDA) suffered a significant data breach exposing sensitive information of thousands of foreign ministry officials and diplomats. The compromised data includes personal identification details, contact information, and potentially classified diplomatic commun
South Korea’s Ministry of Foreign Affairs confirmed a significant data breach affecting diplomatic personnel records worldwide. The incident exposed sensitive information of diplomats, staff members, and their families across multiple overseas missions. While investigation details remain limited, th
A critical vulnerability in Adobe’s Acrobat Chrome extension allowed malicious websites to access and exfiltrate private WhatsApp Web conversations without user consent. The flaw, stemming from improper content security policies and message handling, enabled arbitrary websites to inject scripts into