Apple is once again locked in a high-stakes battle with UK authorities over encryption backdoors, specifically regarding access to iCloud data. The UK government is pressuring Apple to create mechanisms that would allow law enforcement to bypass end-to-end encryption protections on iCloud services.
Security researchers have discovered that malware can steal Google-synced passkeys from infected systems without requiring user passwords, biometric authentication, or any interaction. The attack exploits the way Google Chrome syncs passkey data, allowing attackers to extract and reuse credentials o
A critical remote code execution (RCE) vulnerability tracked as CVE-2026-12935 has been discovered in TP-Link TL-WR940N routers. This flaw allows unauthenticated attackers to execute arbitrary commands on affected devices, potentially leading to full device compromise. With millions of these budget
Google Chrome is implementing enhanced security controls to automatically block extensions that hijack New Tab pages, a common tactic used by malicious actors to redirect user traffic and inject unwanted content. This browser-level protection will activate by default, significantly reducing the atta
Ruby on Rails has released emergency security patches addressing a critical Remote Code Execution (RCE) vulnerability in Active Storage. The flaw, tracked as CVE-2024-47887, affects multiple Rails versions and could allow attackers to execute arbitrary code on vulnerable servers. All Rails applicati
Arch Linux has temporarily suspended the Arch User Repository (AUR) package adoption feature after attackers exploited the process to inject malicious code into orphaned packages. Multiple threat actors systematically adopted abandoned packages and pushed compromised commits, putting thousands of us
Wordfence security researchers discovered a critical backdoor vulnerability in the Advanced Responsive Video Embedder (ARVE) WordPress plugin, affecting thousands of websites. The backdoor allowed unauthorized administrative access to vulnerable WordPress installations, posing an existential threat
Two sophisticated backdoors, OctLurk and SilkLurk, have been discovered targeting government entities across Central Asia. These custom-built malware families enable attackers to perform extensive surveillance operations including keystroke logging, credential theft, screen capture, and full remote
North Korean threat actors are deploying sophisticated malvertising campaigns targeting macOS users with fake browser and system updates. The campaign distributes crypto-stealing malware through malicious advertisements on legitimate websites, leveraging social engineering to convince victims to dow
The Cybersecurity and Infrastructure Security Agency (CISA) has released comprehensive guidance on Open Source Software (OSS) security through its new C4 Framework, designed to help organizations systematically assess trust in open-source components. The framework introduces four critical pillars—Co