Security researchers have disclosed AutoJack, a novel attack vector that exploits autonomous AI agents to achieve remote code execution (RCE) on host systems through maliciously crafted web pages. When an AI agent visits a compromised website, attackers can hijack the agent’s decision-making process
Rocket.Chat has successfully migrated to Meteor 3.0, enabling the platform to move off an end-of-life (EOL) Node.js runtime that posed significant security and operational risks. This critical infrastructure upgrade brings the open-source communication platform onto a supported Node.js version, elim
A significant data breach affecting Texas government systems has exposed over 3 million driver’s license records, potentially compromising sensitive personal information of Texas residents. The incident represents one of the largest state-level data breaches in recent years, raising serious concerns
Security researchers have unveiled a permanent BootROM exploit affecting Apple’s A12 and A13 processors, reminiscent of the infamous checkm8 exploit. This hardware-level vulnerability cannot be patched through software updates and affects iPhone XS, XR, 11 series, and several iPad models. While phys
A coordinated international operation has successfully cleaned 14,971 compromised WordPress websites infected with the SocGholish malware framework. This sophisticated JavaScript-based infection chain has been actively targeting WordPress sites for years, delivering fake browser updates that install
Nintendo of America employee data has been compromised following a cyberattack on TinyPulse, a third-party employee engagement platform. The threat actor Shadowbyt3$ claims responsibility for breaching TinyPulse’s systems and has allegedly exfiltrated sensitive employee information from multiple org
Chief Information Security Officers (CISOs) are experiencing unprecedented pressure from two converging forces: an intensifying threat landscape and the rapid integration of artificial intelligence into both attack vectors and defense strategies. Organizations are restructuring cybersecurity teams,
The Texas Parks and Wildlife Department (TPWD) suffered a significant data exposure affecting approximately 3 million residents. The breach exposed sensitive personal information including names, addresses, dates of birth, Social Security numbers, and driver’s license numbers. The incident highlight
A critical vulnerability (CVE-2026-42530) has been discovered in NGINX’s HTTP/3 implementation that could allow remote attackers to trigger denial-of-service conditions and potentially achieve remote code execution. The flaw affects NGINX versions with HTTP/3 support enabled and stems from improper
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Splunk Enterprise vulnerability (CVE-2024-36991) to its Known Exploited Vulnerabilities (KEV) catalog after detecting active exploitation in the wild. Federal agencies must patch their systems by Sunday under binding op