A staggering compilation of 24 billion stolen credentials has been discovered in what researchers are calling one of the largest credential dumps in history. The dataset, dubbed “MOAB” (Mother of All Breaches), aggregates previously leaked credentials from thousands of breaches spanning multiple yea
Recent research exposes critical flaws in Large Language Model (LLM) defense architectures through “role confusion” attacks, where prompt injections manipulate AI systems into misinterpreting instructions and security boundaries. The paper demonstrates how current safeguards fail when attackers expl
Apple is once again locked in a high-stakes battle with UK authorities over encryption backdoors, specifically regarding access to iCloud data. The UK government is pressuring Apple to create mechanisms that would allow law enforcement to bypass end-to-end encryption protections on iCloud services.
Meta has updated its data usage policies to expand how it leverages off-Meta business activity data beyond advertising purposes. The social media giant will now use information about user interactions with third-party businesses—collected through Meta Pixel, Conversions API, and similar tools—to per
Microsoft SharePoint Server is under siege from active exploitation of CVE-2026-50522, a critical remote code execution vulnerability with a CVSS score of 9.8. Following the public release of proof-of-concept code, threat actors are weaponizing this flaw to compromise unpatched SharePoint instances.
GitHub has disabled automatic execution of npm lifecycle scripts following discoveries of malicious exploitation. The platform will no longer automatically run `preinstall`, `install`, and `postinstall` scripts during package installation on GitHub-hosted services. This critical security decision co
Ukraine’s Security Service (SBU) has exposed a sophisticated SMS phishing campaign orchestrated by Russian intelligence services targeting government officials and critical infrastructure personnel. The operation uses deceptive text messages impersonating legitimate support services to harvest crede
International law enforcement agencies have successfully disrupted the SocGholish botnet infrastructure operated by the notorious Evil Corp cybercrime group. The operation dismantled command-and-control servers responsible for distributing fake browser updates that infected thousands of systems worl
Threat actors are leveraging Large Language Model (LLM) agents to automate post-exploitation activities after successfully compromising systems through CVE-2026-39987, a critical vulnerability in Marimo, a popular Python notebook framework. This novel attack chain represents a significant evolution
A critical use-after-free vulnerability (CVE-2026-50263) has been discovered in the X.Org Server’s CreateSaverWindow function, allowing authenticated local attackers to read sensitive information from freed memory regions. The flaw affects multiple Linux distributions and Unix-like systems still run