US authorities disrupted Chinese state-sponsored hacking tools used in multi-year global espionage operations, as seven governments jointly warn of PRC intelligence activities targeting sensitive data. Organizations potentially compromised since 2021 should review security posture immediately.
Cybercriminals have published multiple malicious npm packages impersonating the legitimate PostCSS ecosystem to distribute a Windows Remote Access Trojan (RAT). The packages use typosquatting and dependency confusion techniques to trick developers into downloading malware that establishes persistent
A sophisticated macOS infostealer dubbed “Reaper” is actively exploiting Apple’s legitimate Script Editor application to harvest cryptocurrency wallet data and stored passwords from infected Mac systems. The malware bypasses traditional security controls by leveraging trusted system utilities, speci
CVE-2026-64561, dubbed “Zapscape,” is a critical vulnerability in the Linux Kernel-based Virtual Machine (KVM) subsystem that allows malicious guest VMs to escape virtualization boundaries and execute arbitrary code on the host system with root privileges. The flaw affects Linux kernel versions 5.15
The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has confirmed a “major” cybersecurity incident following claims by a ransomware group that they breached the federal agency’s systems. The Department of Justice’s Inspector General is leading the investigation into the breach, which repor
Pwn2Own Berlin 2026 wraps up: $1.3M paid out for 47 zero-days. DEVCORE takes Master of Pwn with $505K. Three intense days of enterprise exploits.
A critical vulnerability in Microsoft 365 Android applications could have allowed attackers to hijack user accounts affecting billions of Android users worldwide. The flaw exploited Android’s intent-based communication system, enabling malicious apps to intercept authentication tokens and gain unaut
Pharmaceutical giant Novo Nordisk has confirmed a data breach exposing clinical trial information. The Danish company, known for diabetes and obesity treatments including Ozempic and Wegovy, discovered unauthorized access to systems containing sensitive research data. While patient identities report
A critical integer overflow vulnerability (ZDI-26-332) in QEMU’s `calc_image_hostmem` function allows authenticated local attackers to escalate privileges on affected systems. The flaw stems from improper integer validation when calculating image host memory, potentially enabling attackers to break
Dell has disclosed critical remote code execution (RCE) vulnerabilities in Wyse Management Suite versions prior to 5.5 HF1, affecting enterprise thin client deployments worldwide. Multiple vulnerabilities enable unauthenticated attackers to execute arbitrary code remotely, potentially compromising e