A critical remote code execution (RCE) vulnerability in Google Cloud’s production infrastructure (CVE-2026-2031) has been patched following responsible disclosure by a security researcher who earned $148,337 through Google’s Vulnerability Reward Program. The flaw allowed authenticated attackers to e
A critical namespace vulnerability affecting major cloud service providers enables attackers to hijack abandoned storage bucket names, potentially intercepting sensitive data from applications still referencing those resources. This technique exploits the global namespace model used by AWS S3, Azure
Attackers are exploiting AI memory mechanisms to inject malicious prompts, exfiltrate sensitive data, and manipulate model behavior in Microsoft’s AI-powered applications. This emerging threat vector targets the persistent memory features in AI assistants, allowing adversaries to poison conversation
Cybercriminals have published multiple malicious npm packages impersonating the legitimate PostCSS ecosystem to distribute a Windows Remote Access Trojan (RAT). The packages use typosquatting and dependency confusion techniques to trick developers into downloading malware that establishes persistent
A sophisticated phishing campaign is actively targeting WhatsApp users with malicious documents disguised as legitimate business files. Attackers are distributing weaponized archives containing VBScript-based malware that establishes persistent access to victim systems. The campaign exploits trust i
Security researchers have disclosed a critical zero-click exploit chain targeting Google Pixel 10 devices that leverages a vulnerability in the Visual Processing Unit (VPU) driver to achieve full root access without user interaction. The attack chain, discovered during internal security testing, com
CISA has issued an urgent alert regarding widespread exploitation of a credential exposure vulnerability dubbed “FortiBleed” affecting over 74,000 Fortinet devices globally. The flaw allows attackers to extract plaintext credentials from vulnerable FortiGate SSL-VPN appliances without authentication
Security researchers have disclosed AutoJack, a novel attack vector that exploits autonomous AI agents to achieve remote code execution (RCE) on host systems through maliciously crafted web pages. When an AI agent visits a compromised website, attackers can hijack the agent’s decision-making process
Rocket.Chat has successfully migrated to Meteor 3.0, enabling the platform to move off an end-of-life (EOL) Node.js runtime that posed significant security and operational risks. This critical infrastructure upgrade brings the open-source communication platform onto a supported Node.js version, elim
A significant data breach affecting Texas government systems has exposed over 3 million driver’s license records, potentially compromising sensitive personal information of Texas residents. The incident represents one of the largest state-level data breaches in recent years, raising serious concerns