A critical security vulnerability in Amazon’s Q AI coding assistant for Visual Studio Code could allow attackers to steal AWS credentials through malicious code suggestions. The flaw enables credential exfiltration when developers accept and execute compromised code snippets generated by the AI assi
Microsoft has reversed its stance following a public confrontation with a security researcher over a zero-day vulnerability disclosure. The tech giant initially disputed the researcher’s findings and delayed patching, but mounting pressure from the security community forced a policy reassessment. Th
New zero-day exploit “YellowKey” bypasses Windows 11 BitLocker encryption. Physical access required but defeats TPM protection completely.
South Korea’s Ministry of Foreign Affairs confirmed a significant data breach affecting diplomatic personnel records worldwide. The incident exposed sensitive information of diplomats, staff members, and their families across multiple overseas missions. While investigation details remain limited, th
Cybercriminals are exploiting Google’s advertising platform to distribute a sophisticated macOS backdoor dubbed “FlutterBridge.” The campaign uses malicious ads that appear at the top of Google search results, mimicking legitimate software downloads. When users click these ads, they’re redirected to
Cybercriminals are launching sophisticated phishing campaigns targeting website owners with fake domain renewal notices. These scams impersonate legitimate domain registrars, creating urgency around expiration dates to trick victims into paying renewal fees to fraudulent payment portals. The attacks
18-year-old buffer overflow flaw discovered in NGINX affects millions of deployments worldwide. NGINX Rift (CVE-2026-42945) demands immediate attention.
Cybercriminals are leveraging weaponized LNK files and PowerShell scripts to deliver NarwhalRAT, a remote access trojan capable of extensive system compromise. The attack chain begins with malicious shortcut files that trigger PowerShell commands, ultimately deploying a Python-based loader to establ
Progress Kemp LoadMaster application delivery controllers contain a critical vulnerability (CVE-2024-1212) now being actively exploited by threat actors. The flaw allows unauthenticated remote code execution with a CVSS score of 10.0, affecting multiple LoadMaster versions. Organizations running vul
Citrix released emergency patches for actively exploited NetScaler zero-day vulnerabilities after a weekend of unofficial warnings. The critical flaws allow remote code execution on internet-facing appliances. Immediate patching and compromise assessment required.