A single XSS vulnerability can silently register an attacker-controlled passkey on a victim’s account, creating a persistent authentication backdoor with zero user interaction. The widespread deployment of passkeys without attestation requirements makes this a critical and largely overlooked threat.
Cisco disclosed three critical NX-OS vulnerabilities affecting Nexus 3000 and 9000 switches. All three flaws score CVSS 9.8 and enable unauthenticated remote attackers to execute code with root privileges through the NGOAM feature. Patches available now.
Cisco SD-WAN infrastructure is being actively exploited through a newly discovered zero-day vulnerability with no patch currently available. Threat actors are targeting management interfaces to gain unauthorized access to enterprise networks. Organizations running Cisco SD-WAN must implement immedia
OpenAI has granted UK financial institutions early access to its GPT-5.5 model, positioning itself as the primary AI provider for Britain’s banking sector. This development comes as Anthropic excludes UK banks from its Glasswing enterprise expansion program, creating a competitive divide in enterpri
Federal law enforcement agencies have seized two cryptocurrency mixing services, AudiA6 and Dark2Web, as part of a massive $389 million money laundering investigation. The operation, coordinated across multiple jurisdictions, targeted platforms that facilitated the laundering of illicit proceeds fro
A sophisticated Android ad fraud operation called “Trapdoor” has been discovered operating through 455 malicious apps on Google Play Store, generating fake ad clicks to defraud advertisers. The campaign remained undetected for months, affecting millions of users who unknowingly participated in large
The FBI has successfully dismantled a sophisticated AI-powered phishing-as-a-service operation that leveraged over one million malicious URLs to target victims globally. This groundbreaking takedown marks one of the first major law enforcement actions against cybercriminal infrastructure enhanced by
Anthropic has launched Claude Fable 5, a new AI model available for a limited time period. This specialized model introduces unique capabilities that present both opportunities and security considerations for organizations. Security teams must understand the model’s architecture, assess potential at
CISA has added CVE-2024-48558, a critical path traversal vulnerability in SimpleHelp remote desktop software, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw allows unauthenticated attackers to achieve remote code execution on affected servers. With active exploitation confirmed in th
A critical zero-day vulnerability in Microsoft’s BitLocker encryption has been discovered by the Chaotic Eclipse research team, enabling complete bypass of the disk encryption mechanism in just four hours of focused research. The exploit targets a fundamental weakness in BitLocker’s authentication p