Popular VPN browser extension Hola was compromised through a supply chain attack that delivered cryptocurrency mining malware to Windows users. The malicious version of the software silently installed XMRig cryptominer on victim systems, hijacking CPU resources to mine Monero cryptocurrency. Users w
Elon Musk’s X Corp (formerly Twitter) has intensified efforts to terminate Federal Trade Commission privacy audits mandated by a 2011 consent decree. The company argues the audits are overly burdensome and politically motivated, while the FTC maintains they’re necessary to verify compliance with dat
Microsoft’s AI Red Team has identified seven previously undocumented failure modes in agentic AI systems after a year of intensive testing. These vulnerabilities—spanning prompt injection variants, tool manipulation, and autonomous decision-making flaws—represent systemic risks in AI agents that int
ISO 42001:2023, the world’s first AI management system standard, fundamentally changes how organizations must approach cloud-based AI data risk. This certification framework mandates comprehensive risk assessment, data governance, and accountability measures specifically designed for AI systems. Org
A sophisticated email compromise targeting a stock exchange executive’s Microsoft Outlook account remained undetected for five months, with attackers establishing persistent access to exfiltrate credentials and sensitive communications. The breach leveraged compromised credentials and stealthy inbox
A critical privilege escalation vulnerability (ZDI-26-328) has been discovered in ASUS Business Manager Service, allowing local attackers to elevate privileges to SYSTEM level through improper client-side authentication. The flaw affects enterprise deployments of ASUS management software and could e
DentaQuest, a major dental benefits administrator, disclosed a significant data breach affecting approximately 2.6 million individuals. The incident compromised sensitive personal and health information, including names, addresses, dates of birth, Social Security numbers, and dental treatment record
Brazilian food delivery giant iFood confirmed a data breach affecting approximately 1.2 million users, exposing personal information including names, phone numbers, email addresses, and partial payment data. The incident represents one of the largest data exposures in Brazil’s food delivery sector,
CISA has added a critical Remote Code Execution (RCE) vulnerability in the Magento Cache Warmer module to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2024-34102, this critical flaw allows unauthenticated attackers to execute arbitrary code on vulnerable e-commerce platforms. Fe
Cisco has released security patches for CVE-2026-20230, a critical SQL injection vulnerability in Unified Communications Manager (UCM) with a CVSS score of 9.8. The flaw allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially gain complete system control. With proof-