NSO Group has allegedly violated a court order by continuing to develop and deploy exploits targeting WhatsApp users, despite ongoing litigation and explicit judicial restrictions. The Israeli spyware vendor’s Pegasus software was reportedly used to compromise WhatsApp accounts through zero-click ex
Ivanti has disclosed two critical vulnerabilities in Ivanti Sentry—CVE-2026-10520 and CVE-2026-10523—that enable unauthenticated attackers to achieve remote code execution (RCE). CVE-2026-10520 is an authentication bypass vulnerability with a CVSS score of 9.8, while CVE-2026-10523 is a command inje
Threat actors are leveraging a sophisticated multi-stage ClickFix social engineering technique to deploy MLTBackdoor malware on Windows systems. The attack chain begins with fake CAPTCHA prompts that trick users into executing malicious PowerShell commands, ultimately installing persistent backdoor
Tchap, the French government’s proprietary encrypted messaging application, suffered a significant security breach that exposed sensitive government communications. The platform, designed specifically for state officials and public servants, was compromised through authentication vulnerabilities tha
A critical vulnerability in ServiceNow’s platform has been actively exploited by threat actors to gain unauthorized access to customer instances. The flaw, affecting multiple ServiceNow versions, allows attackers to bypass authentication mechanisms and access sensitive corporate data. Organizations
A critical zero-day vulnerability in Microsoft Windows BitLocker has been discovered that allows attackers with physical or local access to bypass full-disk encryption protections. The flaw exploits weaknesses in the boot process and TPM (Trusted Platform Module) communication, enabling unauthorized
Ivanti has disclosed a maximum severity vulnerability (CVE-2025-22457) in its Sentry product that allows unauthenticated attackers to execute arbitrary code with root privileges. The flaw affects Sentry versions 10.0.2 and earlier, carrying a CVSS score of 10.0. Organizations using Ivanti Sentry mus
Six critical vulnerabilities collectively dubbed “Proto6” have been discovered in protobuf.js, a widely-used JavaScript implementation of Google’s Protocol Buffers. These flaws expose Node.js applications to remote code execution (RCE) and denial-of-service (DoS) attacks. The vulnerabilities stem fr
Anthropic has launched Claude Fable 5, a new AI model available for a limited time period. This specialized model introduces unique capabilities that present both opportunities and security considerations for organizations. Security teams must understand the model’s architecture, assess potential at
A critical zero-day vulnerability dubbed “RoguePlanet” in Microsoft Defender allows attackers with basic user access to escalate privileges to SYSTEM-level control on Windows machines. The flaw exploits Defender’s built-in scanning mechanisms through a time-of-check-time-of-use (TOCTOU) race conditi