A critical vulnerability (CVE-2026-10702) in Firefox’s underlying engine has exposed Tor Browser users to session hijacking attacks through malicious web pages. The flaw allows attackers to bypass Tor’s anonymity protections and execute arbitrary code, potentially unmasking users and compromising th
Malicious actors have deployed typosquatted npm packages mimicking popular JavaScript libraries to steal sensitive developer credentials, including cloud provider tokens, CI/CD secrets, and environment variables. These packages contain obfuscated code that exfiltrates data to attacker-controlled ser
Cisco has confirmed active exploitation of CVE-2026-20230, a critical Server-Side Request Forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM). The flaw allows unauthenticated attackers to perform arbitrary HTTP requests through vulnerable systems, potentially leading to
Critical NGINX vulnerability CVE-2026-8711 lets remote attackers execute malicious code via heap overflow. Unauthenticated exploitation possible. Patch now.
A sophisticated campaign is targeting Signal messenger users by stealing their encrypted backup files and attempting to crack the passphrases offline. Attackers are using social engineering, malware distribution, and cloud storage compromise to access Signal backups stored on victims’ devices or clo
NSO Group has allegedly violated a court order by continuing to develop and deploy exploits targeting WhatsApp users, despite ongoing litigation and explicit judicial restrictions. The Israeli spyware vendor’s Pegasus software was reportedly used to compromise WhatsApp accounts through zero-click ex
CISA has added CVE-2026-45247, a critical remote code execution (RCE) vulnerability in Adobe Magento, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is being actively exploited in the wild, allowing attackers to execute arbitrary code on vulnerable e-commerce platforms. Federal agenc
The U.S. State Department has announced a combined $10 million reward for information leading to the identification or location of members from two Russian hacking groups—UNC5792 and UNC4221—who have been actively targeting users of encrypted messaging platforms including WhatsApp and Signal. These
Attackers are actively exploiting a remote code execution (RCE) vulnerability in Langflow, a popular low-code AI application development platform, to deploy XMRig cryptocurrency miners on exposed instances. The exploitation targets publicly accessible Langflow endpoints, leveraging insecure configur
Security researchers have discovered that malware can steal Google-synced passkeys from infected systems without requiring user passwords, biometric authentication, or any interaction. The attack exploits the way Google Chrome syncs passkey data, allowing attackers to extract and reuse credentials o