Cyber Security
CVE Vulnerability Alerts
Metabase Zero-Day SQL Injection Exploited Against Framework, Tally
Metabase confirmed an exploited CVSS 10.0 zero-day SQL injection vulnerability that let attackers access customer data at Framework, Tally, and LexisNexis.
Cybersecurity
Attackers Reach Managed Endpoints as N-able Ships N-central Hotfix 2
Attackers who compromised N-able N-central reached managed endpoints and installed Cloudflare Tunnel persistence, prompting the vendor to release Hotfix 2.
CVE Vulnerability Alerts
CISA Adds Exploited Kemp LoadMaster Command Injection to KEV
CISA added exploited Progress Kemp LoadMaster command injection CVE-2026-8037 to its KEV catalog after 792 in-the-wild exploitation attempts were documented.
Application Security
Atlassian Rovo One-Click Flaw Exposes Jira, Confluence Data
Varonis and PromptArmor disclosed prompt-injection flaws in Atlassian Rovo that can exfiltrate Jira, Confluence, and SharePoint data from enterprise tenants.
Cybersecurity
CSS Attacks Break Webmail Boundaries to Capture Passwords, Tokens
PortSwigger researcher Gareth Heyes showed email-borne CSS attacks that capture passwords and steal tokens in Outlook, Gmail, Yahoo, and other webmail services.
Cybersecurity
Head Mare Breaches TrueConf Servers, Trojanizes Client Installers
Head Mare hacktivists exploited TrueConf servers and replaced client installers with backdoored versions carrying PhantomCore and PhantomGraph backdoors.
Application Security
Belgian Connective eID Flaws Let Websites Forge Signatures
Researcher James Arnott disclosed severe flaws in the Connective eID extension exposing PINs, enabling forged signatures, and allowing drive-by code execution.
Cybersecurity
Solidity Pro VS Code Extensions Steal Wallets, API Keys From Devs
Yeeth Security flagged malicious Solidity Pro VS Code extensions that steal crypto wallets, API keys, and developer credentials, exfiltrating them via Telegram.
Cybersecurity
OpenAI Pauses Astra Work After Evaluation Flags Cyber Capabilities
OpenAI paused internal work on its Astra model after an evaluation found cyber capabilities that may reach a Critical rating under its preparedness framework.
Cybersecurity
AitM Phishing Campaign Steals Microsoft 365 Finance Emails
Arctic Wolf documented an AitM phishing campaign hijacking Microsoft 365 accounts to collect payroll and finance emails across North America and Europe.
Application Security
Swiss Government SharePoint Breach Compromised 200 Accounts
BIT's SharePoint intrusion compromised credentials for about 200 Swiss federal accounts, likely via Microsoft flaws fixed in the July Patch Tuesday updates.
Cybersecurity
UNC6671 Extortion Group Rebrands After Targeting Hedge Funds
Google Threat Intelligence ties hedge fund vishing attacks to UNC6671 (BlackFile), an extortion group rebranding across Redact, Pink, Helix, and Falcon.
Cybersecurity
3.8 Million Impacted by Unlimited Technology Systems Breach
Unlimited Technology Systems disclosed an October 2025 data theft affecting 3.8 million people, exposing Social Security numbers, diagnoses, and ID scans.
Cybersecurity
4,407 Rockwell PLCs Exposed Online, 22 in Water Cities
A Forescout scan found 4,407 internet-exposed Rockwell PLCs, including 22 in water-industry attack target cities, heightening critical infrastructure risk.
CVE Vulnerability Alerts
Zapscape KVM Flaw Lets Privileged L1 Guest Escape to Host
Researcher Hyunwoo Kim documented Zapscape, CVE-2026-64561, a KVM/x86 shadow memory flaw allowing privileged L1 guest code to escape to the Linux host.
Cybersecurity
TONTOU Interrupt Injection Bypasses Spectre v2 Fixes on AMD Zen 2
MIT CSAIL's interrupt injection attack named TONTOU bypasses retpoline and Safe-RET defenses on AMD Zen 2 to leak Linux password hashes from userspace.
CVE Vulnerability Alerts
NatJack Attacks Hijack TCP Sessions and Spoof DNS via NAT
Researcher Malcolm Stagg's NatJack technique hijacks TCP sessions and spoofs DNS through NAT table manipulation, affecting Windows Hyper-V and Linux Netfilter.
Application Security
Claude Code and Gemini CLI Flaws Expose CI Workflow Secrets
Novee Security found flaws in Claude Code and Google Gemini CLI that let an attacker-controlled GitHub issue reach CI workflow secrets via an AI agent.
Application Security
AI-Assisted HTTP Terminator Finds Apache Traffic Server Zero-Day
PortSwigger's AI-assisted HTTP Terminator found roughly 30,000 HTTP desync vectors and a live Apache Traffic Server zero-day affecting roughly 700 targets.
Cybersecurity
TeamPCP Tied to Redis Attacks Dating Back to 2020
Oligo Security researchers tied the TeamPCP cluster to Redis attacks dating back to April 2020 and to its later evolution into the ShadowRay 2.0 campaign.
CVE Vulnerability Alerts
Metabase Zero-Day SQL Injection Exploited Against Framework, Tally
Application Security
Atlassian Rovo One-Click Flaw Exposes Jira, Confluence Data
CVE Vulnerability Alerts
Metabase Zero-Day SQL Injection Exploited Against Framework, Tally
TOP CYBERSECURITY HEADLINES
Application Security
Atlassian Rovo One-Click Flaw Exposes Jira, Confluence Data
Application Security
Belgian Connective eID Flaws Let Websites Forge Signatures
This Week’s Security Spotlight
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Atlassian Rovo One-Click Flaw Exposes Jira, Confluence Data
Varonis and PromptArmor disclosed prompt-injection flaws in Atlassian Rovo that can exfiltrate Jira, Confluence, and SharePoint data from enterprise tenants.
CSS Attacks Break Webmail Boundaries to Capture Passwords, Tokens
PortSwigger researcher Gareth Heyes showed email-borne CSS attacks that capture passwords and steal tokens in Outlook, Gmail, Yahoo, and other webmail services.
Head Mare Breaches TrueConf Servers, Trojanizes Client Installers
Head Mare hacktivists exploited TrueConf servers and replaced client installers with backdoored versions carrying PhantomCore and PhantomGraph backdoors.
Belgian Connective eID Flaws Let Websites Forge Signatures
Researcher James Arnott disclosed severe flaws in the Connective eID extension exposing PINs, enabling forged signatures, and allowing drive-by code execution.
Solidity Pro VS Code Extensions Steal Wallets, API Keys From Devs
Yeeth Security flagged malicious Solidity Pro VS Code extensions that steal crypto wallets, API keys, and developer credentials, exfiltrating them via Telegram.
OpenAI Pauses Astra Work After Evaluation Flags Cyber Capabilities
OpenAI paused internal work on its Astra model after an evaluation found cyber capabilities that may reach a Critical rating under its preparedness framework.
AitM Phishing Campaign Steals Microsoft 365 Finance Emails
Arctic Wolf documented an AitM phishing campaign hijacking Microsoft 365 accounts to collect payroll and finance emails across North America and Europe.
Swiss Government SharePoint Breach Compromised 200 Accounts
BIT's SharePoint intrusion compromised credentials for about 200 Swiss federal accounts, likely via Microsoft flaws fixed in the July Patch Tuesday updates.
UNC6671 Extortion Group Rebrands After Targeting Hedge Funds
Google Threat Intelligence ties hedge fund vishing attacks to UNC6671 (BlackFile), an extortion group rebranding across Redact, Pink, Helix, and Falcon.
3.8 Million Impacted by Unlimited Technology Systems Breach
Unlimited Technology Systems disclosed an October 2025 data theft affecting 3.8 million people, exposing Social Security numbers, diagnoses, and ID scans.
4,407 Rockwell PLCs Exposed Online, 22 in Water Cities
A Forescout scan found 4,407 internet-exposed Rockwell PLCs, including 22 in water-industry attack target cities, heightening critical infrastructure risk.
Zapscape KVM Flaw Lets Privileged L1 Guest Escape to Host
Researcher Hyunwoo Kim documented Zapscape, CVE-2026-64561, a KVM/x86 shadow memory flaw allowing privileged L1 guest code to escape to the Linux host.
TONTOU Interrupt Injection Bypasses Spectre v2 Fixes on AMD Zen 2
MIT CSAIL's interrupt injection attack named TONTOU bypasses retpoline and Safe-RET defenses on AMD Zen 2 to leak Linux password hashes from userspace.
NatJack Attacks Hijack TCP Sessions and Spoof DNS via NAT
Researcher Malcolm Stagg's NatJack technique hijacks TCP sessions and spoofs DNS through NAT table manipulation, affecting Windows Hyper-V and Linux Netfilter.
Claude Code and Gemini CLI Flaws Expose CI Workflow Secrets
Novee Security found flaws in Claude Code and Google Gemini CLI that let an attacker-controlled GitHub issue reach CI workflow secrets via an AI agent.
AI-Assisted HTTP Terminator Finds Apache Traffic Server Zero-Day
PortSwigger's AI-assisted HTTP Terminator found roughly 30,000 HTTP desync vectors and a live Apache Traffic Server zero-day affecting roughly 700 targets.
TeamPCP Tied to Redis Attacks Dating Back to 2020
Oligo Security researchers tied the TeamPCP cluster to Redis attacks dating back to April 2020 and to its later evolution into the ShadowRay 2.0 campaign.
CryptoJS Weak RNG Behind $5.7M in Five Wallet App Drains
Coinspect traced roughly $5.7 million in cryptocurrency theft to a 12-year-old weak random number generator in the CryptoJS library and five wallet apps.
iCloud Private Relay WebKit Bypasses Expose Users’ Real IPs
Researchers Haj Bakry and Mysk found WebKit proxy bypasses in iCloud Private Relay that can expose a user's real IP address to websites and observers.
ClickFix Campaign Pushes Go-Based macOS Crypto Drainer
Huntress discovered a Go-based macOS infostealer delivered through ClickFix attacks that steals crypto assets and redirects a percentage of each transaction.