Cyber Security
Application Security
N-able Takes N-central Offline After Researcher Posts 33 Flaws
N-able pulled its hosted N-central platform offline worldwide after researcher Sean Bales published 33 alleged flaws and working exploit scripts on GitHub.
Application Security
Google Patches Chrome Zero-Day CVE-2026-125350 Under Attack
Google released Chrome 157 to fix CVE-2026-125350, an XML use-after-free it says is exploited in the wild, plus eight other flaws including a V8 type ...
Application Security
Backdoored Ethersphere bee-js and Swarm Desktop Steal Wallets
Malicious bee-js 13.3.0 and Swarm Desktop 0.56.2 releases stole Ethereum keystores and installed remote access tools, researchers at Socket and SafeDep report.
Cybersecurity
Vanderbilt Hit by BYOD Ransomware Gang Claiming 1M SSNs
Vanderbilt University confirmed an active cybersecurity incident as the BYOD ransomware group listed it on its leak site, claiming over one million SSNs.
Application Security
Web3Auth Flaw Exploited to Drain Keplr Social-Login Wallets
A Web3Auth infrastructure flaw let attackers drain Keplr wallets created with Google or Apple login; estimates put confirmed losses between $1M and $6M.
Application Security
LNbits Tells All Operators to Shut Down Amid Wallet Attacks
LNbits urged every operator to shut down servers after attackers exploited a paywall extension flaw to drain Lightning funds; BitTipBot lost 2.28M sats.
Application Security
Roundcube 1.6.21 and 1.7.6 Patch 17 Webmail Security Flaws
Roundcube released versions 1.6.21 and 1.7.6 on Monday to fix 17 webmail vulnerabilities, including injection bugs, SSRF filter bypasses and CSRF gaps.
Cybersecurity
Meloni Blames Pro-Russian Hackers for Tajani Data Leak
Italian Premier Giorgia Meloni blamed pro-Russian hackers after personal data on Foreign Minister Antonio Tajani appeared on the dark web, with payment offered.
Cybersecurity
DOJ Indicts Three Over AI Deepfake CEO Scams Costing $129M
The DOJ and FBI indicted Jacob Soall, Sharon Hazan and Guy Sheetrit for using AI to impersonate executives and attorneys in $129 million wire scams.
Application Security
Attackers Exploit SSHole OpenSSH Flaw CVE-2026-123158 on Alpine
GreyNoise and Previdian report active exploitation of the SSHole OpenSSH flaw CVE-2026-123158 on musl-based Linux, including a Python C2 tool called TAC Agent.
Cybersecurity
SEGA Newsletter Breach at Vendor ARARA Exposes 2.2M Emails
SEGA disclosed that a breach at newsletter vendor ARARA exposed 2.2 million email addresses across 11 newsletters; SEGA Account systems were not affected.
Cybersecurity
Binance Denies Breach After ShinyHunters Claim of 335M Users
Binance says it found no evidence of compromise after a forum actor using the ShinyHunters name claimed data on 335 million users and demanded $900,000.
Cybersecurity
France Blames Iran’s IRGC Shahid Kaveh for Supermarket Attacks
France formally attributed the supermarket refrigeration attacks to Iran's IRGC Shahid Kaveh unit and will summon Iran's ambassador and propose EU sanctions.
Application Security
WP Duplicate Plugin Flaw CVE-2026-123751 Exploited With No Patch
WPScan reports attackers are exploiting CVE-2026-123751 in the WP Duplicate WordPress plugin, an unauthenticated upload flaw leading to remote code execution.
CVE Vulnerability Alerts
SonicWall Patches Exploited SonicOS SAML MFA Bypass, CVE-2026-19868
SonicWall patched CVE-2026-19868, a SonicOS SSL VPN flaw that bypasses SAML MFA, and CISA added it to its KEV catalog after a report of possible ...
Application Security
UnrealIRCd Warns CVE-2026-114713 Is Under Attack, Worst in 15 Years
The UnrealIRCd team says attackers are exploiting CVE-2026-114713, a labeled-response flaw it calls the most critical issue in 15 years, on linked IRC networks.
Application Security
JPCERT/CC Warns Openwave Webtop Flaw CVE-2026-111793 Is Exploited
JPCERT/CC says attackers are exploiting CVE-2026-111793 in Openwave Webtop Media Transcoder, a flaw patched in December 2021 that exposes sensitive data.
Application Security
Public PoC Released for Hugging Face Datasets RCE CVE-2026-57845
A researcher published a working exploit for CVE-2026-57845, a CVSS 8.8 pickle deserialization flaw in Hugging Face datasets up to 5.1.0 with no fix available.
Application Security
uutils Coreutils Flaw (CVSS 9.9) Let Translation File Inject Code
A CVSS 9.9 flaw in the uucore crate of uutils coreutils let a crafted translation file inject Rust code at build time. A PoC is ...
CVE Vulnerability Alerts
Working Exploit Out for Windows Error Reporting Flaw CVE-2026-97798
A researcher released a working exploit for CVE-2026-97798, a Windows Error Reporting flaw that gives SYSTEM from a standard account, patched in October.
Application Security
N-able Takes N-central Offline After Researcher Posts 33 Flaws
Cybersecurity
Vanderbilt Hit by BYOD Ransomware Gang Claiming 1M SSNs
TOP CYBERSECURITY HEADLINES
Cybersecurity
Vanderbilt Hit by BYOD Ransomware Gang Claiming 1M SSNs
Application Security
Web3Auth Flaw Exploited to Drain Keplr Social-Login Wallets
Application Security
LNbits Tells All Operators to Shut Down Amid Wallet Attacks
Application Security
Roundcube 1.6.21 and 1.7.6 Patch 17 Webmail Security Flaws
This Week’s Security Spotlight
CVE Vulnerability Alerts
Working Exploit Out for Windows Error Reporting Flaw CVE-2026-97798
CVE Vulnerability Alerts
Citrix Fixes CVSS 9.8 XenServer Flaw and Brotli Bug in Scout
CVE Vulnerability Alerts
ASUS Patches AiCloud Root Flaw CVE-2026-84730 in Four Alerts
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Vanderbilt Hit by BYOD Ransomware Gang Claiming 1M SSNs
Vanderbilt University confirmed an active cybersecurity incident as the BYOD ransomware group listed it on its leak site, claiming over one million SSNs.
Web3Auth Flaw Exploited to Drain Keplr Social-Login Wallets
A Web3Auth infrastructure flaw let attackers drain Keplr wallets created with Google or Apple login; estimates put confirmed losses between $1M and $6M.
LNbits Tells All Operators to Shut Down Amid Wallet Attacks
LNbits urged every operator to shut down servers after attackers exploited a paywall extension flaw to drain Lightning funds; BitTipBot lost 2.28M sats.
Roundcube 1.6.21 and 1.7.6 Patch 17 Webmail Security Flaws
Roundcube released versions 1.6.21 and 1.7.6 on Monday to fix 17 webmail vulnerabilities, including injection bugs, SSRF filter bypasses and CSRF gaps.
Meloni Blames Pro-Russian Hackers for Tajani Data Leak
Italian Premier Giorgia Meloni blamed pro-Russian hackers after personal data on Foreign Minister Antonio Tajani appeared on the dark web, with payment offered.
DOJ Indicts Three Over AI Deepfake CEO Scams Costing $129M
The DOJ and FBI indicted Jacob Soall, Sharon Hazan and Guy Sheetrit for using AI to impersonate executives and attorneys in $129 million wire scams.
Attackers Exploit SSHole OpenSSH Flaw CVE-2026-123158 on Alpine
GreyNoise and Previdian report active exploitation of the SSHole OpenSSH flaw CVE-2026-123158 on musl-based Linux, including a Python C2 tool called TAC Agent.
SEGA Newsletter Breach at Vendor ARARA Exposes 2.2M Emails
SEGA disclosed that a breach at newsletter vendor ARARA exposed 2.2 million email addresses across 11 newsletters; SEGA Account systems were not affected.
Binance Denies Breach After ShinyHunters Claim of 335M Users
Binance says it found no evidence of compromise after a forum actor using the ShinyHunters name claimed data on 335 million users and demanded $900,000.
France Blames Iran’s IRGC Shahid Kaveh for Supermarket Attacks
France formally attributed the supermarket refrigeration attacks to Iran's IRGC Shahid Kaveh unit and will summon Iran's ambassador and propose EU sanctions.
WP Duplicate Plugin Flaw CVE-2026-123751 Exploited With No Patch
WPScan reports attackers are exploiting CVE-2026-123751 in the WP Duplicate WordPress plugin, an unauthenticated upload flaw leading to remote code execution.
SonicWall Patches Exploited SonicOS SAML MFA Bypass, CVE-2026-19868
SonicWall patched CVE-2026-19868, a SonicOS SSL VPN flaw that bypasses SAML MFA, and CISA added it to its KEV catalog after a report of possible ...
UnrealIRCd Warns CVE-2026-114713 Is Under Attack, Worst in 15 Years
The UnrealIRCd team says attackers are exploiting CVE-2026-114713, a labeled-response flaw it calls the most critical issue in 15 years, on linked IRC networks.
JPCERT/CC Warns Openwave Webtop Flaw CVE-2026-111793 Is Exploited
JPCERT/CC says attackers are exploiting CVE-2026-111793 in Openwave Webtop Media Transcoder, a flaw patched in December 2021 that exposes sensitive data.
Public PoC Released for Hugging Face Datasets RCE CVE-2026-57845
A researcher published a working exploit for CVE-2026-57845, a CVSS 8.8 pickle deserialization flaw in Hugging Face datasets up to 5.1.0 with no fix available.
uutils Coreutils Flaw (CVSS 9.9) Let Translation File Inject Code
A CVSS 9.9 flaw in the uucore crate of uutils coreutils let a crafted translation file inject Rust code at build time. A PoC is ...
Working Exploit Out for Windows Error Reporting Flaw CVE-2026-97798
A researcher released a working exploit for CVE-2026-97798, a Windows Error Reporting flaw that gives SYSTEM from a standard account, patched in October.
ModSecurity Flaws Detailed: WAF Upload Bypass CVE-2026-104269
Advisories detail ModSecurity flaw CVE-2026-104269, a WAF upload-rule bypass with a public PoC, and CVE-2026-73857, an XML crash bug. Both fixed in 3.0.17.
IBM Discloses 208 API Connect Flaws, 47 Rated Critical
IBM disclosed 208 vulnerabilities in API Connect, 47 critical and scored up to CVSS 9.9, plus a 9.8 flaw in Aspera Faspex. No exploitation has ...
Brenner Base Tunnel SE Confirms Data Access as Everest Claims 812 GB
Brenner Base Tunnel SE confirmed unauthorized access to some data after the Everest extortion group claimed 812 GB. The company says operations are unaffected.