Google published PoC exploit code for an unpatched 42-month Chromium Service Worker flaw enabling persistent JavaScript execution after the browser
Texas AG Ken Paxton sued Meta and WhatsApp in May 2026, alleging the companies falsely claimed end-to-end encryption while retaining
SHADOW-WATER-063 deploys Banana RAT via fraudulent Brazilian NF-e invoice lures, hijacking Pix QR codes to redirect instant payments to attacker-held
Seqrite Labs exposed UNG0002 hiding Cobalt Strike inside macOS-style nested folder structures to evade Windows scanners while targeting Changzhou University.
CRIL documented INJ3CTOR3 deploying new JOMANGY webshell alongside a six-layer self-healing persistence mechanism against FreePBX VoIP systems for toll fraud.
Operation Dragon Whistle abuses Visual Studio Code Remote Tunnels as a C2 channel, targeting Pakistani surveillance infrastructure and a Chinese
CVE-2026-20223 lets unauthenticated remote attackers gain full Site Admin access to Cisco Secure Workload; no credentials or user interaction are
Researcher Vega publicly disclosed nginx-poolslip, an unpatched RCE zero-day in NGINX 1.31.0 that bypasses ASLR and threatens tens of millions
Sophos CTU analysis reveals WantToCry ransomware encrypts files off-device via brute-forced SMB sessions, leaving no local binary for EDR tools
Two U.S. telecom executives pleaded guilty to concealing a six-year tech-support fraud scheme that cost Americans an estimated $2.1 billion
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.