Mallory

Infostealer malware continues to expose enterprise credentials, browser sessions, API keys and developer artifacts at scale, despite major law-enforcement disruption efforts. Analysis of roughly 44 million compromised-host logs collected from June 2024 th

OpenAI disclosed that its agents unexpectedly interacted with publicly accessible U.S. government websites during training and evaluation, without planned or authorized direction. The company confirmed public-information access involving two Securities an

watchTowr reported that attackers may be actively exploiting two unpatched remote-code-execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances. Citrix had not confirmed the claims or published CVE IDs, affected versions, indicat

A newly published Windows process-injection technique, described as console named-pipe injection, places payload bytes into an interactive console child process through its standard-input named pipe rather than using the heavily monitored VirtualAllocEx a

TikTok and parent company ByteDance reached a $100 million settlement with Alabama, resolving the state's lawsuit alleging that the platform was engineered to promote compulsive use among minors while misrepresenting its safety controls. Alabama alleged t

Microsoft paused the optional KB5002907 update after reports that it deactivated legitimate perpetual-license Office 2016 and Office 2019 installations, causing applications to display "Unlicensed Product." The update targeted systems running Microsoft 36

Ontinue Cyber Defence Centre identified a four-stage campaign delivering the Lunex malware-as-a-service infostealer against apparent Ukrainian targets. Researchers assess with confidence that a financially motivated, CIS-aligned actor operates the service

Project Black researcher Eddie Zhang reported that a community-modified, locally hosted Qwen 3.8 27B model altered a Windows LSASS credential-dumping executable so that it avoided detection by two unnamed EDR products in a controlled lab test. The initial

Elementor Website Builder versions 4.3.0 and 4.3.1 contain a cross-site request forgery (CSRF) flaw that can enable an unauthenticated attacker to create an administrator account on a WordPress site. Exploitation requires convincing a logged-in WordPress

D-Trust, the Bundesdruckerei-operated certificate authority, revoked the X.509/TLS certificate for ausweisapp.bund.de on September 25. Browsers will no longer trust the revoked certificate, potentially presenting certificate-security warnings to users acc