Explore

Trendline Trendline
SAP Patches Critical Vulnerabilities in NetWeaver and Commerce Platforms

SAP Patches Critical Vulnerabilities in NetWeaver and Commerce Platforms

SAP Patches Critical Vulnerabilities in NetWeaver and Commerce Platforms
Trendline Trendline
Adobe Addresses 123 Security Vulnerabilities Across Multiple Products

Adobe Addresses 123 Security Vulnerabilities Across Multiple Products

Adobe Addresses 123 Security Vulnerabilities Across Multiple Products
Trendline Trendline
Check Point Warns of Critical VPN Vulnerability Exploited by Ransomware Group

Check Point Warns of Critical VPN Vulnerability Exploited by Ransomware Group

Check Point Warns of Critical VPN Vulnerability Exploited by Ransomware Group
Rapid Read Rapid Read
WhatsApp Identifies NSO Group-Linked Spearphishing Attempts, Calls for Legal Action

WhatsApp Identifies NSO Group-Linked Spearphishing Attempts, Calls for Legal Action

WhatsApp has discovered spearphishing attempts linked to the Israeli spyware firm NSO Group, prompting the messaging platform to request a U.S. court to hold the firm in contempt. The attempts involved social engineering tactics to trick users into clicking malicious links, similar to previous campaigns associated with NSO. WhatsApp has disrupted these attempts and taken down test accounts and groups created by the firm. This development follows a previous court ruling ordering NSO to pay damages for hacking into WhatsApp users' devices, a case that highlighted the use of NSO's Pegasus spyware by repressive regimes.
Rapid Read Rapid Read
Critical phpBB Flaw Allows Account Hijacking with Single Request, Affecting All Users

Critical phpBB Flaw Allows Account Hijacking with Single Request, Affecting All Users

A significant security vulnerability has been identified in the phpBB forum software, allowing attackers to hijack any account, including those of administrators, with a single unauthenticated request. This flaw, tracked as PTT-2026-004, has been rated 9.4 on the CVSS scale and affects all phpBB versions up to 3.3.16, as well as the 4.0.0 alpha version. The vulnerability was discovered by Dan Stefan Alexandru from Pentest-Tools.com and reported to phpBB on June 4. The flaw exploits the default database-authentication mode, making a standard installation vulnerable. An attacker only needs a target's username, which can be easily obtained from the public member list, to execute the attack. Successful exploitation grants the attacker a valid session as the chosen account, allowing access to private messages and any content visible to the victim. However, access to the Administration Control Panel remains restricted, as it requires the admin's password.
Rapid Read Rapid Read
Presidential Pardon Data Exposed to Cyber Threats, Audit Reveals

Presidential Pardon Data Exposed to Cyber Threats, Audit Reveals

A report by the State Comptroller has revealed significant cybersecurity deficiencies at the President's Residence, which holds sensitive data on nearly 100,000 pardon applicants. The audit found issues in cyber management, database governance, and supplier oversight, with systems not meeting legal information-security requirements. The lack of an information-security officer, inadequate database management, and unencrypted email transfers of sensitive information were highlighted as major concerns. These vulnerabilities pose risks to privacy, the institution's reputation, and the public image of the President's Residence, especially during wartime when cyber threats are heightened.
Rapid Read Rapid Read
North Korean Hackers Exploit Fake Coding Tasks to Steal Cryptocurrency

North Korean Hackers Exploit Fake Coding Tasks to Steal Cryptocurrency

A North Korean threat actor, tracked as UNK_DeadDrop by Proofpoint, has been targeting software developers with fake job and code-review lures to steal cryptocurrency and credentials. The campaign involved sending over 250 phishing emails in April and May 2026, primarily targeting U.S.-based individuals in technology, education, and finance sectors, with a focus on cryptocurrency firms. The emails linked to repositories disguised as coding assignments, which contained malicious scripts. These scripts installed malware that scanned for browser data and cryptocurrency wallets, aiming to drain them. The operation is reminiscent of previous North Korean campaigns but is tracked separately due to its unique characteristics.
Rapid Read Rapid Read
North Korean Hackers Exploit Fake Coding Tasks to Target U.S. Cryptocurrency Firms

North Korean Hackers Exploit Fake Coding Tasks to Target U.S. Cryptocurrency Firms

A recent analysis by Proofpoint has uncovered a campaign by a likely North Korean threat actor targeting U.S.-based software developers with fake job and code-review lures. The campaign, tracked as UNK_DeadDrop, involved sending over 250 emails in April and May 2026 to individuals in technology, education, and finance sectors, particularly those associated with cryptocurrency firms. The emails contained links to GitHub or GitLab repositories disguised as coding assignments. Upon opening these repositories in editors like VS Code or Cursor, a hidden tasks.json file would execute, installing a malicious VS Code extension. This extension, posing as a Google service, relaunches malware whenever the editor reopens on macOS or Linux. The malware's primary goal is to drain cryptocurrency and credentials by scanning for browser data and cryptocurrency wallets. The campaign is noted for its industrial scale of repository creation and a self-contained payload that survives infrastructure takedowns.
Trendline Trendline
WatchGuard Acquires Perimeters.io to Enhance Cloud Security Services

WatchGuard Acquires Perimeters.io to Enhance Cloud Security Services

WatchGuard Acquires Perimeters.io to Enhance Cloud Security Services
Trendline Trendline
Adobe Releases Security Updates to Patch 123 Vulnerabilities Across Multiple Products

Adobe Releases Security Updates to Patch 123 Vulnerabilities Across Multiple Products

Adobe Releases Security Updates to Patch 123 Vulnerabilities Across Multiple Products
Trendline Trendline
Minimus Launches Supply Chain Protection and Minicli to Enhance Open-Source Security

Minimus Launches Supply Chain Protection and Minicli to Enhance Open-Source Security

Minimus Launches Supply Chain Protection and Minicli to Enhance Open-Source Security
Rapid Read Rapid Read
Silent Ransom Group Targets U.S. Law Firms with Aggressive Extortion Tactics

Silent Ransom Group Targets U.S. Law Firms with Aggressive Extortion Tactics

The Silent Ransom Group, a cyber extortion gang, is actively targeting U.S. law firms and professional services organizations through sophisticated social engineering attacks. According to a report by cybersecurity firm Mandiant, the group, also known as UNC3753, Luna Moth, and Chatty Spider, has been conducting these attacks since January 2026. The attackers use invoice-themed phishing emails to initiate contact, followed by phone calls impersonating IT staff to gain remote access. Once inside, they exfiltrate sensitive legal and financial documents, demanding ransoms within 30 minutes of leaving the victim's network. The group is known for its aggressive tactics, including threatening to contact clients directly if demands are not met.