Breaches, vulnerabilities and the people cleaning up after them. Reporting for defenders, not for panic.
The Russian state-sponsored group Star Blizzard has introduced RedFlick, a new malware delivery method that chains phishing, virtual disks and scheduled tasks to deploy its CosmicPulse backdoor with minimal victim interaction.
A pre-authentication integer underflow in MikroTik RouterOS web management could let attackers execute code with root privileges or trigger denial of service with a single request, CISA warned.
Cisco has released fixes for a critical authentication bypass flaw in Catalyst SD-WAN Manager that attackers are actively exploiting to gain administrative access. The vulnerability marks the fifth SD-WAN zero-day weaponized this year.
Microsoft will roll out Content Security Policy protections across Entra ID to block external scripts during authentication, completing the deployment by late October 2026.
The remote access vendor has released version 15.82 to address multiple vulnerabilities, including a critical access control bypass that could enable remote code execution across Windows, Linux and macOS platforms.
Investigators from SlowMist and Mandiant determined that attackers breached the cryptocurrency exchange by compromising security appliances through previously unknown vulnerabilities, then pivoted to steal hundreds of millions in digital assets.
Threat actors are abusing OpenAI's custom GPT feature to redirect victims through Google search ads to malicious sites that deploy remote access trojans using ClickFix social engineering tactics.
Federal authorities are publicly calling on members of the ShinyHunters extortion gang to turn themselves in after Dutch police detained a 24-year-old man identified as a group leader. The arrest follows the group's recent claim of breaching FBI systems.
