Blog

A new Ransom Busters scam sees ransomware affiliates posing as recovery specialists to hijack negotiations and extort victims a second time.

Researchers show self-propagating mind virus payloads can jump between autonomous AI agents through persistent prompt files, expanding risks for memory-enabled LLM systems.

A critical arbitrary file upload flaw in the Forminator Forms plugin, tracked as CVE-2026-15748, exposes over 600,000 WordPress sites to potential takeover.

Researchers warn Ruby developers after 16 typosquatted RubyGems packages were caught dropping StubMaker, a Windows info-stealer for browser and crypto data.

Heights Finance is notifying 700,000 people after hackers accessed a third-party cloud platform holding loan data, SSNs and bank details in May 2026.

Apple ships new macOS, iOS and iPadOS updates that patch dozens of WebKit vulnerabilities and a Telephony bug that could impact VPN security on Apple devices.

An AI-generated GitHub Actions bug in Snowflake’s .NET connector was autonomously exploited by Wiz’s AI agent and swiftly patched after internal Jira access.

New Mirai-derived Linux botnet Evooo1Bot hijacks routers and edge devices as encrypted SOCKS5 relays, adding exploit modules and credential theft beyond DDoS.

A new ShieldBreak zero-day in Microsoft Defender bypasses July’s RoguePlanet patch, enabling local attackers to gain SYSTEM privileges while no fix exists yet.

Security experts warn that misconfigured Model Context Protocol servers can leak secrets via configs, overbroad access and prompt injection, urging stricter controls[1][13].