Threats, breaches, defenders. Reported by people who can actually read the post-mortems.
GoDaddy security researchers have found malware on approximately 1,980 WordPress websites as part of a campaign that hides command-and-control data inside Steam Community profile comments using invisible Unicode characters.
Sara Montes de Oca · 56 DAYS AGO
Palo Alto Networks has raised the severity of CVE-2026-0257, a GlobalProtect VPN authentication bypass flaw, to High after Rapid7 observed active exploitation across multiple customers dating back to May 17. CISA has ordered federal agencies to apply mitigations by June 1, 2026.
Jay Goldberg · 56 DAYS AGO
A 19-year-old Linux kernel vulnerability called CIFSwitch allows unprivileged local attackers to forge CIFS authentication requests and gain root access, affecting Linux Mint, CentOS Stream 9, Rocky Linux 9, Kali Linux, and other major distributions.
Jay Goldberg · 58 DAYS AGO
Researchers at Push Security have uncovered a campaign dubbed "LLMShare" that abuses ChatGPT's content-sharing feature to display fake OpenAI outage pages hosted on chatgpt.com, redirecting users to download malware disguised as a desktop application.
Jay Goldberg · 59 DAYS AGO
Federal prosecutors charged Google engineer Michele Spagnuolo with money laundering, commodities fraud, and wire fraud, alleging he used internal search trend data to place Polymarket bets that earned him $1.2 million.
Sara Montes de Oca · 60 DAYS AGO
GCHQ Director Anne Keast-Butler will warn Wednesday that the West faces a "narrowing window" to counter escalating cyber and hybrid threats from China and Russia, calling for cybersecurity to become "ten times more urgent."
Jay Goldberg · 61 DAYS AGO
Two men have been arrested under the Take It Down Act after FBI agents identified them through basic web browsing, PayPal records, and, in one case, a profile photo the suspect apparently took himself.
Sara Montes de Oca · 61 DAYS AGO
CISA has ordered U.S. federal agencies to patch a critical SQL injection flaw in the Drupal CMS by midnight on May 27, after more than 15,000 exploit attempts were observed targeting nearly 6,000 sites across 65 countries.
Jay Goldberg · 62 DAYS AGO
A security firm found that deleted Google API keys remain exploitable for up to 23 minutes, allowing attackers to exfiltrate data from Gemini — a gap Aikido researcher Joseph Leon says is a matter of priorities, not engineering limits.
Jay Goldberg · 63 DAYS AGO
Security researchers say AI chatbot attacks have evolved from simple command injections into sophisticated psychological manipulation, with firms like Mindgard now profiling models the way interrogators profile suspects to probe their conversational vulnerabilities.
Sara Montes de Oca · 64 DAYS AGO
Researchers at AI red-teaming firm Mindgard say they "gaslit" Claude into producing prohibited content, underscoring a broader shift in which hackers are exploiting chatbot behavior through psychological manipulation rather than technical exploits.
Jay Goldberg · 64 DAYS AGO
Researchers at AI red-teaming firm Mindgard have demonstrated that chatbots can be manipulated through psychological pressure rather than traditional hacking techniques, signaling a new class of AI security threat that relies on conversation as its primary weapon.
Jay Goldberg · 64 DAYS AGO
Meta settled a landmark Kentucky school district lawsuit over alleged addictive platform design and faced a new Texas AG suit challenging WhatsApp's end-to-end encryption claims, capping a legally turbulent week for the company.
Sara Montes de Oca · 65 DAYS AGO
CISA has launched a public nomination form allowing security researchers, vendors, and industry partners to submit vulnerabilities for addition to the Known Exploited Vulnerabilities catalog, broadening a program central to federal and private-sector cybersecurity triage.
Sara Montes de Oca · 66 DAYS AGO
Google accidentally exposed details of an unpatched Chromium remote code execution flaw, Cisco patched a maximum-severity Secure Workload vulnerability, and researchers detailed a Chinese espionage campaign hitting telecom providers with new Linux and Windows malware.
Jay Goldberg · 67 DAYS AGO
Security researcher Justin O'Leary says Microsoft silently patched a privilege escalation flaw in Azure Backup for AKS after rejecting his disclosure report and blocking CVE issuance — a sequence Microsoft denies constitutes a security fix.
Jay Goldberg · 71 DAYS AGO
Russia-linked Secret Blizzard has transformed its long-running Kazuar backdoor into a modular, peer-to-peer botnet with 150 configuration options, designed to evade detection through decentralized internal communications and autonomous leader election.
Sara Montes de Oca · 72 DAYS AGO
Microsoft reversed its position on a password-in-memory vulnerability in the Edge browser and announced Cloud-Initiated Driver Recovery, a new Windows Update feature that lets the company remotely roll back faulty drivers without end-user action.
Sara Montes de Oca · 73 DAYS AGO
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.