tomcat

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

PEEP uses Chrome and Edge as a post-compromise backdoor for credential theft and host command execution.

Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks

Check Point fixed a Security Management Server flaw exploited in targeted July attacks that can run scripts without login.

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors

Jade Sleet compromised an Indian IT services provider through a DevOps engineer’s MacBook, where FLATROOF and ROOFDECK were detected.

SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE

SolarWinds patched an ARM flaw caused by a hard-coded static key that could enable unauthenticated remote code execution.

Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

Docker Sandboxes flaws can expose host files or Unix sockets outside the workspace; both were fixed in 0.42.0, with no exploitation reported

Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

KREMLIN targets Brazilian bank users with malicious Chrome and Edge extensions that steal credentials, session tokens, cookies, and browser data.

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft details a million-email CEO fraud campaign and passkey-themed attacks that compromised cloud accounts and enabled data exfiltration.

Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

JeetBot's Twitch extension sent OAuth tokens from nearly 31,000 users to operator-controlled proxies; Firefox 85.8.7 stops the behavior.

Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers chained two JFrog Artifactory flaws on unupdated servers to gain admin control, while a third flaw was exploited separately.

Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks

Anthropic says China-based AI labs ran illicit Claude distillation campaigns using proxy networks, fake accounts, and harvested user exchanges.

Google Play Early Access Abused to Push Thousands of Deceptive Android Apps

Google Play Early Access is being abused to push thousands of deceptive apps, including fake casino and reward apps promoted via social media.

U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto

U.S. authorities disrupted Xinbi Guarantee and froze $52.8 million in crypto tied to the scam marketplace and its merchant network.

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

A WeChat worm demo took over iPhone and Android accounts through incoming calls from existing contacts; Calif says Tencent blocked the exploit.

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

JSCeal can steal browser credentials, replay Google sessions using stolen cookies, and modify traffic for cryptocurrency services.

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers

CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks

CrashStealer uses a notarized macOS dropper to pass Gatekeeper, then steals browser, wallet, password manager, file, and keychain data.

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

WordPress fixes CVE-2026-64638, a pre-auth login XSS affecting every version, with a demonstrated path to PHP execution under specific conditions.

Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption

Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

Russian spies exploited CVE-2025-66376 in Zimbra to steal 90 days of mail, passwords, 2FA codes, and directories from Western targets.

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

An exposed open directory on a Hong Kong server revealed an autonomous AI agent running unattended, an unreported Go implant, and target-specific tooling used against Thailand's Ministry of Finance.

Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs

CVE-2026-8933 combines two snap-confine races that could turn local Ubuntu access into root on default Desktop 24.04, 25.10, and 26.04 installs.

Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA

Authorities seize 200 Kratos servers and arrest its alleged developer and operator; investigators estimate 15,000 campaigns ran monthly.

Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign

Rapid7 pulls 1,048 files from an exposed server, linking an LLM-assisted phishing pipeline to a live WebDAV campaign targeting Mexico.

World's Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent

Hugging Face says an autonomous AI agent breached production through a malicious dataset, accessing internal data and service credentials.

New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

WordPress 6.9.5 and 7.0.2 patch wp2shell, a pre-auth core RCE that lets anonymous attackers run code on default installs, even with no plugins.

New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

WordPress 6.9.5 and 7.0.2 patch wp2shell, a pre-auth core RCE that lets anonymous attackers run code on default installs, even with no plugins.

Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack

Two TfL hackers get 5.5 years each for the £29 million 2024 attack, which disabled 148 systems, exposed customer data, and disrupted travel services.

TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development

TuxBot v3 Evolution contains raw LLM reasoning, 1,496 Telnet credentials, and exploits for over 30 IoT device families in a modular DDoS botnet.

Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack

Microsoft fixes a record 622 CVEs, including two exploited SharePoint and AD FS zero-days, while a Kerberos RC4 change could break service account log

Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions

DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts

DevMan's v3 RaaS portal centralizes payload builds, network access, victim tracking, team controls, deadlines, and an 80-20 affiliate split.

Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads