20+ hour, 36+ min ago   (444+ words) Infostealer malware has become the connective tissue of modern cybercrime, quietly harvesting credentials and session data that ransomware crews later use to walk straight into corporate networks. Documented by Darkowl, ransomware operators no longer need to breach firewalls when infostealer…...

21+ hour, 27+ min ago   (182+ words) A multi-stage phishing campaign that impersonates trusted business communications, including a global logistics provider and a government tax authority, to deploy Phantom Stealer v3.5.0, a credential-harvesting malware that exfiltrates data via SMTP. Documented by Seqrite, the campaign uses two distinct phishing…...

1+ day, 13+ hour ago   (542+ words) Cl0p ransomware affiliates are actively exploiting a critical zero-day in PTC Windchill and FlexPLM (CVE-2026-12569) to gain unauthenticated remote code execution, drop JSP webshells, and exfiltrate sensitive engineering data for double‑extortion. Tracking a coordinated campaign in which Cl0p (aka Graceful Spider,…...

1+ day, 16+ hour ago   (314+ words) TAG-195, also known as Golden Chickens or Venom Spider, is a financially motivated MaaS developer long linked to credential theft and remote access tooling for multiple criminal operators. Insikt Group recently identified four new malware families in this ecosystem, naming…...

1+ day, 15+ hour ago   (370+ words) A newly disclosed eight high-severity vulnerabilities in NodeBB, a popular Node.js-based forum platform, all discovered during a six-hour AI-driven whitebox penetration test. The flaws affected default NodeBB instances prior to version 4.14.0 and included cross-site scripting (XSS), authentication bypasses, and…...

2+ day, 15+ hour ago   (419+ words) An exposed directory on an operator-controlled Alibaba Cloud server revealed the inner workings of the JadeProx intrusion set, including bash history, webshell paths, phishing kits, and a full post-exploitation toolkit. From this single staging host, investigators traced concurrent operations targeting…...

2+ day, 16+ hour ago   (390+ words) A critical Bluetooth vulnerability in the dealer-installed KARR Security System exposes more than 2.2 million vehicles across the United States to remote unlocking, immobilization, and horn/light manipulation attacks by anyone within Bluetooth range. San Diego disclosed the flaw after finding…...

2+ day, 15+ hour ago   (373+ words) Chick-fil-A has notified customers of a data security incident in which unauthorized parties gained access to Chick-fil-A One loyalty accounts through a credential stuffing attack, exposing personal information and stored account credit for affected users. Chick-fil-A identified suspicious login activity…...

2+ day, 15+ hour ago   (380+ words) GitHub Actions abuse is powering a large-scale attack campaign that exploits the cPanel CVE-2026-41940 authentication bypass to steal server credentials and other sensitive secrets from internet-facing hosting environments. The operation turns compromised GitHub repositories and their Actions runners into distributed…...

2+ day, 16+ hour ago   (337+ words) A newly disclosed local privilege escalation vulnerability in Ubuntu’s snap-confine component allows any unprivileged local user to obtain full root access on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. Tracked as CVE-2026-8933, the flaw was discovered by the Qualys Threat Research…...