Earlier in Cybersecurity
Security researchers at the firm Calif have developed a sophisticated zero-click worm capable of compromising WeChat accounts on both iOS and Android devices. This worm exploits an incoming call vulnerability, meaning that a user does not need to answer…
A critical vulnerability chain discovered in FreeIPA, a Linux identity management system, allows anonymous clients to create reusable administrator credentials. Red Hat disclosed this flaw, which enables an unauthenticated client to establish its own Kerberos identity within the directory…
Adobe released critical security patches on Monday to address a maximum-severity vulnerability affecting Adobe Commerce and Magento Open Source, which has been actively exploited in the wild. The vulnerability, identified as CVE-2026-75650 with a CVSS score of 10.0, was discovered…
Cybersecurity researchers have detailed a significant search engine optimization (SEO) poisoning campaign, codenamed BengalSEO, which manipulates search engine results to distribute malware and facilitate tech support scams. The DFIR Report disclosed findings of this operation in March 2026, revealing…
Cybersecurity researchers have detailed a sophisticated post-exploitation toolkit named PEEP, designed to transform web browsers like Google Chrome and Microsoft Edge into persistent backdoors capable of executing host commands. This toolkit operates by masquerading as a seemingly innocuous bookmarks extension…
Attackers have developed a novel method to bypass email image blocking by embedding malicious QR codes constructed entirely from text characters. This technique allows the QR code to be displayed and scanned even when email clients are configured to block…
Cybersecurity researchers have detailed a worm-like campaign that exploits ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. Huntress, a cybersecurity firm, reported that three distinct incidents have been observed, each employing different initial…
Security firm TantoSec has released a public proof-of-concept exploit chain that leverages a critical vulnerability in Telerik UI for ASP.NET AJAX, transforming an AES-CBC padding oracle flaw into unauthenticated remote code execution (RCE).