Collaborate Disseminate
In December 2024, the popular Ultralytics AI library was compromised, installing malicious code that hijacked system resources for cryptocurrency mining. In August 2025, malicious Nx packages leaked 2,349 GitHub, cloud, and AI credentials. Throughout 2… Continue reading Traditional Security Frameworks Leave Organizations Exposed to AI-Specific Attack Vectors
A high-severity security flaw has been disclosed in MongoDB that could allow unauthenticated users to read uninitialized heap memory.
The vulnerability, tracked as CVE-2025-14847 (CVSS score: 8.7), has been described as a case of improper handling of l… Continue reading New MongoDB Flaw Lets Unauthenticated Attackers Read Uninitialized Memory
Trust Wallet is urging users to update its Google Chrome extension to the latest version following what it described as a “security incident” that led to the loss of approximately $7 million.
The issue, the multi‑chain, non‑custodial cryptocurrency wal… Continue reading Trust Wallet Chrome Extension Breach Caused $7 Million Crypto Loss via Malicious Code
A China-linked advanced persistent threat (APT) group has been attributed to a highly-targeted cyber espionage campaign in which the adversary poisoned Domain Name System (DNS) requests to deliver its signature MgBot backdoor in attacks targeting victi… Continue reading China-Linked Evasive Panda Ran DNS Poisoning Campaign to Deliver MgBot Malware
A critical security flaw has been disclosed in LangChain Core that could be exploited by an attacker to steal sensitive secrets and even influence large language model (LLM) responses through prompt injection.
LangChain Core (i.e., langchain-core) is a… Continue reading Critical LangChain Core Vulnerability Exposes Secrets via Serialization Injection
It’s getting harder to tell where normal tech ends and malicious intent begins. Attackers are no longer just breaking in — they’re blending in, hijacking everyday tools, trusted apps, and even AI assistants. What used to feel like clear-cut “hacker sto… Continue reading ThreatsDay Bulletin: Stealth Loaders, AI Chatbot Flaws AI Exploits, Docker Hack, and 15 More Stories
The encrypted vault backups stolen from the 2022 LastPass data breach have enabled bad actors to take advantage of weak master passwords to crack them open and drain cryptocurrency assets as recently as late 2025, according to new findings from TRM Lab… Continue reading LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds
Fortinet on Wednesday said it observed “recent abuse” of a five-year-old security flaw in FortiOS SSL VPN in the wild under certain configurations.
The vulnerability in question is CVE-2020-12812 (CVSS score: 5.2), an improper authentication vulnerabil… Continue reading Fortinet Warns of Active Exploitation of FortiOS SSL VPN 2FA Bypass Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a security flaw impacting Digiever DS-2105 Pro network video recorders (NVRs) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulne… Continue reading CISA Flags Actively Exploited Digiever NVR Vulnerability Allowing Remote Code Execution
Cybersecurity researchers have discovered a new variant of a macOS information stealer called MacSync that’s delivered by means of a digitally signed, notarized Swift application masquerading as a messaging app installer to bypass Apple’s Gatekeeper ch… Continue reading New MacSync macOS Stealer Uses Signed App to Bypass Apple Gatekeeper