Collaborate Disseminate
Researchers at the security firm Calif have built a worm that takes over a WeChat account via an incoming call and demonstrated it spreading among three test phones.
The person being called does not have to answer or touch their phone for it… Continue reading WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls
In the last six months, Chainguard doubled its output from 500 million to more than 1 billion container build manifests. We also surpassed 3,000 unique container images and 675,000 image versions in our catalog. Those are the headline numbers, but I wa… Continue reading What It Took to Reach 1 Billion Build Manifests
A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group, Red Hat says.
FreeIPA is the system that determines who may log in across a Linux domain a… Continue reading FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials
Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild.
The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has… Continue reading Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
Cybersecurity researchers have disclosed details of a sprawling search engine optimization (SEO) poisoning campaign that paves the way for malware deployment and tech support scams.
The campaign, discovered by the DFIR Report in March 2026, has been c… Continue reading BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams
Online dating app Grindr has opted to pay £26 million ($35.1 million) to settle a lawsuit in the U.K. over allegations that it shared users’ personal information, including their HIV status, with third-parties.
Grindr, which is the largest LGBTQ+ dati… Continue reading Grindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing
Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser.
“Requiring prior administrative or code execution access, its installer i… Continue reading PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that’s targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle… Continue reading Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were … Continue reading ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
If managing security across multiple cloud providers wasn’t hard enough, each one fails in a different way. For the 2026 Cloud Security Index, Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud and foun… Continue reading Your Cloud Security Checklist Doesn’t Work the Way You Think It Does