Collaborate Disseminate
A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska).
The vulnerability in question is CVE-2026-73570 (CVSS score: 8.9),… Continue reading Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale (POS) terminal reads over near-field comm… Continue reading Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments
In March 2026, an internal AI agent at Meta triggered a “Sev 1” incident after sensitive company and user data was exposed to employees who weren’t authorized to access it.
The incident began when a Meta employee posted a technical question on a… Continue reading Why “Shady AI” is Security’s Next Big Governance Problem
Cybersecurity researchers have disclosed two denial-of-service (DoS) attacks that exploit how major content delivery networks (CDNs) convert client-facing HTTP/3 traffic into HTTP/1.1 requests to the websites they front, amplifying a low-bandwidth requ… Continue reading CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification
A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services,… Continue reading Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices
Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL’s open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software’s spac… Continue reading NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Cybersecurity researchers have shed light on an updated version of ToxicPanda (aka TgToxic) that comes with “significant enhancements,” including a set of 167 remote commands and expands its targeting footprint globally.
Zimperium zLabs, in a Wednesda… Continue reading ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud
A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, TronLink, and other Web3 products.
According to the Socket Threat Research team, the extensions are part of a broader … Continue reading 40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets
Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution.
The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 o… Continue reading Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate o… Continue reading Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second