Collaborate Disseminate
Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution.
The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 o… Continue reading Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate o… Continue reading Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second
OpenAI on Tuesday revealed that it paused reinforcement learning (RL) training for its latest artificial intelligence (AI) models for two weeks while it shored up additional defenses and increased the scope of its monitoring to avert another Hugging Fa… Continue reading OpenAI Pauses Frontier RL Training as It Tightens Defenses Against Unsafe AI Behavior
A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia.
The intrusion set makes use of seven remote access tool (RAT) families, five of which have never been previously docum… Continue reading SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs
Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) re… Continue reading Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Most email defenses still do the job they did a decade ago. Scan the message, look for something malicious, block it. That worked when the danger sat in the payload, a bad link or an attachment. It stopped working when the danger moved into the message… Continue reading Phishing 3.0: The Fight Moves to Agent Versus Agent
Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created … Continue reading StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, stating they are being exploited in the wild.
The shortcomings added to the KEV catal… Continue reading Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint and network behaviors across changing infrastructure, tracing the malware from payload retriev… Continue reading Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure
A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management (PLM) software, according to new findings f… Continue reading Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data