Collaborate Disseminate
Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets.
“At 18:31 UTC on September 24, 2026, Bitget’s security systems identified unauthorized transfers involving a limit… Continue reading Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise
The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild.
The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the … Continue reading Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
A flaw in Cloudflare Containers let a paying customer read data that other customers’ containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday.
The data came from disk space that earlier containers ha… Continue reading Cloudflare Fixes Flaw That Let One Container Read Another Customer’s Leftover Disk Data
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitatio… Continue reading WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus’s own software to gain root access, the highest… Continue reading Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions
This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before.
That is the thread running through the pile. Trusted paths get poisoned…. Continue reading ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
The “third-party[.]com” domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users.
“third-party[.]com has been a generic documentation placehold… Continue reading Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content
An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic.
“When … Continue reading Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM.
According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distr… Continue reading Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls
AI coding agents are changing how quickly developers can build and ship software as well as how quickly credentials can become exposed. According to GitGuardian’s 2026 State of Secrets Sprawl Report, commits identified as AI-assisted are leaking secret… Continue reading Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignore