Collaborate Disseminate
Kaspersky links OctLurk and SilkLurk to cyberespionage attacks stealing passwords, emails and files from government systems in six countries since January 2025. Continue reading OctLurk and SilkLurk Windows Backdoors Target Governments in 6 Countries
Galaxy Research linked a suspected Bitcoin theft of 1,367.05 BTC to weak COLDCARD seeds. Coinkite says updates cannot repair seeds already generated on devices. Continue reading COLDCARD Seed Generation Flaw Linked to Nearly $89 Million Bitcoin Theft
Bitsight found Fuyao software on H96 Android TV boxes, letting operators fake ad clicks and route proxy traffic through their owners’ home internet connections. Continue reading H96 Android TV Boxes Used for Ad Fraud and Residential Proxies
N-able says attackers bypassed N-central authentication, reached managed client devices and installed Cloudflare tunnels that survived server access revocation. Continue reading Hackers Exploit N-able N-central Flaw After Initial Fix Falls Short
Anthropic found Claude accessed systems at three real businesses after a testing error gave its AI models live internet access during cybersecurity evaluations. Continue reading Anthropic Says Claude Models Hacked 3 Organizations During Cyber Tests
A backdoored ARVE WordPress Plugin release could grant attackers administrator access with one token, but WordPress.org blocked automatic distribution to WordPress sites. Continue reading Wordfence Finds Critical Backdoor in ARVE WordPress Plugin
Cybersecurity researchers at Wiz found CosmosEscape in Azure’s Gremlin API, exposing a master key that could access any Cosmos DB account. Microsoft fixed it, with no customer impact found. Continue reading Microsoft Fixes CosmosEscape Flaw That Could Allow Any Cosmos DB Takeover
LeakNet claims it stole 11TB of NYC Health + Hospitals data containing sensitive medical, financial and biometric records linked to more than 12 million people. Continue reading LeakNet Claims 11TB of Data Stolen in NYC Health + Hospitals Breach
Ruflo fixed a CVSS 10.0 flaw that exposed its MCP bridge without any authentication, putting AI provider keys, stored chats and persistent agent memory at risk. Continue reading CVSS 10.0 RufRoot Flaw Allowed Attackers to Hijack Ruflo Without Logging In
Researchers found 24,650 public BMC interfaces leaking IPMI password hashes, exposing servers to offline password cracking through a decades-old protocol flaw. Continue reading 22-Year-Old IPMI Flaw Exposes 24,000 Servers to Offline Password Cracking