Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument comman…
Uma vulnerabilidade de alta gravidade no Cursor para Windows pode permitir a execução automática de código malicioso quando um desenvolvedor abre um repositório especialmente preparado. A falha é rastreada como CVE-2026-63093 e recebeu pontuação CVSS 8.7. O problema é classificad…
Cybersecurity researchers have shed light on an updated version of ToxicPanda (aka TgToxic) that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report, said the Android m…
A new Android malware named Manic targeting users in multiple European countries has a fallback data exfiltration mechanism that uses nearby infected devices. [...]
CERT Polska, the Polish Computer Emergency Response Team (CERT), warned that attackers have begun exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS). [...]
A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, TronLink, and other Web3 products. According to the Socket Threat Research team, the extensions are part of a broader set of 77 browser add-ons th…
CISA, the Department of Health and Human Services (HHS), and the Federal Bureau of Investigation (FBI) have issued an updated […] The post Medusa Ransomware Group Has Attacked 500+ Critical Infrastructure Orgs appeared first on The HIPAA Journal.
Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been desc…
A CISA, o FBI e o Departamento de Saúde e Serviços Humanos dos EUA (HHS) publicaram uma atualização do alerta conjunto sobre o ransomware Medusa, informando que o grupo já comprometeu mais de 500 organizações em todo o mundo até abril de 2026, com forte direcionamento a infraestr…
Agências do governo dos Estados Unidos, incluindo a NSA, o FBI, a CISA e o Departamento de Energia, emitiram um alerta sobre uma ameaça ativa contra PLCs (controladores lógicos programáveis) da série S7 da Siemens, utilizados em sistemas de infraestrutura crítica como abastecimen…
A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting the victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. [...]
A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting the victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. [...]
The AI company officially forbids illicit use, while offering guardrail-free social engineering, offensive cybercrime, and OSINT scanning to anyone with a bit of cryptocurrency.
Katie Moussouris of Luta Security talks with the Dark Reading News Desk about how enterprises will now need to monitor risks posed by their own agents in the wake of the recent Hugging Face attack.
A Agência de Segurança Cibernética e Infraestrutura dos EUA (CISA) adicionou uma vulnerabilidade crítica de autenticação no Microsoft SharePoint (CVE-2026-55040) ao seu catálogo de vulnerabilidades conhecidas exploradas (KEV) em 18 de agosto, após confirmação de exploração ativa,…
A Cloud Software Group emitiu um alerta crítico sobre duas vulnerabilidades que afetam o NetScaler ADC (antigo Citrix ADC) e o NetScaler Gateway (antigo Citrix Gateway), conforme comunicado da fabricante. A falha mais grave, rastreada como CVE-2026-19490, possui pontuação CVSS v4…
Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 20…
In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia. [...]
U.S. cybersecurity agencies warn that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure. [...]
A spear-phishing campaign by a Chinese-nexus group linked to FamousSparrow provides insight into geopolitical, technical, and strategic global moves by China's APTs.
