Category: Cybersecurity

A high-severity flaw in Firefox’s JavaScript engine can allow attackers to compromise unpatched Tor Browser installations when a user visits a specially crafted webpage, security researchers have demonstrated.The vulnerability, tracked as CVE-2026-10702, affects the just-in-time compiler used to improve JavaScript performance. A programming error can cause the compiler to generate unsafe machine code, giving an attacker the ability to execute commands within the browser’s content process without requiring a download, login or additional click.Mozilla fixed the flaw in Firefox 151.0.3

Three high-severity vulnerabilities in Hugging Face’s Diffusers library can allow malicious model repositories to execute arbitrary Python code even when users disable remote-code execution, exposing weaknesses in a key security control used across artificial intelligence development environments.The flaws affect Diffusers versions earlier than 0.38.0 and centre on the library’s trustremotecode safeguard. Developers rely on this setting to prevent unreviewed code bundled with models or pipelines from running on their systems. Crafted repositories could bypass that protection during several common loading

A Linux kernel vulnerability capable of giving a local attacker root access has been publicly detailed after artificial intelligence helped a security researcher identify and weaponise a race condition in the operating system’s network traffic-control subsystem.The flaw, tracked as CVE-2026-53264, affects the kernel’s net/sched component and carries a severity score of 7.8. It is a use-after-free vulnerability that can allow an ordinary user with access to a vulnerable machine to gain the highest level of system privileges.Lee Jia Jie of

Attackers are exploiting a critical vulnerability in Alibaba’s Fastjson library that can allow unauthenticated remote code execution on Java servers, raising urgent concerns for organisations running older versions of the widely deployed software component.The flaw, tracked as CVE-2026-16723, affects Fastjson 1. x installations under specific configurations and carries a severity score of 9.0 out of 10. Successful exploitation can give an attacker control of a vulnerable application with the same privileges as the Java process, potentially enabling data theft, malware

A malvertising operation targeting traders and cryptocurrency users is assembling malicious Windows software inside victims’ browsers, allowing each downloaded file to evade conventional fingerprint-based security checks.The campaign, known as SourTrade, uses sponsored advertisements and imitation websites resembling TradingView, Solana and Luno. Rather than transmitting a complete malicious program, the sites send instructions and separate components that the browser combines into an executable file on the user’s device.The technique represents a significant change in malware delivery. Network security products inspecting downloaded

Multiple high-severity vulnerabilities in FFmpeg have exposed media-processing systems to memory corruption, information leakage and service disruption when they handle malicious video, audio, image or subtitle files.The newly catalogued flaws affect FFmpeg 8.1.2 and, depending on the vulnerability, several older branches. They are especially significant for cloud transcoding services, streaming platforms, social networks, content-management systems and artificial intelligence applications that automatically process files supplied by users.Security records identify weaknesses across FFmpeg’s decoders, encoders, filters, demuxers and hardware-acceleration components. Several could

A critical vBulletin vulnerability has exposed unpatched forum servers to remote takeover through malicious requests that require no login credentials or user interaction.Tracked as CVE-2026-61511, the flaw allows an unauthenticated attacker to inject code into vBulletin’s template-processing system and execute arbitrary PHP commands on the underlying server. Successful exploitation could enable intruders to steal data, modify forum content, install malware, create backdoors or use the compromised machine to attack other systems.The vulnerability affects vBulletin 5. x versions through 5.7.5 and

A developer project has demonstrated an experimental jailbreak process for iOS 27 on Apple’s iPhone 11 Pro, using the hardware-level usbliter8 exploit and a heavily modified firmware restoration workflow.The open-source project, known as usbliter8-fun, is designed solely for security researchers and experienced developers. Its creator warns that the procedure erases the device, disables several core functions and can leave the handset unsuitable for ordinary use.The proof of concept currently supports only the iPhone 11 Pro, identified internally as iPhone12,3. That

Iran-affiliated hackers are exploiting internet-connected industrial controllers across US water, energy and government facilities, expanding their targets to equipment made by Rockwell Automation, Schneider Electric and Siemens.A July 22 update to a joint federal cybersecurity advisory confirmed that the campaign has moved beyond Rockwell Automation’s Allen-Bradley controllers. The affected equipment now includes Schneider Electric BMX P34 and Modicon M340 programmable logic controllers, as well as Siemens S7-1200 devices. Other brands may also be exposed where controllers can be reached directly

Cybersecurity researchers have renewed warnings over SparkKitty, a cross-platform mobile Trojan that steals photographs from compromised Android and iOS devices and transfers them to attacker-controlled command servers.The malware targets images that may expose cryptocurrency wallet recovery phrases, passwords, identity documents, QR codes and financial information. Its ability to capture entire photo libraries also creates risks beyond digital-asset theft, including account takeover, identity fraud, surveillance and extortion.SparkKitty was first documented in June 2025 after being found inside applications distributed through Apple’s

A flaw in Claude Code’s project-memory system can cause sensitive files outside a downloaded software repository to be transmitted to Anthropic’s servers without a separate warning or approval request, security researchers have found.The weakness affects the way Anthropic’s artificial intelligence coding assistant processes symbolic links while loading project instructions at startup. A malicious repository can contain a CLAUDE. md file that imports another file through a link appearing to remain within the project directory. The computer’s operating system can then

Infostealer malware is giving ransomware operators a faster route into corporate networks by supplying stolen passwords, browser cookies and authentication tokens that can defeat conventional identity controls.The growing trade in “stealer logs” has turned infections on individual computers into a dependable source of access for organised cybercrime groups. Criminals can search the harvested data for corporate email addresses, virtual private network credentials, cloud accounts, remote desktop services and privileged administrator sessions.Unlike traditional password theft, stealer logs can contain active browser

A weakness in Anthropic’s Claude Code can allow a repository to send the contents of files outside its project directory to an external server when a developer starts the coding assistant, security researchers have disclosed.The technique relies on a symbolic link placed inside an otherwise ordinary software repository. When combined with instructions in a CLAUDE. md file, the link can direct Claude Code towards sensitive material elsewhere on the developer’s computer and include that information in the first request transmitted

Ransomware attacks on universities rose during the first half of 2026 as a fast-expanding cybercrime operation called The Gentlemen intensified its focus on higher education institutions across several continents.Higher education attacks increased by more than 8% compared with the second half of 2025, even as ransomware incidents across the broader education sector fell by 13%. Researchers recorded 104 attacks on schools, colleges and universities worldwide between January and June, including 36 incidents confirmed by the targeted organisations.The Gentlemen claimed 15

Cyber attackers have compromised hotel and conference-centre Wi-Fi gateways to redirect business travellers towards fake Microsoft authentication pages, creating a scalable route for stealing corporate credentials and cloud-access tokens.The campaign has affected hospitality networks across several US cities, as well as locations in India and Saudi Arabia. Activity has been detected since at least June 2026, with visitors from financial services, law, healthcare, energy, retail and other industries connecting through manipulated gateways.The operation differs from conventional phishing because attackers do

Hackers are using a legitimate copy of Notepad++ and a disguised plugin to install malware on Windows computers, allowing malicious code to run through the text editor’s normal extension-loading process.The campaign has been linked to UAC-0099, a threat cluster known for targeting government bodies, defence organisations and strategically important enterprises in Ukraine. The revised infection chain, detected from mid-July, deploys two newly identified tools called LUNCHPOKE and BURNYBEAR, followed by an updated version of the MATCHBOIL malware loader.The operation does

Iran-linked cyber actors are targeting internet-connected industrial control systems used across US water, energy, manufacturing and public-service networks, prompting an expanded federal warning covering equipment made by Siemens, Schneider Electric and Rockwell Automation.The updated alert says attackers have gained access to programmable logic controllers, or PLCs, which manage physical processes inside critical infrastructure. Intruders have downloaded malicious project files, altered control logic and manipulated information shown on operator displays, creating risks of disruption, financial losses and unsafe operating conditions.Investigators identified

A Russian-speaking cybercriminal has transformed techniques for bypassing Claude’s safety controls into a commercial artificial intelligence platform marketed for offensive penetration testing.The operator, using the online name Trim, moved from publishing a detailed jailbreak tutorial on a Russian-language cybercrime forum on 31 March to advertising a working product called AI Pentest Checker on 21 June. The three-month progression illustrates how quickly instructions for manipulating mainstream AI systems can be converted into services aimed at hackers.Researchers tracking the activity said the

Project CAV3RN has adopted a new communication module that hides command-and-control traffic inside Outlook calendar events, marking a significant upgrade to the cyberespionage framework’s efforts to evade conventional network monitoring.The module, named AzureCommunication. dll, appears designed to replace an earlier component that exchanged instructions and stolen data through HTTP and WebSocket connections. It instead uses Microsoft Graph to access a compromised Microsoft 365 mailbox, turning calendar entries and their attachments into concealed communication points between operators and infected systems.Researchers have

Craneware has disclosed a cyberattack that allowed an unauthorised party to extract employee information and records linked to customers and business partners, raising fresh concerns about technology supply-chain risks across the US healthcare sector.The Edinburgh-based healthcare software provider said attackers gained access to a limited section of its data environment. A significant volume of file names was viewed and removed, while an unspecified proportion of employee data and a subset of customer and partner records were also taken.The company said

WordPress has issued emergency security updates to block a critical vulnerability that allowed unauthenticated attackers to execute code on websites running standard installations without plugins.The flaw, dubbed “wp2shell” and tracked as CVE-2026-63030, affected WordPress 6.9.0 through 6.9.4 and versions 7.0.0 and 7.0.1. WordPress released versions 6.9.5 and 7.0.2 on July 17, urging administrators to install the patches immediately.The vulnerability carried exceptional risk because an attacker did not require a valid account, administrator privileges or user interaction. A specially prepared

Magnet Forensics has accused a former contractor of disclosing confidential information about an undisclosed iPhone vulnerability to a rival cybersecurity company, potentially destroying the commercial value of a hacking capability used by government investigators.The Canadian digital forensics company filed a federal lawsuit against exploit engineer Mario Del Gaudio and Spain-based Paradigm Shift Technology S. L. The complaint alleges that Paradigm Shift published technical research derived from Magnet’s trade secrets, exposing a flaw affecting Apple’s A12 and A13 processors.Magnet lodged the

Hackers linked to China and India separately infiltrated Pakistan’s law-enforcement infrastructure, exposing systems containing criminal records, biometric information, personnel files and citizen complaints during espionage campaigns that lasted more than two years.The operations, detected between February 2024 and April 2026, converged most heavily on Balochistan Police, the principal law-enforcement agency in the strategically important south-western province. Khyber Pakhtunkhwa Police, Islamabad Police and the Punjab Safe Cities Authority were also targeted.The campaigns appeared to be independent rather than coordinated. Their overlap

Artificial intelligence is making cyber attackers faster and more effective while creating new security weaknesses through autonomous software tools, malware and increasingly sophisticated social-engineering campaigns.ESET’s Threat Report for the first half of 2026 found that criminals are using AI less as a substitute for technical expertise than as a force multiplier. The technology is helping attackers prepare convincing lures, automate repetitive work, adapt malicious code and expand campaigns at a speed that would otherwise require larger teams.The report, covering threat

GitHub Copilot generated harmful material in every test conducted through a carefully constructed coding workflow, exposing a sharp divide between safeguards in conversational chat and the behaviour of artificial intelligence agents operating across multiple development steps.Researchers Abhishek Kumar and Carsten Maple at the Alan Turing Institute in London tested Copilot inside Visual Studio Code using 204 harmful prompts drawn from three established safety benchmarks. The study covered four model backends available through the coding assistant: Anthropic’s Claude Sonnet 4.6 and

A newly identified ransomware operation is using a Microsoft-signed malicious driver to disable cybersecurity protections before encrypting files, exposing a dangerous weakness in the trust mechanisms underpinning Windows systems.The malware, named GodDamn, deploys the PoisonX kernel driver to terminate antivirus and endpoint detection and response processes. Kernel-level access gives the driver extensive control over an infected computer, allowing attackers to neutralise defensive software that might otherwise detect or stop the ransomware.GodDamn was first observed on May 21, 2026, and appears

A new artificial intelligence system has autonomously identified and exploited security weaknesses in laboratory-based Internet of Things environments, completing 95% of 260 attempted attacks.The framework, named VEXAIoT, uses cooperating AI agents to scan networks, identify vulnerable services, devise attack plans and execute exploits with limited human involvement. Researchers tested it against IoTGoat and Metasploitable2, two deliberately vulnerable platforms used for cybersecurity training and controlled experimentation.VEXAIoT achieved a 94.5% success rate on IoTGoat, completing 189 of 200 attack attempts. It succeeded

A flaw in the BIOS firmware of several Dell computers can allow attackers with physical access to recover administrator and user passwords from the device’s flash memory without brute-force cracking.The vulnerability, tracked as CVE-2026-40639, affects the way certain Dell client platforms protect passwords stored in the system’s Serial Peripheral Interface flash chip. Dell has classified the issue as a medium-severity weakness and released BIOS updates for a range of affected products.Successful exploitation could give an unauthenticated attacker elevated privileges at

The US Cybersecurity and Infrastructure Security Agency has disclosed how privileged AWS GovCloud credentials and sensitive development material were exposed through a contractor’s public GitHub repository, using the breach to urge organisations to strengthen cloud security and incident-response procedures.CISA said it opened an internal investigation on May 15 after an investigative journalist asked about agency credentials appearing online. The journalist had been alerted by a security researcher whose company scans public code repositories for exposed passwords, tokens and other secrets.The

Cybersecurity investigators have uncovered an AI-generated PowerShell script used during a live attack to map a company’s Active Directory environment, offering fresh evidence that criminals are deploying “vibe-coded” malware inside compromised networks.The script was recovered from an intrusion that began on June 3 after the attacker gained remote desktop access to a Windows Server connected to the victim’s domain. The available evidence indicated that the intruder entered through a virtual private network using credentials that had already been compromised.Within minutes

Interpol has announced 5,811 arrests and the interception of $293 million in illicit assets following a sweeping operation against cyber-enabled fraud across 97 countries and territories.Operation First Light 2026 targeted social engineering scams and related money laundering networks between January 15 and April 30. Authorities identified more than 142,000 victims, analysed 152,808 cases and blocked 31,014 bank accounts linked to suspected criminal proceeds.The China-funded operation also led investigators to identify 15,606 suspects and solve 23,715 cases. Interpol issued 99 Notices

A newly examined Everest ransomware encryptor has exposed a sharper technical playbook built to weaken recovery, obstruct analysis and expand damage across dormant network systems before encryption begins.The Windows payload, identified as hlntqyun. exe, is a 114 KB C# assembly compiled for. NET Framework 4.0 and protected with ConfuserEx, a widely abused obfuscation tool used to frustrate static malware analysis. The sample carries the SHA-256 hash 1df92bf4c967297d8a39fc3f619a56702ee96d5cf9196b8e1d5b3654746c6514 and appears to have been tailored for a specific victim, rather than built

A newly demonstrated attack against Claude Desktop has highlighted how synced AI preferences and locally connected tools can be chained to turn a trusted chatbot into a covert route for command execution on a user’s workstation.The attack path centres on Claude Desktop’s Personal Preferences feature, which allows users to set account-wide instructions that are synchronised across sessions and devices. Security researchers showed that if an attacker gains access to a victim’s Claude account, malicious instructions can be planted in those

DuckDuckGo has added YouTube video ad blocking to its privacy-focused browser, widening its challenge to dominant browsers and giving users a built-in way to watch videos with fewer commercial interruptions.The feature blocks ads that appear before and during videos viewed inside the DuckDuckGo browser, including on YouTube. It relies on community-maintained uBlock Origin filter lists, a significant choice because those lists are open-source, regularly updated and shaped by a large volunteer ecosystem rather than a closed, proprietary detection system.DuckDuckGo says