logo

News related to
flaw

A Microsoft-tracked cybercrime group is using adversary-in-the-middle techniques to hijack Microsoft 365 sessions, bypass multifactor authentication and reroute employee pay into attacker-controlled bank accounts, in what researchers describe as a geographically focused campaign against users in Canada. Microsoft said the actor, tracked as Storm-2755, combined search-result poisoning, fake sign-in pages and session replay to move from account takeover to payroll fraud, causing direct financial loss for at […]

A critical security flaw in the Ninja Forms File Uploads add-on has put thousands of WordPress sites at risk, with researchers warning that attackers can exploit the bug without logging in and, in the worst case, gain remote code execution on a vulnerable server. The issue affects all versions up to and including 3.3.26, while version 3.3.27 has been identified as the fully patched release after an […]

Amazon Web Services has patched three high-severity vulnerabilities in its open-source Research and Engineering Studio platform, closing weaknesses that could have allowed authenticated users to run commands on key systems or gain broader permissions inside cloud environments used for scientific and engineering work. The flaws affected AWS Research and Engineering Studio, known as RES, a web-based portal that helps administrators build and manage controlled research and engineering […]

STX RAT, a newly identified remote access trojan, has drawn attention in the cyber-security sector after researchers tied it to an attempted intrusion against a financial-services environment and linked it to broader opportunistic delivery campaigns that include trojanised software and script-based loaders. The malware stands out because it combines hidden remote control with data theft, while delaying some of its most suspicious behaviour until it has an […]

Attackers have planted a stealthy Magecart credit-card skimmer on nearly 100 Magento-based online shops by hiding the malicious code inside an invisible SVG image, according to incident findings published this week, in what security specialists describe as another sign that payment-page attacks are becoming harder for merchants and scanners to detect. The operation was identified on April 7 and affected 99 stores, with stolen payment data sent […]

GitLab has issued a security update covering multiple vulnerabilities in its Community Edition and Enterprise Edition products, with the latest patch aimed at denial-of-service weaknesses and an Enterprise-only code injection issue that could expose users’ IP addresses through maliciously crafted Code Quality reports. The company said self-managed customers should upgrade immediately to versions 18.10.3, 18.9.5 or 18.8.9, while GitLab. com is already running the patched release and […]

Google’s handling of API keys has come under fresh scrutiny after security researchers said Android applications are exposing credentials that can now unlock parts of the Gemini AI platform, potentially allowing unauthorised access to files, cached data and billable AI services. The latest warning, published by CloudSEK on April 7, says 32 hardcoded Google API keys were found across 22 popular Android apps and that the issue […]

Advertisements

Palo Alto Networks has issued a high-priority security update for a flaw in its Cortex XSOAR and Cortex XSIAM platforms that could allow an unauthenticated attacker to access and alter protected resources through the Microsoft Teams integration, adding fresh pressure on security teams to review third-party connectors that sit inside core incident response systems. The vulnerability, tracked as CVE-2026-0234, was published on April 8 and affects Microsoft […]

Anthropic has launched Project Glasswing, a controlled cybersecurity programme that gives a select group of large technology, finance and security organisations access to its unreleased Claude Mythos Preview model to identify and help fix serious software vulnerabilities in widely used systems. The company says the model has already uncovered thousands of significant flaws across operating systems, browsers and other foundational software, but has stopped short of making […]

Hackers are exploiting internet-exposed ComfyUI servers in a monetisation campaign that turns poorly secured AI image-generation systems into cryptocurrency mining machines and proxy infrastructure, according to multiple security findings published this week. Researchers say more than 1,000 exposed ComfyUI instances remain reachable online after honeypots are filtered out, giving attackers a narrow but valuable pool of GPU-equipped targets spread across cloud environments. The activity centres on unauthenticated […]

  Microsoft has warned that a threat actor it tracks as Storm-1175 is exploiting vulnerabilities in internet-facing systems at high speed to deliver Medusa ransomware, in some cases moving from initial access to data theft and encryption within 24 hours. The alert points to a pattern that security teams have feared for months: a shrinking window between vulnerability disclosure, exploitation and full-scale ransomware deployment. The group, described […]

Security leaders are being told to treat “vibe coding” as a governance issue, not merely a productivity trend, as AI assistants move deeper into software development and expose organisations to flaws ranging from insecure dependencies to credential leakage and command injection. Guidance from standards bodies and security groups now points towards a simple principle: code produced with AI should be handled as untrusted until it has passed […]

Anthropic’s Claude Code has come under fresh scrutiny after researchers disclosed a flaw that can neutralise user-set deny rules when a shell command is padded with a long chain of harmless subcommands, raising concerns that a safety feature marketed as a hard stop may fail in exactly the kind of hostile conditions it is meant to resist. The issue centres on Claude Code’s permission system, which lets […]

Drift Protocol has said the theft of about $270 million to $286 million from its platform was the result of a six-month operation by North Korea-linked actors who built trust slowly, posed as a legitimate trading firm and used face-to-face meetings, capital deposits and carefully timed social engineering to prepare the strike. The Solana-based exchange’s account adds a new layer to an attack that security researchers had […]

Google has disclosed a coordinated takedown of UNC2814, a suspected China-linked cyber-espionage group, after investigators tied it to intrusions at 53 organisations in 42 countries, with telecommunications providers and government bodies forming the core of the victim set. The campaign centred on a custom backdoor called GRIDTIDE, which used Google Sheets as a covert command-and-control channel, allowing malicious traffic to blend with ordinary cloud activity rather than […]

Artificial intelligence is lowering the cost of cyberattacks across the digital-asset industry and forcing crypto firms to rethink how they protect users, wallets and transaction systems, according to Ledger chief technology officer Charles Guillemet, whose warning lands as the sector grapples with a fresh cycle of major breaches and more sophisticated fraud. Guillemet said AI is making hacks “cheaper and faster”, amplifying a security problem that has […]

Cloudflare’s launch of EmDash has opened a fresh front in the struggle over the future of web publishing, landing at a moment when WordPress is already under pressure from courtroom battles, security criticism and questions over who gets to define the rules of the world’s biggest content management ecosystem. EmDash, presented by Cloudflare as a “spiritual successor” to WordPress, is being pitched as a modern, open-source alternative […]

A newly disclosed exploit chain in Progress ShareFile has raised fresh concern over the security of enterprise file-transfer systems after researchers showed that two critical flaws can be combined to seize control of vulnerable customer-managed servers without prior authentication. The vulnerabilities, tracked as CVE-2026-2699 and CVE-2026-2701, affect ShareFile Storage Zones Controller, the on-premises component used by organisations that keep files in their own infrastructure while relying on […]

Drift, one of Solana’s larger decentralised finance trading platforms, said it was facing an “active attack” on April 1 and moved to suspend deposits and withdrawals as hundreds of millions of dollars appeared to leave the protocol, deepening concern over operational security risks in crypto markets. The platform told users not to deposit funds and said it was working with security firms, bridges and exchanges to contain […]

  Breaches involving employee information reported to the UK’s data regulator climbed again in 2025, reaching their highest level since the Information Commissioner’s Office began publishing comparable incident data in 2019, according to an analysis by law firm Nockolds that draws on ICO reporting. The rise adds to mounting concern among employers that staff records, payroll details and internal HR files are becoming harder to protect as […]

Apple has added a new safeguard in macOS Tahoe 26.4 that warns users before potentially dangerous text is pasted into Terminal, a move aimed at disrupting ClickFix-style scams that trick people into infecting their own devices. The feature appears in the latest macOS release even though Apple’s public feature summary for version 26.4 does not spell it out directly, while the company’s broader security pages confirm 26.4 […]

Federal prosecutors have charged a Maryland man with carrying out two 2021 attacks on Uranium Finance that drained more than $53 million from the decentralised crypto exchange, a case that is drawing fresh attention to long-running weaknesses in decentralised finance and to the growing ability of authorities to follow money through blockchain networks. The accused, Jonathan Spalletta, 36, of Rockville, Maryland, surrendered on March 30 after an […]

  EvilTokens, a newly identified phishing-as-a-service operation, is offering cybercriminals a ready-made way to hijack Microsoft accounts by abusing a legitimate sign-in process rather than stealing passwords through fake login pages. The service centres on Microsoft’s device code flow, a method designed for televisions, printers and other input-constrained devices, and researchers say the toolkit has been active since the middle of February. What makes the platform notable […]

Hackers are weaponising trusted Windows administration tools and signed but vulnerable drivers to switch off antivirus and endpoint detection systems before launching ransomware, a tactic that is making intrusions quieter, faster and more difficult for defenders to stop. Security researchers and government-backed advisories say attackers are increasingly avoiding noisy custom malware in the opening stages of an attack, instead leaning on built-in utilities, service controls, scripts and […]

VISHNU RAJA
RYO YAMADA
HITORI GOTOH
IKUYO KITA
Just in:
Cong activists storm police station // Japan strengthens cyber defences after widespread data breaches // Gulf governments warn against renewed strikes on Iran // Probe into judge’s conduct // Kochi apartment protesters threaten to block ministers // Crypto.com introduces regulated perpetual futures to US traders // MR ROBOT malware network targets bank customers across India // Federal court rejects Trump’s Epstein letter defamation lawsuit // High Court invalidates Vizhinjam coastal erosion panel // Gulf governments warn against renewed strikes on Iran // As AI Reshapes Education, Singapore to Convene Global Dialogue on the Future of Early Childhood Education // Suspected China-linked hackers penetrate US government-affiliated network // As AI Reshapes Education, Singapore to Convene Global Dialogue on the Future of Early Childhood Education // SIT throws out Veena assault // Visa and Senegal formalise two-year digital payments cooperation // Binance faces $3.75 billion withdrawal claim after reopening // Uralungal contracts on Vigilance radar // Supreme Court registers contempt plea against Kerala Congress // As AI Reshapes Education, Singapore to Convene Global Dialogue on the Future of Early Childhood Education // Three ONYX Hotels Win Green Tourism Awards, Bringing “ONYX for Planet” to Life in Chonburi //