Enterprise Infrastructure
A new global scan by Censys reveals that nearly half of all internet-facing FTP servers lack basic encryption, leaving enterprise data pipelines vulnerable to credential sniffing and man-in-the-middle attacks. ANN ARBOR, MI — In an era dominated by zero trust and encrypted tunnels, one of the internet’
Digital Identity
Following a coordinated global takedown of the Tycoon 2FA infrastructure, decentralized threat actors are abandoning traditional Adversary-in-the-Middle (AiTM) kits in favor of more resilient device code phishing tactics. LONDON, UK — The landscape of Multi-Factor Authentication (MFA) bypass is undergoing a rapid transformation. Just weeks after an
IoT Security
The classic Mirai botnet has evolved, weaponizing a critical RCE vulnerability in TBK-brand DVR devices to scale its destructive volumetric traffic capabilities. TEL AVIV, ISRAEL — Cybersecurity researchers have identified a sophisticated new variant of the notorious Mirai botnet, dubbed Nexcorium, which is rapidly expanding its footprint by exploiting unpatched
Vulnerabilities
A disgruntled security researcher has publicly released proof-of-concept code for three critical vulnerabilities in Microsoft Defender, leaving over a billion users exposed as two flaws remain unpatched. REDMOND, WA — The global cybersecurity community is on high alert following the unauthorized leak and subsequent exploitation of three zero-day
Vulnerabilities
The "Jolokia" vulnerability allows for unauthenticated Remote Code Execution, posing a significant risk to the message-brokering infrastructure that underpins global finance and logistics. WASHINGTON, D.C. — The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical input validation vulnerability in Apache ActiveMQ to its Known
Vulnerability Management
The National Institute of Standards and Technology pivots to a prioritization model, focusing enrichment efforts on critical software and known exploited vulnerabilities as the backlog reaches historic levels. GAITHERSBURG, MD — The National Institute of Standards and Technology (NIST) has announced a fundamental shift in how it manages the National Vulnerability
National Security
Security researchers claim sensitive contracts and user IDs were indexed by Google due to misconfigured URLs; Fiverr maintains that its core systems remain secure. TEL AVIV — Fiverr, the global freelance services marketplace, is facing intense scrutiny following reports that sensitive user documents — including contracts, project briefs, and personal IDs — were
Crypto-Crime & Laundering
The disruption of the W3LL Panel dismantles a "full-service" cybercrime ecosystem that bypassed Multi-Factor Authentication (MFA) to target thousands of Microsoft 365 enterprise accounts. ATLANTA, GA — In a major blow to the "Phishing-as-a-Service" (PhaaS) industry, the FBI’s Atlanta Field Office
Vulnerabilities
The addition of both legacy vulnerabilities and 2026 zero-days signals a "two-front war" for defenders: securing modern cloud-facing infrastructure while purging decade-old exploits still being used in the wild. WASHINGTON, D.C. — The Cybersecurity and Infrastructure Security Agency (CISA) has added seven new vulnerabilities
Trending
Adobe has issued an emergency out-of-band update to address a critical memory corruption vulnerability that allowed threat actors to exfiltrate data from targeted workstations for months. SAN JOSE, CA — Adobe has released emergency security updates for Acrobat and Acrobat Reader to patch a critical zero-day vulnerability, tracked
Trending
In a significant blow to the infostealer ecosystem, Google has officially integrated Device Bound Session Credentials (DBSC) into Chrome 146, fundamentally changing how authentication cookies are protected on Windows and macOS. MOUNTAIN VIEW, CA — For over a decade, session hijacking has been the "skeleton key" for cybercriminals. By
Threat Intelligence
In a sophisticated six-hour window of compromise, the official CPUID website was hijacked to serve malicious payloads to thousands of enthusiasts and IT professionals downloading system monitoring utilities. PARIS, FRANCE — The cybersecurity community is on high alert after CPUID, the developer of the ubiquitous system-profiling tools CPU-Z