5+ day, 20+ hour ago   (383+ words) A security researcher has published details of what appears to be a zero-day privilege escalation exploit in CrowdStrike. The individual, identified by their online moniker “Nightmare Eclipse” (aka Infinite Nightmare, MSNightmare) posted the details to GitHub on September 3. “FalconFlank is…...

1+ week, 3+ day ago   (520+ words) US healthcare provider Nutex Health has disclosed that a threat actor has stolen sensitive data, including of patients, and threatened to publish it online. The Texas-based firm, which delivers care through facilities throughout the US, made the notification in an…...

1+ week, 4+ day ago   (397+ words) One of America’s largest healthcare distributors is investigating a serious data breach which notorious threat actor ShinyHunters has claimed responsibility for. However, the firm revealed in a statement on August 28 that it was investigating an incident “involving third-party applications and…...

3+ week, 5+ day ago   (197+ words) Read more on WordPress plugin flaws: Everest Forms Pro Vulnerability Allows Remote Code Execution on WordPress Sites The issue stems from a type confusion error in the plugin’s registration and automatic-login flow. Wordfence, a security plugin for WordPress, found that…...

4+ week, 2+ day ago   (428+ words) A compromised AWS access key was the likely root cause of the cyber-attack on CRM provider Beacon, which has exposed personal information held by around 1500 UK charities. The software provider said in an August 12 incident update that the access key…...

1+ mon, 1+ week ago   (417+ words) A cryptomining operation has been observed abandoning root access on compromised Linux servers in favor of impersonating low-privileged users, a deliberate downgrade designed to avoid the alerts that root activity triggers in a security operations center (SOC). According to new…...

1+ mon, 2+ week ago   (488+ words) A Russia-aligned espionage group has resurfaced after months without observed activity, using a half-click exploit against on-premises Outlook Web Access (OWA) to plant a browser-resident implant and establish server-side persistence that can survive credential rotation and device re-imaging. According to…...

1+ mon, 2+ week ago   (533+ words) Russian state-supported hackers are targeting organizations with a new attack technique using a Zero-Click method which doesn’t require users to interact with the phishing email. The campaign is designed to compromise networks and gain persistent access, a joint advisory from…...

1+ mon, 3+ week ago   (487+ words) A newly disclosed vulnerability in the Ubuntu component that isolates snap applications has been found to hand full root access to any local user on default installations of Ubuntu Desktop 24.04, 25.10 and 26.04. According to new research from the Qualys Threat Research…...

1+ mon, 3+ week ago   (422+ words) A Russian-speaking cyber-criminal has been observed moving in three months from posting a jailbreak tutorial on a Russian-language forum to selling a commercial offensive AI pentest platform built on the techniques he documented. According to new research from Cato CTRL,…...