⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
First, the good news: If you use a Linux-based operating system, you may not be asked your age in a few months. The bad news is that Windows, macOS, iOS, and Android users in California will be.
The iPhone of a Serbian student protest member was infected with NSO Group's Pegasus spyware via a zero-click iMessage exploit, according to Citizen Lab and the SHARE Foundation. The infection occurred between December 2025 and January 2026, though additional infections may have occurred, and Apple addressed the vulnerability in iOS 18.4.1.
This article discusses the rise of supply chain attacks in 2026 as a dominant threat vector, citing the Verizon DBIR data and the MOVEit attack as examples. It argues that traditional security tools fail to detect poisoned dependencies, making threat intelligence essential for early warning.
A security researcher known as Chaotic Eclipse has released a proof-of-concept exploit called FalconFlank, which demonstrates a privilege escalation vulnerability in CrowdStrike Falcon by abusing the office malicious macros remediation feature. The PoC works on fully updated Windows 11 25H2 or Windows Server 2025 with CrowdStrike Falcon installed, and the researcher notes that CrowdStrike may already have detections in place.
CISA added seven vulnerabilities to its KEV catalog after observing active exploitation, including flaws in SonicWall SMA 1000, Sangoma Switchvox, JFrog Artifactory, and others. Attackers are deploying reverse shells and crypto miners using these exploits.
Multiple vulnerabilities were identified in GitHub Enterprise Server. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass, remote code execution and spoofing on the targeted system.