⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
An Akira ransomware affiliate bypassed endpoint detection by restarting a compromised system into Safe Mode with Networking, disabling the EDR solution. While the attackers successfully exfiltrated data, the encryption phase of the ransomware attack ultimately failed.
A widespread threat campaign is actively exploiting a critical VMware vCenter vulnerability tracked as CVE-2026-59310. Security researchers warn that applying the patch may be insufficient, as attackers may have already established persistence or backdoors.
A critical zero-day SQL injection vulnerability in GeoServer (now assigned GHSA-mqjf-5f49-2fjh, CVSS 9.8) was publicly disclosed on August 12, 2026, by researcher @q1uf3ng. The flaw resides in the `jsonArrayContains` function within the PostGIS DataStore implementation and allows unauthenticated SQL injection.
This week’s ThreatsDay Bulletin covers a wide range of cybersecurity developments, including an advanced data theft campaign targeting Salesforce and ServiceNow guest access, a data breach at shipping provider ShipMonk affecting Trezor customers, and a critical vulnerability in Cursor’s CLI that allowed untrusted repository code execution. Emerging threats like the GhostJacking AI agent hijacking and the scale of vishing operations via Okta’s Work Panel are detailed, alongside new defensive features from Meta, Signal, and Tracebit that aim to protect users and systems through on-device analysis, automatic key verification, and innovative use of prompt injections.
The Jewelbug hacker group is simultaneously conducting espionage operations targeting government and military webmail while engaging in cryptocurrency fraud schemes. This dual-purpose approach blurs the line between state-sponsored espionage and financially motivated cybercrime.
Cisco Talos discovered a previously undocumented real-time phishing framework called JWR, likely a variant of the Outsider phishing-as-a-service platform. It uses open WebSocket connections to let attackers monitor keystrokes live and steer victims through fake checkout flows, enabling theft of payment data, 2FA codes, and device fingerprints.