⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
The Iranian state-sponsored hacking group Nimbus Manticore, also known as UNC1549 and Mirage Kitten, has been linked to a new campaign targeting organizations in the Middle East, Africa, and South Asia. The group deployed a previously undocumented Windows backdoor called NightLedger, along with custom WebSocket tunnelers BridgeHead and ArcBridge, to maintain stealthy access to victim systems.
Iranian state-backed group Nimbus Manticore (aka GalaxyGato, Smoke Sandstorm, UNC1549) targeted entities across the Middle East, Africa, and South Asia using a previously undocumented Windows backdoor called NightLedger and two custom WebSocket tunnelers (BridgeHead and ArcBridge). Targets included government, aviation, telecom, and financial organizations in Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso.
Apple has released a significant round of security updates for its devices, including iOS/iPadOS 26.6, macOS Tahoe 26.6, Safari 26.6, and other operating systems, addressing dozens of vulnerabilities across kernel, WebKit, media frameworks, and core apps. These updates focus on security improvements rather than new features and are critical for users of iPhone 11 and later, iPad Pro 3rd generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, iPad mini 5th generation and later, Apple TV HD and Apple TV 4K, Apple Watch Series 6 and later, and Apple Vision Pro.
Apple has shipped a hefty round of July security patches, headlined by iOS/iPadOS 26.6, macOS Tahoe 26.6, and Safari 26.6, with dozens of vulnerabilities squashed...
The Vatican’s Click To Pray app, endorsed by Pope Francis and developed by La Machi Communication for Good Causes, exposed personal data of over 700,000 users due to an Insecure Direct Object Reference (IDOR) vulnerability. Independent researcher BobDaHacker discovered in January 2026 that the app’s API endpoint leaked sensitive information—including email addresses, names, countries, and dates of birth—by allowing unauthorized access to sequential user IDs.
The app, Click To Pray, was <a...