⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Attackers registered the placeholder domain third-party.com, which is often used in code examples and documentation, and turned it into a ClickFix trap. Windows visitors are shown a fake Cloudflare page that tricks them into running a malicious PowerShell command to download malware.
Security leaders keep debating whether AI will produce an entirely new class of cyberattack. The nearer change is quieter and already visible: AI has made a failed attack cheap to retry.
Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," BitGet said in a post shared on X. "Bitget's cold wallets and the overwhelming majority of platform assets remain secure and unaffected." The company emphasized that customer account balances remain accurate, and deposits and trading continue to operate normally.
Microsoft has confirmed that some users may experience desktop loading issues, including black screens, after installing the August 2026 preview updates and subsequent updates.
The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1.
Websites like ShipmentsFree and related domains promise shipping rebates but also charge recurring monthly fees, as evidenced by Better Business Bureau complaints. The sites share overlapping infrastructure and policies, suggesting a coordinated operation that may mislead consumers.