⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
The article from Sophos discusses how AI research under SecAI enhances threat detection and customer protections, highlighting the need for adaptive security measures.
A malvertising operation called SourTrade makes victims' browsers build the final Windows executable themselves using the Bun runtime instead of serving a complete malicious file from a fixed URL. Active since late 2024, it impersonates TradingView, Solana, and Luno to target retail traders and cryptocurrency investors across 12 countries in 25 languages. Landing pages fingerprint visitors, showing empty pages to researchers and convincing copies of impersonated services to selected targets.
Attackers are targeting a critical unauthenticated RCE vulnerability (CVE-2026-16723, CVSS 9.0) in Fastjson 1.x, Alibaba's JSON library for Java. In Spring Boot applications, a malicious JSON request can execute code with Java process privileges without authentication.
Security researchers published working exploit code for a GitLab RCE vulnerability (patched June 10, 2026) that lets any authenticated user who can push to a project run commands as the git user on self-managed GitLab 18.11.3 servers. The exploit uses crafted Jupyter notebooks to leak heap pointers via commit diffs, then fires payloads through memory corruption bugs in the Oj Ruby JSON parser.
CTM360 research reveals that insurance-focused phishing has evolved from credential harvesting to real-time account hijacking. Attackers now synchronize their activity with victims in real-time, authenticating against legitimate insurance portals as victims unknowingly complete the login process, all within a single browsing session.
Cl0p ransomware affiliates are exploiting flaws in internet-exposed PTC Windchill and FlexPLM deployments in a new data extortion campaign. Attackers chain a pre-authentication information disclosure in FlexPLM's WSDL endpoint with a server-side flaw in Windchill's login servlet to achieve unauthenticated RCE and deploy JSP web shells.