⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Unknown attackers hijacked Microsoft's official X account with over 13 million followers to promote a cryptocurrency token in a pump-and-dump scheme. The incident highlights the ongoing risk of social media account takeovers targeting high-profile brands for financial fraud.
Google has announced that Android 17 will restrict accessibility service access to verified applications when Advanced Protection is enabled, blocking a common attack vector used by banking trojans and spyware. The measure is part of ongoing efforts to prevent malicious abuse of the AccessibilityService API, which has been exploited to steal data and perform fraudulent transactions.
This article details a critical zero-day vulnerability in Fortinet FortiMail that enables unauthenticated arbitrary file writes via crafted HTTP or HTTPS requests. The flaw is actively exploited, prompting CISA to add it to the KEV catalog and Fortinet to release indicators of compromise.
This article reports a remote code execution vulnerability in Fortinet FortiMail, tracked as CVE-2025-25249, which is actively exploited in the wild. The flaw enables unauthenticated attackers to execute arbitrary code and manipulate data on vulnerable systems.
Mozilla Thunderbird is affected by multiple vulnerabilities that allow a remote attacker to execute arbitrary code, cause denial of service, escalate privileges, bypass security restrictions, disclose sensitive information, manipulate data, and spoof content. The vulnerabilities impact versions prior to 140.17, 153.4, and 157, and users should update to the latest fixed versions.
This article from BleepingComputer reports that Fortinet is warning customers about a critical FortiMail zero-day vulnerability, CVE-2026-104286, actively exploited in attacks. The flaw allows unauthenticated attackers to execute unauthorized code or commands on vulnerable devices.