Attackers exploit identity verification processes, particularly during onboarding and account recovery, to gain unauthorized access to corporate systems.
A bipartisan kids online safety bill has been unveiled by House leaders, but it omits a key provision that would have mandated online platforms to take reasonable measures to prevent harms such as suicidal ideation and cyberbullying.
The FortiBleed campaign has targeted over 430,000 FortiGate devices worldwide, using custom sniffers to steal credentials and authentication secrets from compromised firewalls.
Hackers are exploiting a medium-severity info disclosure bug in the Gravity SMTP WordPress plugin, affecting 100,000 sites and exposing sensitive information like API keys and credentials.
A new BootROM exploit called Usbliter8 affects millions of iPhones, allowing attackers to bypass Apple's SecureROM and execute arbitrary code with full system privileges.
Authorities disrupted the SocGholish botnet, a malware framework used by Evil Corp and other cybercrime groups to steal data and break into networks, seizing infrastructure and remediating nearly 15,000 infected sites.
A vulnerability chain dubbed AutoJack in Microsoft's AutoGen Studio allows attackers to execute arbitrary commands on a host system by visiting a malicious webpage.
Microsoft attributes a recent Mastra AI supply chain attack to North Korean hacking group Sapphire Sleet, compromising over 140 npm packages.
Threat actors offer searchable underground services for stolen credentials, allowing buyers to request specific company or platform credentials.
A 21-year-old New York man faces cyberstalking charges for sharing AI-generated nude images and fabricated racist messages to harass a Georgia college student.