Critical Rails Flaw Lets a Single Malicious Image Upload Expose Server Secrets
A critical, CVSS 9.8 flaw in Ruby on Rails' Active Storage lets an unauthenticated user trigger file writes, and in some configurations file reads, simply by uploading a...
Maximum-Severity Flaw in SolarWinds Dameware Puts Remote Support Sessions at Risk
SolarWinds has patched a near-maximum-severity command injection flaw in its Dameware remote support software, tracked as CVE-2026-28336 with a CVSS score of 9.9. An authenticated attacker could use...
Gorbag Hackers Weaponize a WinRAR Bug to Spy on Ukrainian Government Networks
A Russia-aligned group tracked as Gorbag is abusing a WinRAR path-traversal flaw to plant credential-stealing malware inside Ukrainian government, justice, and defense-adjacent networks. Researchers say the group favors...
DreamHost Confirms Breach After Attackers Exploited a File Manager Flaw
Hosting provider DreamHost has confirmed that attackers broke into its browser-based File Manager tool and made off with FTP/SFTP logins and some webmail credentials, with a handful of...
Fake Job Interviews and a Hijacked AI Assistant: Inside North Korea’s $6.34 Billion Binance Heist
The FBI has pinned a record-breaking $6.34 billion theft from Binance on North Korea's TraderTraitor group, which used a fabricated recruitment process and a compromised internal AI tool...
An AI Agent Helped Run This Ransomware Attack on UK Schools — and Left a Noisy Trail Doing It
Bitdefender researchers say a 3AM ransomware affiliate combined human decision-making with an AI agent that handled repetitive technical grunt work during an attack on a UK school network,...
Fake Nuclear Strike Warnings Flood Ukraine and Russia After Hackers Breach Emergency Alert Apps
Air-raid and emergency warning apps used by civilians in both Ukraine and Russia were hijacked within hours of each other, pushing out fabricated alerts about radiation leaks, chemical...
Hackers Cranked French Blood Plasma Freezers to 110°C in Overnight Attack on Medical Cold Chain
Attackers broke into refrigeration systems tied to France's national blood service, allegedly pushing freezer setpoints from -30°C to 110°C overnight by compromising a third-party cooling vendor. Staff caught...