Leaked Screenshots Reignite Questions Over Who Can Access U.S. Government Data in Microsoft’s Cloud
Screenshots shared by an anonymous whistleblower appear to show a Microsoft engineer based outside the United States being approved to view logs from a U.S. government cloud environment...
Fake FedEx Tax Invoice Emails Are Dropping a Memory-Only Backdoor That Blinds Windows Defenses
A phishing campaign impersonating FedEx billing notices is delivering a newly documented, largely fileless backdoor called Sirius that patches Windows' own security logging to evade detection. Once installed,...
Three TLS Flaws in Widely Embedded GoAhead Web Server Undermine Certificate Trust on Millions of Devices
Researchers have disclosed three flaws in GoAhead, a lightweight web server embedded in routers, printers, industrial controllers, and networking gear from vendors including Palo Alto Networks, Siemens, and...
Unpatched UEFI Bug Lets Attackers Hijack Servers Before the Operating System Even Boots
A critical flaw in the open-source EDK II firmware powering network-booting servers, desktops, and laptops lets an unauthenticated attacker crash or potentially hijack a machine during PXE boot,...
New DarkCore RAT Hijacks Gmail and WhatsApp Logins, Then Disguises the Theft as the Victim’s Own Traffic
A remote access trojan called DarkCore, discovered by researchers at BlackFog, is being sold with a built-in browser that reuses stolen Gmail and WhatsApp session cookies while routing...
Apache Camel’s Latest Security Update Closes Six Flaws — From File-Leaking XXE Bugs to Remote Code Execution
The Apache Camel integration framework has shipped fixes for six vulnerabilities spanning XML parsing, deserialization, and credential handling. Three are rated high severity, including a pair of XXE...
Palo Alto Confirms Critical 9.2-Severity Flaw in PAN-OS Firewalls, Ships Workarounds Ahead of Patches
Palo Alto Networks has confirmed that a critical memory-corruption flaw in Google's Brotli decompression library, tracked as CVE-2026-111497 with a CVSS score of 9.2, affects certain PAN-OS firewall...
Instagram Ads Are Quietly Dropping Spyware on iPhones — No Tap Required
Researchers at iVerify and Report URI have traced a live malvertising operation that used a World Cup-themed Instagram ad to plant iOS spyware on a victim's phone without...