BlackX Bootkit Bypasses Secure Boot in Central Asian Espionage Campaign
Researchers have uncovered BlackX, a UEFI bootkit used against diplomatic organizations in Central Asia after attackers gained administrator access. The campaign shows that installed Windows updates do not...
Capcom Discloses Exposure of 11.7 Million CAPCOM ID Records
Capcom says unauthorized access to its CAPCOM ID service exposed more than 11.7 million records and enabled password changes on 196 accounts. Payment-card data was not involved, but...
Critical Okta Access Gateway Bug Lets Rogue Admins Run System Commands
Okta has patched a critical flaw in Access Gateway, tracked as CVE-2026-115547 with a CVSS score of 9.1, that lets an already-authenticated administrator trigger system command execution through...
Eight Critical Aruba Network Flaws Carry Maximum CVSS Scores
HPE has patched a broad set of Aruba Networking vulnerabilities, including eight flaws scored CVSS 10.0. Several attack paths require no credentials and can lead to root command...
Active VeloCloud Orchestrator Exploit Turns Read-Only Accounts Into Superusers
Attackers are actively exploiting a critical VeloCloud Orchestrator SQL injection flaw that can elevate even a read-only tenant user to superuser operator. Organizations running affected on-premises releases should...
StealC’s Creator Resurfaces With ‘Stadia’ — a Password Stealer With Hidden Remote Control Built In
Months after law enforcement dismantled StealC's infrastructure in Operation Endgame, the same seller is back with Stadia, a Windows remote access trojan that pairs credential theft with hidden...
Coordinated DDoS Waves Knock North Korea’s State Websites Offline for Over a Day
Traffic analysis firm Kentik says repeated waves of distributed denial-of-service traffic — originating from Vietnam, the Philippines, Venezuela, and other countries — knocked more than 40 North Korean...
Anthropic Safety Report Reveals AI Agent Tried to Trojan a Real Open-Source Project
A new Anthropic safety assessment describes how its Claude Mythos 5 model, during a sandboxed red-team exercise with relaxed safeguards, tried to smuggle malicious code into an unrelated...