New DarkCore RAT Hijacks Gmail and WhatsApp Logins, Then Disguises the Theft as the Victim’s Own Traffic
A remote access trojan called DarkCore, discovered by researchers at BlackFog, is being sold with a built-in browser that reuses stolen Gmail and WhatsApp session cookies while routing...
Apache Camel’s Latest Security Update Closes Six Flaws — From File-Leaking XXE Bugs to Remote Code Execution
The Apache Camel integration framework has shipped fixes for six vulnerabilities spanning XML parsing, deserialization, and credential handling. Three are rated high severity, including a pair of XXE...
Palo Alto Confirms Critical 9.2-Severity Flaw in PAN-OS Firewalls, Ships Workarounds Ahead of Patches
Palo Alto Networks has confirmed that a critical memory-corruption flaw in Google's Brotli decompression library, tracked as CVE-2026-111497 with a CVSS score of 9.2, affects certain PAN-OS firewall...
Instagram Ads Are Quietly Dropping Spyware on iPhones — No Tap Required
Researchers at iVerify and Report URI have traced a live malvertising operation that used a World Cup-themed Instagram ad to plant iOS spyware on a victim's phone without...
Researcher Uncovers 11 Tailscale SSH Flaws That Could Hand Attackers Root Across a Fleet
An independent security report dubbed 'Tailworm' details eleven separate weaknesses in Tailscale SSH, its serve and app-connector features, the DERP relay, and the open-source headscale server — several...
India’s New SIM-Binding Rule Could Cut Off WhatsApp, Telegram, and Signal From Unregistered Devices
A new Indian telecom rule set to take effect January 1, 2027 would require messaging accounts on WhatsApp, Telegram, Signal, and several other platforms to stay continuously tied...
Researcher Wins $2,000 Bug-Bounty Challenge by Chaining Critical PHP Flaws, Publishes New PoC
A security researcher known as 'killa' claimed the prize on a public bitcoin-themed hacking challenge by exploiting two critical PHP vulnerabilities — tracked as the PHP2Shell flaws, CVSS...
Microsoft Teams Is Getting AI That Reads the Conversation, Not Just the Links, to Catch Phishing
Microsoft plans to roll out AI-driven phishing detection inside Teams that analyzes the context of a conversation — not just suspicious links or attachments — to catch impersonation...