Fraudsters Turn Open Banking Links Into a Free Stolen-Card Checking Service
Group-IB uncovered a scheme in which criminals abused a spend-management platform's open-banking integration to silently verify stolen card and bank credentials, while the platform unknowingly footed the bill....
Ransomware Negotiator Allegedly Ran Extortion Site for ShinyHunters, FBI Probe Finds
Federal investigators suspect an executive at a major U.S. consulting firm helped ShinyHunters run a pressure site that pushed nearly 100 breached companies toward paying extortion demands. The...
WP2Shell Chains WordPress Flaws Into Unauthenticated Server Takeover
The WP2Shell technique combines two WordPress Core vulnerabilities to create administrator access and deploy a plugin-based web shell without a login. Operators should upgrade to a fixed release...
Compromised eMudhra CA Keys Force Emergency Trust-Store Updates
Eight eMudhra intermediate certificate-authority keys were shown to be compromised, triggering emergency blocks across browsers and software ecosystems. Browsers update quickly, but applications with bundled or stale trust...
PHP Prepares Emergency Fixes for Two Critical 9.2 Flaws
PHP is preparing security updates for two critical vulnerabilities rated 9.2 under CVSS 4.0. Administrators should inventory exposed PHP systems now and apply the official fixes as soon...
Stolen UpdraftCentral Keys Let Attackers Backdoor WordPress Sites
A breach at TeamUpdraft exposed remote-management keys that attackers used to push malicious plugins to connected WordPress sites. Administrators should update UpdraftPlus, remove old connection keys and hunt...
Midnight Mimosa Firmware Malware Infects Thousands of Budget Android Phones Worldwide
Researchers have traced a firmware-embedded malware campaign called Midnight Mimosa to thousands of low-cost Android devices across 150+ countries, giving attackers system-level control before a single app is...
Ransomware Gangs Lean on Generative AI to Outrun Signature-Based Defenses
New Zscaler research shows ransomware operators increasingly using generative AI to write custom malware, craft near-flawless phishing lures, and sift stolen data faster than ever. The trend is...