Iran-Linked Blinder Tunnel Campaign Targets Iraqi Infrastructure Through Fake Coding Test
An Iran-aligned operation used a counterfeit Dubai Airports recruitment process and a weaponized Visual Studio project to target an Iraqi developer. The chain deployed persistent remote access and...
Encrypted Prompt Injection Can Turn Copilot CLI Into a Developer-Secret Exfiltration Tool
Researchers demonstrated how encrypted instructions on a hostile web page could lead Copilot CLI in autopilot mode to read local files and transmit secrets. The finding shows why...
Apache Struts Updates Close RCE, Memory Exhaustion and Data-Leak Flaws
Apache Struts maintainers have addressed four flaws spanning remote code execution, denial of service and cross-user data exposure. Administrators should move to Struts 7.4.0 or 6.12.0 and verify...
EY Tax Platform Breach Exposes Data Tied to Goldman Sachs and Man Group Clients
A breach of an EY tax-support platform exposed personal and financial data connected to clients of Goldman Sachs and Man Group. The incident highlights how sensitive documents in...
Crafted HEIC Uploads Can Turn WordPress Image Processing Into Server Code Execution
A newly demonstrated exploit chain turns a malicious HEIC upload into code execution through WordPress's server-side image pipeline. Administrators should update libheif, restrict unnecessary modern image formats, and...
Police Impersonation Call Center Dismantled in Timor-Leste, 16 Detained in Japan-Targeted Fraud Scheme
Authorities in Timor-Leste raided a Dili building allegedly used to run a scripted phone-fraud operation impersonating Japanese police, detaining 16 suspects and recovering fake uniforms and a prefectural...
Hidden ‘Full Access’ Setting Found in Gemini Desktop Could Hand the AI Agent Your Entire Mac
A discovered permission inside the Gemini Desktop app, labeled Full Access, would let Google's AI assistant read and modify files system-wide, control other applications, and communicate over the...
Apple to Overhaul macOS Full Disk Access Controls as AI Agents Gain More System Power
Apple says it will require a far more deliberate approval step before granting apps Full Disk Access on macOS, warning that the permission's sweeping reach becomes more dangerous...