Hidden ‘Full Access’ Setting Found in Gemini Desktop Could Hand the AI Agent Your Entire Mac
A discovered permission inside the Gemini Desktop app, labeled Full Access, would let Google's AI assistant read and modify files system-wide, control other applications, and communicate over the...
Apple to Overhaul macOS Full Disk Access Controls as AI Agents Gain More System Power
Apple says it will require a far more deliberate approval step before granting apps Full Disk Access on macOS, warning that the permission's sweeping reach becomes more dangerous...
Fake CAPTCHA Prompts Are Hiding Malware in Your Browser Cache, Microsoft Warns
Microsoft Threat Intelligence has uncovered a ClickFix variant that pre-stages a disguised VBScript payload inside the browser cache before a victim ever pastes a command into the Windows...
Undercover Blockchain Probe Maps Lazarus-Linked Laundering After $1.5B Bybit Theft
Blockchain investigator ZachXBT says an undercover operation exposed a Chinese laundering network handling funds linked to North Korea's $1.5 billion Bybit theft. Private chats were correlated with public...
GlassWorm Hides Malware Inside VS Code Themes to Target Developer Workstations
GlassWorm operators used convincing VS Code theme extensions to conceal downloaders, encrypted JavaScript and blockchain-based payload routing. Developer teams should remove confirmed malicious packages and investigate hosts because...
AI-Driven Zammad Attack Chained Two Zero-Days to Reach Root in Seconds
An AI-assisted intruder compromised the Dutch Institute for Vulnerability Disclosure by chaining two previously unknown Zammad flaws. The incident moved from session hijacking to root access in seconds...
Researchers Warn of Two More Unpatched NetScaler Zero-Days Already Under Attack
Security firm watchTowr says it has uncovered two additional, undisclosed remote-code-execution vulnerabilities in Citrix NetScaler during forensic investigations, and that both appear to have been exploited in real-world...
Apple Patches CoreGraphics Zero-Day Used in Spyware-Style Attacks on iPhones and iPads
Apple's iOS 26.7.1 and iPadOS 26.7.1 updates close CVE-2026-86950, an out-of-bounds write in CoreGraphics that attackers used in what Apple describes as an extremely sophisticated attack against specifically...