‘Anne Hathaway’ Admits Leading $245M Crypto Theft, Spent Big on Luxuries
The alleged ringleader of a $245 million cryptocurrency theft has admitted to the crime, with lavish spending on nightclubs and luxury cars helping to expose the gang.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
BIND 9 Patches 14 Flaws, Including Unauthenticated DoH Crash
The Internet Systems Consortium's latest BIND 9 releases address a critical denial-of-service risk in DNS-over-HTTPS deployments.
CISOs Boost AI Security Spending Despite Thin Evidence
Fear of emerging threats is outpacing demonstrable ROI as security leaders pour budget into AI defenses, according to Dark Reading.
SANS ISC Logs Unusual Scan Targeting Hospitality Applications
New scan traffic seen by the SANS Internet Storm Center points to active reconnaissance of hospitality-related applications.
Issabel Framework Flaw Exploited for Unauthenticated Command Execution
A critical PBX framework flaw is being actively exploited, giving unauthenticated attackers remote command execution.
Single Browser Extension Can Seize Control of AI Assistants in Five Chromium Browsers
Researchers demonstrate that a malicious extension could hijack AI features across Chrome, Edge, Opera, and more, raising new supply-chain concerns.
N0va Phishkit Uses Legit Auth Flows to Hit US, EU Businesses
The kit's reliance on valid authentication flows rather than malware signals a growing blind spot in identity security.
Threat Intel Alone Can't Close the Exploitation Gap
Leaked credentials and vulnerability disclosures are weaponized before most teams triage, so threat intelligence alone is insufficient.
Acronis cPanel Backup Plugin Flaw CVE-2026-87886 Exploited in Targeted Attacks
A high-severity privilege escalation bug in Acronis's backup plugin for cPanel and WHM has been confirmed as an active attack vector.
Pixel Modem Privilege Escalation Flaw Exploited in the Wild
Google has patched a high-severity Pixel modem vulnerability that shows signs of limited targeted exploitation.
WooCommerce Wholesale Lead Capture Flaw Actively Exploited for PHP Backdoors
A critical unauthenticated file-upload vulnerability in the WooCommerce Wholesale Lead Capture plugin is being used in the wild to install PHP web shells on WordPress sites.
Fake CAPTCHA Pages Trick Users Into Running Malware
A new twist on an old scam uses the familiar CAPTCHA ritual to get victims to download and execute malicious code themselves.
Meshery adds pre-deployment checks and policy controls for Kubernetes
The open-source manager helps teams catch faulty Kubernetes configurations before they reach live clusters and centralizes access control.
Patching lessons: speed isn't enough, measure exposure window
Qualys' Kunal Modasiya explains why patching remains difficult and why teams should track exposure time rather than just remediation speed.
CVE Scores Don't Answer the Exploitability Question
A new webinar argues that severity scores and scanners fail to tell you whether a vulnerability can actually be exploited in your environment.
Autonomous AI Pentesting Aims to Close 38-Day Patch Gap
A new free guide for CISOs argues that autonomous AI agents can shrink the window between exploit disclosure and remediation.
Researchers Drunk-Test LG TV to Dodge Legal Ban on Hacking
A novel workaround for smart-TV security research shows how restrictive terms of service can block legitimate hacking.
Data Broker Radaris Loses Domains After New Jersey Privacy Lawsuit
A consumer data broker that long ignored takedown requests has lost control of its domains amid a state privacy lawsuit.