Another new vulnerability is giving cybercriminals the ability to crash Citrix NetScaler appliances, as The Record reports: Customers began reporting strange exploitation incidents on Friday, even on appliances that were up to date on all patches. Citrix confirmed late on Friday that it was “tracking a newly observed issue” related to some customer-managed NetScaler deployments […]
If you haven’t patched already, get busy. DarkReading reports: Attackers have begun widely exploiting two critical vulnerabilities in WordPress that, when chained, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites. The attacks are being fueled by the ready availability of numerous proof-of-concept exploits for the two bugs, identified as CVE-2026-60137 and CVE-2026-63030. Researchers at […]
Cybersecurity Insiders reports: Cyberattacks have long evolved in waves, with ransomware groups historically choosing their victims based on industry type or company size. Financial institutions, healthcare providers, and large enterprises were often prime targets due to their ability to pay hefty ransoms. However, a new trend is emerging that signals a shift in attacker strategy. […]
TechCrunch reports: Last week, cybersecurity researchers uncovered a hacking campaign targeting iPhone users that used an advanced hacking tool called DarkSword. Now someone has leaked a newer version of DarkSword and published it on the code-sharing site GitHub. Researchers are warning that this will allow any hacker to easily use the tools to target iPhone users running […]
Ars Technica reports: Researchers say they have uncovered a takedown-resistant botnet of 14,000 routers and other network devices—primarily made by Asus—that have been conscripted into a proxy network that anonymously carries traffic used for cybercrime. The malware—dubbed KadNap—takes hold by exploiting vulnerabilities that have gone unpatched by their owners, Chris Formosa, a researcher at security […]
The Register reports: Google has pushed out an emergency Chrome update to fix two previously unknown vulnerabilities that attackers were already exploiting before the patches landed. The bugs, tracked as CVE-2026-3909 and CVE-2026-3910, affect core components of the browser and have prompted the usual warning from Google that technical details will remain under wraps until […]
From the Google Threat Intelligence Group: Google Threat Intelligence Group (GTIG) has identified a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023). The exploit kit, named “Coruna” by its developers, contained five full iOS exploit chains and a total of […]
The Record reports: A Chinese state-backed hacking group is targeting Dell customers with a zero-day vulnerability impacting a popular line of operational and disaster recovery tools. Dell and Google released notices on Tuesday about CVE-2026-22769, warning that a sophisticated Chinese actor has been targeting the bug since at least mid-2024. Dell’s advisory said the vulnerability carries a […]
The Record reports: A software update mechanism for the popular text editor Notepad++ was hijacked by suspected Chinese state-sponsored hackers, allowing them to silently redirect some users to malicious update servers, the project’s developers announced on Monday. In a security update posted on the project’s website, the development team said the attack did not exploit a flaw […]
The Record reports: State-backed hackers in China are exploiting a vulnerability impacting a popular open-source tool built into thousands of widely-used digital products, according to new reports. The tool, React Server Components, was maintained by Meta for many years and now is embedded in 50 million websites and products built by countless major firms. The bug, tagged […]
