Zero-Day Attacks Exploit SonicWall SMA1000 Flaws, Push Custom Malware A highly sophisticated threat actor has been exploiting two previously undisclosed vulnerabilities in SonicWall’s SMA1000 Secure Mobile Access appliances for weeks, installing custom malware on vulnerable VPN devices. The attacks took place long before the vulnerabilities were publicly disclosed by SonicWall last week, and experts warn … Read more
Estée Lauder’s Data Breach Exposes Sensitive Information of 57,000 Employees and Customers Cosmetics giant Estée Lauder has disclosed a data breach that occurred in August 2025, when hackers exploited a flaw in Oracle E-Business Suite, a software system used by the company for human resources management. The breach exposed sensitive information of certain individuals, including … Read more
A massive cyberattack campaign, dubbed “FakeGit,” has been using over 7,600 compromised GitHub repositories to spread malware known as SmartLoader. The attackers have leveraged the trust associated with open-source code hosting platforms like GitHub to distribute their malicious software, putting countless developers and organizations at risk. At its core, FakeGit works by creating fake versions … Read more
Cybersecurity Executives Feel the Heat as AI Adoption Creates Unprecedented Challenges A recent survey has revealed that a staggering 26% of top cybersecurity executives are considering leaving their jobs due to the pressures brought on by the rapid adoption of artificial intelligence (AI) technologies. This alarming figure highlights the growing concern among security professionals that … Read more
A Critical Vulnerability in ServiceNow’s AI Platform is Being Exploited by Attackers A critical vulnerability in the ServiceNow AI Platform, a popular enterprise-grade platform that helps businesses integrate artificial intelligence into core workflows, has been discovered to be actively exploited by attackers. The vulnerability, known as CVE-2026-6875, allows unauthenticated threat actors to escape the sandbox … Read more
A New Wave of Stealthy Malware Exploits Microsoft 365 to Exfiltrate Data In a concerning development, researchers have discovered a sophisticated malware module called HollowGraph that uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel for stealthy communication. The malicious component, which is part of the Cavern framework linked to an … Read more
A sophisticated phishing campaign, aided by artificial intelligence (AI), has been exposed through an unintentionally left-open server. The discovery sheds light on the inner workings of a malware distribution operation that exploited WebDAV vulnerabilities to infect unsuspecting victims’ devices. This incident highlights the growing role of AI in cybersecurity threats and underscores the importance of … Read more
**Malware Campaign Exploits GitHub Repositories, Spreads SmartLoader Malware** A sophisticated malware campaign has been uncovered, using over 7,600 compromised GitHub repositories to spread the notorious SmartLoader malware. The FakeGit campaign, as it’s come to be known, demonstrates the ease with which malicious actors can exploit software development platforms and compromise users’ devices. The attackers created … Read more
Attackers have concocted a sophisticated phishing campaign designed to evade detection by leveraging a combination of fileless techniques and loaders with low detection rates. Dubbed “The TFF Trap” by researchers at Fortinet, this campaign has been observed since late March and has already seen widespread use in targeting Microsoft Windows systems. At its core, the … Read more
Microsoft is scrambling to fix a problem that’s been causing synchronization issues with its Windows Server Update Services (WSUS) servers, leaving many enterprise networks without access to the latest security patches and updates for over a week. This issue affects not just server administrators but also end-users who rely on IT teams to keep their … Read more