A New Breed of Malware Emerges, Using AI Agents to Hijack Exposed Docker Hosts Cybersecurity researchers have discovered a sophisticated new malware botnet, dubbed Carbonato, that is targeting insecure hosts running Docker daemons. The malware uses artificial intelligence (AI) agents to hijack exposed Docker hosts, making it a particularly concerning development for organizations that rely … Read more
A massive third-party library, referenced across over 1,700 online repositories, has been compromised and is now serving malicious content. This development has significant implications for developers and users alike, highlighting the need for vigilance in managing dependencies and protecting against supply chain attacks. The affected library, which we’ll refer to as “third-party[.]com” for the sake … Read more
Identity exposure is a fundamental problem in cybersecurity, and it’s not just about password breaches or data dumps. A recent spate of incidents highlights the critical issue of identity exposure as an attack vector, where compromised credentials unlock active attack paths that can lead to devastating consequences. We’re taking a closer look at 11 real-world … Read more
A Critical Vulnerability in OnePlus Phones Puts Millions of Users at Risk, Even with Installed Security Apps A newly discovered vulnerability in certain OnePlus phones has been found to allow installed Android apps to gain root access without requiring explicit user permissions. This means that malicious software can exploit a flaw in the phone’s operating … Read more
A major new update has landed for Windows 11, bringing a slew of improvements and bug fixes to users. The KB5124010 September 2026 non-security preview update is now available for both Windows 11 24H2 and 25H2 devices, with 46 changes aimed at enhancing the overall user experience. This optional update allows administrators and users to … Read more
Critical Roundcube Webmail Flaw Exploited in Code Injection Attacks, Thousands of Users at Risk Hackers have started exploiting a high-severity vulnerability in Roundcube Webmail, a widely used browser-based email client, to carry out code injection attacks. The flaw, patched in May but now actively exploited, allows attackers with no privileges to bypass authentication and inject … Read more
If you’re among the thousands of organizations that hold a FedRAMP certification, your attention is likely focused on the rapidly approaching deadline of December 7, 2026. This is the day when two critical rules, Vulnerability Detection and Response (VDR) and Verification and Evaluation (VER), will become mandatory for all cloud service offerings obtaining or maintaining … Read more
Critical Roundcube Vulnerability Exploited in Code Injection Attacks, Leaving Millions of Users Exposed A highly critical vulnerability in the popular webmail client Roundcube is being actively exploited by hackers, putting millions of users at risk. The Canadian Centre for Cyber Security has issued a warning that attackers are now taking advantage of the flaw, which … Read more
Yesterday, a critical vulnerability in WordPress was exploited by attackers mere hours after its public disclosure. The bug, identified as CVE-2026-87902, affects all versions of WordPress prior to 5.9.2 and allows an attacker to gain elevated privileges on a compromised site. The impact of this exploit is far-reaching, with thousands of websites potentially vulnerable to … Read more
A Critical Deadline Looms for FedRAMP-Certified Cloud Providers: Understanding the Impact of VDR and VER Rules FedRAMP-certified cloud providers have a critical deadline approaching on December 7, 2026. By this date, new rules governing vulnerability detection and response (VDR) and vulnerability exposure reporting (VER) will become mandatory for all cloud service offerings seeking or maintaining … Read more