Over 270 Zimbra servers have been compromised by hackers in ongoing attacks that exploit a high-severity vulnerability in the email and collaboration suite. The attacks, which are being tracked as CVE-2026-73570, allow unauthenticated attackers to gain code execution remotely by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled. … Read more
A critical vulnerability in a widely-used WordPress plugin has left thousands of websites exposed to potential attacks, allowing malicious actors to gain administrator access. miniOrange’s SAML (Security Assertion Markup Language) implementation, which provides single sign-on functionality for WordPress sites, contains flaws that can be exploited by attackers. The issue, discovered through a real-world incident, reveals … Read more
Cybersecurity’s Catch-22: Discovery Outpaces Repair as Vulnerability Gap Widens In a stark illustration of cybersecurity’s speed-of-light challenges, the gap between vulnerability discovery and remediation has grown alarmingly wide. Advanced AI models are now capable of pinpointing serious flaws in widely used open source software in mere hours, whereas fixing these vulnerabilities takes weeks or even … Read more
A New Era of Mobile Threats Emerges as ToxicPanda Banking Trojan Evolves The latest iteration of the Android-based malware, ToxicPanda 2.0, has been making waves in the cybersecurity community with its expanded capabilities and increased reach. What was initially a threat targeting only 16 financial institutions has now grown to target 349 banking, e-wallet, and … Read more
A Sophisticated Malware Family Emerges with Potential Ransomware Implications A newly discovered malware family, dubbed “SynkLoader,” has been making waves in the cybersecurity community due to its advanced features and potential for causing significant harm. This multilingual malware is capable of executing code in-memory, running scheduled tasks, and even hijacking screens to steal sensitive information … Read more
Cyber attackers have found a new way to evade detection and deliver malware, using lists of ordinary English words to conceal malicious code. This tactic is being employed by a growing number of threat campaigns, including those that use ClickFix-style attacks to infect Windows machines with the increasingly prevalent infostealer Amatera. Researchers from Gen Threat … Read more
A critical vulnerability in Oracle WebLogic has been actively exploited by attackers, allowing unauthenticated users to access sensitive data. The flaw, which affects various versions of the web server software, has been identified as CVE-2021-2109 (also known as Log4Shell). This means that any organization using WebLogic without proper security measures is at risk of being … Read more
Personal information has been compromised in a data breach affecting private equity giant Apollo Global Management. The company revealed that hackers gained access to its cloud platforms through a social engineering attack, potentially exposing sensitive details such as names, contact information, and Social Security numbers. The incident occurred between July 6 and 10, with an … Read more
A Venezuelan national has been handed a record federal prison term of 8 years for his role in a sophisticated ATM jackpotting scheme that caused millions of dollars in losses across the United States. Juan Manuel Gouveia-Aguilera, 27, pleaded guilty to bank fraud, bank burglary, and cyber-enabled fraud charges after his involvement in the high-tech … Read more
A massive update has been released for the Spring application development framework, addressing a staggering 91 vulnerabilities that could have allowed attackers to compromise enterprise applications. The patch is crucial for developers and organizations using Spring, as it mitigates potential threats ranging from low-severity issues to critical remote code execution flaws. Spring, an open-source framework … Read more