A Critical Flaw in XQUIC Puts HTTP/3 Servers at Risk of Remote Crashes A severe vulnerability, dubbed XRING, has been discovered in the XQUIC protocol, which is used by some HTTP/3 servers. The flaw allows remote clients to crash these servers with a single malicious packet, putting sensitive online services and data at risk. What’s … Read more
A New and Highly Sophisticated RAT Exploits gRPC Streaming for Stealthy C2 Traffic A sophisticated new malware variant known as MODBEACON RAT has been discovered, leveraging the gRPC streaming protocol to facilitate encrypted command and control (C2) communication between compromised systems. This latest threat poses a significant challenge to cybersecurity experts, who must now contend … Read more
A newly uncovered WhatsApp-to-host attack chain, leveraging three previously unknown vulnerabilities in OpenClaw software, poses a significant threat to users and organizations worldwide. The exploit allows attackers to remotely execute malicious code on unsuspecting hosts, making it a potentially devastating tool for cybercriminals. The vulnerabilities, identified by cybersecurity researcher Alex Pilkington, reside within the OpenClaw … Read more
A new phishing tactic has been discovered, where hackers are impersonating Microsoft’s Entra Passkey enrollment process to gain unauthorized access to Microsoft 365 accounts. This cunning approach leverages the trust users have in legitimate company services, making it a particularly effective and insidious form of social engineering. The attack begins when an unsuspecting user receives … Read more
A study of 281 free Android VPN apps has revealed alarming security lapses, including traffic leaks, unencrypted data transmission, and tracking capabilities that put users’ sensitive information at risk. The investigation, conducted by researchers from a leading cybersecurity firm, shed light on the vulnerabilities inherent in these popular mobile apps. The researchers analyzed a range … Read more
A massive backdoor campaign targeting thousands of WordPress sites has come to light, courtesy of an exposed hacker server that’s been leaking sensitive data online. The revelation sheds light on the WP-SHELLSTORM malware, a sophisticated piece of code designed to grant malicious actors unfettered access to compromised websites. At its core, WP-SHELLSTORM is a type … Read more
A Major Overhaul: Lumen Technologies Ditches Legacy Exposure Management for AI-Powered Solution Lumen Technologies, a leading provider of network infrastructure and cybersecurity services, has undergone a significant transformation in its exposure management strategy. The company has abandoned its legacy system, which initially identified 17,000 potential vulnerabilities, in favor of an AI-driven solution that now detects … Read more
A Critical Flaw in XQUIC Puts HTTP/3 Servers at Risk of Catastrophic Failure A high-severity vulnerability, dubbed XRING, has been discovered in the XQUIC protocol, which underlies the emerging HTTP/3 internet standard. The flaw allows remote clients to crash servers handling HTTP/3 traffic, potentially causing widespread service disruptions and data losses. The XRING issue arises … Read more
Researchers have uncovered a novel attack technique that exploits the tendency of AI assistants to “hallucinate” or make incorrect assumptions when faced with incomplete information. Dubbed “HalluSquatting,” this method leverages the fact that AI tools often generate fictional repository or package names in response to requests for popular resources, allowing attackers to pre-register these fake … Read more
A Sophisticated Wiper Malware, GigaWiper, Allows Threat Actors to Combine Destructive Capabilities with Espionage-Grade Backdoor A highly advanced malware, dubbed GigaWiper, has been used by a threat actor for over eight months to devastating effect. According to Microsoft, the malware combines multiple system-level sabotage capabilities with robust command-and-control (C&C) features, making it a formidable tool … Read more