Three high-severity security flaws have been disclosed in Hugging Face’s Diffusers library that could allow crafted model repositories to stealthily execute arbitrary code on machines that load it, opening the… Read More »Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
N-able said attackers exploited an authentication bypass in N-central to gain remote administrative access and reach the customer systems managed through those servers. Its first fix was incomplete. CVE-2026-18577 affects… Read More »N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete
Thermo Fisher Scientific has patched a flaw in select Applied Biosystems human identification software that could allow data files to be altered before analysis software loads them. The vendor’s July… Read More »Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectable
An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million at the time. Galaxy Research mapped the sweep and tied it… Read More »Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes
Attackers modified a JavaScript file served by advertising technology company Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. Adform detected the incident on July 27, 2026,… Read More »Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites
A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake, a remote access trojan (RAT) that can capture webcam images, microphone audio, and keystrokes, Microsoft… Read More »Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware
Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked… Read More »Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and… Read More »Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk
Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka. According to Blackpoint Cyber, the intrusion sequence begins… Read More »HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm
Bitsight says some cheap Android TV boxes have shipped with apps that rewrite their hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo phones, then click ads on websites run… Read More »Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies