A flaw in Cloudflare Containers let a paying customer read data that other customers’ containers had left behind on the same server, Cloudflare and the researchers who found it said… Read More »Cloudflare Fixes Flaw That Let One Container Read Another Customer’s Leftover Disk Data
This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times… Read More »ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws… Read More »Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions
The “third-party[.]com” domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. “third-party[.]com has been… Read More »Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content
An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic.… Read More »Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
AI coding agents are changing how quickly developers can build and ship software as well as how quickly credentials can become exposed. According to GitGuardian’s 2026 State of Secrets Sprawl… Read More »Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignore
The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM. According to Have I Been Squatted, the campaign uses… Read More »Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls
ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat… Read More »17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360
Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure. The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow… Read More »Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily… Read More »TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords