Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been described as a type confusion bug in V8, Chrome's J…
A Broadcom, fabricante do software de virtualização VMware, publicou o comunicado de segurança VMSA-2026-0007 alertando para duas vulnerabilidades em seus produtos VMware Workstation e VMware Fusion, que podem permitir que um atacante execute código no sistema operacional host a …
Threat actors behind the "Phantom Deal" campaign are studying companies in extreme detail, aiming to dupe midlevel employees into initiating large financial transfers.
Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code. [...]
In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the latest antics of ShinyHunters to new research about the prevalence (or lack thereof) of AI-generated malware.
Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution. [...]
The worst part is how normal these attacks look. A call from IT. A shared file. A trusted app. A simple request to click “Allow.” Why break in when someone might open the door? That idea runs through this edition. Attackers use real tools, fake login pages, old account links, an…
Cisco has released patches to address a critical security flaw affecting 10 Silicon One-based Nexus 9000 switches that could allow an unauthenticated, remote attacker to execute code as root, alongside an IOS XR hardening release bundling 7 umbrella CVEs, 2 of which are rated 9.8…
Cybersecurity researchers have disclosed details of a sophisticated Python-based Windows malware framework called BraZetsu that fuels an underground marketplace commercializing access to compromised hosts. "Unlike the standard infostealer model, BraZetsu is a comprehensive maste…
A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server. [...]
Um pesquisador de segurança conhecido como Chaotic Eclipse, também identificado como MSNightmare e Nightmare-Eclipse, publicou na madrugada de hoje um código de prova de conceito para o que ele alega ser uma vulnerabilidade de elevação de privilégios não corrigida no sensor Crowd…
The incident demonstrates how frontier AI agents can dramatically compress an attack timeline and coordinate a large-scale breach, according to researchers.
Five Healthcare Providers Report Ransomware-Related Data Breaches The HIPAA Journal
Data breaches have been confirmed by Alta Orthopaedics in California, Cornerstone Behavioral Healthcare in Maine, Cameron Regional Medical Center in […] The post Five Healthcare Providers Report Ransomware-Related Data Breaches appeared first on The HIPAA Journal.
By Steve Akers - Healthcare security programs were built around an assumption that no longer holds everywhere: that a human sits on the other end of an attack, working at human speed and making human mistakes. That is why the Five Eyes intelligence alliance, in a joint advisory t…
Brazil's most sophisticated threat group is making light work of the country's financial systems, putting money directly into its own pocket.
An RMM phishing campaign initially associated with Canadian targeting due to its use of Canada Revenue Agency (CRA) tax forms as lures has turned out to be part of a broader campaign spanning 46 countries. Around 45% of observed activity was associated with the United States, ma…
Operadores ligados ao ransomware The Gentlemen estão usando um novo framework de comando e controle chamado TukTuk para roubar credenciais, monitorar máquinas comprometidas e preparar ambientes para ataques de ransomware. O conjunto foi identificado em um servidor que também arma…
Plex urged users this week to update their desktop clients and media servers immediately to patch multiple security vulnerabilities. [...]
A SonicWall corrigiu duas vulnerabilidades zero-day no Secure Mobile Access (SMA) 1000 que já estão sendo exploradas em ataques. As falhas podem ser combinadas para obter acesso não autorizado e, em determinadas condições, executar comandos no appliance. A mais grave, CVE-2026-83…
