“AI”

wp2shell critical chain saw 45 million exploit attempts, illustrating compressed vulnerability exploitation windows for popular WordPress sites.

Encrypted prompt injection in xAI's Grok enables zero-click theft of names, locations, subscription tiers and prompt history.

Trojanized npm packages install RedC2 4.0 Linux backdoor with AI-assisted command-and-control capabilities.

Retired official in Pune lost ₹1.15 crore to a fake trading app campaign promoted via social engineering.

Over 9,300 exposed AWS access keys remain active between 2022-2026, enabling potential full control over corporate accounts.

Type-confusion V8 sandbox bug enables isolated-vm escape and remote code execution on the host process.

Cisco fixes nine Crosswork and Secure Workload vulnerabilities, five rated CVSS 10.0 requiring urgent updates.

Three suspected Russian espionage clusters abuse OAuth and WhatsApp linking to hijack accounts at academia, aerospace and governments.

Researchers found over 50,000 exposed Stripe API keys, increasing fraud and payment compromise risk for merchants.

Supply-chain compromise of Android car head unit updater spreads malware to build ad-fraud and proxy botnet on vehicles.

Iran-linked attackers forced a UK power plant offline for four days, disrupting energy infrastructure operations.

ToxicPanda Android malware abuses VPN permissions to block Google Play and expand remote command control across apps.

Medusa ransomware campaign now affects 500+ organizations and increasingly targets critical infrastructure sectors.

CISA ordered immediate patching of TrueConf Server vulnerabilities that are being actively abused to deploy malware.

Malicious Rust crate releases introduced build-time payloads, affecting widely used packages and prompting removals.

Critical Entra ID RCE patched; exploited reports prompted emergency guidance and wide Microsoft updates.