Three teams demonstrated remote exploits against fully patched Pixel 10 phones at Pwn2Own Ireland, earning $562,500 in total.

Citrix patched CVE-2026-107406, a critical NetScaler memory overflow that could allow RCE or DoS in deployments configured ...

U.S. authorities seized seven domains used by China-linked Flax Typhoon to scan networks and support intrusions into critical ...

JPCERT/CC links Japan's recent data leaks to mobile API abuse and known software flaws, including an exploited Metabase SQL ...

A GoBalance signing flaw lets attackers recover Tor-format .onion private keys from public descriptors and hijack affected site addresses.

ThreatsDay: Malicious VS Code themes, npm supply-chain attacks, AI phishing, ransomware betrayal, exposed hacker tools, and ...

Attackers used ARTEX and LLMs against South Korean financial organizations in a campaign that resulted in data exfiltration.

TrendAI links UAC-0099 to ASHVEIN, a .NET stealer and RAT used in attacks targeting Ukrainian government personnel.

Sixteen malicious Firefox extensions imitate Rabby and OKX wallets to intercept recovery phrases and private keys during ...

Malicious tensorlake npm version 0.5.144 contained a Shai-Hulud worm that harvests credentials and can republish compromised ...

MonsterCloud's owner is accused of charging ransomware victims over $19 million while secretly paying attackers over $8 ...

Wazza filters visitors with session tokens and browser checks before serving Adobe-themed Device Code phishing pages.