Ionut Arghire

A critical-severity flaw could be exploited remotely, without authentication, to take over a vulnerable device.

Attackers could exploit these vulnerabilities in denial-of-service, information disclosure, and arbitrary code execution attacks.

The document provides a behavior-based model of the tactics and techniques employed by fraudsters.

Within nine hours, a hacker built an exploit from the unauthenticated bug’s advisory and started using it in the wild.

New Device Bound Session Credentials render stolen session cookies unusable by cryptographically binding authentication.

Dozens of such keys can be extracted from apps’ decompiled code to gain access to all Gemini endpoints.

The bugs could allow attackers to modify protected resources and escalate their privileges to administrator.

Tracked as UNC6783, the threat actor is likely linked to Mr. Raccoon, the hacker behind the alleged theft of Adobe data from a BPO.

In December 2025, hackers stole names and passport numbers from the European travel company’s network.

The vulnerability requires authentication for successful exploitation, but another flaw exposes the Jolokia API without authentication.

The FBI received over 1 million complaints of malicious activity in 2025, with investment, BEC, and tech support scams causing the highest losses.

Focused on persistence, the botnet does not engage in widespread infection and avoids blacklisted IPs and critical infrastructure entities.

The vulnerability allows hackers to upload arbitrary files to a site’s server and achieve remote code execution.

The startup has created a layered security solution aiming to secure AI agents throughout their entire lifecycle.

The improper validation of user-supplied JavaScript code allows attackers to execute arbitrary code and access the file system.

By targeting Grafana’s AI components, attackers can point to external resources and inject indirect prompts to bypass safeguards.

The group is using zero-days, quickly weaponizes fresh bugs, and exfiltrates and encrypts data within days of initial access.

Shchukin is accused of extorting more than $2 million as the head of the GandCrab and REvil ransomware operations.

A vulnerability named ‘AI Agent Traps’ allows attackers to manipulate, deceive, and exploit visiting agents via malicious web content.

Hackers published 36 NPM packages posing as Strapi plugins to execute shells, escape containers, and harvest credentials.