Ionut Arghire

PowerShell and .NET variants of the malware abuse AirWatch’s MDM API to establish a C&C communication channel.

The two bugs are high-severity type confusion and inappropriate implementation issues in the browser’s V8 JavaScript engine.

Open VSX fully contained the GlassWorm attacks and says it was not a self-replicating worm in the traditional sense.

Broadcom has updated its advisory on CVE-2025-41244 to mention the vulnerability’s in-the-wild exploitation.

The Windows shortcut vulnerability has been seen in attacks conducted by Mustang Panda to drop the PlugX malware.

The company will expand its product offering, establish global headquarters in Boston, and fuel growth and go-to-market efforts.

The hackers stole names, addresses, dates of birth, Social Security numbers, and health and insurance information.

The packages deployed malicious code harvesting system information, credentials, tokens, API keys, and other sensitive information.

Peter Williams stole trade secrets from his US employer and sold them to a Russian cybersecurity tools broker.

The company has built a plug-and-play photonic layer transmission system that encrypts data in transit to prevent interception.

Exploits have been available publicly for over half a year, but the bug was previously targeted only for reconnaissance.

Starting October 2026, the browser will ask users if they want to access public websites that do not use secure connections.

Two DELMIA Apriso flaws can be chained together to gain privileged access to the application and execute arbitrary code remotely.

The critical-severity flaw allows attackers to smuggle HTTP requests and access sensitive data, modify server files, or cause DoS conditions.

A new class of Mirai-based DDoS botnets have been launching massive attacks, but their inability to spoof traffic enables device remediation.

The email addresses were pulled from various sources and 16.4 million of them were not present in previous data breaches.

The hackers stole information from a file transfer solution and the country’s power supply was not affected.

The malicious Smishing Triad domains were used to collect sensitive information, including Social Security numbers.

All new extensions will be required to declare their data collection practices in their manifest file using a specific key.

Roughly 9 million exploit attempts were observed this month as mass exploitation of the critical vulnerabilities recommenced.