Security News & Blog

AryStinger has compromised at least 4,300 legacy routers, primarily D-Link DIR-850L and DIR-818LW devices, using vulnerabilities dating back as far as 2013. Unlike many conventional IoT botnets focused mainly on denial-…

The disclosure of the USBLighter8 exploit demonstrates that even the earliest and most trusted stages of a modern device’s boot process can be undermined by a flaw built into the hardware.USBLighter8 targets Apple’s Sec…

The Texas Parks and Wildlife Department data breach demonstrates how a compromise at a third-party service provider can expose millions of government records without attackers necessarily breaching the government agency…

The active exploitation of an information-disclosure vulnerability in the Gravity SMTP WordPress plugin demonstrates how a flaw that does not directly provide code execution can still create serious security exposure.Th…

CISA’s warning that a critical Splunk Enterprise vulnerability is being actively exploited should be treated as an urgent security event, particularly because Splunk often occupies one of the most trusted and informatio…

India’s temporary restriction of Telegram over alleged examination-leak and fraud channels highlights the difficult balance between platform accountability, public safety, examination integrity, and the rights of millio…

The Klue OAuth breach demonstrates how third-party SaaS integrations can become a highly effective route into enterprise cloud data. Instead of compromising each affected organization individually, attackers gained acce…

The discovery of a USB-spreading malware campaign targeting cryptocurrency users demonstrates that removable media remains an effective attack channel, even in an era dominated by cloud applications, phishing emails, an…

F5’s disclosure of two critical vulnerabilities in NGINX Open Source highlights the security risks created when widely deployed web infrastructure handles modern HTTP protocols under unusual or attacker-controlled condi…

The Nintendo data breach linked to the compromise of the TinyPulse employee survey platform demonstrates how third-party services can expose an organization even when its own systems remain secure.Nintendo of America co…

The comment below is based on the reported 33-day intrusion into a small French automotive business, during which the attacker used in-memory malware, a keylogger, scheduled tasks, RustDesk, OpenSSH, and Tailscale to ma…

Kodak’s confirmation of unauthorized access to company data highlights the continuing shift from traditional ransomware toward data theft and extortion. In these attacks, cybercriminals may not need to encrypt systems o…