Intelligence · Updated daily
AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.
A previously undocumented Rust-based remote access trojan uses NVIDIA software masquerading as a social engineering vector to establish persistent hands-on access to Windows systems. The malware's use of a compiled language and legitimate vendor branding suggests a sophisticated threat actor.
Finnish authorities have issued a wanted notice for a suspect linked to the Vastaamo psychotherapy data breach, with the defendant's legal counsel indicating the individual is believed to be outside Finland. This suggests the investigation remains active and potentially unresolved months or years after the initial breach.
A threat actor has created approximately 300 fraudulent GitHub repositories mimicking legitimate software and security projects to distribute infostealer malware. This represents a significant supply-chain risk targeting developers who may inadvertently clone or depend upon these repositories.
Authenticated SQL injection in DIRAC's FileCatalog DatasetManager allows attackers to inject malicious Python code that executes via eval(), resulting in remote code execution with service privileges. This disclosure is significant for defenders because it demonstrates a two-stage attack chain (injection → unsafe deserialization) that may exist in other components.
The 2FA validation endpoint in FacturaScripts accepts unauthenticated TOTP codes without rate-limiting, CSRF protection, or prior password verification, enabling rapid brute-force attacks against any 2FA-enabled user account.
Official Kimai Docker images ship with a publicly-known default `APP_SECRET`, allowing unauthenticated attackers to forge Symfony HMAC-signed cookies and authentication tokens to assume any account. This affects all unpatched deployments that did not manually override the sentinel value.
CISA's postmortem on a contractor's accidental publication of internal credentials and AWS Govcloud keys to a public GitHub repository for six months before external notification exposes critical gaps in credential scanning, access controls, and incident response procedures.
SecurityWeek published an interview with Jesse McGraw (GhostExodus), a former blackhat hacker who served prison time and has since transitioned to cybersecurity advocacy. The piece explores personal redemption rather than detailing any active threat or vulnerability.
A new macOS information stealer called CrashStealer uses Apple-notarised droppers to evade Gatekeeper protections. Written in native C++ rather than scripting languages, it validates victim credentials locally before exfiltration.
The European Commission is proposing a regulatory framework to restrict social media access for children under 13, representing a significant policy shift toward age verification and platform accountability. This marks a move beyond current self-regulatory approaches but faces substantial technical and enforcement barriers.
Nihon Kotsu, Japan's largest taxi operator, experienced a cyberattack forcing partial system shutdown, disrupting dispatch and booking infrastructure for a major transportation provider serving millions of passengers.
SiYuan v3.6.5 and earlier contain stored XSS in database asset cells that escalates to RCE via Electron's enabled nodeIntegration. The vulnerability exists in two unescaped rendering sinks that execute arbitrary JavaScript with Node.js access on page load.
TSDProxy forwards its internal management authentication token to all proxied backend services by default, allowing network-local backends to bypass Tailscale identity verification and escalate privileges via the management API.
The Gentlemen ransomware operation has scaled through an affiliate recruitment model, enabling rapid growth and diversified targeting across multiple sectors. This represents a maturing threat group adopting proven operational patterns from established ransomware families.
A SecurityWeek roundup combines several significant incidents: a DHS database breach, Adobe's move to faster patching, Canadian law enforcement disruption of ransomware operations, and an Anthropic lawsuit against Abnormal AI alongside a major data breach affecting 7 million AssuranceAmerica customers.
Progress Software has instructed ShareFile customers to immediately shut down Storage Zone Controllers due to active exploitation of a critical vulnerability. The company disabled affected accounts preemptively whilst coordinating incident response.
The European Parliament has approved Chat Control 2.0 legislation that mandates large technology companies to scan private messages for child sexual abuse material. This represents a significant shift toward normalising client-side scanning and creates privacy and security risks across the EU's digital infrastructure.
Six vulnerabilities in U-Boot bootloader allow attackers to inject malicious code during device boot before the OS loads, enabling persistent firmware-level compromise that defeats standard security protections. This affects billions of embedded systems, IoT devices, and network equipment worldwide.
YesWiki's spam comment erasure action lacks authorization checks, allowing any default-privileged user to permanently delete arbitrary wiki pages including administrative content. This represents a complete loss of data integrity in default installations.
YesWiki's Bazar formula calculator uses unsafe eval() on user input after regex validation that is vulnerable to ReDoS, allowing both stack exhaustion DoS and arbitrary PHP code execution. The PoC demonstrates the fundamental architectural flaw: regex-based sandboxing is inherently bypassable.
Chinese and Indian state-sponsored actors conducted separate espionage campaigns targeting the same Pakistani police organisation, each motivated by distinct geopolitical interests in Pakistan's internal security apparatus. This convergence demonstrates how critical infrastructure becomes a contested domain when multiple regional powers perceive overlapping strategic value.
QIZ Security, an Israeli cryptographic posture management startup, has secured $17 million in funding to commercialise a platform addressing cryptographic governance and post-quantum cryptography readiness. This reflects growing enterprise demand for centralised crypto inventory and compliance tooling ahead of quantum-resistant algorithm transitions.
Datadog Security Labs has identified multiple coordinated campaigns conducting API-driven enumeration of corporate GitHub organisations, repositories, and user accounts. Attackers operate through years-old dormant accounts and compromised OAuth tokens, enabling reconnaissance at scale while evading detection.
Latvia's state-owned forestry company LVM was struck by a financially-motivated ransomware attack from a foreign threat group and remains in recovery weeks later, indicating either significant infrastructure complexity or data exfiltration complications that extend remediation timelines.
A contributor to OpenMandriva Linux attempted to sabotage the project following a dispute, highlighting how community-driven distributions remain vulnerable to insider threats despite distributed development models.