Researchers demonstrate InjectEave EM attack, SIM swapper is sentenced to prison, and VulnCheck reviews vulnerabilities found via Glasswing.

A government organization providing cloud infrastructure to Indian companies is inadvertently distributing malware.

A rapidly adopted exploit kit, dubbed BlueMoon, chains Chrome and Microsoft Windows zero-days to compromise targets in espionage-focused phishing campaigns.

AI agents helped attackers launch a cloud credential theft campaign in under six hours, stealing thousands of third-party ...

Magento zero-day vulnerability CVE-2026-75650 exploited a fully patched store for three days before Adobe released APSB26-146 on September 7. A self-updating Rust backdoor survived the patch, evaded ...

Microsoft 365 phishing MFA bypass platform BigBear 2.0 compromised 258 organizations across 40+ countries by using custom JavaScript to disable FIDO2 hardware key authentication before stealing authen ...

Chrome zero-day attacks, router hijacks, Coder’s supply chain breach, image-free QR phishing, and more security news.

MCP is now stateless at the protocol level. The Mcp-Session-Id header and the initialize/initialized handshakes that linked ...

External data should be treated as hostile until it has been checked, constrained, and transformed for the specific place it will be used. That applies whether the data comes from a browser form, a ...

GENEVA — An 18-year-old man with a sword attacked a school Friday in central Sweden, leaving one person dead and at least two others seriously injured, a police chief said. Police Chief Tommy ...

Russian drone and missile strikes killed at least seven people in Ukraine, officials said Saturday, while a Ukrainian drone attack on Russia's Krasnodar region killed three others. The attacks came a ...

Russian drone and missile strikes killed at least seven people in Ukraine, officials said Saturday, while a Ukrainian drone attack on Russia’s Krasnodar region killed three people there. The attacks ...