Stay ahead of emerging threats with expert analysis from 84+ security articles, vulnerability reports, and cybersecurity insights — updated daily with the latest CVEs, threat actor campaigns, and security advisories. This week: Russian CTRL toolkit using named pipes for stealth persistence, Iran's Handala group breaching FBI Director email and deploying wiper malware, and critical LangChain/LangGraph AI stack vulnerabilities putting enterprise AI deployments at risk.
North Korean hackers drained $285 million from Solana-based Drift Protocol using social engineering to compromise multi-signature approvals. The attack involved no code exploits, just patient manipulation of human trust over several weeks.
Check Point researchers discovered a ChatGPT vulnerability allowing silent data exfiltration via DNS queries from the code execution sandbox. Separately, BeyondTrust found a critical command injection flaw in OpenAI Codex that enabled GitHub token theft through malicious branch names.
Read moreThe Iran-linked Handala Hack Team breached FBI Director Kash Patel's personal email and executed a devastating wiper attack against medical technology company Stryker. This marks the first confirmed destructive wiper operation targeting a U.S. Fortune 500 company.
Read moreThree critical vulnerabilities in LangChain and LangGraph let attackers steal files from filesystems, siphon API keys and environment secrets, and pillage conversation histories. With 84 million weekly downloads, most enterprise AI deployments are affected.
Read moreSecurity researchers at Cyera disclosed three vulnerabilities in LangChain and LangGraph affecting millions of AI applications. Path traversal, deserialization, and SQL injection flaws expose filesystem contents, environment secrets, and conversation histories.
Read moreTeamPCP has compromised LiteLLM, a Python package present in 36% of cloud environments. Malicious versions 1.82.7 and 1.82.8 deploy credential harvesters, Kubernetes lateral movement tools, and persistent backdoors.
Read moreOracle patches CVE-2026-21992, a pre-auth RCE in Identity Manager scoring 9.8 CVSS. No credentials needed to exploit. Emergency patches available now.
Read moreA second supply chain attack on Trivy compromised 75 GitHub Actions tags and spawned a credential-stealing worm across 47 npm packages. Check your CI pipeline.
Read moreCritical authentication bypass in Veeam Backup & Replication allows attackers to delete backup repositories without credentials.
Read moreA critical vulnerability in VMware ESXi allows attackers to escape from a guest virtual machine and execute code on the hypervisor.
Read moreSophisticated iOS exploit kit chains six vulnerabilities including three zero-days to achieve complete device takeover. Multiple threat actors including Russian espionage groups and commercial surveillance vendors observed using DarkSword against targets in Ukraine, Saudi Arabia, and Turkey.
Read moreNine critical vulnerabilities in budget IP KVM switches from GL-iNet, Angeet, Sipeed, and JetKVM allow unauthenticated code execution and hardware-level access.
Read moreCISA added CVE-2025-47813 (info disclosure) to KEV, used to enhance CVE-2025-47812 (CVSS 10.0 RCE) exploitation. Attackers chain both flaws for reliable remote access. Wing FTP patches available since May 2025. Federal deadline: March 30.
Read moreGoogle patched CVE-2026-3909 (Skia OOB write) and CVE-2026-3910 (V8 implementation flaw), both actively exploited. Third Chrome zero-day emergency in 2026. Update to 146.0.7680.75/76 immediately.
Read moreCVE-2026-42071 (CVSS 9.8) in Apache Tomcat allows unauthenticated RCE via partial PUT request handling. Actively exploited 30 hours after disclosure.
Read moreA critical arbitrary file read vulnerability in Jenkins allows attackers to extract credentials, API keys, and secrets from CI/CD pipelines.
Read moreA critical authentication bypass in Citrix NetScaler Gateway and ADC allows attackers to access protected resources without valid credentials.
Read moreSonicWall discloses a critical pre-authentication RCE vulnerability affecting SMA and SonicOS products.
Read moreA critical RCE vulnerability in Atlassian Confluence is being mass-exploited by multiple threat actors.
Read moreIvanti discloses another actively exploited zero-day chain in Connect Secure VPN appliances. CVE-2026-0778 and CVE-2026-0779 allow unauthenticated attackers ...
Read moreOur CyberOne MobileAssess platform performs deep static analysis, source code decompilation, and runtime security testing for iOS and Android apps. From one-time assessments to year-long continuous testing, we find what surface-level scanners miss.
Subscribe to our newsletter and get the latest security insights delivered to your inbox.