Cybersecurity News

CubeCart 6.7.4 - Stored XSS

CubeCart 6.7.4 - SQL

CubeCart 6.7.4 - SQL injection

C-MOR 6.0104 - Cross-Site Scripting (XSS)

C-MOR 6.0104 - Directory Traversal

A large-scale phishing campaign used fake voicemail SVG attachments to bypass email defenses, targeting 5527 organizations with over 26,000 malicious messages

More than 100 companies, including OpenAI, Anthropic, Google and Microsoft, have urged collective action to unlock the power of AI to protect critical public services

Aurora ransomware operators are abusing SpaceX’s Cursor Agent AI tool to conduct tasks such as reconnaissance and exploitation activities

The ClickFix campaign that sideloads a malicious mscoree.dll also ships a driver to kill Elastic Endpoint. We rebuilt that DLL as a NativeAOT library, dropped it beside a signed Microsoft binary, and Elastic Defend 9.5.0 flagged the load.

Customer data linked to bookings and airport Wi-Fi registrations at Manchester, Stansted and East Midlands airports has been accessed by an unauthorized third party

Owners of operational technology encouraged to address avoidable vulnerabilities, and build long-term cyber resilience.

The FBI advisory set out QTFY’s distributed hacking ecosystem, allowing it to exploit vulnerabilities at scale and obfuscate its activities

CISA added six new bugs to its Known Exploited Vulnerabilities catalog on August 26, showing signs of active exploitation in the wild

MedTech giant Boston Scientific has revealed IT outages following a cyber incident

OpenAI reveals that unauthorized message boards were at the heart of the recent Hugging Face breach

It’s getting cheaper and easier for cybercriminals to research potential victims. Here’s what’s still in your control.

In this post, we explore how a simple website summary request hijacks Claude Code Opus 5 in Auto Mode and achieves code execution with 60-80% attack success rate using a small sample size. This is interesting because a third-party evaluation commissioned by Anthropic showed a 0.00% prompt injection attack success rate for Opus 5 in Auto Mode. Auto Mode Is Now the Default in Claude Code Auto Mode replaces human approval prompts with a safety classifier. Since mid-August it is the default starting mode for Claude Code.

Discover how the Russian state-sponsored threat group BlueDelta is using the HOOKEDGE backdoor to target defense and diplomatic organizations across Europe

Group-IB uncovered new Tortoiseshell infrastructure, including a backdoor and SSH tunneling tool

Interpol operation leads to 58 arrests and identifies 263 suspects across 22 countries

Reco report reveals growing shadow AI problem and surge in vulnerability disclosures

Chubb reported that growing privacy litigation has contributed to surging cyber claim costs in the US

This new open standard offers hardware-attested runtime and compliance evidence for AI agents

A coordinated DDoS campaign has caused disruption among Norwegian government services

AI Alert Filtering is now available. Powered by Recorded Future AI, it automates the first pass of filtering Alerts by relevance so analysts prioritize faster while keeping control.

ZeroTokens gives phishing operators live control of victim sessions targeting 53 financial brands

I was on my laptop, as I often am when there's rubbish on telly, and found myself wondering what characters are allowed in a tag. I knew they had to begin with "a-zA-Z", but what about after that? I t

RecruitTrap campaigns use mobile-optimized phishing pages to target enterprise credentials

Australian officials are urging TeamCity customers to patch an actively exploited critical flaw, which follows a similar warning from the US government

A threat actor keeps spreading the WeedHack malware to Minecraft players despite its original infrastructure taken down in July