AI reads 36 sources every 2 hours and ranks each story by importance from 1 to 5 - so you see what actually matters.
Security researchers have found that spyware can infect smartphones without any user interaction, delivered through targeted advertising networks. The attack, described as a "nightmare scenario," lets attackers compromise phones silently by exploiting ad delivery systems that reach specific users. It raises major concerns because no click or download is needed, making the technique hard to detect and defend against.
A campaign dubbed GhostAction has compromised roughly 1,900 GitHub accounts and targeted more than 30,000 repositories, according to security researchers. Attackers appear to abuse GitHub Actions workflows and stolen credentials to push malicious code into projects. The incident highlights the growing risk of software supply chain attacks, where tampering with widely used code can quickly spread to downstream users and organizations.
Attackers have repeatedly tried to exploit a critical remote code execution flaw in Langflow, an open-source tool for building AI applications, with researchers logging 1,423 exploitation attempts across honeypot sensors. The flaw requires authentication to trigger, but successful exploitation would let attackers run arbitrary code on vulnerable servers. The volume of attempts signals that automated scanners and botnets have already weaponized the bug, putting unpatched Langflow deployments at risk.
AhsayCBS has released new fixes for security flaws that attackers exploited to install web shells on vulnerable servers. The updates follow earlier patches that were found to be incomplete, leaving systems exposed to remote compromise. Administrators should update immediately because exposed backup servers can be used for persistent access and further attacks.
Palo Alto Networks has released fixes for a remote code execution vulnerability in its PAN-OS firewall operating system after reports that attackers are already exploiting it. The flaw requires authentication, but successful exploitation could let attackers run malicious code on affected devices. Organizations running PAN-OS should apply the patches promptly, as actively exploited firewall bugs pose a serious risk to enterprise networks.
Cisco has disclosed a newly identified critical vulnerability in its Secure Email Gateway and says attackers are already exploiting it in the wild. The company has issued warnings and guidance urging administrators to patch or mitigate immediately. Because Secure Email Gateway sits on the edge of corporate mail networks, successful exploitation could expose sensitive email traffic and internal systems at many organizations.
Attackers are exploiting a critical vulnerability in Collabora's built-in CODE app to plant backdoors in Nextcloud servers, according to The Hacker News. Nextcloud is widely used by businesses, governments, and universities to host private file-sharing and collaboration services, so a flaw in a bundled component can expose large numbers of organizations at once. Administrators are urged to patch or disable the affected app and check their servers for signs of compromise.
Microsoft has disrupted three phishing kits linked to more than 1 billion scam messages, according to reports. The action targets infrastructure used to send large-scale phishing and fraud campaigns. It matters because such kits help criminals launch scams at scale, though operators may rebuild.
U.S. authorities dismantled more than 40 laptop farms and charged 14 people in a scheme involving North Korean IT workers fraudulently obtaining remote tech jobs. The operation allegedly generated illicit revenue for North Korea and helped evade sanctions. The crackdown matters because it targets a growing tactic used to infiltrate Western companies and fund Pyongyang’s weapons programs.