AI reads 36 sources every 2 hours and ranks each story by importance from 1 to 5 - so you see what actually matters.
A suspected Chinese state-linked hacking group chained previously unknown flaws in Google Chrome and Windows to infect targets with a backdoor called CLEANGULP. The zero-day exploit required no user action beyond visiting a malicious page, giving attackers deep access to compromised machines. It matters because the bugs affected the world's most widely used browser and operating system, exposing millions of users until patches were released.
A critical vulnerability in Next.js's ImageResponse feature allows attackers to trigger remote code execution on affected servers by supplying specially crafted SVG input. ImageResponse is widely used to generate dynamic Open Graph and social preview images, so any app that exposes it to untrusted input may be at risk. Administrators should check for patched versions and update promptly or restrict the endpoint until a fix is applied.
The hacking group ShinyHunters says it breached FBI systems and stole data belonging to agents and job applicants, according to TechCrunch. The claim has not been verified by the bureau, and the extent of any real intrusion remains unclear. If confirmed, a compromise of FBI personnel records would be a serious national security and counterintelligence concern.
Researchers found a malicious package on the npm registry disguised as a tool for Twilio's bug-bounty program, which harvests and exfiltrates developer credentials when installed. The discovery highlights the ongoing risk of supply-chain attacks targeting open-source package ecosystems. Developers are urged to audit dependencies and rotate any credentials exposed.
Microsoft has taken down EvilTokens, a phishing-as-a-service platform that abused the OAuth device-code flow to steal access tokens and compromise roughly 12,000 inboxes. The service let attackers bypass multi-factor authentication and resell working account access to other criminals. The takedown matters because device-code abuse targets the cloud identity systems used by businesses worldwide, and this operation was among the more widely used tools for it.
A critical vulnerability in the Bifrost AI Gateway lets attackers execute commands on affected systems without any credentials, according to a report by The Hacker News. The flaw poses a serious risk to organizations that expose the gateway, since unauthenticated remote code execution can lead to full host compromise and data theft. Administrators are urged to apply vendor patches or mitigations promptly and to restrict network access to the service.
A security researcher has released a proof-of-concept exploit called BigDiskBuster that prevents Microsoft Defender from receiving updates. Publicly dropping the PoC gives attackers a ready-made tool and puts pressure on Microsoft to patch, since unpatched Defender installations could be left exposed to newer threats. The researcher has not reported wide exploitation so far.
Security researchers report that AI-driven agents are changing how attackers move laterally across compromised networks, automating reconnaissance, credential abuse, and pivot decisions that once required skilled human operators. The shift lowers the expertise barrier and speeds up intrusions, making traditional detection based on human-paced behavior less reliable. Defenders are urged to adapt monitoring and response strategies accordingly.
A cybersecurity analysis marking the second year of the EU's Digital Operational Resilience Act questions whether financial firms' security operations centers (SOCs) have the visibility needed to detect and respond to real intrusions. DORA imposes strict incident detection and reporting duties on financial entities, and the piece argues that many SOCs still lack the monitoring coverage and threat detection capabilities to meet them. It matters because compliance deadlines are advancing while gaps in detection—not just documentation—remain a common weakness across the sector.