China-Linked Hackers Hijack Sogou Input Method DNS to Deploy DarkVigil Backdoor

Researchers say hackers tied to Russia's APT29 group compromised a widely used web analytics script so that it served exploits to visitors' iPhones and Android devices. The tampered script turned ordinary website traffic into a delivery channel for mobile exploits, the kind of supply-chain attack that can reach many sites at once. It matters because a nation-state actor is now using trusted third-party code to hit mobile targets at scale.

A critical vulnerability in Ruby on Rails lets attackers write arbitrary files to a server by uploading specially crafted images processed through ImageMagick. The flaw could enable code execution or server compromise, making patching urgent for affected Rails applications.

Researchers disclosed vulnerabilities in the Xen hypervisor that allow a malicious or compromised guest virtual machine to read and write the memory of other VMs running on the same host. Xen underpins many public cloud and hosting platforms, so a successful exploit could break the isolation tenants rely on and expose data across customers. Patches have been released and operators are urged to apply them promptly.

Google released patches for a critical Android vulnerability that could allow remote code execution without any user interaction. The flaw affects Android devices and could let attackers compromise systems remotely. Users should install available updates promptly to reduce exposure.

CISA confirmed that hackers are exploiting a WordPress core vulnerability during software upgrades. Active exploitation raises urgency for WordPress administrators to apply fixes and secure affected sites. The flaw matters because WordPress powers a large share of websites worldwide.